Search NASA⌕ Search

SEARCH · Search NASA

Results for “Criticality safety”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 199 records · Page 11

Towards A Comprehensive Consideration of Epistemic Questions in Software System Safety

For any software system upon which lives depend, the most important question one can ask about it is, 'How do we know the system is safe?' Despite the critical importance of this question, no widely accepted, generally applicable answer exists. Instead, debate continues to rage over the question, with theorists and practitioners quarrelling with each other and amongst themselves. This paper suggests a possible way forward towards quelling the quarrels, based on refining the critical safety question into additional questions, which may be more likely to have answers on which a consensus can be reached.

Holloway, C. M.↗

Querying Safety Cases

Querying a safety case to show how the various stakeholders' concerns about system safety are addressed has been put forth as one of the benefits of argument-based assurance (in a recent study by the Health Foundation, UK, which reviewed the use of safety cases in safety-critical industries). However, neither the literature nor current practice offer much guidance on querying mechanisms appropriate for, or available within, a safety case paradigm. This paper presents a preliminary approach that uses a formal basis for querying safety cases, specifically Goal Structuring Notation (GSN) argument structures. Our approach semantically enriches GSN arguments with domain-specific metadata that the query language leverages, along with its inherent structure, to produce views. We have implemented the approach in our toolset AdvoCATE, and illustrate it by application to a fragment of the safety argument for an Unmanned Aircraft System (UAS) being developed at NASA Ames. We also discuss the potential practical utility of our query mechanism within the context of the existing framework for UAS safety assurance.

Safety Case↗

A Framework for the Analysis of Deep Neural Networks in Autonomous Aerospace Applications using Bayesian Statistics

Deep Neural Networks (DNNs) are considered to be key components in many autonomous systems. Applications range from vision-based obstacle avoidance to intelligent/learning control and planning. Safety-critical applications as found in the aerospace domain require that the behavior of the DNN is validated and tested rigorously for safety of the autonomous system (AUS). In this paper, we present a framework to support testing of DNNs and the analysis of the network structure. Our framework employs techniques from statistical modeling and active learning to effectively generate test cases for DNN safety testing and performance analysis. We will present results of a case study on a physics-based Deep recurrent residual neural network (DR-RNN), which has been trained to emulate the aerodynamics behavior of a fixed-wing aircraft.

Deep Neural networks↗

Survey of Methods for Assessing Safety Compliance of sUAS BVLOS Operations

To ensure the safety of small Unmanned Aircraft System (sUAS) Beyond Line of Sight (BVLOS) operations in the National Airspace System (NAS), the FAA offers a guideline on how sUAS operators can demonstrate compliance with FAA rules, including regulations, advisory circulars, policy statements, and acceptable means of compliance (AMOC), using a formal and top-down approach. According to FAA Advisory Circular 23.2010-1, the AMOC refers to “one method, but not the only method, to show compliance with a regulatory requirement.” It is common for regulations to include a performance and safety standard rather than a detailed design or operation requirement, which allows for flexibility in fulfilling the regulatory requirements while still achieving a predetermined level of safety. This technical report explores existing frameworks for sUAS BVLOS safety analysis. It begins by discussing how sUAS BVLOS operations can be strategically deconflicted and then discusses their hazards. The next step is to establish safety assessment methods commonly used by the aviation industry and the FAA, illustrate how these methods can be applied to several safety-critical air traffic systems, and list collision models that the FAA and industry use. This investigation documents the processes for assessing safety risks in sUAS BVLOS operations and will allow sUAS BVLOS operations to be assessed for safety compliance more efficiently.

sUAS BVLOS Operations↗

A Markov model reduction technique for fault tolerant processor reliability analysis

A fault tolerant processor (FTP) plays a key role in many high performance, safety-critical control system applications. Realistic modeling of an FTP is crucial to gaining a high degree of confidence in the reliability and safety analysis of such a system. While fidelity is clearly a major consideration, a practical model must also be kept to a moderate size to allow its incorporation into the overall system model. This paper presents a systematic reduction technique that starts from a complex, detailed model of a triple, redundant FTP and produces a low order approximation of very high accuracy. The existence of two distinct time scales represents the key to the success of the technique. No eigenvalue solution or coordinate transformation are needed. The reduced model captures all the important features of the detailed model, is amenable to an analytical solution and provides insight into the reconfiguration behavior of an FTP.

