Search NASA⌕ Search

SEARCH · Search NASA

Results for “safety critical software”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 343 records · Page 19

Formal Verification of a Conflict Resolution and Recovery Algorithm

New air traffic management concepts distribute the duty of traffic separation among system participants. As a consequence, these concepts have a greater dependency and rely heavily on on-board software and hardware systems. One example of a new on-board capability in a distributed air traffic management system is air traffic conflict detection and resolution (CD&R). Traditional methods for safety assessment such as human-in-the-loop simulations, testing, and flight experiments may not be sufficient for this highly distributed system as the set of possible scenarios is too large to have a reasonable coverage. This paper proposes a new method for the safety assessment of avionics systems that makes use of formal methods to drive the development of critical systems. As a case study of this approach, the mechanical veri.cation of an algorithm for air traffic conflict resolution and recovery called RR3D is presented. The RR3D algorithm uses a geometric optimization technique to provide a choice of resolution and recovery maneuvers. If the aircraft adheres to these maneuvers, they will bring the aircraft out of conflict and the aircraft will follow a conflict-free path to its original destination. Veri.cation of RR3D is carried out using the Prototype Verification System (PVS).

Maddalon, Jeffrey↗

San Francisco Bar Pilot Fatigue Study

The purpose of this study was to evaluate the extent of fatigue among San Francisco Bar Pilots (Maritime Pilots) and its potential impact on safety, and to make recommendations concerning how the risk of fatigue could be managed. Information was gathered via a literature review, observations of Bar Pilots at work, surveys, a task analysis, and an analysis of dispatch records.The work of San Francisco Bar Pilots involves an unusual mix of activities and job demands. Their work calls for situational awareness, reasoning, communication, and perceptual abilities comparable to those required by airline pilots and air traffic controllers. Errors can have severe consequences for public safety and the environment, as well as significant financial costs. Fatigue is increasingly recognized as a hazard that must be managed by the transportation industry. The reduced sleep quality and quantity experienced by personnel who work at night, in conjunction with human circadian rhythms can lead to an operationally significant level of cognitive impairment. The cognitive impact of fatigue includes functions that are critical to safe maritime piloting, such as vigilance, judgment, reaction time and communication. The surveys distributed to Bar Pilots did not uncover evidence of widespread fatigue. The survey results also suggested that fatigue was not a major concern of Bar Pilots. Bar Pilots had overall low scores on the subjective fatigue measures used in the survey, and generally assessed the safety risk due to fatigue as low. Compared to air traffic controllers, Bar Pilots gave significantly lower ratings on questions concerning the prevalence and impact of fatigue. The application of fatigue modeling software to Bar Pilot dispatch records identified that in most cases, pilot's cognitive effectiveness was predicted to be acceptable during their duty periods. However, these results could not be verified with objective data.The study identified a number of fatigue issues that deserve attention. These include Bar Pilot work periods that frequently infringe on the circadian low, consecutive work periods without a significant break, consecutive periods of night work, unpredictable work schedules, start time variability, the potential for sleep inertia, and the number of pilots on the board at any given time.

fatigue↗

Alternative Metrics for Evaluating the Resilence of Advanced Life Support Systems

Ensuring the safety of the crew is a key performance requirement of a life support system. However, a number of conceptual and practical difficulties arise when devising metrics to concretely measure the ability of a life support system to maintain critical functions in the presence of anticipated and unanticipated faults. Resilience is a dynamic property of a life support system that depends on the complex interactions between faults, controls and system hardware. We review some of the approaches to understanding the robustness or resilience of complex systems being developed in diverse fields such as ecology, software engineering and cell biology and discuss their applicability to regenerative life support systems. We also consider how approaches to measuring resilience vary depending on system design choices such as the definition and choice of the nominal operating regime. Finally, we explore data collection and implementation issues such as the key differences between the instantaneous or conditional and average or overall measures of resilience. Extensive simulation of a hybrid computational model of a water revitalization subsystem (WRS) with probabilistic, component-level faults provides data about off-nominal behavior of the system. The data are used to consider alternative measures of resilience as predictors of the system's ability to recover from component-level faults.

