Search NASA⌕ Search

SEARCH · Search NASA

Results for “Design Safety”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 307 records · Page 17
All sourcesNASA NTRSDOE OSTI
NASA NTRS2003

Discrete Abstractions of Hybrid Systems: Verification of Safety and Application to User-Interface Design

Human interaction with a complex control system involves the user, the automation’s discrete mode logic, and the underlying continuous dynamics of the physical system. The user-interface of such systems always displays a reduced set of information about the entire system. Designing interfaces such that all the pertinent information is available and assuring that this information is correct is important for any user-interface, but especially so for safety-critical systems such as automotive systems and autopilots. Here we describe a methodology for the analysis of hybrid control systems that incorporate user interaction, with the goal of assuring that the information provided to the user is correct. That is, the user-interface must contain all information necessary to safely complete a desired procedure or task. We begin with a hybrid system model which incorporates discrete mode logic as well as nonlinear continuous dynamics. Using a hybrid computational tool for reachability, we find the largest region of the state-space in which we can guarantee the state of the system can always remain – this is the safe region of operation. By implementing a controller for safety which arises from this computation, we mathematically guarantee that this safe region is invariant, meaning that the system will always remain within the safe region if the determined controller is used on the boundary of the safe region. Verification within a hybrid framework allows us to account for the continuous dynamics underlying the discrete representations displayed to the user. Using the computed invariant regions as discrete states, we can abstract a discrete event system from this hybrid system with safety restrictions. This abstraction can be used to determine what information must be provided on the display. Furthermore, in cases in which an interface already exists, the abstraction provides the necessary input into existing interface verification methods. We provide two examples: a car traveling through a yellow light at an intersection and an aircraft autopilot in an automatic landing/go-around maneuver. The examples demonstrate the applicability of this methodology to hybrid systems that have operational constraints we can pose in terms of safety. This methodology differs from existing work in hybrid system verification in that we directly account for the user’s interactions with the system.

Meeko Oishi↗
NASA NTRS2023

An In-time Aviation Safety Management System (IASMS) Concept of Operations for Vertiport Design and Operations

The National Airspace System is foreseen to undergo revolutionary change with Urban Air Mobility (UAM) and its use of vertiports to transport passengers and cargo. To assure safety with UAM and more broadly with Advanced Air Mobility (AAM), the National Academies recommended an In-time Aviation Safety Management System (IASMS) that is extensible to the design and operation of vertiports. Vertiport designs will scale in several dimensions including physical size and infrastructure depending upon location and in the Services, Functions, and Capabilities required for assuring safety with increasingly complex vertiport designs and operations. These operations will be enabled by evolving technologies including electric vertical takeoff and landing (eVTOL) aircraft for passenger-and cargo-carrying commercial transportation. Within this construct, safety hazards and risk mitigations involving predictive data analytics and modeling will be used. Use cases and future challenges are examined to guide maturation of the IASMS ConOps for vertiports.

K Ellis↗
NASA NTRSDate not supplied

Design and Testing of an Approach to Automated In-Flight Safety Risk Management for sUAS Operations

An onboard risk management automation design is presented based on run-time assurance principles, as well as the concept for In-Time Aviation Safety Management Systems (IASMS) as described by the National Academies. The automation is designed to operate independently of the autopilot and perform real-time risk assessment spanning multiple classes of hazards, predict constraint violations, and track autopilot states. In the event of elevated risk conditions or predicted constraint violations, the automation will select from a set of available contingencies and trigger autopilot mode changes if necessary to mitigate risk exposure. The onboard automation also informs the remote operator/pilot of what the independent monitor is observing and any contingency decisions or actions that may arise during flight. Details of an implementation of this design and results of verification and validation activities, as required to meet stringent NASA software and system assurance standards, are also presented. This includes simulation and flight testing using small unmanned aircraft systems.

