SEARCH · Search NASA

Results for “dynamic safety cases”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2

All sources NASA NTRS DOE OSTI

NASA NTRS2024

Aeroelastic Stability Assessment Methodology and Application to Slat Noise Treatments on the High-Lift Common Research Model

This work supports a larger effort at NASA to reduce airframe noise and, thus, environmental noise around airports. The leading-edge slat of conventional high-lift systems is a prominent source of airframe noise, and two technologies were previously identified as promising for noise reduction without significant aerodynamic or weight penalty: the slat cove filler (SCF) and the slat gap filler (SGF). NASA fabricated a 10%-scale semispan aircraft model for wind tunnel testing based upon the High-Lift Common Research Model (CRM-HL). NASA embarked on a test campaign with the 10% CRM-HL to determine the noise reduction effectiveness and other performance metrics of 3D SCF and SGF treatments in flow conditions representative of flight. The highly flexible SCF and SGF treatments posed a risk to the model and aeroelastic instability would compromise research integrity, so aeroelastic stability assessment was required. This work briefly describes the 10% CRM-HL, design of the SCF and SGF treatments to the model, and supporting fluid structure interaction (FSI) research. Relations for static and dynamic aeroelastic similitude are then developed for convenience of reference, and simplifications are introduced of particular utility to the cases considered in this study. The similitude relations are employed to assess the stability of the treatments under wind tunnel flow conditions based upon known behaviors from the supporting research. It is shown that the treatments are safe for test under the anticipated wind tunnel flow conditions with significant margins/factors of safety. It is furthermore demonstrated that the SCF is more susceptible to aeroelastic instability than the SGF, which has implications for flight feasibility.

Similitude↗

NASA NTRS2003

Discrete Abstractions of Hybrid Systems: Verification of Safety and Application to User-Interface Design

Human interaction with a complex control system involves the user, the automation’s discrete mode logic, and the underlying continuous dynamics of the physical system. The user-interface of such systems always displays a reduced set of information about the entire system. Designing interfaces such that all the pertinent information is available and assuring that this information is correct is important for any user-interface, but especially so for safety-critical systems such as automotive systems and autopilots. Here we describe a methodology for the analysis of hybrid control systems that incorporate user interaction, with the goal of assuring that the information provided to the user is correct. That is, the user-interface must contain all information necessary to safely complete a desired procedure or task. We begin with a hybrid system model which incorporates discrete mode logic as well as nonlinear continuous dynamics. Using a hybrid computational tool for reachability, we find the largest region of the state-space in which we can guarantee the state of the system can always remain – this is the safe region of operation. By implementing a controller for safety which arises from this computation, we mathematically guarantee that this safe region is invariant, meaning that the system will always remain within the safe region if the determined controller is used on the boundary of the safe region. Verification within a hybrid framework allows us to account for the continuous dynamics underlying the discrete representations displayed to the user. Using the computed invariant regions as discrete states, we can abstract a discrete event system from this hybrid system with safety restrictions. This abstraction can be used to determine what information must be provided on the display. Furthermore, in cases in which an interface already exists, the abstraction provides the necessary input into existing interface verification methods. We provide two examples: a car traveling through a yellow light at an intersection and an aircraft autopilot in an automatic landing/go-around maneuver. The examples demonstrate the applicability of this methodology to hybrid systems that have operational constraints we can pose in terms of safety. This methodology differs from existing work in hybrid system verification in that we directly account for the user’s interactions with the system.

Meeko Oishi↗

NASA NTRS2017

Command and Control Software Development Memory Management

This internship was initially meant to cover the implementation of unit test automation for a NASA ground control project. As is often the case with large development projects, the scope and breadth of the internship changed. Instead, the internship focused on finding and correcting memory leaks and errors as reported by a COTS software product meant to track such issues. Memory leaks come in many different flavors and some of them are more benign than others. On the extreme end a program might be dynamically allocating memory and not correctly deallocating it when it is no longer in use. This is called a direct memory leak and in the worst case can use all the available memory and crash the program. If the leaks are small they may simply slow the program down which, in a safety critical system (a system for which a failure or design error can cause a risk to human life), is still unacceptable. The ground control system is managed in smaller sub-teams, referred to as CSCIs. The CSCI that this internship focused on is responsible for monitoring the health and status of the system. This team's software had several methods/modules that were leaking significant amounts of memory. Since most of the code in this system is safety-critical, correcting memory leaks is a necessity.