Bell, Ann Maria↗

The STAT7 Code for Statistical Propagation of Uncertainties in Steady State Thermal Hydraulics Analysis of Plate Fueled Reactors

The STAT7 software was developed to perform steady-state thermal hydraulic analyses. Application of the software is for non-power research and test reactors, including conversion to low-enriched uranium fuel of U.S. High-Performance Research Reactors such as MITR-II. Since it can be necessary to repeat analysis during fuel reloading, STAT7 accommodates flexibility in analyzing many realistic aspects of reactor fuel management. STAT7 uses a Monte Carlo approach to model common fabrication parameters and other key reactor analysis uncertainties required for research and test reactor thermal hydraulic analyses. These safety calculations are ultimately intended to protect against high fuel plate temperatures due to critical heat flux or departure from nucleate boiling or onset of flow instability; but additional margin is obtained by basing the limiting safety settings on avoiding onset of nucleate boiling. STAT7 can simultaneously analyze all of the axial nodes of all of the fuel plates and all of the coolant channels for one lateral stripe of a fuel element. The stripes run the length of the fuel, from the bottom to the top. Power splits are calculated for each axial node of each plate to determine how much of the power goes out each face of the plate. By running STAT7 multiple times, full core analysis can be performed by analyzing the margin to onset of nucleate boiling and onset of flow instability for each axial node of each stripe of each plate of each element in the core.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗

Evaluation of an expert system for fault detection, isolation, and recovery in the manned maneuvering unit

The authors explore issues in the specification, verification, and validation of artificial intelligence (AI) based software, using a prototype fault detection, isolation and recovery (FDIR) system for the Manned Maneuvering Unit (MMU). They use this system as a vehicle for exploring issues in the semantics of C-Language Integrated Production System (CLIPS)-style rule-based languages, the verification of properties relating to safety and reliability, and the static and dynamic analysis of knowledge based systems. This analysis reveals errors and shortcomings in the MMU FDIR system and raises a number of issues concerning software engineering in CLIPs. The authors came to realize that the MMU FDIR system does not conform to conventional definitions of AI software, despite the fact that it was intended and indeed presented as an AI system. The authors discuss this apparent disparity and related questions such as the role of AI techniques in space and aircraft operations and the suitability of CLIPS for critical applications.

Rushby, John↗

A hazard control system for robot manipulators

A robot for space applications will be required to complete a variety of tasks in an uncertain, harsh environment. This fact presents unusual and highly difficult challenges to ensuring the safety of astronauts and keeping the equipment they depend on from becoming damaged. The systematic approach being taken to control hazards that could result from introducing robotics technology in the space environment is described. First, system safety management and engineering principles, techniques, and requirements are discussed as they relate to Shuttle payload design and operation in general. The concepts of hazard, hazard category, and hazard control, as defined by the Shuttle payload safety requirements, is explained. Next, it is shown how these general safety management and engineering principles are being implemented on an actual project. An example is presented of a hazard control system for controlling one of the hazards identified for the Development Test Flight (DTF-1) of NASA's Flight Telerobotic Servicer, a teleoperated space robot. How these schemes can be applied to terrestrial robots is discussed as well. The same software monitoring and control approach will insure the safe operation of a slave manipulator under teleoperated or autonomous control in undersea, nuclear, or manufacturing applications where the manipulator is working in the vicinity of humans or critical hardware.