Ersin Ancel↗
NASA NTRS2014

Application of Fault Management Theory to the Quantitative Selection of a Launch Vehicle Abort Trigger Suite

The theory of System Health Management (SHM) and of its operational subset Fault Management (FM) states that FM is implemented as a "meta" control loop, known as an FM Control Loop (FMCL). The FMCL detects that all or part of a system is now failed, or in the future will fail (that is, cannot be controlled within acceptable limits to achieve its objectives), and takes a control action (a response) to return the system to a controllable state. In terms of control theory, the effectiveness of each FMCL is estimated based on its ability to correctly estimate the system state, and on the speed of its response to the current or impending failure effects. This paper describes how this theory has been successfully applied on the National Aeronautics and Space Administration's (NASA) Space Launch System (SLS) Program to quantitatively estimate the effectiveness of proposed abort triggers so as to select the most effective suite to protect the astronauts from catastrophic failure of the SLS. The premise behind this process is to be able to quantitatively provide the value versus risk trade‐off for any given abort trigger, allowing decision makers to make more informed decisions. All current and planned crewed launch vehicles have some form of vehicle health management system integrated with an emergency launch abort system to ensure crew safety. While the design can vary, the underlying principle is the same: detect imminent catastrophic vehicle failure, initiate launch abort, and extract the crew to safety. Abort triggers are the detection mechanisms that identify that a catastrophic launch vehicle failure is occurring or is imminent and cause the initiation of a notification to the crew vehicle that the escape system must be activated. While ensuring that the abort triggers provide this function, designers must also ensure that the abort triggers do not signal that a catastrophic failure is imminent when in fact the launch vehicle can successfully achieve orbit. That is, the abort triggers must have low false negative rates to be sure that real crew‐threatening failures are detected, and also low false positive rates to ensure that the crew does not abort from non‐crew‐threatening launch vehicle behaviors. The analysis process described in this paper is a compilation of over six years of lessons learned and refinements from experiences developing abort triggers for NASA's Constellation Program (Ares I Project) and the SLS Program, as well as the simultaneous development of SHM/FM theory. The paper will describe the abort analysis concepts and process, developed in conjunction with SLS Safety and Mission Assurance (S&MA) to define a common set of mission phase, failure scenario, and Loss of Mission Environment (LOME) combinations upon which the SLS Loss of Mission (LOM) Probabilistic Risk Assessment (PRA) models are built. This abort analysis also requires strong coordination with the Multi‐Purpose Crew Vehicle (MPCV) and SLS Structures and Environments (STE) to formulate a series of abortability tables that encapsulate explosion dynamics over the ascent mission phase. The design and assessment of abort conditions and triggers to estimate their Loss of Crew (LOC) Benefits also requires in‐depth integration with other groups, including Avionics, Guidance, Navigation and Control(GN&C), the Crew Office, Mission Operations, and Ground Systems. The outputs of this analysis are a critical input to SLS S&MA's LOC PRA models. The process described here may well be the first full quantitative application of SHM/FM theory to the selection of a sensor suite for any aerospace system.

Lo, Yunnhon↗
NASA NTRS1977

Preliminary design of a flight control system for a V/STOL airplane with geared variable pitch fans

A flight control system designed for an aircraft powered by three variable pitch fans, interconnected by shafts to provide lifting system redundancy is considered for application to a Navy Type A V/STOL aircraft with similar configurational features. The differences and similarities in the applications are discussed with emphasis on a design approach for safety in the event of failures in the propulsion and flight control systems. Differences in flying qualities and system design criteria are considered.