Programmin↗

NASA NTRS2024

Integrated Systems Engineering, Safety, Reliability and Risk Management – Minimizing Black Swan Events

This paper examines key barriers that can possibly inhibit safe and reliable mission execution and, in the worst case, result in loss of human life due to many unknown contributory factors that can lead to Black Swan events. Some of the representative contributory factors include decision errors, overconfidence and a host of common causes including cultural and human factors. Decisions are always easy to criticize in hindsight when more information is available after a major accident. Depending on the type and complexity of the project and/or mission, the catastrophic risks of drifting into failure can be alleviated by implementing uniquely and strategically tailored Integrated-System-of-Systems, dynamic, risk-informed decision management processes. This paper presents some of the lessons learned from James Webb Space Telescope (JWST), NASA’s Human Space Flight program, and industry that provide motivation to organizations working on mega-complex missions to prudently accomplish targeted mission success. These lessons are important for future human Lunar, Mars and Beyond missions planned to be pursued by NASA through a public-private partnership using nimble but effective safety-conscious, proven sound engineering practices including implementation of integrated risk mitigation practices.

SLS↗

NASA NTRS2005

Probabilistic Fracture Mechanics Analysis of the Orbiter's LH2 Feedline Flowliner

Work performed by Southwest Research Institute (SwRI) as part of an Independent Technical Assessment (ITA) for the NASA Engineering and Safety Center (NESC) is summarized. The ITA goal was to establish a flight rationale in light of a history of fatigue cracking due to flow induced vibrations in the feedline flowliners that supply liquid hydrogen to the space shuttle main engines. Prior deterministic analyses using worst-case assumptions predicted failure in a single flight. The current work formulated statistical models for dynamic loading and cryogenic fatigue crack growth properties, instead of using worst-case assumptions. Weight function solutions for bivariant stressing were developed to determine accurate crack "driving-forces". Monte Carlo simulations showed that low flowliner probabilities of failure (POF = 0.001 to 0.0001) are achievable, provided pre-flight inspections for cracks are performed with adequate probability of detection (POD)-specifically, 20/75 mils with 50%/99% POD. Measurements to confirm assumed POD curves are recommended. Since the computed POFs are very sensitive to the cyclic loads/stresses and the analysis of strain gage data revealed inconsistencies with the previous assumption of a single dominant vibrant mode, further work to reconcile this difference is recommended. It is possible that the unaccounted vibrational modes in the flight spectra could increase the computed POFs.

Bonacuse, Peter J.↗

NASA NTRS1978

Path selection process utilizing rapid estimation scheme

The paper describes the use of a rapid estimation scheme for path selection by a roving vehicle. Essentially, the evaluation procedure simulates movement of the rover over each of several corridors lying radially outward from the scanning position. Two levels of corridors are used, and the path selection scheme selects the optimal primary corridor according to a dynamic programming algorithm. In the present version, the length of the corridors is variable. The rapid estimation scheme provides information to define corridor dimensions. This corridor structure, which varies as a function of the terrain, eliminates the need for backtracking, except in certain extreme cases. Computer results are promising in that obstacles were avoided while corridor lengths were kept to a maximum where safety permitted.

Ring, H.↗

NASA NTRS2010

Passing the Baton: An Experimental Study of Shift Handover

Shift handovers occur in many safety-critical environments, including aviation maintenance, medicine, air traffic control, and mission control for space shuttle and space station operations. Shift handovers are associated with increased risk of communication failures and human error. In dynamic industries, errors and accidents occur disproportionately after shift handover. Typical shift handovers involve transferring information from an outgoing shift to an incoming shift via written logs, or in some cases, face-to-face briefings. The current study explores the possibility of improving written communication with the support modalities of audio and video recordings, as well as face-to-face briefings. Fifty participants participated in an experimental task which mimicked some of the critical challenges involved in transferring information between shifts in industrial settings. All three support modalities, face-to-face, video, and audio recordings, reduced task errors significantly over written communication alone. The support modality most preferred by participants was face-to-face communication; the least preferred was written communication alone.