Carter, Ruth Chiang↗

Failure Assessment

Three questions to which software developers want accurate, precise answers are "How can the software system fail?", "mat bad things will happen if the software fails?t', and "How many failures will the software experience?". Numerous techniques have been devised to answer these questions; three of the best known are: 1) Software Fault Tree Analysis (SFTA) 2) Software Failure Modes, Effects, and Criticality Analysis (SFMECA 3) Software Fault/Failure Modeling. SFTA and SFMECA have been successfully used to analyze the flight software for a number of robotic planetary exploration missions, including Galileo, Cassini, and Deep Space 1. Given the increasing interest in reusing software components from mission to mission, one of us has developed techniques for reusing the corresponding portions of the SFTA and SFMECA, reducing the effort required to conduct these analyses. SFTA has also been shown to be effective in analyzing the security aspects of software systems; intrusion mechanisms and effects can easily be modeled using these techniques. The Bi- Directional Safety Analysis (BDSA) method combines a forward search (similar to SFMECA) from potential failure modes to their effects, with a backward search (similar to SFTA) from feasible hazards to the contributing causes of each hazard. BDSA offers an efficient way to identify latent failures. Recent work has extended BDSA to product-line applications such as flight-instrumentation displays and developed tool support for the reuse of the failure-analysis artifacts within a product line. BDSA has also been streamlined to support those projects having tight cost and/or schedule constraints for their failure analysis efforts. We discuss lessons learned from practice, describe available tools, and identi@ some future directions for the topic. A substantial amount of research has been devoted to estimating the number of failures that a software system will experience during test and operations, as well as the number of faults that have been inserted into that system during its development. One of us has found that the amount of structural change to a system during its development is strongly related to the number of faults inserted into it. Using techniques requiring no additional effort on the part of the development organization, the required measurements of structural evolution can be easily obtained from a development effort's configuration management system and readily transformed into an estimate of fault content. So far, structure-fault relationships have been identified for source code; current work seeks to examine artifacts available earlier in the lifecycle to determine if similar relationships between structure and fault content can be found. In particular, relationships between requirements change requests and the number of faults inserted into the implemented system would provide a significant improvement in our ability to control software quality during the early development phases.

fault tree↗

UAS-Systems Integration, Validation, and Diagnostics Simulation Capability

As part of the Phase 1 efforts of NASA's UAS-in-the-NAS Project a task was initiated to explore the merits of developing a system simulation capability for UAS to address airworthiness certification requirements. The core of the capability would be a software representation of an unmanned vehicle, including all of the relevant avionics and flight control system components. The specific system elements could be replaced with hardware representations to provide Hardware-in-the-Loop (HWITL) test and evaluation capability. The UAS Systems Integration and Validation Laboratory (UAS-SIVL) was created to provide a UAS-systems integration, validation, and diagnostics hardware-in-the-loop simulation capability. This paper discusses how SIVL provides a robust and flexible simulation framework that permits the study of failure modes, effects, propagation paths, criticality, and mitigation strategies to help develop safety, reliability, and design data that can assist with the development of certification standards, means of compliance, and design best practices for civil UAS.

Buttrill, Catherine W.↗

Digitizing Curves from LA-10860 to be Used in CritView

This report documents the digitization of figures from LA-10860-MS in order to import the data into the CritView software application. The original figures were created by Los Alamos National Laboratory and the latest revision was released in 1986. All figures were digitized using Engauge Digitizer (ver. 12.1) .

73 NUCLEAR PHYSICS AND RADIATION PHYSICS↗

Design and verification of a multiple fault tolerant control system for STS applications using computer simulation

General Dynamics/Convair is under NASA contract to integrate the Centaur upper stage into the space transportation system for future planetary missions. This requires that control of all safety critical functions be two-failure tolerant. The control system developed consists of five asynchronous computers, each contributing at their outputs to a 3-out-of-5 voting plane. Subsystem control is based on an end function redundancy management scheme. Analysis of multiple component failures and worst-case time-phase asynchrony among the computers is performed by a real-time computer simulation. The simulation emulates the hardware and subsystem interfaces, wire by wire, providing assessibility to any component for the insertion of preprogrammed failures. Observability is provided via a graphics system and diagnostic software. The simulation provides an engineering tool where the integrity of control system hardware and imbedded software can be demonstrated.