Gotleib, P.↗
NASA NTRS1997

Demonstration of a Safety Analysis on a Complex System

For the past 17 years, Professor Leveson and her graduate students have been developing a theoretical foundation for safety in complex systems and building a methodology upon that foundation. The methodology includes special management structures and procedures, system hazard analyses, software hazard analysis, requirements modeling and analysis for completeness and safety, special software design techniques including the design of human-machine interaction, verification, operational feedback, and change analysis. The Safeware methodology is based on system safety techniques that are extended to deal with software and human error. Automation is used to enhance our ability to cope with complex systems. Identification, classification, and evaluation of hazards is done using modeling and analysis. To be effective, the models and analysis tools must consider the hardware, software, and human components in these systems. They also need to include a variety of analysis techniques and orthogonal approaches: There exists no single safety analysis or evaluation technique that can handle all aspects of complex systems. Applying only one or two may make us feel satisfied, but will produce limited results. We report here on a demonstration, performed as part of a contract with NASA Langley Research Center, of the Safeware methodology on the Center-TRACON Automation System (CTAS) portion of the air traffic control (ATC) system and procedures currently employed at the Dallas/Fort Worth (DFW) TRACON (Terminal Radar Approach CONtrol). CTAS is an automated system to assist controllers in handling arrival traffic in the DFW area. Safety is a system property, not a component property, so our safety analysis considers the entire system and not simply the automated components. Because safety analysis of a complex system is an interdisciplinary effort, our team included system engineers, software engineers, human factors experts, and cognitive psychologists.

Leveson, Nancy↗
NASA NTRS2007

Sample Return Primer and Handbook

This three-part Sample Return Primer and Handbook provides a road map for conducting the terminal phase of a sample return mission. The main chapters describe element-by-element analyses and trade studies, as well as required operations plans, procedures, contingencies, interfaces, and corresponding documentation. Based on the experiences of the lead Stardust engineers, the topics include systems engineering (in particular range safety compliance), mission design and navigation, spacecraft hardware and entry, descent, and landing certification, flight and recovery operations, mission assurance and system safety, test and training, and the very important interactions with external support organizations (non-NASA tracking assets, landing site support, and science curation).

Stardust↗
NASA NTRS2012

Combining System Safety and Reliability to Ensure NASA CoNNeCT's Success

Hazard Analysis, Failure Modes and Effects Analysis (FMEA), the Limited-Life Items List (LLIL), and the Single Point Failure (SPF) List were applied by System Safety and Reliability engineers on NASA's Communications, Navigation, and Networking reConfigurable Testbed (CoNNeCT) Project. The integrated approach involving cross reviews of these reports by System Safety, Reliability, and Design engineers resulted in the mitigation of all identified hazards. The outcome was that the system met all the safety requirements it was required to meet.

Havenhill, Maria↗
NASA NTRSDate not supplied

Moon to Mars (M2M): Exploration Atmosphere

As humans leave the bounds of Earth to explore the lunar surface and beyond, crew will don extravehicular activity (EVA) suits to learn more about these extraterrestrial environments, establish sustained presence, and perform needed upgrades and maintenance to their space vehicle and habitation systems. Spacefaring vehicle and habitation design will need to support these EVA excursions while ensuring crew health and safety. A crucial technological design advancement towards this goal is the use of a lower pressure exploration atmosphere (EA) that enables high efficiency EVA, rather than the sea level atmosphere of 14.7 psia, 21% oxygen (O 2 ) found on the International Space Station, Shuttle, and most other Russian and Chinese space vehicles and stations. Early space vehicles (Mercury through Apollo Programs) used a 5 psia, 100% O 2 environment, which eliminated the need for pre-EVA denitrogenation protocols, simplified the life support system to a single gas, and saved structural mass. For longer duration missions (Skylab), a diluent gas was added, changing the atmosphere to 5 psia, 70-74% O 2 to prevent atelectasis while remaining normoxic. As in-flight science became a top priority, Shuttle and ISS atmospheres were chosen to operate at sea level allowing for simpler ground-based study control conditions. Consequently this led to long pre-EVA denitrogenation protocols involving up to 4 hours of O 2 prebreathe because the EVA suit still operated at a low pressure of 4.3 psid. To increase operational efficiency, the Shuttle was retroactively certified to operate using 10.2 psia, 26.5% O 2 , reducing O 2 prebreathe time to 40-75 min. Current plans for M2M habitats on the Lunar surface require EVA, thus EA recommendation became 8 psia and 32% O 2 but was revised to 8.2 psia and 34% O 2 to decrease hypoxia exposure. Unfortunately, the benefits of EA in support of safe and efficient EVAs comes with the challenge of fire management in a higher-than-normal O 2 % environment. Although known for decades, the recommended forward work to address fire management has only recently begun. Current flammability tests include examining material propagation and ignition sources as well as fire mitigation processes to better understand these properties for proposed new EA environments. Fire safety, DCS risk, and mission design all contribute to the multifaceted parameters of EA. Thus while it is clear that EA is required to achieve the goals of future exploratory space missions, final specifications are still being evaluated for optimizing crew health and safety.

