SEARCH · Search NASA

Results for “Criticality safety”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 181 records · Page 10

All sources NASA NTRS DOE OSTI

NASA NTRS2009

Deriving Safety Cases from Automatically Constructed Proofs

Formal proofs provide detailed justification for the validity of claims and are widely used in formal software development methods. However, they are often complex and difficult to understand, because the formalism in which they are constructed and encoded is usually machine-oriented, and they may also be based on assumptions that are not justified. This causes concerns about the trustworthiness of using formal proofs as arguments in safety-critical applications. Here, we present an approach to develop safety cases that correspond to formal proofs found by automated theorem provers and reveal the underlying argumentation structure and top-level assumptions. We concentrate on natural deduction style proofs, which are closer to human reasoning than resolution proofs, and show how to construct the safety cases by covering the natural deduction proof tree with corresponding safety case fragments. We also abstract away logical book-keeping steps, which reduces the size of the constructed safety cases. We show how the approach can be applied to the proofs found by the Muscadet prover.

Basir, Nurlida↗

NASA NTRS2009

Deriving Safety Cases from Machine-Generated Proofs

Proofs provide detailed justification for the validity of claims and are widely used in formal software development methods. However, they are often complex and difficult to understand, because they use machine-oriented formalisms; they may also be based on assumptions that are not justified. This causes concerns about the trustworthiness of using formal proofs as arguments in safety-critical applications. Here, we present an approach to develop safety cases that correspond to formal proofs found by automated theorem provers and reveal the underlying argumentation structure and top-level assumptions. We concentrate on natural deduction proofs and show how to construct the safety cases by covering the proof tree with corresponding safety case fragments.

Basir, Nurlida↗

NASA NTRS2009

Deriving Safety Cases from Machine-Generated Proofs

Basir, Nurlida↗

NASA NTRS2016

The Evolution of the NASA Commercial Crew Program Mission Assurance Process

In 2010, the National Aeronautics and Space Administration (NASA) established the Commercial Crew Program (CCP) in order to provide human access to the International Space Station and low Earth orbit via the commercial (non-governmental) sector. A particular challenge to NASA has been how to determine that the Commercial Provider's transportation system complies with programmatic safety requirements. The process used in this determination is the Safety Technical Review Board which reviews and approves provider submitted hazard reports. One significant product of the review is a set of hazard control verifications. In past NASA programs, 100% of these safety critical verifications were typically confirmed by NASA. The traditional Safety and Mission Assurance (S&MA) model does not support the nature of the CCP. To that end, NASA S&MA is implementing a Risk Based Assurance process to determine which hazard control verifications require NASA authentication. Additionally, a Shared Assurance Model is also being developed to efficiently use the available resources to execute the verifications.

Mission Assurance↗

NASA NTRS2016

The NASA Commercial Crew Program (CCP) Mission Assurance Process

In 2010, NASA established the Commercial Crew Program in order to provide human access to the International Space Station and low earth orbit via the commercial (non-governmental) sector. A particular challenge to NASA has been how to determine the commercial providers transportation system complies with Programmatic safety requirements. The process used in this determination is the Safety Technical Review Board which reviews and approves provider submitted Hazard Reports. One significant product of the review is a set of hazard control verifications. In past NASA programs, 100 percent of these safety critical verifications were typically confirmed by NASA. The traditional Safety and Mission Assurance (SMA) model does not support the nature of the Commercial Crew Program. To that end, NASA SMA is implementing a Risk Based Assurance (RBA) process to determine which hazard control verifications require NASA authentication. Additionally, a Shared Assurance Model is also being developed to efficiently use the available resources to execute the verifications. This paper will describe the evolution of the CCP Mission Assurance process from the beginning of the Program to its current incarnation. Topics to be covered include a short history of the CCP; the development of the Programmatic mission assurance requirements; the current safety review process; a description of the RBA process and its products and ending with a description of the Shared Assurance Model.

Commercial Crew Program↗

NASA NTRS2020

The Friendly Argument Notation (FAN)

This document defines and explains through examples the Friendly Argument Notation (FAN). FAN builds on previous work investigating text-based ways to express arguments [2, 3]. Its primary intended use is for creating and evaluating arguments about safety-critical systems, especially the types of arguments common within safety and assurance cases [4], but nothing in its design constrains its use to that domain. Compared to existing notations commonly used within this domain (for example [6]), FAN corresponds more closely to traditional argument concepts (for example [1]), allows greater flexibility in expression, provides for including counter-arguments, and requires less knowledge of computer-science-specific concepts. Only time and use will determine how beneficial these differences are in practice. This paper concentrates on showing how FAN looks to someone who is using it manually to develop or assess arguments. A later document will concentrate on providing the information necessary for software tools to be created for FAN.

