Search NASA⌕ Search

SEARCH · Search NASA

Results for “safety certification”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 325 records · Page 18
All sourcesNASA NTRSDOE OSTI
NASA NTRS2005

Automatic Certification of Kalman Filters for Reliable Code Generation

AUTOFILTER is a tool for automatically deriving Kalman filter code from high-level declarative specifications of state estimation problems. It can generate code with a range of algorithmic characteristics and for several target platforms. The tool has been designed with reliability of the generated code in mind and is able to automatically certify that the code it generates is free from various error classes. Since documentation is an important part of software assurance, AUTOFILTER can also automatically generate various human-readable documents, containing both design and safety related information. We discuss how these features address software assurance standards such as DO-178B.

Denney, Ewen↗
NASA NTRS2011

Development and Certification of Ultrasonic Background Noise Test (UBNT) System for use on the International Space Station (ISS)

As a next step in the development and implementation of an on-board leak detection and localization system on the International Space Station (ISS), there is a documented need to obtain measurements of the ultrasonic background noise levels that exist within the ISS. This need is documented in the ISS Integrated Risk Management System (IRMA), Watch Item #4669. To address this, scientists and engineers from the Langley Research Center (LaRC) and the Johnson Space Center (JSC), proposed to the NASA Engineering and Safety Center (NESC) and the ISS Vehicle Office a joint assessment to develop a flight package as a Station Development Test Objective (SDTO) that would perform ultrasonic background noise measurements within the United States (US) controlled ISS structure. This document contains the results of the assessment

Prosser, William H.↗
NASA NTRS2002

Best Practices for Crash Modeling and Simulation

Aviation safety can be greatly enhanced by the expeditious use of computer simulations of crash impact. Unlike automotive impact testing, which is now routine, experimental crash tests of even small aircraft are expensive and complex due to the high cost of the aircraft and the myriad of crash impact conditions that must be considered. Ultimately, the goal is to utilize full-scale crash simulations of aircraft for design evaluation and certification. The objective of this publication is to describe "best practices" for modeling aircraft impact using explicit nonlinear dynamic finite element codes such as LS-DYNA, DYNA3D, and MSC.Dytran. Although "best practices" is somewhat relative, it is hoped that the authors' experience will help others to avoid some of the common pitfalls in modeling that are not documented in one single publication. In addition, a discussion of experimental data analysis, digital filtering, and test-analysis correlation is provided. Finally, some examples of aircraft crash simulations are described in several appendices following the main report.

Fasanella, Edwin L.↗
NASA NTRS2015

Explicate '78: Uncovering the Implicit Assurance Case in DO-178C

For about two decades, compliance with Software Considerations in Airborne Systems and Equipment Certification (DO-178B/ED-12B) has been the primary means for receiving regulatory approval for using software on commercial airplanes. A new edition of the standard, DO-178C/ED-12C, was published in December 2011, and recognized by regulatory bodies in 2013. The purpose remains unchanged: to provide guidance 'for the production of software for airborne systems and equipment that performs its intended function with a level of confidence in safety that complies with airworthiness requirements.' The text of the guidance does not directly explain how its collection of objectives contributes to achieving this purpose; thus, the assurance case for the document is implicit. This paper presents an explicit assurance case developed as part of research jointly sponsored by the Federal Aviation Administration and the National Aeronautics and Space Administration.

Holloway, C. Michael↗
NASA NTRS2015

Argument-Based Airworthiness Assurance of Small UAS

Presently, there are three avenues by which Unmanned Aircraft System (UAS) operations are authorized in the U.S. National Airspace System (NAS): obtaining either (i) a certificate of authorization (COA), or (ii) a special airworthiness certificate (SAC) in either the experimental, or the restricted category, or (iii) an exemption from an airworthiness certificate together with a civil COA. The first is meant primarily for public entities, such as NASA; the remaining two are the only available means for civil UAS operations. Recently, the Federal Aviation Administration (FAA) has also proposed a regulatory framework targeted for certain small UAS, specifically those weighing 55 pounds or less, although final rulemaking remains pending. We have previously shown how an assurance case can aggregate heterogeneous reasoning and safety evidence, with application to UAS safety. In this paper, we describe how assurance cases can serve as a common framework to justify overall system safety, unifying both operational aspects and airworthiness, in particular system design assurance. We also show how this approach can coexist with, and augment, existing safety analysis processes and best-practices, by transforming the artifacts they produce into structured assurance arguments. To illustrate the applicability and utility of our approach, we have been applying it for the design assurance of an unmanned rotorcraft system, intended for precision agriculture operations, as part of the NASA Unmanned Aircraft System (UAS) Integration in the National Airspace System (NAS) project.