Szatkowski, G. P.↗

Time-Domain Terahertz Computed Axial Tomography NDE System

NASA has identified the need for advanced non-destructive evaluation (NDE) methods to characterize aging and durability in aircraft materials to improve the safety of the nation's airline fleet. 3D THz tomography can play a major role in detection and characterization of flaws and degradation in aircraft materials, including Kevlar-based composites and Kevlar and Zylon fabric covers for soft-shell fan containment where aging and durability issues are critical. A prototype computed tomography (CT) time-domain (TD) THz imaging system has been used to generate 3D images of several test objects including a TUFI tile (a thermal protection system tile used on the Space Shuttle and possibly the Orion or similar capsules). This TUFI tile had simulated impact damage that was located and the depth of damage determined. The CT motion control gan try was designed and constructed, and then integrated with a T-Ray 4000 control unit and motion controller to create a complete CT TD-THz imaging system prototype. A data collection software script was developed that takes multiple z-axis slices in sequence and saves the data for batch processing. The data collection software was integrated with the ability to batch process the slice data with the CT TD-THz image reconstruction software. The time required to take a single CT slice was decreased from six minutes to approximately one minute by replacing the 320 ps, 100-Hz waveform acquisition system with an 80 ps, 1,000-Hz waveform acquisition system. The TD-THZ computed tomography system was built from pre-existing commercial off-the-shelf subsystems. A CT motion control gantry was constructed from COTS components that can handle larger samples. The motion control gantry allows inspection of sample sizes of up to approximately one cubic foot (.0.03 cubic meters). The system reduced to practice a CT-TDTHz system incorporating a COTS 80- ps/l-kHz waveform scanner. The incorporation of this scanner in the system allows acquisition of 3D slice data with better signal-to-noise using a COTS scanner rather than the gchirped h scanner. The system also reduced to practice a prototype for commercial CT systems for insulating materials where safety concerns cannot accommodate x-ray. A software script was written to automate the COTS software to collect and process TD-THz CT data.

Zimdars, David↗

Conceptual design and simulator implementation of an automatic terminal approach system

The pilot-machine interface with aircraft automation to increase the safety and utility of single-pilot IFR (instrument flight rules) operations is addressed. An automatic terminal approach system (ATAS), that uses stored instrument approach data to automatically tune aircraft radios and control the aircraft autopilot, was conceived as a means of improving this critical interface. The ATAS automatically flies instrument approach procedures, including the missed approach, and provides for easy pilot interaction to accommodate air traffic control radar vectors and altitude assignments. A research prototype of an ATAS was developed to the extent necessary for a simulation implementation and piloted evaluation. The development of the ATAS concept and the software algorithms is described.

Hinton, D. A.↗

Preliminary Structural Sizing and Alternative Material Trade Study of CEV Crew Module

This paper presents the results of a preliminary structural sizing and alternate material trade study for NASA s Crew Exploration Vehicle (CEV) Crew Module (CM). This critical CEV component will house the astronauts during ascent, docking with the International Space Station, reentry, and landing. The alternate material design study considers three materials beyond the standard metallic (aluminum alloy) design that resulted from an earlier NASA Smart Buyer Team analysis. These materials are graphite/epoxy composite laminates, discontinuously reinforced SiC/Al (DRA) composites, and a novel integrated panel material/concept known as WebCore. Using the HyperSizer (Collier Research and Development Corporation) structural sizing software and NASTRAN finite element analysis code, a comparison is made among these materials for the three composite CM concepts considered by the 2006 NASA Engineering and Safety Center Composite Crew Module project.

Bednarcyk, Brett A.↗

STAT7 v1.2 User Guide: The STAT7 Code for Statistical Propagation of Uncertainties in Steady-State Thermal Hydraulics Analysis of Plate-Fueled Reactors

The STAT7 software was developed to perform steady-state, single-phase thermal hydraulics analysis of plate-fueled reactors based on statistical propagation of uncertainties. Application of the software is for non-power research and test reactors, including conversion to low-enriched uranium fuel of U.S. High-Performance Research Reactors such as Massachusetts Institute of Technology Research Reactor. Since it can be necessary to repeat analysis during fuel reloading, STAT7 accommodates flexibility in analyzing many realistic aspects of reactor fuel management. STAT7 uses a Monte Carlo approach to model uncertainty in common fuel fabrication parameters and other key reactor operating parameters required for thermal hydraulics analyses of research and test reactors. These safety calculations are ultimately intended to protect against high fuel plate temperatures due to critical heat flux, or onset of flow instability. STAT7 supports water properties based on the IAPWS-IF97 functions (The International Association for the Properties of Water and Steam Industrial Formulation 1997 for the Thermodynamic Properties of Water and Steam) in addition to the fit functions. STAT7 predicts axial profiles of fuel, cladding, and coolant temperature along a lateral stripe that runs the full length of the fuel plate from the bottom to the top. STAT7 can simultaneously analyze all of the axial nodes of all of the fuel plates and all of the coolant channels for one latera stripe of a fuel element. Power splits are calculated for each axial node of each plate to determine how much of the power goes out each face of the plate. By running STAT7 multiple times, full core analysis can be performed by analyzing the margin to onset of nucleate boiling and onset of flow instability for each axial node of each stripe of each plate of each fuel element in the core.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