Parke, Bonny↗

NASA NTRS2012

SOFIA: Flying the Telescope

The primary focus of this paper is how the flight test team for the Stratospheric Observatory For Infrared Astronomy (SOFIA) re-cast an extensive developmental test program to meet key milestones while simultaneously ensuring safe certification of the airframe and delivery of an operationally relevant platform, ultimately saving the overall program from financial demise. Following a brief introduction to the observatory and what it is designed to do, SOFIAs planned developmental test program is summarized, including analysis and design philosophy, envelope expansion, model validation and airframe certification. How NASA used lessons learned from other aircraft that employed open cavities in flight is explained as well as how and why the chosen design was selected. The approach to aerodynamic analysis, including bare airframe testing, wind tunnel testing, computational fluid dynamics and finite element modeling proved absolutely critical. Despite a solid analytical foundation, many unknowns remained. History provides several examples of disastrous effects on both systems and flight safety if cavity design is not approached properly. For these reasons, an extensive test plan was developed to ensure a safe and thorough build-up for envelope expansion, airframe certification and early science missions. Unfortunately, as is often the case, because of chronic delays in overall program execution, severe schedule and funding pressures were present. If critical milestones were not met, domestic as well as international funding was in serious jeopardy, and the demise of the entire program loomed large. Concentrating on rigorous model validation, the test team challenged certification requirements, increased test efficiency and streamlined engineering analysis. This resulted in the safe reduction of test point count by 72%, meeting all program milestones and a platform that soundly satisfied all operational science requirements. Results from early science missions are shown and a proof of concept mission for which SOFIA was opportunely positioned is showcased. Success on this time-critical mission to observe a rare astronomical event proved the usefulness of an airborne observatory and the value in waiting for the capability provided by SOFIA. Finally, lessons learned in the test program are presented with emphasis on how lessons from previous aircraft and successful test programs were applied to SOFIA. Effective application of these lessons was crucial to the success of the SOFIA flight test program. SOFIA is an international cooperative program between NASA and the German Space Agency, DLR. It is a 2.5 meter (100-inch) telescope mounted in a Boeing 747SP aircraft used for astronomical observations at altitudes above 35,000 feet. SOFIA will accommodate a host of scientific instruments from the international science community and has a planned operational lifespan of more than 20 years.

Asher, Troy A.↗

NASA NTRS2018

Runtime Assurance Protection for Advanced Turbofan Engine Control

This paper describes technical progress made in the application of run time assurance (RTA) methods to turbofan engines with advanced propulsion control algorithms that are employed to improve engine performance. It is assumed that the advanced algorithms cannot be fully certified using current verification and validation approaches and therefore need to be continually monitored by an RTA system that ensures safe operation. However, current turbofan engine control systems utilize engine protection logic for safe combustion dynamics and stable airflow through the engine. It was determined that the engine protection logic should continue to be used to provide system safety and should be considered as a part of the overall RTA system. The additional function that an RTA system provides is to perform diagnostics on anomalous conditions to determine if these conditions are being caused by errors in the advanced controller. If this is the case, the RTA system switches operation to a trusted reversionary controller. Initial studies were performed to demonstrate this benefit. The other focus was to improve the performance of the engine protection logic, which was deemed too conservative and reduced engine performance during transient operations. It was determined that the conservative response was due to poor tuning of one of the controller channels within the protection logic. An automatic tuning algorithm was implemented to optimize the protection logic control gains based on minimizing tracking error. Improved tracking responses were observed with no change to the existing protection logic control architecture.

runtime monitoring↗

NASA NTRS1981

Real-time computer simulation/emulation for verification of multi-fault-tolerant control of Centaur-in-Shuttle

NASA has contracted with General Dynamics to design and develop an advanced Centaur liquid upper stage for support of the Galileo and Solar Polar interplanetary missions in 1985-86. The control of the Centaur while it resides in the Shuttle cargo bay must meet the STS safety requirements to be dual failure tolerant in all mission critical functions. The demonstration of the integrity of this control system in the event of multiple component failures and worst-case time-phase asynchroniety among the system's computers is performed by a real-time computer simulation. The simulation emulates the control hardware, subsystem interfaces, and imbedded software processes, wire-by-wire, to provide accessibility for fault insertion. Observability is provided via graphics and diagnostic software. Verification is the product of Monte Carlo simulation analysis.

Szatkowski, G. P.↗

NASA NTRS1981

The role of communications, socio-psychological, and personality factors in the maintenance of crew coordination

The influence of group dynamics on the capability of aircraft crew members to make full use of the resources available on the flight deck in order to maintain flight safety is discussed. Instances of crewmembers withholding altimeter or heading information from the captain are cited as examples of domineering attitudes from command pilots and overconscientiousness on the parts of copilots, who may refuse to relay information forcefully enough or to take control of the aircraft in the case of pilot incapacitation. NASA studies of crew performance in controlled, simulator settings, concentrating on communication, decision making, crew interaction, and integration showed that efficient communication reduced errors. Acknowledgements served to encourage correct communication. The best crew performance is suggested to occur with personnel who are capable of both goal and group orientation. Finally, one bad effect of computer controlled flight is cited to be the tendency of the flight crew to think that someone else is taking care of difficulties in threatening situations.

