Search NASA⌕ Search

SEARCH · Search NASA

Results for “Assurance Cases”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 271 records · Page 15

Model-Driven Development of Safety Architectures

We describe the use of model-driven development for safety assurance of a pioneering NASA flight operation involving a fleet of small unmanned aircraft systems (sUAS) flying beyond visual line of sight. The central idea is to develop a safety architecture that provides the basis for risk assessment and visualization within a safety case, the formal justification of acceptable safety required by the aviation regulatory authority. A safety architecture is composed from a collection of bow tie diagrams (BTDs), a practical approach to manage safety risk by linking the identified hazards to the appropriate mitigation measures. The safety justification for a given unmanned aircraft system (UAS) operation can have many related BTDs. In practice, however, each BTD is independently developed, which poses challenges with respect to incremental development, maintaining consistency across different safety artifacts when changes occur, and in extracting and presenting stakeholder specific information relevant for decision making. We show how a safety architecture reconciles the various BTDs of a system, and, collectively, provide an overarching picture of system safety, by considering them as views of a unified model. We also show how it enables model-driven development of BTDs, replete with validations, transformations, and a range of views. Our approach, which we have implemented in our toolset, AdvoCATE, is illustrated with a running example drawn from a real UAS safety case. The models and some of the innovations described here were instrumental in successfully obtaining regulatory flight approval.

Safety case↗

Advanced Wet Tantalum Capacitors: Design, Specifications and Performance

Insertion of new types of commercial, high volumetric efficiency wet tantalum capacitors in space systems requires reassessment of the existing quality assurance approaches that have been developed for capacitors manufactured to MIL-PRF-39006 requirements. The specifics of wet electrolytic capacitors is that leakage currents flowing through electrolyte can cause gas generation resulting in building up of internal gas pressure and rupture of the case. The risk associated with excessive leakage currents and increased pressure is greater for high value advanced wet tantalum capacitors, but it has not been properly evaluated yet. This presentation gives a review of specifics of the design, performance, and potential reliability risks associated with advanced wet tantalum capacitors. Problems related to setting adequate requirements for DPA, leakage currents, hermeticity, stability at low and high temperatures, ripple currents for parts operating in vacuum, and random vibration testing are discussed. Recommendations for screening and qualification to reduce risks of failures have been suggested.

wet tantalum capacitors (WTC)↗

Advanced Wet Tantalum Capacitors: Design, Specifications and Performance

Insertion of new types of commercial, high volumetric efficiency wet tantalum capacitors in space systems requires reassessment of the existing quality assurance approaches that have been developed for capacitors manufactured to MIL-PRF-39006 requirements. The specifics of wet electrolytic capacitors is that leakage currents flowing through electrolyte can cause gas generation resulting in building up of internal gas pressure and rupture of the case. The risk associated with excessive leakage currents and increased pressure is greater for high value advanced wet tantalum capacitors, but it has not been properly evaluated yet. This presentation gives a review of specifics of the design, performance, and potential reliability risks associated with advanced wet tantalum capacitors. Problems related to setting adequate requirements for DPA, leakage currents, hermeticity, stability at low and high temperatures, ripple currents for parts operating in vacuum, and random vibration testing are discussed. Recommendations for screening and qualification to reduce risks of failures have been suggested.

hermeticity↗

Formal Assurance Certifiable Tooling Formal Assurance Certifiable Tooling Strategy Final Report

This is the Final Report of a research project to investigate issues and provide guidance for the qualification of formal methods tools under the DO-330 qualification process. It consisted of three major subtasks spread over two years: 1) an assessment of theoretical soundness issues that may affect qualification for three categories of formal methods tools, 2) a case study simulating the DO-330 qualification of two actual tool sets, and 3) an investigation of risk mitigation strategies that might be applied to chains of such formal methods tools in order to increase confidence in their certification of airborne software.