Evolution of the Preliminary Fault Management Architecture and Design for the Psyche Mission

The Psyche Mission presents the first opportunity toexplore the largest metal asteroid in the solar system, (16)Psyche, which is believed to be the exposed core of a largerplanetesimal that was stripped of its rocky mantle throughmultiple collisions during early solar system formation. Themission was selected in January 2017 for a 2022 launch as partof NASA’s Discovery Program and is uniquely enabled by theintegration of a Solar Electric Propulsion (SEP) Chassisdelivered by Maxar Space Solutions with JPL’s core deepspace avionics, flight software, and fault managementarchitectures. One of the key design tasks is the development ofa fault management system capable of being responsive to theunique elements of the combined JPL and Maxar spacecraftarchitecture. This new design leverages the strengths of eachorganization, with Maxar delivering its well-proven highvoltage power bus and low-thrust electric propulsionsubsystem from its GEO communications satellite product line,and JPL delivering its deep space mission expertise and thehardware and software most critical to deep space missiondesign. The development of a robust low-thrust mission andthe integration of design philosophies and hardware from twoorganizations is not without its challenges though.A key challenge in the development of the Psyche faultmanagement architecture and design is in the integration ofdesign philosophies and hardware from JPL and Maxar. Atthe architecture level, Maxar GEO communications satellitesare developed under the premise of highly responsive groundin the loop for the resolution of anomalies, and theimplementation takes a fail-operational approach to minimizedown time for its customers. In contrast, a deep space missionmust be able to maintain safety with long periods of groundcommunication outage. Additionally, with no time-criticalevents after launch, the Psyche spacecraft will generally failsafe in the presence of anomalous conditions; specialconsideration is being given to this approach, however, tominimize the loss of electric propulsion thrust time, which iscritical to low-thrust missions. At the hardware level, thedetailed definition of interfaces between JPL and Maxarhardware presents a unique challenge in the development andflowdown of fault management requirements, the developmentand implementation of fault monitors and responses, and thedevelopment and verification of fault containment boundaries.This paper describes the evolution of the Psyche faultmanagement architecture and design from the concept studyinto the preliminary design phase, with a focus on the uniquechallenges associated with flying GEO communicationssatellite hardware in deep space, implementing a robust lowthrust mission, and the integration of design philosophies andhardware from JPL and Maxar. Details regarding how thesechallenges are addressed in the fault management design inorder to maximize heritage, leverage the strengths of eachorganization, and minimize risk across the design are alsodiscussed.

Marsh, Danielle↗

Modeling Flight: The Role of Dynamically Scaled Free-Flight Models in Support of NASA's Aerospace Programs