Rotocraft↗
NASA NTRS2002

Synthesizing Certified Code

Code certification is a lightweight approach to demonstrate software quality on a formal level. Its basic idea is to require producers to provide formal proofs that their code satisfies certain quality properties. These proofs serve as certificates which can be checked independently. Since code certification uses the same underlying technology as program verification, it also requires many detailed annotations (e.g., loop invariants) to make the proofs possible. However, manually adding theses annotations to the code is time-consuming and error-prone. We address this problem by combining code certification with automatic program synthesis. We propose an approach to generate simultaneously, from a high-level specification, code and all annotations required to certify generated code. Here, we describe a certification extension of AUTOBAYES, a synthesis tool which automatically generates complex data analysis programs from compact specifications. AUTOBAYES contains sufficient high-level domain knowledge to generate detailed annotations. This allows us to use a general-purpose verification condition generator to produce a set of proof obligations in first-order logic. The obligations are then discharged using the automated theorem E-SETHEO. We demonstrate our approach by certifying operator safety for a generated iterative data classification program without manual annotation of the code.

Whalen, Michael↗
NASA NTRSDate not supplied

Assuring Safety-Critical Machine Learning Enabled Systems: Challenges and Promise

Machine learning is increasingly being used in safety-critical systems, where the public safety requires a rigorous assurance process. We shall outline how assurance processes work for conventional systems and identify the primary difficulty in applying them to machine learning enabled systems. We will then outline a path forward including identifying where considerable basic research remains.

machine learning↗
NASA NTRSDate not supplied

NASA's Office Safety Mission Assurance Efforts to Improve Non-destructive Evaluation Methods for Additive Manufacturing and In-Space Inspection

National Aeronautics and Space Administration (NASA) continues to push the boundary of manned flight. Current mission profiles include flights to the Moon and Mars. Many of these missions require advance manufacturing and planned off planet resource utilization. As NASA continues to develop highly advance materials and manufacturing techniques to meet these mission profiles, inspection of these increasingly complex parts has had to evolve as well. Additive manufacturing is coming to the forefront as a primary manufacturing technique but offers unique challenges when inspection and certification are required. NASA has been working diligently to be a leader in developing and utilizing inspection techniques capable of inspecting these highly advanced parts. Additionally additive manufacturing techniques can also be used to build parts in space and provides a vehicle for in-situ resource utilization for off world missions. As NASA and its commercial crew partners move forward, inspection techniques will need to continue to advance to ensure safe manned space flight. In this talk NASA will highlight many of the advanced nondestructive evaluation efforts going on across the agency, as well as providing highlights for points of infusion for helping NASA meet its future mission goals.

NDE↗
NASA NTRS2005

Trial by Fire

The NASa/ATK Thiokol space shuttle solid rocket motor program has doubled ground test firings and enhanced manufacturing quality and process control to increase safety for Discovery's return to flight. There are a number of places where we've strengthened our engineering and our processes, says Mike Kahn, ATK Thiokol vice president of space launch systems. Protecting the booster against corrosion in the humid Florida environment is one area that has been addressed. Since the loss of Columbia, ATK Thiokol and the Marshall Space Flight Center have completely reevaluated the shuttle solid rocket motor's design certification and found no major problems, Kahn said. The Thiokol solid motors did not play a role in the 2003 Columbia accident, but the motor's older field joint design (since replaced) was the primary cause of the 1986 Challenger accident that killed seven astronauts. The 129 X 12-ft. ATK Thiokol reusable solid rocket motor forms the core of the shuttle's two solid rocket boosters (SRBs). United Space Alliance (USA) has overall responsibility for the booster's nose-mounted systems such as recovery parachutes and aft-mounted thrust vector control systems that increase the length to 149 ft. USA and its subcontractors have also reaffirmed quality control on systems such as the booster's Hamilton Sundstrand hydraulic power units for critical thrust vector control. And to ensure greater safeguards against booster debris jeopardizing the orbiter, a bolt-catcher system to restrain the large bolts, severed at booster separation, was also redesigned.