Bush, Eric↗

Alternative Architectures for Distributed Cooperative Problem-Solving in the National Airspace System

The air traffic management system in the United States is an example of a distributed problem solving system. It has elements of both cooperative and competitive problem-solving. This system includes complex organizations such as Airline Operations Centers (AOCs), the FAA Air Traffic Control Systems Command Center (ATCSCC), and traffic management units (TMUs) at enroute centers and TRACONs, all of which have a major focus on strategic decision-making. It also includes individuals concerned more with tactical decisions (such as air traffic controllers and pilots). The architecture for this system has evolved over time to rely heavily on the distribution of tasks and control authority in order to keep cognitive complexity manageable for any one individual operator, and to provide redundancy (both human and technological) to serve as a safety net to catch the slips or mistakes that any one person or entity might make. Currently, major changes are being considered for this architecture, especially with respect to the locus of control, in an effort to improve efficiency and safety. This paper uses a series of case studies to help evaluate some of these changes from the perspective of system complexity, and to point out possible alternative approaches that might be taken to improve system performance. The paper illustrates the need to maintain a clear understanding of what is required to assure a high level of performance when alternative system architectures and decompositions are developed.

Smith, Phillip J.↗

TRISO SiC Failure Probability for Reactivity Initiated Accidents in High-Temperature Gas-Cooled Reactors

This work analyzes the failure process of the silicon carbide (SiC) layer in tristructural isotropic (TRISO) during reactivity-initiated accident scenarios for a high-temperature gas-cooled reactor (HTGR) with BISON. Two cases are considered—a group control rod withdrawal (CRW) and a control rod ejection (CRE)—reproduced from a previous study. Failure probability is modeled using Weibull statistics, and worst-case scenario Weibull parameters are adopted to simulate the envelopes in BISON with a one-dimensional TRISO model. CRW scenario results are characterized by higher values of maximum energy deposition and final temperature and volumetric strain with respect to the CRE ones, but the latter have remarkably higher SiC failure probability, mainly due to the offset in strain rates between the two cases. This work also confirms the validity and conservatism of the performance envelopes produced in a previous work by replicating the envelope formulation using RELAP5-3D and RAVEN with a different sampling technique and obtaining consistent results. A sensitivity analysis using the Sobol variance decomposition method on SiC failure probability is then performed involving a set of inputs on both CRW and CRE. The two most important parameters are Weibull modulus and characteristic stress, and their relative importance depends on the specific case. The proposed interpretation of the results is that both energy deposition and strain rate influence the relative degree of importance of the failure parameters. Computation of 95% confidence intervals around worst-case scenario SiC failure probability values is also carried out for four different sets of Weibull parameters. Heren a new criterion for SiC TRISO quality classification built upon safety-based ranges of Weibull parameters is proposed to be integrated in future Fuel-Production Quality Assurance Plans.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗

A note on pole assignment

It is shown that for a controllable, linear time invariant multivariable system at least max (m,p) poles can be assigned arbitrarily. In certain cases more than max (m,p) oikes can be assigned. This result is particularly useful in designing systems for high integrity in the event of transducer failure. In such an event this design takes advantage of the unequal number of inputs and outputs so as to assure no loss in pole assignability.

Sridhar, B.↗

Soyuz/ACRV accommodation study

Included is a set of viewgraphs that present the results of a study conducted at the LaRC Space Station Freedom Office at the request of the Space Station Freedom Level 1 Program Office and the JSC ACRV Project Office to determine the implications of accommodating two Soyuz TM spacecraft as Assured Crew Return Vehicles (ACRV) on the Space Station Freedom (SSF) at the Permanently Crewed Capability (PCC) stage. The study examined operational as well as system issues associated with the accommodation of the Soyuz for several potential configuration options. Operational issues considered include physical hardware clearances, worst case Soyuz departure paths, and impacts to baseline operations such as Pressurized Logistics Module (PLM) exchange, Space Station Remote Manipulator System (SSRMS) attachment, Extravehicular Activity (EVA), and automatic rendezvous and docking (AR&D). Systems impact analysis included determining differences between Soyuz interface requirements and SSF capabilities for the Electrical Power System (EPS), Thermal Control System (TCS), Communications and Tracking (C&T), Audio-Video Subsystem (A/V), Data Management System (DMS), and Environmental Control and Life Support System (ECLSS). Significant findings of this study have indicated that the current AV capability of the Soyuz will need to be increased to provide adequate departure clearances for a worst case escape from an uncontrolled SSF and that an interface element will be required to mate the Soyuz vehicles to station, provide for AR&D structural loads, and to house Soyuz-to-SSF system interfaces.