Schor, Andrei L.↗

Physics-of-Failure Approach to Prognostics

As more and more electric vehicles emerge in our daily operation progressively, a very critical challenge lies in accurate prediction of the electrical components present in the system. In case of electric vehicles, computing remaining battery charge is safety-critical. In order to tackle and solve the prediction problem, it is essential to have awareness of the current state and health of the system, especially since it is necessary to perform condition-based predictions. To be able to predict the future state of the system, it is also required to possess knowledge of the current and future operations of the vehicle. In this presentation our approach to develop a system level health monitoring safety indicator for different electronic components is presented which runs estimation and prediction algorithms to determine state-of-charge and estimate remaining useful life of respective components. Given models of the current and future system behavior, the general approach of model-based prognostics can be employed as a solution to the prediction problem and further for decision making.

Kulkarni, Chetan S.↗

Explanation Constraint Programming for Model-based Diagnosis of Engineered Systems

We can expect to see an increase in the deployment of unmanned air and land vehicles for autonomous exploration of space. In order to maintain autonomous control of such systems, it is essential to track the current state of the system. When the system includes safety-critical components, failures or faults in the system must be diagnosed as quickly as possible, and their effects compensated for so that control and safety are maintained under a variety of fault conditions. The Livingstone fault diagnosis and recovery kernel and its temporal extension L2 are examples of model-based reasoning engines for health management. Livingstone has been shown to be effective, it is in demand, and it is being further developed. It was part of the successful Remote Agent demonstration on Deep Space One in 1999. It has been and is being utilized by several projects involving groups from various NASA centers, including the In Situ Propellant Production (ISPP) simulation at Kennedy Space Center, the X-34 and X-37 experimental reusable launch vehicle missions, Techsat-21, and advanced life support projects. Model-based and consistency-based diagnostic systems like Livingstone work only with discrete and finite domain models. When quantitative and continuous behaviors are involved, these are abstracted to discrete form using some mapping. This mapping from the quantitative domain to the qualitative domain is sometimes very involved and requires the design of highly sophisticated and complex monitors. We propose a diagnostic methodology that deals directly with quantitative models and behaviors, thereby mitigating the need for these sophisticated mappings. Our work brings together ideas from model-based diagnosis systems like Livingstone and concurrent constraint programming concepts. The system uses explanations derived from the propagation of quantitative constraints to generate conflicts. Fast conflict generation algorithms are used to generate and maintain multiple candidates whose consistency can be tracked across multiple time steps.

Narasimhan, Sriram↗

Toward Certification of Machine-Learning Systems for Low Criticality Airborne Applications

The exceptional progress in the field of machine learning (ML) in recent years has attracted a lot of interest in using this technology in aviation. Possible airborne applications of ML include safety-critical functions, which must be developed in compliance with rigorous certification standards of the aviation industry. Current certification standards for the aviation industry were developed prior to the ML renaissance without taking specifics of ML technology into account. There are some fundamental incompatibilities between traditional design assurance approaches and certain aspects of ML-based systems. In this paper, we analyze the current airborne certification standards and show that all objectives of the standards can be achieved for a low-criticality ML-based system if certain assumptions about ML development workflow are applied.