space atmosphere↗
NASA NTRS2006

Software Tools for Developing and Simulating the NASA LaRC CMF Motion Base

The NASA Langley Research Center (LaRC) Cockpit Motion Facility (CMF) motion base has provided many design and analysis challenges. In the process of addressing these challenges, a comprehensive suite of software tools was developed. The software tools development began with a detailed MATLAB/Simulink model of the motion base which was used primarily for safety loads prediction, design of the closed loop compensator and development of the motion base safety systems1. A Simulink model of the digital control law, from which a portion of the embedded code is directly generated, was later added to this model to form a closed loop system model. Concurrently, software that runs on a PC was created to display and record motion base parameters. It includes a user interface for controlling time history displays, strip chart displays, data storage, and initializing of function generators used during motion base testing. Finally, a software tool was developed for kinematic analysis and prediction of mechanical clearances for the motion system. These tools work together in an integrated package to support normal operations of the motion base, simulate the end to end operation of the motion base system providing facilities for software-in-the-loop testing, mechanical geometry and sensor data visualizations, and function generator setup and evaluation.

Bryant, Richard B., Jr.↗
NASA NTRS1983

A review of modern approaches to fatigue reliability analysis and design

Metal fatigue is a principal mode of failure in components of mechanical systems. But fatigue design factors (e.g., stress, fatigue strength) are subject to considerable uncertainty. Therefore, relative to fatigue, reliability methods are appropriate for purposes of safety checking of designs, risk assessment, failure analysis, and development of code statements. Described herein are four methods which can be effectively employed for fatigue reliability analysis, (1) Monte Carlo methods, (2) the lognormal format, (3) the Weibull format, (4) the Rackwitz-Fiessler algorithm. Examples of the application of each are presented. In summary, no general reliability method can be recommended for all situations involving fatigue. The approach has to be tailored to the problem.

Wirsching, P. H.↗
NASA NTRS2007

The Lunar Environment: Determining the Health Effects of Exposure to Moon Dusts

The Earth s moon presents a hostile environment in which to live and work. There is no atmosphere to protect its surface from the ravages of solar wind and micrometeorite impacts. As a result, the moon s surface is covered with a thin layer of fine, charged, reactive dust capable of entering habitats and vehicle compartments, where it can result in crewmember health problems. During the Apollo missions, lunar dusts were introduced into the crew vehicle, resulting in direct exposure and occasional reports of respiratory, dermal and ocular irritation. In order to study the toxicological effects of lunar dust, NASA formed the Lunar Airborne Dust Toxicity Advisory Group (LADTAG). This interdisciplinary group is comprised of leading experts in space toxicology, lunar geology, space medicine and biomedical research. LADTAG has demonstrated that lunar soil contains several types of reactive dusts, including an extremely fine respirable component. These dusts have highly reactive surfaces in the lunar environment; the grains contain surface coatings which are generated by vapor phases formed by hypervelocity impact of micrometeorites. This unique class of dusts has surface properties that are unlike any Earth based analog. These distinctive properties are why lunar dusts are of great toxicological interest. Understanding how these reactive components behave "biochemically" in a moisture-rich pulmonary environment will aid in determining how toxic these particles are to humans. The data obtained from toxicological examination of lunar dusts will determine the human risk criteria for lunar dust exposure and produce a lunar health standard. LADTAG s analysis of lunar dusts and lunar dust simulants will include detailed lunar particle characterizations, determining the properties of particle activation, reactivation of lunar dust, the process of dust passivation and discerning the pathology of lunar dust exposure via inhalation, intratracheal instillation, cell culture exposure, dermal exposure and ocular exposure. The resulting health standard will be time-based and will vary by the duration and type of exposure. It may also be necessary to set multiple standards for different types of lunar dust, as well as for dust in its activated form vs. aged & passivated dust. This standard, set to protect the health of our robust astronaut crews, will not only impact NASA medical operations, but engineering designs as well. The data from our multidisciplinary research are vital in developing remediation devices and environmental monitors. Ultimately, the engineering and safety groups will design and develop countermeasures for space vehicles, suits, rovers and habitats that will be sustained within the limits of the health standard.