Foushee, H. C.↗

NASA NTRSDate not supplied

Urban Air Mobility Airspace Dynamic Density

Effective flight planning requires information about a variety of potential threats, such as adverse weather or airspace restrictions, and about alternatives available if unforeseen events occur. Expected traffic along the route of flight is also essential to a safe outcome so that, for example, adequate fuel/energy supply can be loaded prior to flight. A dynamic density (DD) metric is introduced for the emerging urban air mobility (UAM) concept to predict airspace congestion that may lead to loss of separation between aircraft or less efficient operations. Using inspiration from dynamic density metric research for traditional air traffic management and a two-way highway analogy, we develop a dynamic density metric for a portion of airspace (aUAM corridor) that aggregates the impact from five factors: aircraft density, density of populous clusters, mean number of aircraft in populous clusters, mean distance between aircraft, and minimum distance between aircraft. This works describes our methodology, rationale, use cases, and visualization techniques to efficiently present the DD metric to an operator for informed decision making. We also present an approach for validating the metric. However, validation remains part of future work.

UAM↗

NASA NTRS2005

RSRM TP-H1148 Main Grain Propellant Crack Initiation Evaluation

Pressurized TP-HI 148 propellant fracture toughness testing was performed to assess the potential for initiation of visually undetectable cracks in the RSRM forward segment transition region during motor ignition. Two separate test specimens were used in this evaluation. Testing was performed in cold-gas and hot-fire environments, and under both static and dynamic pressurization conditions. Analysis of test results demonstrates safety factors against initiation of visually undetectable cracks in excess of 8.0. The Reusable Solid Rocket Motor (RSRM) forward segment is cast with PBAN propellant (TP-HI 148) to form T an 1 1-point star configuration that transitions to a tapered center perforated bore (see Figure 1). The geometry of the transition region between the fin valleys and the bore causes a localized area of high strain during horizontal storage. Updated analyses using worst-case mechanical properties at 40 F and improved modeling techniques indicated a slight reduction in safety margins over previous predictions. Although there is no history of strain induced cracks or flaws in the transition region propellant, a proactive test effort was initiated to better understand the implications of the new analysis, primarily the resistance of TP-H1148 propellant to crack initiation' during RSRM ignition.

Earnest, Todd E.↗

NASA NTRS2016

A Vision and Roadmap for Increasing User Autonomy in Flight Operations in the National Airspace

The purpose of Air Transportation is to move people and cargo safely, efficiently and swiftly to their destinations. The companies and individuals who use aircraft for this purpose, the airspace users, desire to operate their aircraft according to a dynamically optimized business trajectory for their specific mission and operational business model. In current operations, the dynamic optimization of business trajectories is limited by constraints built into operations in the National Airspace System (NAS) for reasons of safety and operational needs of the air navigation service providers. NASA has been developing and testing means to overcome many of these constraints and permit operations to be conducted closer to the airspace user's changing business trajectory as conditions unfold before and during the flight. A roadmap of logical steps progressing toward increased user autonomy is proposed, beginning with NASA's Traffic Aware Strategic Aircrew Requests (TASAR) concept that enables flight crews to make informed, deconflicted flight-optimization requests to air traffic control. These steps include the use of data communications for route change requests and approvals, integration with time-based arrival flow management processes under development by the Federal Aviation Administration (FAA), increased user authority for defining and modifying downstream, strategic portions of the trajectory, and ultimately application of self-separation. This progression takes advantage of existing FAA NextGen programs and RTCA standards development, and it is designed to minimize the number of hardware upgrades required of airspace users to take advantage of these advanced capabilities to achieve dynamically optimized business trajectories in NAS operations. The roadmap is designed to provide operational benefits to first adopters so that investment decisions do not depend upon a large segment of the user community becoming equipped before benefits can be realized. The issues of equipment certification and operational approval of new procedures are addressed in a way that minimizes their impact on the transition by deferring a change in the assignment of separation responsibility until a large body of operational data is available to support the safety case for this change in the last roadmap step.This paper will relate the roadmap steps to ongoing activities to clarify the economics-based transition to these technologies for operational use.