Cruz, Jonathan↗

Atlas V Launch Incorporated NASA Glenn Thermal Barrier

In the Spring of 2002, Aerojet experienced a major failure during a qualification test of the solid rocket motor that they were developing for the Atlas V Enhanced Expendable Launch Vehicle. In that test, hot combustion gas reached the O-rings in the nozzle-to-case joint and caused a structural failure that resulted in loss of the nozzle and aft dome sections of the motor. To improve the design of this joint, Aerojet decided to incorporate three braided carbon-fiber thermal barriers developed at the NASA Glenn Research Center. The thermal barriers were used to block the searing-hot 5500 F pressurized gases from reaching the temperature-sensitive O-rings that seal the joint. Glenn originally developed the thermal barriers for the nozzle joints of the space shuttle solid rocket motors, and Aerojet decided to use them on the basis of the results of several successful ground tests of the thermal barriers in the shuttle rockets. Aerojet undertook an aggressive schedule to redesign the rocket nozzle-to-case joint with the thermal barriers and to qualify it in time for a launch planned for the middle of 2003. They performed two successful qualification tests (Oct. and Dec. 2002) in which the Glenn thermal barriers effectively protected the O-rings. These qualification tests saved hundreds of thousands of dollars in development costs and put the Lockheed-Martin/Aerojet team back on schedule. On July 17, 2003, the first flight of an Atlas V boosted with solid rocket motors successfully launched a commercial satellite into orbit from Cape Canaveral Air Force Station. Aero-jet's two 67-ft solid rocket boosters performed flawlessly, with each providing thrust in excess of 250,000 lbf. Both motors incorporated three Glenn-developed thermal barriers in their nozzle-to-case joints. The Cablevision satellite launched on this mission will be used to provide direct-to-home satellite television programming for the U.S. market starting in late 2003. The Atlas V is a product of the military's Enhanced Expendable Launch Vehicle program designed to provide assured military access to space. It can lift payloads up to 19,100 lb to geosynchronous transfer orbit and was designed to meet Department of Defense, commercial, and NASA needs. The Atlas V and Delta IV are two launch systems being considered by NASA to launch the Orbital Space Plane/Crew Exploration Vehicle. The launch and rocket costs of this mission are valued at $250 million. Successful application of the Glenn thermal barrier to the Atlas V program was an enormous breakthrough for the program's technical and schedule success.

Dunlap, Patrick H., Jr.↗

Board Level Proton Testing Book of Knowledge for NASA Electronic Parts and Packaging Program