Avionics↗

Effects on Task Performance and Psychophysiological Measures of Performance During Normobaric Hypoxia Exposure

Human-autonomous systems have the potential to mitigate pilot cognitive impairment and improve aviation safety. A research team at NASA Langley conducted an experiment to study the impact of mild normobaric hypoxia induction on aircraft pilot performance and psychophysiological state. A within-subjects design involved non-hypoxic and hypoxic exposures while performing three 10-minute tasks. Results indicated the effect of 15,000 feet simulated altitude did not induce significant performance decrement but did produce increase in perceived workload. Analyses of psychophysiological responses evince the potential of biomarkers for hypoxia onset. This study represents on-going work at NASA intending to add to the current knowledge of psychophysiologically-based input to automation to increase aviation safety. Analyses involving coupling across physiological systems and wavelet transforms of cortical activity revealed patterns that can discern between the simulated altitude conditions. Specifically, multivariate entropy of ECG/Respiration components were found to be significant predictors (p< 0.02) of hypoxia. Furthermore, in EEG, there was a significant decrease in mid-level beta (15.19-18.37Hz) during the hypoxic condition in thirteen of sixteen sites across the scalp. Task performance was not appreciably impacted by the effect of 15,000 feet simulated altitude. Analyses of psychophysiological responses evince the potential of biomarkers for mild hypoxia onset.The potential for identifying shifts in underlying cortical and physiological systems could serve as a means to identify the onset of deteriorated cognitive state. Enabling such assessment in future flightdecks could permit increasingly autonomous systems-supported operations. Augmenting human operator through assessment of cognitive impairment has the potential to further improve operator performance and mitigate human error in safety critical contexts. This study represents ongoing work at NASA intending to add to the current knowledge of psychophysiologically-based input to automation to increase aviation safety.

Stephens, Chad↗

Prognostics and Health Monitoring: Application to Electric Vehicles

As more and more autonomous electric vehicles emerge in our daily operation progressively, a very critical challenge lies in accurate prediction of remaining useful life of the systemssubsystems, specifically the electrical powertrain. In case of electric aircrafts, computing remaining flying time is safety-critical, since an aircraft that runs out of power (battery charge) while in the air will eventually lose control leading to catastrophe. In order to tackle and solve the prediction problem, it is essential to have awareness of the current state and health of the system, especially since it is necessary to perform condition-based predictions. To be able to predict the future state of the system, it is also required to possess knowledge of the current and future operations of the vehicle.Our research approach is to develop a system level health monitoring safety indicator either to the pilotautopilot for the electric vehicles which runs estimation and prediction algorithms to estimate remaining useful life of the vehicle e.g. determine state-of-charge in batteries. Given models of the current and future system behavior, a general approach of model-based prognostics can be employed as a solution to the prediction problem and further for decision making.

Prognostics↗

Statistical learning framework for safety and failure analysis of a DNN-based autonomous aircraft system

Deep Neural Networks (DNNs) and Machine Learning technology is increasingly used for safety-critical applications in the Aerospace domain. To ensure safe operations, the DNN and the system must undergo rigorous verification and validation, including advanced statistical analyses. Performance and safety of the DNN and system behavior must not only be analyzed for the nominal case, but under numerous off-nominal and failure cases. In this paper we will describe how our statistical learning framework SYSAI can efficiently perform such analyses using the tool’s unique combination of advanced learning modeling and statistical analysis techniques. SYSAI can effectively explore the high-dimensional state and failure space of the system under test; geometrical shape detection of safety regions and boundaries support explainability of the results to the designer. In this paper, we report experiments and results obtained with a vision-based DNN control system (ACT) that is capable of autonomously steering an aircraft down a runway.