Covault, Craig↗
NASA NTRS2006

Biologically-Inspired Concepts for Autonomic Self-Protection in Multiagent Systems

Biologically-inspired autonomous and autonomic systems (AAS) are essentially concerned with creating self-directed and self-managing systems based on metaphors &om nature and the human body, such as the autonomic nervous system. Agent technologies have been identified as a key enabler for engineering autonomy and autonomicity in systems, both in terms of retrofitting into legacy systems and in designing new systems. Handing over responsibility to systems themselves raises concerns for humans with regard to safety and security. This paper reports on the continued investigation into a strand of research on how to engineer self-protection mechanisms into systems to assist in encouraging confidence regarding security when utilizing autonomy and autonomicity. This includes utilizing the apoptosis and quiescence metaphors to potentially provide a self-destruct or self-sleep signal between autonomic agents when needed, and an ALice signal to facilitate self-identification and self-certification between anonymous autonomous agents and systems.

Sterritt, Roy↗
NASA NTRS1991

Human factors of flight-deck checklists: The normal checklist

Although the aircraft checklist has long been regarded as the foundation of pilot standardization and cockpit safety, it has escaped the scrutiny of the human factors profession. The improper use, or the non-use, of the normal checklist by flight crews is often cited as the probable cause or at least a contributing factor to aircraft accidents. An attempt is made to analyze the normal checklist, its functions, format, design, length, usage, and the limitations of the humans who must interact with it. The development of the checklist from the certification of a new model to its delivery and use by the customer are discussed. The influence of the government, particularly the FAA Principle Operations Inspector, the manufacturer's philosophy, the airline's culture, and the end user, the pilot, influence the ultimate design and usage of this device. The effects of airline mergers and acquisitions on checklist usage and design are noted. In addition, the interaction between production pressures and checklist usage and checklist management are addressed. Finally, a list of design guidelines for normal checklists is provided.

Degani, Asaf↗
NASA NTRS2001

Evaluation of NCAR Icing/SLD Forecasts, Tools and Techniques Used During The 1998 NASA SLD Flight Season

Supercooled Large Droplet (SLD) icing conditions were implicated in at least one recent aircraft crash, and have been associated with other aircraft incidents. Inflight encounters with SLD can result in ice accreting on unprotected areas of the wing where it can not be removed. Because this ice can adversely affect flight characteristics of some aircraft, there has been concern about flight safety in these conditions. The FAA held a conference on in-flight icing in 1996 where the state of knowledge concerning SLD was explored. One outcome of these meetings was an identified need to acquire SLD flight research data, particularly in the Great Lakes Region. The flight research data was needed by the FAA to develop a better understanding of the meteorological characteristics associated with SLD and facilitate an assessment of existing aircraft icing certification regulations with respect to SLD. In response to this need, NASA, the Federal Aviation Administration (FAA), and the National Center for Atmospheric Research (NCAR) conducted a cooperative icing flight research program to acquire SLD flight research data. The NASA Glenn Research Center's Twin Otter icing research aircraft was flown throughout the Great Lakes region during the winters of 1996-97 and 1997-98 to acquire SLD icing and meteorological data. The NASA Twin Otter was instrumented to measure cloud microphysical properties (particle size, LWC (Liquid Water Content), temperature, etc.), capture images of wing and tail ice accretion, and then record the resultant effect on aircraft performance due to the ice accretion. A satellite telephone link enabled the researchers onboard the Twin Otter to communicate with NCAR meteorologists. who provided real-time guidance into SLD icing conditions. NCAR meteorologists also provided preflight SLD weather forecasts that were used to plan the research flights, and served as on-board researchers. This document contains an evaluation of the tools and techniques NCAR forecasters used to predict the location of SLD icing conditions during the winter of 1997-1998. The objectives of this report are to: (1) assess the tools used to forecast in-flight icing. (2) assess the success/failure rate of the forecasts, and (3) discuss suggested changes to forecast techniques.