This book of knowledge (BoK) provides a critical review of the benefits and difficulties associated with using proton irradiation as a means of exploring the radiation hardness of commercial-off-the-shelf (COTS) systems. This work was developed for the NASA Electronic Parts and Packaging (NEPP) Board Level Testing for the COTS task. The fundamental findings of this BoK are the following. The board-level test method can reduce the worst case estimate for a board's single-event effect (SEE) sensitivity compared to the case of no test data, but only by a factor of ten. The estimated worst case rate of failure for untested boards is about 0.1 SEE/board-day. By employing the use of protons with energies near or above 200 MeV, this rate can be safely reduced to 0.01 SEE/board-day, with only those SEEs with deep charge collection mechanisms rising this high. For general SEEs, such as static random-access memory (SRAM) upsets, single-event transients (SETs), single-event gate ruptures (SEGRs), and similar cases where the relevant charge collection depth is less than 10 μm, the worst case rate for SEE is below 0.001 SEE/board-day. Note that these bounds assume that no SEEs are observed during testing. When SEEs are observed during testing, the board-level test method can establish a reliable event rate in some orbits, though all established rates will be at or above 0.001 SEE/board-day. The board-level test approach we explore has picked up support as a radiation hardness assurance technique over the last twenty years. The approach originally was used to provide a very limited verification of the suitability of low cost assemblies to be used in the very benign environment of the International Space Station (ISS), in limited reliability applications. Recently the method has been gaining popularity as a way to establish a minimum level of SEE performance of systems that require somewhat higher reliability performance than previous applications. This sort of application of the method suggests a critical analysis of the method is in order. This is also of current consideration because the primary facility used for this type of work, the Indiana University Cyclotron Facility (IUCF) (also known as the Integrated Science and Technology (ISAT) hall), has closed permanently, and the future selection of alternate test facilities is critically important. This document reviews the main theoretical work on proton testing of assemblies over the last twenty years. It augments this with review of reported data generated from the method and other data that applies to the limitations of the proton board-level test approach. When protons are incident on a system for test they can produce spallation reactions. From these reactions, secondary particles with linear energy transfers (LETs) significantly higher than the incident protons can be produced. These secondary particles, together with the protons, can simulate a subset of the space environment for particles capable of inducing single event effects (SEEs). The proton board-level test approach has been used to bound SEE rates, establishing a maximum possible SEE rate that a test article may exhibit in space. This bound is not particularly useful in many cases because the bound is quite loose. We discuss the established limit that the proton board-level test approach leaves us with. The remaining possible SEE rates may be as high as one per ten years for most devices. The situation is actually more problematic for many SEE types with deep charge collection. In cases with these SEEs, the limits set by the proton board-level test can be on the order of one per 100 days. Because of the limited nature of the bounds established by proton testing alone, it is possible that tested devices will have actual SEE sensitivity that is very low (e.g., fewer than one event in 1 × 10(exp 4) years), but the test method will only be able to establish the limits indicated above. This BoK further examines other benefits of proton board-level testing besides hardness assurance. The primary alternate use is the injection of errors. Error injection, or fault injection, is something that is often done in a simulation environment. But the proton beam has the benefit of injecting the majority of actual SEEs without risk of something being missed, and without the risk of simulation artifacts misleading the SEE investigation.

Guertin, Steven M.↗

Granger Causality for prediction in Dynamic Mode Decomposition: Application to power systems

Here, the dynamic mode decomposition (DMD) technique extracts the dominant modes characterizing the innate dynamical behavior of the system within the measurement data. For appropriate identification of dominant modes from the measurement data, the DMD algorithm necessitates ensuring the quality of the input measurement data sequences. On that account, for validating the usability of the dataset for the DMD algorithm, the paper proposed two conditions: Persistence of excitation (PE) and the Granger Causality Test (GCT). The virtual data sequences are designed with the hankel matrix representation such that the dimensions of the subspace spanning the essential system modes are increased with the addition of new state variables. The PE condition provides the lower bound for the trajectory length, and the GCT provides the order of the model. Satisfying the PE condition enables estimating an approximate linear model, but the predictability with the identified model is only assured with the temporal causation among data searched with GCT. The proposed methodology is validated with the application for coherency identification (CI) in a multi-machine power system (MMPS), an essential phenomenon in transient stability analysis. The significance of PE condition and GCT is demonstrated through various case studies implemented on 22 bus six generator system.

24 POWER TRANSMISSION AND DISTRIBUTION↗

Systems Engineering and Integration for Advanced Life Support System and HST

Systems engineering (SE) discipline has revolutionized the way engineers and managers think about solving issues related to design of complex systems: With continued development of state-of-the-art technologies, systems are becoming more complex and therefore, a systematic approach is essential to control and manage their integrated design and development. This complexity is driven from integration issues. In this case, subsystems must interact with one another in order to achieve integration objectives, and also achieve the overall system's required performance. Systems engineering process addresses these issues at multiple levels. It is a technology and management process dedicated to controlling all aspects of system life cycle to assure integration at all levels. The Advanced Integration Matrix (AIM) project serves as the systems engineering and integration function for the Human Support Technology (HST) program. AIM provides means for integrated test facilities and personnel for performance trade studies, analyses, integrated models, test results, and validated requirements of the integration of HST. The goal of AIM is to address systems-level integration issues for exploration missions. It will use an incremental systems integration approach to yield technologies, baselines for further development, and possible breakthrough concepts in the areas of technological and organizational interfaces, total information flow, system wide controls, technical synergism, mission operations protocols and procedures, and human-machine interfaces.