Yuning He↗

Autonomous Assessment and Predictive Capabilities for Low-Altitude Urban Flight Operations

The integration of unmanned aerial vehicles in the national airspace will introduce new vehicle types, technologies, and operational paradigms for which safety must be maintained and hazards mitigated. One approach is to attempt to design for possible hazards and unsafe incidents that can occur at different phases of flight (pre-flight, in-flight, and post-flight) and during ground operations. Another is to mitigate safety incidents by implementing changes to policies, procedures, regulations, and design to cover personnel, equipment, and aircraft during operations. These and other techniques, not described herein, are typically conservative or adhoc in that they reduce the likelihood of risk after safety incidents have occurred. In this work, the goal is to develop a more predictive capability to monitor and mitigate risk and hazards to safety “in-time” enough for decisions to be made. In line with NASA’s Aeronautics Mission Directorate Strategic Thrust 5 [1] (In-Time System-Wide Safety Assurance), the System-Wide Safety (SWS) project under which this work falls, is developing and demonstrating innovative and safety-oriented solutions that enable modernization and aviation transformation. To that effect, this work will detail data-driven efforts on the SWS project to develop a number of safety-critical services for in-time monitoring and mitigation of hazards to low-altitude flight operations. First, hazards to these operations are identified based on previous work by NASA [2,3] and others in the aerospace industry. These hazards include (i) unsafe proximity to other vehicles, property, and people on the ground, (ii) critical system failures such as communication signal/GPS loss, unexpected propulsion system degradation, engine/power failure, and (iii) operational/environmental issues such as severe weather and gusty winds. For these hazards, safety metrics, which can be quantified and assessed are defined, models to monitor and predict them are developed, and flight test data is generated to develop, validate, and test these models, considering the complex interplay of the different hazards that define them [4-6]. In addition, the uncertainty in the non-deterministic effects that cannot be modeled nor predicted and unknown unknowns that arise after design/testing and during operations must be handled in rigorous manner. As a result, for each of the developed safety metrics, their dependencies on one another are characterized and a framework for handling the uncertainties inherent in the modeling, algorithms, and measurements required for prediction is also developed [7]. To that effect, this presentation will describe the safety metrics and services already developed and underway under the System-Wide Safety project that utilize data-driven techniques for the identification of anomalies, precursors, and trends (APTs) to monitor and mitigate hazards to safety, in-time, for urban flight operations in low-altitude airspace.

Okolo, Wendy A.↗

The role of reliability graph models in assuring dependable operation of complex hardware/software systems

The complexity of computer systems currently being designed for critical applications in the scientific, commercial, and military arenas requires the development of new techniques for utilizing models of system behavior in order to assure 'ultra-dependability'. The complexity of these systems, such as Space Station Freedom and the Air Traffic Control System, stems from their highly integrated designs containing both hardware and software as critical components. Reliability graph models, such as fault trees and digraphs, are used frequently to model hardware systems. Their applicability for software systems has also been demonstrated for software safety analysis and the analysis of software fault tolerance. This paper discusses further uses of graph models in the design and implementation of fault management systems for safety critical applications.

Patterson-Hine, F. A.↗

Spur Gear Wear Investigated in Support of Space Shuttle Return-To-Flight Efforts

As part of NASA s Return-To-Flight efforts, the Space Operations Program investigated the condition of actuators for the orbiter s rudder speed brake. The actuators control the position of the rudder panels located in the tail of the orbiter, providing both steering control and braking during reentry, approach, and landing. Inspections of flight hardware revealed fretting and wear damage to the critical working surfaces of the actuator gears. To best understand the root cause of the observed damage and to help establish an appropriate reuse and maintenance plan for these safety critical parts, researchers completed a set of gear wear experiments at the NASA Glenn Research Center.

Krantz, Timothy L.↗

Space Applications of a Trusted AI Framework: Experiences and Lessons Learned

Artificial intelligence (AI), which encompasses machine learning (ML), has become a critical technology due to its well-established success in a wide array of applications. However, the proper application of AI remains a central topic of discussion in many safety-critical fields. This has limited its success in autonomous systems due to the difficulty of ensuring AI algorithms will perform as desired and that users will understand and trust how they operate. In response, there is growing demand for trustability in AI to address both the expectations and concerns regarding its use. The Aerospace Corporation (Aerospace) developed a Framework for Trusted AI (henceforth referred to as the framework) to encourage best practices for the implementation, assessment, and control of AI-based applications. It is generally applicable, being based on terms and definitions that cut across AI domains, and thus is a starting point for practitioners to tailor to their particular application. To help demonstrate how the framework can be tailored into mission assurance guidance for the space domain, Aerospace sought the involvement of the Jet Propulsion Laboratory (JPL) to engage with actual examples of AI-based space autonomy.