Khan-Mayberry, Noreen↗
NASA NTRS2021

Defining and Reasoning about Model-based Safety Analysis: A Review

Model-based safety analysis (MBSA) has been around for over two decades. The benefits of MBSA have been well-documented in the literature, such as tackling complexity, introducing Formal Methods to eliminate the ambiguity in the traditional safety analysis, using automation to replace the error-prone manual safety modeling process, and ensuring consistency between the design model and the safety model. However, there is still a lack of consensus on what MBSA even is. This paper provides an approach towards developing such a consensus

model-based↗
NASA NTRS1990

Software safety - A user's practical perspective

Software safety assurance philosophy and practices at the NASA Ames are discussed. It is shown that, to be safe, software must be error-free. Software developments on two digital flight control systems and two ground facility systems are examined, including the overall system and software organization and function, the software-safety issues, and their resolution. The effectiveness of safety assurance methods is discussed, including conventional life-cycle practices, verification and validation testing, software safety analysis, and formal design methods. It is concluded (1) that a practical software safety technology does not yet exist, (2) that it is unlikely that a set of general-purpose analytical techniques can be developed for proving that software is safe, and (3) that successful software safety-assurance practices will have to take into account the detailed design processes employed and show that the software will execute correctly under all possible conditions.

Dunn, William R.↗
NASA NTRS2023

Trades, Architecture, and Design of the Joint Augmented Reality Visual Informatics (Joint AR) Product

Future expeditions will enable exploration and study of the planetary surfaces of the Moon and Mars by performing extravehicular activity (EVA) operations. Present-day International Space Station (ISS) EVA operations require an intricate and tight choreography of crew, space suits, tools, systems, and flight teams to plan, train, and execute with limited advanced informatics. Additionally, EVA operations, aside from the Apollo Lunar surface missions, have predominately focused on maintenance and construction tasks where success criteria are clearly measurable. However, future exploration missions expect to enable crew to carry out scientific objectives in increasingly Earth-independent ways. In this paper, the Joint Augmented Reality Visual Informatics System (Joint AR) characterizes the design space for developing a modular augmented reality (AR) device for a spacesuit form factor that can support crew decision-making for EVA. This paper highlights the project’s experience with a product-focused management style and use-case centered systems engineering approach to iteratively design, build, and test. The Joint AR product features were defined via trade studies and market analysis of previous EVA display efforts, various AR components such as optics, commercial AR systems, light engines, data interfaces, graphics engine software and analog test beds. We outline the defining architectural design decisions, including safety criticality considerations, suit mounting interfaces, computer architectures, and partnership contracting mechanisms. The outcomes of these studies, architecture decisions, and management requirements result in a recommended design which is the Joint AR product. We discuss the evolution, development of these system components, and what work remains. We hope to share a unified understanding of various design decisions and how they impact the future of crew members’ access to data during Lunar and Martian EVAs. This ongoing effort can enable a community-wide discovery process toward realizing necessary AR features and capabilities for future missions.