Kamarani, Ali K.↗

Probability Distribution Estimated From the Minimum, Maximum, and Most Likely Values: Applied to Turbine Inlet Temperature Uncertainty

Modern engineering design practices are tending more toward the treatment of design parameters as random variables as opposed to fixed, or deterministic, values. The probabilistic design approach attempts to account for the uncertainty in design parameters by representing them as a distribution of values rather than as a single value. The motivations for this effort include preventing excessive overdesign as well as assessing and assuring reliability, both of which are important for aerospace applications. However, the determination of the probability distribution is a fundamental problem in reliability analysis. A random variable is often defined by the parameters of the theoretical distribution function that gives the best fit to experimental data. In many cases the distribution must be assumed from very limited information or data. Often the types of information that are available or reasonably estimated are the minimum, maximum, and most likely values of the design parameter. For these situations the beta distribution model is very convenient because the parameters that define the distribution can be easily determined from these three pieces of information. Widely used in the field of operations research, the beta model is very flexible and is also useful for estimating the mean and standard deviation of a random variable given only the aforementioned three values. However, an assumption is required to determine the four parameters of the beta distribution from only these three pieces of information (some of the more common distributions, like the normal, lognormal, gamma, and Weibull distributions, have two or three parameters). The conventional method assumes that the standard deviation is a certain fraction of the range. The beta parameters are then determined by solving a set of equations simultaneously. A new method developed in-house at the NASA Glenn Research Center assumes a value for one of the beta shape parameters based on an analogy with the normal distribution (ref.1). This new approach allows for a very simple and direct algebraic solution without restricting the standard deviation. The beta parameters obtained by the new method are comparable to the conventional method (and identical when the distribution is symmetrical). However, the proposed method generally produces a less peaked distribution with a slightly larger standard deviation (up to 7 percent) than the conventional method in cases where the distribution is asymmetric or skewed. The beta distribution model has now been implemented into the Fast Probability Integration (FPI) module used in the NESSUS computer code for probabilistic analyses of structures (ref. 2).

Holland, Frederic A., Jr.↗

Progress Towards NQA-1 for Cardinal in FY25

Cardinal is a wrapping of the GPU-oriented spectral element Computational Fluid Dynamics (CFD) code NekRS and the Monte Carlo particle transport code OpenMC within the Multiphysics Object-Oriented Simulation Environment (MOOSE). Cardinal provides high-resolution thermal-hydraulics and/or radiation transport feedback to MOOSE multiphysics simulations. Multiphysics feedback is implemented in a geometry-agnostic manner which eliminates the need for rigid one-to-one mappings. A generic data transfer implementation also allows NekRS and OpenMC to couple to any MOOSE application, enabling a broad set of multiphysics capabilities. Cardinal simulations can also leverage combinations of MPI, OpenMP, and GPU resources. Cardinal continuous development and improvement efforts have led to the software being considered as a high-fidelity design and licensing tool for key areas of nuclear reactor relevant physics, including neutron transport, fluid flow, heat transfer, and mechanical processes. The fast development and expansion of the software from a pure R&D framework towards its application in the nuclear industry and regulation require a focus on developing, enhancing,and maintaining Cardinal’s software quality through strict adherence to a Software Quality Assurance (SQA) framework and SQA program. To facilitate compliance with SQA standards, the Cardinal SQA Program was initiated during Fiscal Year 2023 (FY23). During the development of the Cardinal SQA Program, multiple gaps have been identified. These gaps are primarily related to model verification and code pedigree as they relate to the use of Cardinal as an analysis tool. These gaps were captured in a report published in 2023. A second report highlighted the progress made during Fiscal Year 2024 (FY24) and described Argonne’s effort to document and integrate software verification within Cardinal’s software development process. This report documents the progress made towards NQA-1 for Cardinal in the Fiscal Year 2025 (FY25). All cases in the expanded Continuous Integration (CI) suite of NekRS are included in this report which test the solvers and modules available in NekRS exhaustively. The NekRS tests are integrated with the Cardinal CI suite and made available in publicly accessible Github documentation. Following the CI practice permits integrating of source code changes frequently and ensuring that the integrated codebase clears the verification testing for the software. Also in this report is a brief overview of the development of the Cardinal Software Quality Assurance Plan (SQAP) that was done in FY25, though it should be noted that the rest of the documentation for the SQA program needs to be developed in a future step of this task.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