arugment↗

NASA NTRSDate not supplied

Minimum-Violation Traffic Management for Urban Air Mobility

Urban air mobility (UAM) refers to air transportation services in and over an urban area and has the potential to revolutionize mobility solutions. However, due to the projected scale of operations, current air traffic management (ATM) techniques are not viable. Increasingly autonomous systems are a pathway to accelerate the realization of UAM operations but must be fielded safely and efficiently. The heavily regulated, safety critical nature of aviation may lead to multiple, competing safety constraints that can be traded off based on the operational context. In this paper, we design a framework which allows for the scalable planning of a UAM ATM system. We formalize safety oriented constraints derived from FAA regulations by encoding them as temporal logic formulae. We then propose a method for UAM ATM that is both scalable and minimally violates the temporal logic constraints. Numerical results show that the runtime for our proposed algorithm is suitable for very large problems and is backed by theoretical guarantees of correctness with respect to given temporal logic constraints.

Urban Air Mobility↗

NASA NTRS2023

The Friendly Argument Notation (FAN): 2023 Version

This document constitutes the official description of the current iteration of the Friendly Argument Notation (FAN). This new version provides several enhancements to the original 2020 instantiation, while maintaining essential compatibility with it. Specifically, the new version enables distinguishing between deductive and non-deductive arguments, removes the requirement for always providing an explicit statement of reasoning, and relaxes the rules for when labels may be used. The primary intended use of FAN is unchanged: creating and evaluating arguments about safety-critical systems, specifically the types of arguments common within safety and assurance cases.

language↗

NASA NTRS2016

Analysis of Terrestrial Interference Protection from UAS CNPC Satellite Transmitters

Unmanned aircraft (UA) are projected to have a major impact on future aviation. Larger UA operating at altitudes above 3000 feet will require at least occasional access to non-segregated, that is, controlled airspace. In order for unmanned aircraft to be integrated into the airspace and operate with other commercial aircraft, a very reliable command and control (a. k. a. control and non-payload communications, (CNPC)) link is required. For operations covering large distances or over remote locations, a beyond-line-of-sight (BLOS) CNPC link implemented through a satellite will almost always be required. Protected aviation spectrum (aeronautical mobile satellite (route) service, or AMS(R)S) would normally be used for such a safety-critical link, however studies have shown that currently available aviation safety satellite spectrum is inadequate to support the projected BLOS CNPC link bandwidth requirements. To address this inadequacy, the 2015 World Radio communication Conference studied the possible use of the Fixed Satellite Service (FSS) to provide CNPC, including possible allocations in Ku-Band and Ka-Band, under Agenda Item (AI) 1.5. Although UA CNPC satellite links in these bands were shown to meet operational availability and continuity requirements, a serious complication exists in that there are also terrestrial service allocations in these bands, in particular, Fixed Service (FS) point-to-point and point-to-multipoint microwave digital links. During the WRC-15 study cycle, much opposition to AI 1.5 was generated based on fears that UA CNPC satellite transmitters in these bands would impose unacceptable levels of interference to the FS receivers. NASA analyzed the possible interference from the UA transmitters based on probable UA transmission and FS receiver characteristics, and UA traffic distributions and densities to determine conditions under which UA could operate without imposing unacceptable interference levels to the FS. Ultimately, UA power flux density transmission limits were proposed as a way to insure protection of FS receivers and further studies were prepared on the various proposals. This paper presents the results of these studies and discusses possible implications on future UA BLOS operations.

aircraft communications↗

NASA NTRS2015

Towards a Formal Basis for Modular Safety Cases

Safety assurance using argument-based safety cases is an accepted best-practice in many safety-critical sectors. Goal Structuring Notation (GSN), which is widely used for presenting safety arguments graphically, provides a notion of modular arguments to support the goal of incremental certification. Despite the efforts at standardization, GSN remains an informal notation whereas the GSN standard contains appreciable ambiguity especially concerning modular extensions. This, in turn, presents challenges when developing tools and methods to intelligently manipulate modular GSN arguments. This paper develops the elements of a theory of modular safety cases, leveraging our previous work on formalizing GSN arguments. Using example argument structures we highlight some ambiguities arising through the existing guidance, present the intuition underlying the theory, clarify syntax, and address modular arguments, contracts, well-formedness and well-scopedness of modules. Based on this theory, we have a preliminary implementation of modular arguments in our toolset, AdvoCATE.