Kaufman, James↗

Systemic Analysis Approaches for Air Transportation

Air transportation system designers have had only limited success using traditional operations research and parametric modeling approaches in their analyses of innovations. They need a systemic methodology for modeling of safety-critical infrastructure that is comprehensive, objective, and sufficiently concrete, yet simple enough to be used with reasonable investment. The methodology must also be amenable to quantitative analysis so issues of system safety and stability can be rigorously addressed. However, air transportation has proven itself an extensive, complex system whose behavior is difficult to describe, no less predict. There is a wide range of system analysis techniques available, but some are more appropriate for certain applications than others. Specifically in the area of complex system analysis, the literature suggests that both agent-based models and network analysis techniques may be useful. This paper discusses the theoretical basis for each approach in these applications, and explores their historic and potential further use for air transportation analysis.

Conway, Sheila↗

Testing First-Order Logic Axioms in AutoCert

AutoCert [2] is a formal verification tool for machine generated code in safety critical domains, such as aerospace control code generated from MathWorks Real-Time Workshop. AutoCert uses Automated Theorem Provers (ATPs) [5] based on First-Order Logic (FOL) to formally verify safety and functional correctness properties of the code. These ATPs try to build proofs based on user provided domain-specific axioms, which can be arbitrary First-Order Formulas (FOFs). These axioms are the most crucial part of the trusted base, since proofs can be submitted to a proof checker removing the need to trust the prover and AutoCert itself plays the part of checking the code generator. However, formulating axioms correctly (i.e. precisely as the user had really intended) is non-trivial in practice. The challenge of axiomatization arise from several dimensions. First, the domain knowledge has its own complexity. AutoCert has been used to verify mathematical requirements on navigation software that carries out various geometric coordinate transformations involving matrices and quaternions. Axiomatic theories for such constructs are complex enough that mistakes are not uncommon. Second, adjusting axioms for ATPs can add even more complexity. The axioms frequently need to be modified in order to have them in a form suitable for use with ATPs. Such modifications tend to obscure the axioms further. Thirdly, speculating validity of the axioms from the output of existing ATPs is very hard since theorem provers typically do not give any examples or counterexamples.

Ahn, Ki Yung↗

Regulatory Compliance in Multi-Tier Supplier Networks

Over the years, avionics systems have increased in complexity to the point where 1st tier suppliers to an aircraft OEM find it financially beneficial to outsource designs of subsystems to 2nd tier and at times to 3rd tier suppliers. Combined with challenging schedule and budgetary pressures, the environment in which safety-critical systems are being developed introduces new hurdles for regulatory agencies and industry. This new environment of both complex systems and tiered development has raised concerns in the ability of the designers to ensure safety considerations are fully addressed throughout the tier levels. This has also raised questions about the sufficiency of current regulatory guidance to ensure: proper flow down of safety awareness, avionics application understanding at the lower tiers, OEM and 1st tier oversight practices, and capabilities of lower tier suppliers. Therefore, NASA established a research project to address Regulatory Compliance in a Multi-tier Supplier Network. This research was divided into three major study efforts: 1. Describe Modern Multi-tier Avionics Development 2. Identify Current Issues in Achieving Safety and Regulatory Compliance 3. Short-term/Long-term Recommendations Toward Higher Assurance Confidence This report presents our findings of the risks, weaknesses, and our recommendations. It also includes a collection of industry-identified risks, an assessment of guideline weaknesses related to multi-tier development of complex avionics systems, and a postulation of potential modifications to guidelines to close the identified risks and weaknesses.

Goossen, Emray R.↗