Recent developments in analysis of crack propagation and fracture of practical materials

Present U.S. Air Force and proposed U.S. civil airworthiness regulations are based on considerations of 'damage tolerance' in aircraft structures. Airworthiness is assured by demonstrating that damage that escapes one in a sequence of periodic inspections will not grow to critical size before the next inspection. The evaluations conducted employ fracture mechanics analyses. Problems arise because the features of fracture mechanics applications related to aircraft structures are more complex than the cases of fracture mechanics which have been mainly investigated. NASA has, therefore, conducted a variety of research tasks to extend the capabilities of fracture mechanics to deal with some of these complexities. The current stage of development of these capabilities is described. Attention is given to the limitations of linear elastic fracture mechanics, a two-parameter fracture criterion, aspects of fatigue crack propagation, and crack propagation and fracture in built-up structures.

Hardrath, H. F.↗

A case study for the real-time experimental evaluation of the VIPER microprocessor

An experiment to evaluate the applicability of the Verifiable Integrated Processor for Enhanced Reliability (VIPER) microprocessor to real time control is described. The VIPER microprocessor was invented by the Royal Signals and Radar Establishment (RSRE), U.K., and is an example of the use of formal mathematical methods for developing electronic digital systems with a high degree of assurance on the system design and implementation correctness. The experiment consisted of selecting a control law, writing the control law algorithm for the VIPER processor, and providing real time, dynamic inputs into the processor and monitoring the outputs. The control law selected and coded for the VIPER processor was the yaw damper function of an automatic landing program for a 737 aircraft. The mechanisms for interfacing the VIPER Single Board Computer to the VAX host are described. Results include run time experiences, performance evaluation, and comparison of VIPER and FORTRAN yaw damper algorithm output for accuracy estimation.

Carreno, Victor A.↗

Case Study: Formal Inspections at the Jet Propulsion Laboratory

The Jet Propulsion Laboratory (JPL) of the California Institute of Technology is a federally funded research and development center operating under contract to the National Aeronautics and Space Administration (NASA). JPL's charter emphasizes the exploration of the solar system including observations of Earth as well as other stellar systems and extra-solar-system bodies. Within JPL, the Software Product Assurance (SPA) Section helps to ensure the operational integrity of the software within the system. SPA evaluates the operational requirements, the acceptability and readiness of all software, hardware/software interfaces, and the integrity of the completed software before its final release into the operational environment.

Kelly, J. C.↗

Assuring Ground-Based Detect and Avoid for UAS Operations

One of the goals of the Marginal Ice Zones Observations and Processes Experiment (MIZOPEX) NASA Earth science mission was to show the operational capabilities of Unmanned Aircraft Systems (UAS) when deployed on challenging missions, in difficult environments. Given the extreme conditions of the Arctic environment where MIZOPEX measurements were required, the mission opted to use a radar to provide a ground-based detect-and-avoid (GBDAA) capability as an alternate means of compliance (AMOC) with the see-and-avoid federal aviation regulation. This paper describes how GBDAA safety assurance was provided by interpreting and applying the guidelines in the national policy for UAS operational approval. In particular, we describe how we formulated the appropriate safety goals, defined the processes and procedures for system safety, identified and assembled the relevant safety verification evidence, and created an operational safety case in compliance with Federal Aviation Administration (FAA) requirements. To the best of our knowledge, the safety case, which was ultimately approved by the FAA, is the first successful example of non-military UAS operations using GBDAA in the U.S. National Airspace System (NAS), and, therefore, the first nonmilitary application of the safety case concept in this context.

Detect-and-Avoid↗