Safety↗

NASA NTRS2021

Advanced Multimodal Solutions for Information Presentation

High-workload, fast-paced, and degraded sensory environments are the likeliest candidates to benefit from multimodal information presentation. For example, during extra-vehicular activity (EVA) and telerobotic operations, the sensory restrictions associated with such a hostile environment provide a major challenge to maintaining the situation awareness (SA) required for safe operations. In particular, orientation, navigation, and collision avoidance are critical aspects of EVA tasks that need to be addressed to ensure the safety of the crew and the success of the mission. Multimodal displays hold promise to enhance situation awareness and task performance by utilizing different sensory modalities and maximizing their effectiveness based on appropriate interaction between modalities. Multimodal displays will also play an important role for long-duration information systems and will likely begin to be developed in the early phases of cislunar Gateway, and later lunar or Mars transit missions. Information systems are envisioned for LDEMs that require spacecraft with greater crew autonomy and increased dependence on computer-provided information needed to perform routine tasks, as well as time- and safety critical tasks. Such a system will require a single, common interface that is easy to learn and use and accesses key information from all relevant vehicle/habitat systems to enable task performance in both nominal and emergency conditions. Understanding of multimodal display technologies and their interactions will help to inform interface guidelines for LDEMs. The scope of the current report is an analysis of potential multimodal display technologies for long duration missions and, in particular, will focus on their potential role in EVA activities. The review will address multimodal (combined visual, auditory and/or tactile) displays investigated by the National Aeronautics and Space Administration (NASA), industry, and Department of Defense (DoD). It also considers the need for adaptive information systems to accommodate a variety of operational contexts such as crew status (e.g., fatigue, workload level) and task environment (e.g., EVA, habitat, rover, spacecraft). Current approaches to guidelines and best practices for combining modalities for the most effective information displays are also reviewed. Potential issues in developing interface guidelines for LDEMs are briefly considered.

multimodal displays↗

NASA NTRS2005

Mitigating Motion Base Safety Issues: The NASA LaRC CMF Implementation

The NASA Langley Research Center (LaRC), Cockpit Motion Facility (CMF) motion base design has taken advantage of inherent hydraulic characteristics to implement safety features using hardware solutions only. Motion system safety has always been a concern and its implementation is addressed differently by each organization. Some approaches rely heavily on software safety features. Software which performs safety functions is subject to more scrutiny making its approval, modification, and development time consuming and expensive. The NASA LaRC's CMF motion system is used for research and, as such, requires that the software be updated or modified frequently. The CMF's customers need the ability to update the simulation software frequently without the associated cost incurred with safety critical software. This paper describes the CMF engineering team's approach to achieving motion base safety by designing and implementing all safety features in hardware, resulting in applications software (including motion cueing and actuator dynamic control) being completely independent of the safety devices. This allows the CMF safety systems to remain intact and unaffected by frequent research system modifications.

Bryant, Richard B., Jr.↗

NASA NTRS2001

Adapting safety requirements analysis to intrusion detection

Several requirements analysis techniques widely used in safety-critical systems are being adapted to support the analysis of secure systems. Perhaps the most relevant system safety techique for Intrusion Detection Systems is hazard analysis.

requirements analysis safety intrusion detection↗

NASA NTRS2010

Reference Avionics Architecture for Lunar Surface Systems

Developing and delivering infrastructure capable of supporting long-term manned operations to the lunar surface has been a primary objective of the Constellation Program in the Exploration Systems Mission Directorate. Several concepts have been developed related to development and deployment lunar exploration vehicles and assets that provide critical functionality such as transportation, habitation, and communication, to name a few. Together, these systems perform complex safety-critical functions, largely dependent on avionics for control and behavior of system functions. These functions are implemented using interchangeable, modular avionics designed for lunar transit and lunar surface deployment. Systems are optimized towards reuse and commonality of form and interface and can be configured via software or component integration for special purpose applications. There are two core concepts in the reference avionics architecture described in this report. The first concept uses distributed, smart systems to manage complexity, simplify integration, and facilitate commonality. The second core concept is to employ extensive commonality between elements and subsystems. These two concepts are used in the context of developing reference designs for many lunar surface exploration vehicles and elements. These concepts are repeated constantly as architectural patterns in a conceptual architectural framework. This report describes the use of these architectural patterns in a reference avionics architecture for Lunar surface systems elements.