Augmented Reality↗
NASA NTRS1989

The Space Station Freedom - International cooperation and innovation in space safety

The Space Station Freedom (SSF) being developed by the United States, European Space Agency (ESA), Japan, and Canada poses novel safety challenges in design, operations, logistics, and program management. A brief overview discloses many features that make SSF a radical departure from earlier low earth orbit (LEO) space stations relative to safety management: size and power levels; multiphase manned assembly; 30-year planned lifetime, with embedded 'hooks and scars' forevolution; crew size and skill-mix variability; sustained logistical dependence; use of man, robotics and telepresence for on-orbit maintenance of station and free-flyer systems; closed-environment recycling; use of automation and expert systems; long-term operation of collocated life-sciences and materials-science experiments, requiring control and segregation of hazardous and chemically incompatible materials; and materials aging in space.

Rodney, George A.↗
NASA NTRS1979

Photovoltaic system criteria documents. Volume 5: Safety criteria for photovoltaic applications

Methodology is described for determining potential safety hazards involved in the construction and operation of photovoltaic power systems and provides guidelines for the implementation of safety considerations in the specification, design and operation of photovoltaic systems. Safety verification procedures for use in solar photovoltaic systems are established.

Koenig, John C.↗
NASA NTRS2014

Simulation Technology at NASA

NASA Ames Research Center is home to several high-fidelity research flight and air-traffic control simulation facilities which, together with an experienced workforce, produce high-quality research data and findings that have proven to be applicable in the real world. These assets include the Vertical Motion Simulator (VMS), Crew Vehicle Systems Research Facility (CVSRF), Future Flight Central (FFC) air traffic control tower simulator, and several air-traffic control (ATC) simulators. The VMS combines a high-fidelity simulation capability with an adaptable simulation environment, enabling customization for numerous human-in-the-loop research applications. The distinctive feature of the VMS is its unparalleled large amplitude, high-fidelity motion capability. In over 30 years of continuous operation, the VMS has contributed significantly to the body of knowledge in a range of disciplines directly benefiting several aerospace programs and flight safety, including the design and development of flight control systems for the Joint Strike Fighter, Space Shuttle Orbiter, and rotorcraft. It continues to be used for researching new vehicle configurations, vehicle control and safety, transfer-of-training, etc., by NASA, other government agencies, and Industry.The CVSRF includes two motion-based flight simulators: a Boeing 747-400 full flight simulator and the reconfigurable Advanced Concepts Flight Simulator (ACFS). These simulators are primarily used to research air-traffic management concepts and procedures, advanced navigation and avionics concepts, and cockpit human factors. FFC is a full-sized control tower simulator with a 360-degree external field-of-view display system and reconfigurable system architecture. FFC and the ATC simulators are used for testing air-traffic management automation and decision support tools and demonstrate their feasibility in a realistic environment prior to technology transfer for implementation in the National Airspace System (NAS).To support integrated simulations and flight-tests for NASA's Unmanned Aircraft Systems (UAS) in the National Airspace System (NAS) Project, NASA developed a distributed test environment incorporating Live, Virtual, Constructive, (LVC) concepts. Development of the software enabling the LVC is conducted primarily at the Distributed Simulation Research Lab (DSRL) at NASA Ames. The LVC components provide the core infrastructure supporting simulation of UAS operations by integrating live and virtual aircraft in a realistic air traffic environment. This provides the ability to conduct tests more efficiently by promoting the use of existing distributed assets. The LVC infrastructure was used in several human-in-the-loop simulations to evaluate acceptance of Detect and Avoid (DAA) advisories used by UAS pilots to maintain well clear of other virtual traffic and to negotiate maneuvers with air traffic control. It is currently being used to support testing of self-separation algorithms between unmanned and manned aircraft in live flight. Further simulations with more comprehensive air traffic scenarios mixing live and virtual aircraft is planned.In the current fiscal environment, maintaining and upgrading these high-fidelity simulation assets and retaining the skilled workforce necessary to meet future research needs is the primary non-technical challenge.

CVSRF↗