Cotton, William B.↗

NASA NTRS2017

Real-Time Risk Assessment Framework for Unmanned Aircraft System (UAS) Traffic Management (UTM)

The new Federal Aviation Administration (FAA) Small Unmanned Aircraft rule (Part 107) marks the first national regulations for commercial operation of small unmanned aircraft systems (sUAS) under 55 pounds within the National Airspace System (NAS). Although sUAS flights may not be performed beyond visual line-of-sight or over non- participant structures and people, safety of sUAS operations must still be maintained and tracked at all times. Moreover, future safety-critical operation of sUAS (e.g., for package delivery) are already being conceived and tested. NASA's Unmanned Aircraft System Trac Management (UTM) concept aims to facilitate the safe use of low-altitude airspace for sUAS operations. This paper introduces the UTM Risk Assessment Framework (URAF) which was developed to provide real-time safety evaluation and tracking capability within the UTM concept. The URAF uses Bayesian Belief Networks (BBNs) to propagate off -nominal condition probabilities based on real-time component failure indicators. This information is then used to assess the risk to people on the ground by calculating the potential impact area and the effects of the impact. The visual representation of the expected area of impact and the nominal risk level can assist operators and controllers with dynamic trajectory planning and execution. The URAF was applied to a case study to illustrate the concept.

Ancel, Ersin↗

NASA NTRS2015

Are We There Yet? Determining the Adequacy of Formalized Requirements and Test Suites

Structural coverage metrics have traditionally categorized code as either covered or uncovered. Recent work presents a stronger notion of coverage, checked coverage, which counts only statements whose execution contributes to an outcome checked by an oracle. While this notion of coverage addresses the adequacy of the oracle, for Model-Based Development of safety critical systems, it is still not enough; we are also interested in how much of the oracle is covered, and whether the values of program variables are masked when the oracle is evaluated. Such information can help system engineers identify missing requirements as well as missing test cases. In this work, we add to the idea of checked coverage an analysis of requirements coverage to help provide insight to engineers as to whether the requirements or the test suite need to be improved. We implement our approach based on a dynamic backward slicing technique and evaluate it on several systems developed in Simulink. The results of our preliminary study show that even for systems with comprehensive test suites and good sets of requirements, our approach can identify cases where more tests or more requirements are needed to improve coverage numbers.

Dynamic Slicing↗

NASA NTRS2019

An Approach for Uncertainty Quantification and Management of Unmanned Aerial Vehicle Health

The increasing interest in low-altitude unmanned aerial vehicle (UAV) operations is bringing along safety concerns. Performance of small, low-cost UAVs drastically changes with type, size and controller of the vehicle. Their reliability is lower when compared to reliability of commercial aircrafts, and the availability of on-board sensors for health and state awareness is extremely limited due to their size and propulsion capabilities. Uncertainty plays a dominant role in such a scenario, where a variety of UAVs of different size, propulsion systems, dynamic performance and reliability enters the low-altitude airspace. Unexpected failures could have dangerous consequences for both equipment and humans within that same airspace. As a result, a number of research works and methodologies are being proposed in the area of UAV dynamic modeling, health and safety monitoring, but uncertainty quantification is rarely addressed. Thus, this paper pro- poses a perspective towards uncertainty quantification for autonomous systems, giving special emphasis to a UAV health monitoring application. A formal approach to classify uncertainty is presented; it is utilized to identify the uncertainty sources in UAVs health and operations, and then map uncertainty within a predictive process. To show the application of the methodology proposed here, the design of a model-based powertrain health monitoring algorithm for small-size UAVs is used as case study. The example illustrates how the uncertainty quantification approach can help the modeling strategy, as well as the assessment of diagnostic and prognostic performance.

Health Monitoring↗

NASA NTRS2009

The Case for Distributed Engine Control in Turbo-Shaft Engine Systems

The turbo-shaft engine is an important propulsion system used to power vehicles on land, sea, and in the air. As the power plant for many high performance helicopters, the characteristics of the engine and control are critical to proper vehicle operation as well as being the main determinant to overall vehicle performance. When applied to vertical flight, important distinctions exist in the turbo-shaft engine control system due to the high degree of dynamic coupling between the engine and airframe and the affect on vehicle handling characteristics. In this study, the impact of engine control system architecture is explored relative to engine performance, weight, reliability, safety, and overall cost. Comparison of the impact of architecture on these metrics is investigated as the control system is modified from a legacy centralized structure to a more distributed configuration. A composite strawman system which is typical of turbo-shaft engines in the 1000 to 2000 hp class is described and used for comparison. The overall benefits of these changes to control system architecture are assessed. The availability of supporting technologies to achieve this evolution is also discussed.

Culley, Dennis E.↗