Bernstein, Ben C.↗
NASA NTRS2006

Progress in Development of an Airborne Turbulence Detection System

Aircraft encounters with turbulence are the leading cause of in-flight injuries (Tyrvanas 2003) and have occasionally resulted in passenger and crew fatalities. Most of these injuries are caused by sudden and unexpected encounters with severe turbulence in and around convective activity (Kaplan et al 2005). To alleviate this problem, the Turbulence Prediction and Warning Systems (TPAWS) element of NASA s Aviation Safety program has investigated technologies to detect and warn of hazardous in-flight turbulence. This effort has required the numerical modeling of atmospheric convection: 1) for characterizing convectively induced turbulence (CIT) environments, 2) for defining turbulence hazard metrics, and 3) as a means of providing realistic three-dimensional data sets that can be used to test and evaluate turbulence detection sensors. The data sets are being made available to industry and the FAA for certification of future airborne turbulence-detection systems (ATDS) with warning capability. Early in the TPAWS project, a radar-based ATDS was installed and flight tested on NASA s research aircraft, a B-757. This ATDS utilized new algorithms and hazard metrics that were developed for use with existing airborne predictive windshear radars, thus avoiding the installation of new hardware. This system was designed to detect and warn of hazardous CIT even in regions with weak radar reflectivity (i.e. 5-15 dBz). Results from an initial flight test of the ATDS were discussed in Hamilton and Proctor (2002a; 2002b). In companion papers (Proctor et al 2002a; 2002b), a numerical simulation of the most significant encounter from that flight test was presented. Since the presentation of these papers a second flight test has been conducted providing additional cases for examination. In this paper, we will present results from NASA s flight test and a numerical model simulation of a turbulence environment encountered on 30 April 2002. Progress leading towards FAA certification of industry built ATDS will also be discussed.

Hamilton, David W.↗
NASA NTRS2019

Electrified Aircraft Propulsion Systems: Potential Failure Modes and Failure Mitigation Strategies

Electrified aircraft propulsion (EAP) systems hold great potential for the reduction of aircraft fuel burn, emissions, and noise. Currently, NASA and other organizations are actively working to identify and mature technologies necessary to bring EAP designs to reality. A requirement for the development of any civil aircraft and its systems is to ensure that potential hazards in the design are identified and appropriately mitigated to ensure that the system is safe. During aircraft development, a system safety assessment that consists of a functional hazard assessment is conducted to identify all potential failure conditions of each function, and classify those failures according to the severity of their effects on the aircraft or its occupants. The more severe a function's failure condition classification, the greater the development assurance level required for the function to ensure that the probability of the hazard is acceptably low. Today, aircraft engines and their control systems receive type certificate approval as a stand-alone system to signify their airworthiness. However, the complex coupling and distributed nature of EAP designs are expected to place added challenges on the certification of these systems. This presentation will provide an initial high-level review of the potential failure modes and hazards posed by a generic EAP system along with potential mitigation strategies for those failures. The EAP system is assumed to be a hybrid design consisting of gas turbine engines, mechanical drives, electric machines, power electronics and distribution systems, energy storage devices, and motor driven propulsors. The functionality provided by each of these EAP subsystems will be discussed along with the potential failure modes they may encounter. This will include a discussion of coupled failure effects, where a fault in one EAP subsystem effects the operation of other subsystems in the architecture. Next, potential failure mitigation strategies are discussed including both software-based and hardware-based mitigation strategies. The presentation will conclude with an example evaluation of the potential failure modes and mitigation strategies for a concept EAP system proposed by NASA.