Somervill, Kevin M.↗

NASA NTRSDate not supplied

Understanding and Verifying Neural Networks

Deep Neural Networks (DNNs) have gained immense popularity in recent times and have widespread use in applications such as image classification, sentiment analysis, speech recognition and also in safety-critical applications such as autonomous driving. However, they suffer limitations such as lack of explainability and robustness which raise safety and security concerns in their usage. Further, the complex structure and large input spaces of DNNs act as an impediment to thorough verification and testing. The SafeDNN project at the Robust Software Engineering (RSE) group at NASA aims at exploring techniques to ensure that systems that use deep neural networks are safe, robust and interpretable. In this talk, I will be presenting our technique Prophecy that automatically infers formal properties of deep neural network models. The tool extracts patterns based on neuron activations as preconditions that imply certain desirable output properties of the model. I would be highlighting case studies that use Prophecy in obtaining explanations for network decisions, understanding correct and incorrect behavior, providing formal guarantees wrt safety and robustness, and debugging neural network models. We have applied the tool on image classification networks, neural network controllers providing turn advisories in unmanned aircrafts, regression models used for autonomous center-line tracking in aircrafts and neural network object detectors

Deep Neural Networks↗

NASA NTRS2012

Tools Ensure Reliability of Critical Software

In November 2006, after attempting to make a routine maneuver, NASA's Mars Global Surveyor (MGS) reported unexpected errors. The onboard software switched to backup resources, and a 2-day lapse in communication took place between the spacecraft and Earth. When a signal was finally received, it indicated that MGS had entered safe mode, a state of restricted activity in which the computer awaits instructions from Earth. After more than 9 years of successful operation gathering data and snapping pictures of Mars to characterize the planet's land and weather communication between MGS and Earth suddenly stopped. Months later, a report from NASA's internal review board found the spacecraft's battery failed due to an unfortunate sequence of events. Updates to the spacecraft's software, which had taken place months earlier, were written to the wrong memory address in the spacecraft's computer. In short, the mission ended because of a software defect. Over the last decade, spacecraft have become increasingly reliant on software to carry out mission operations. In fact, the next mission to Mars, the Mars Science Laboratory, will rely on more software than all earlier missions to Mars combined. According to Gerard Holzmann, manager at the Laboratory for Reliable Software (LaRS) at NASA's Jet Propulsion Laboratory (JPL), even the fault protection systems on a spacecraft are mostly software-based. For reasons like these, well-functioning software is critical for NASA. In the same year as the failure of MGS, Holzmann presented a new approach to critical software development to help reduce risk and provide consistency. He proposed The Power of 10: Rules for Developing Safety-Critical Code, which is a small set of rules that can easily be remembered, clearly relate to risk, and allow compliance to be verified. The reaction at JPL was positive, and developers in the private sector embraced Holzmann's ideas.

Source record↗

NASA NTRS2015

Formal Foundations for Hierarchical Safety Cases

Safety cases are increasingly being required in many safety-critical domains to assure, using structured argumentation and evidence, that a system is acceptably safe. However, comprehensive system-wide safety arguments present appreciable challenges to develop, understand, evaluate, and manage, partly due to the volume of information that they aggregate, such as the results of hazard analysis, requirements analysis, testing, formal verification, and other engineering activities. Previously, we have proposed hierarchical safety cases, hicases, to aid the comprehension of safety case argument structures. In this paper, we build on a formal notion of safety case to formalise the use of hierarchy as a structuring technique, and show that hicases satisfy several desirable properties. Our aim is to provide a formal, theoretical foundation for safety cases. In particular, we believe that tools for high assurance systems should be granted similar assurance to the systems to which they are applied. To this end, we formally specify and prove the correctness of key operations for constructing and managing hicases, which gives the specification for implementing hicases in AdvoCATE, our toolset for safety case automation. We motivate and explain the theory with the help of a simple running example, extracted from a real safety case and developed using AdvoCATE.

Hierarchy↗

NASA NTRSDate not supplied

Achieving Resilient In-Flight Performance for Advanced Air Mobility through Simplified Vehicle Operations

A research and development (R&D) approach is proposed for developing and validating concepts and technologies to achieve vehicle autonomy goals of Advanced Air Mobility (AAM) through Simplified Vehicle Operations (SVO). The approach applies resilience-engineering and human-automation teaming (HAT) principles to a framework for defining vehicle-based functions for the management of missions and flight trajectories, focusing initially on the en route flight domain. To achieve the SVO goal of reducing pilot training requirements and thereby increasing the pilot pool for AAM, while at the same time promoting ever-safer operations, a framework for identifying essential functions is proposed. In this framework, functions are first categorized by high-level functional purpose (mission management, flightpath management, tactical operations, and vehicle control) and then subcategorized by attributes of resilient-performing systems (abilities to monitor, respond, learn, and anticipate). The categorization by functional purpose provides structure within which HAT designs can be holistically explored and total levels of human vs. automation responsibility can be varied. The subcategorization by resilient-system attributes provides a mechanism for capturing safety-critical functions that may not be codified in current operational procedures and training curricula, particularly those where humans proactively enhance safety in currently undocumented ways. An R&D approach consisting of seven strategies is proposed in which automation engineering and human-factors communities can collaborate in the research, development, and design of an SVO roadmap to enable the ambitious objectives of AAM.

AAM↗