The state of the art in aeronautical engineering has been continually accelerated by the development of advanced analysis and design tools. Used in the early design stages for aircraft and spacecraft, these methods have provided a fundamental understanding of physical phenomena and enabled designers to predict and analyze critical characteristics of new vehicles, including the capability to control or modify unsatisfactory behavior. For example, the relatively recent emergence and routine use of extremely powerful digital computer hardware and software has had a major impact on design capabilities and procedures. Sophisticated new airflow measurement and visualization systems permit the analyst to conduct micro- and macro-studies of properties within flow fields on and off the surfaces of models in advanced wind tunnels. Trade studies of the most efficient geometrical shapes for aircraft can be conducted with blazing speed within a broad scope of integrated technical disciplines, and the use of sophisticated piloted simulators in the vehicle development process permits the most important segment of operations the human pilot to make early assessments of the acceptability of the vehicle for its intended mission. Knowledgeable applications of these tools of the trade dramatically reduce risk and redesign, and increase the marketability and safety of new aerospace vehicles. Arguably, one of the more viable and valuable design tools since the advent of flight has been testing of subscale models. As used herein, the term "model" refers to a physical article used in experimental analyses of a larger full-scale vehicle. The reader is probably aware that many other forms of mathematical and computer-based models are also used in aerospace design; however, such topics are beyond the intended scope of this document. Model aircraft have always been a source of fascination, inspiration, and recreation for humans since the earliest days of flight. Within the scientific community, Leonardo da Vinci, George Cayley, and the Wright brothers are examples of early aviation pioneers who frequently used models during their scientific efforts to understand and develop flying machines. Progress in the technology associated with model testing in worldwide applications has firmly established model aircraft as a key element in new aerospace research and development programs. Models are now routinely used in many applications and roles, including aerodynamic data gathering in wind tunnel investigations for the analysis of full-scale aircraft designs, proof-of-concept demonstrators for radical aeronautical concepts, and problem-solving exercises for vehicles already in production. The most critical contributions of aerospace models are to provide confidence and risk reduction for new designs and to enhance the safety and efficiency of existing configurations.

Chambers, Joseph↗

STAT7 v2.0 User Guide

The STAT7 software was developed to perform steady-state, single-phase thermal hydraulics analysis of plate-fueled reactors based on statistical propagation of uncertainties. Application of the software includes non-power research and test reactor analysis, and it has been used for the conversion to low- enriched uranium fuel of U.S. High Performance Research Reactors such as the Massachusetts Institute of Technology Research Reactor. Since it can be necessary to repeat reactor safety analysis, such as during fuel reloading, STAT7 accommodates flexibility in analyzing many practical aspects of reactor fuel management. STAT7 uses a Monte Carlo approach to model uncertainty in common fuel fabrication parameters and other key reactor operating parameters required for reactor thermal hydraulics analysis. These safety calculations are ultimately intended to protect against high fuel plate temperatures due to critical heat flux, or onset of flow instability. STAT7 supports water properties based on the IAPWS-IF97 functions (The International Association for the Properties of Water and Steam Industrial Formulation 1997 for the Thermodynamic Properties of Water and Steam) in addition to fitted functions. STAT7 predicts axial profiles of fuel, cladding, and coolant temperature along a lateral stripe that runs the full length of the fuel plate from the bottom to the top. STAT7 can simultaneously analyze every axial node in each lateral stripe of all fuel plates and coolant channels in every fuel element of an entire reactor core. Power splits are calculated for each axial node of each plate to determine how much of the power goes out each face of the plate. In a single execution, STAT7 can be used to perform full core analysis by analyzing the margin to onset of nucleate boiling and onset of flow instability for each axial node of each stripe of each plate of each fuel element in the core.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

Verification of the Generalized Aerospace Simulation in Simulink

NASA uses six-degrees-of-freedom (6-DOF) simulations tools to design, test, develop Guidance Navigation and Control (GN&C) software, and certify vehicle performance prior to flight. Therefore, it is critical that the 6-DOF tools used for vehicle design and certification are validated. The focus of this work is the validation of the NASA Marshall Space Flight Center 6-DOF “GeneraLized Aerospace Simulation in Simulink” (GLASS) framework tool. The GLASS tool framework is currently used to support NASA GN&C insight for the Human Landing System (HLS) project, simulating vehicle dynamics during lunar descent and ascent. The GLASS framework utilizes the off-the-shelf Mathworks (R) Simscape (TM) Multibody (TM) toolbox to model vehicle multi-body dynamics. NASA’s Engineering and Safety Center (NESC) provides a set of 6-DOF simulation verification “check cases” that are available to any user needing to verify 6-DOF tools. The check cases contain seventeen atmospheric and twenty-six orbital test scenarios are provided to validate equations of motion, environmental models (e.g., atmosphere, gravitation, and geodesy) and tool propagators. This paper compares GLASS 6-DOF simulation results against the NESC check cases’ results via simulation-to-simulation comparisons. The comparison demonstrates that GLASS simulation results are “in family” with the outputs of the applicable NASA NESC check-cases and verify the GLASS core framework dynamics and the implementation of the check case scenario models.

6-Dof↗