Simon, Donald L.↗
NASA NTRS1999

Fire and Ice - Safety, Comfort, and Getting the Firefighters' Job Done

Daily life for firefighters consists of working with life-threatening hazards in hostile environments. A major hazard is excessive ambient heat. New hazards have arisen from protective gear that was intended to increase survival time of firefighters while finding and rescuing victims. The insulation is so good now that a firefighter's metabolic heat buildup cannot escape. This forces body core temperatures to life threatening levels in about 20 minutes of moderate activity. Using NASA space suit technology, Oceaneering Space Systems developed a liquid cooling garment prototype that will remove up to 250 watts of metabolic heat. After testing and certification as an approved accessory for firefighter use, this garment will be available for use by any individual encapsulated in protective clothing. This demonstration will present a high surface area circulated liquid cooling garment displayed on a mannequin and available for attendees to try on to experience the effects of active cooling.

Foley, Tico↗
NASA NTRS2006

Ultrasonics Equipped Crimp Tool: A New Technology for Aircraft Wiring Safety

We report on the development of a new measurement technique to quantitatively assess the condition of wire crimp connections. This ultrasonic (UT) method transmits high frequency sound waves through the joint under inspection. The wire-crimp region filters and scatters the ultrasonic energy as it passes through the crimp and wire. The resulting output (both time and frequency domains) provides a quantitative measure of the joint quality that is independent and unaffected by current. Crimps of poor mechanical and electrical quality will result in low temporal output and will distort the spectrum into unique and predictable patterns, depending on crimp "quality". This inexpensive, real-time measurement system can provide certification of crimps as they are made and recertification of existing wire crimps currently in service. The measurements for re-certification do not require that the wire be disconnected from its circuit. No other technology exists to measure in-situ the condition of wire joints (no electrical currents through the crimp are used in this analytical technique). We discuss the signals obtained from this instrument, and correlate these signals with destructive wire pull tests.

Yost, William T.↗
NASA NTRS2013

Making the Implicit Explicit: Towards an Assurance Case for DO-178C

For about two decades, compliance with Software Considerations in Airborne Systems and Equipment Certification (DO-178B) has been the primary means for receiving regulatory approval for using software on commercial airplanes. A new edition of the standard, DO-178C, was published in December 2011, and regulatory bodies have started the process towards recognizing this edition. The stated purpose of DO-178C remains unchanged from its predecessor: providing guidance “for the production of software for airborne systems and equipment that performs its intended function with a level of confidence in safety that complies with airworthiness requirements.” Within the text of the guidance, little or no rationale is given for how a particular objective or collection of objectives contributes to achieving this purpose. Thus the assurance case for the document is implicit. This paper discusses a current effort to make the implicit explicit. In particular, the paper describes the current status of the research seeking to identify the specific arguments contained in, or implied by, the DO-178C guidance that implicitly justify the assumption that the document meets its stated purpose.

Holloway, C. Michael↗
NASA NTRS2019

Flyover-Noise Reduction of Commercial Aircraft via Reduced Slat Deflections and Modified Flight Procedures

Current regulation and operation of commercial aircraft result in flyover noise that generates public protest from residents well outside the recognized noise footprint of modern airports. This noise issue was recently exacerbated by the implementation of NextGen air-traffic control which uses GPS-navigation for predictable flight paths and improved efficiency. A side-effect of the narrow flight corridors is a perceived increase in noise level and annoyance experienced by the residents directly under the flight paths. As a possible solution to the community noise issue, the feasibility of a lower slat deflections and modified flight procedures were explored. To document the maximum potential noise reduction, field measurements were conducted on the ground at locations before and after slat deployment. For safety considerations, the stall margin of a lower slat deflection was computed for a realistic geometry based on a modern commercial aircraft. The logistics of setting lower slat angles on current aircraft were also investigated through discussions with the FAA (Federal Aviation Administration) and aircraft manufacturers. The results suggest that community flyover noise could be reduced via lower slat deflections during early approach, but that modifying current aircraft would be difficult due to existing control systems and hurdles in certification. Alternatively, modifications to existing flight procedures could reduce the perceived noise of the NextGen flight patterns. For next generation commercial aircraft, reduced slat deflections could be considered if mandated by FAA noise requirements during early approach.

Storms, Bruce L.↗