SEARCH · Search NASA

Results for “assurance case”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

371 records · Page 21

All sources NASA NTRS DOE OSTI

NASA NTRS1996

Guidance and Control Design for High-Speed Rollout and Turnoff (ROTO)

A ROTO architecture, braking and steering control law and display designs for a research high speed Rollout and Turnoff (ROTO) system applicable to transport class aircraft are described herein. Minimum surface friction and FMS database requirements are also documented. The control law designs were developed with the aid of a non-real time simulation program incorporating airframe and gear dynamics as well as steering and braking guidance algorithms. An attainable objective of this ROTO system, as seen from the results of this study, is to assure that the studied aircraft can land with runway occupancy times less then 53 seconds. Runway occupancy time is measured from the time the aircraft crosses the runway threshold until its wing tip clears the near side of the runway. Turnoff ground speeds of 70 knots onto 30 degree exits are allowed with dry and wet surface conditions. Simulation time history and statistical data are documented herein. Parameters which were treated as variables in the simulation study include aircraft touchdown weight/speed/location, aircraft CG, runway friction, sensor noise and winds. After further design and development of the ROTO control system beyond the system developed earlier, aft CG MD-11 aircraft no longer require auto-asymmetric braking (steering) and fly-by-wire nose gear steering. However, the auto ROTO nose gear hysteresis must be less than 2 degrees. The 2 sigma dispersion certified for MD-11 CATIIIB is acceptable. Using this longitudinal dispersion, three ROTO exits are recommended at 3300, 4950 and 6750 feet past the runway threshold. The 3300 foot exit is required for MD-81 class aircraft. Designs documented in this report are valid for the assumptions/models used in this simulation. It is believed that the results will apply to the general class of transport aircraft; however further effort is required to validate this assumption for the general case.

Goldthorpe, S. H.↗

NASA NTRS2022

NASA Ground-based Layered Pressure Vessels Materials Report

A significant portion of Layered Pressure Vessels (LPVs) manufactured for NASA in the 1950s and ’60s are of non-code construction. These vessels were constructed to the standards of individual manufacturers rather than an industry or consensus standard and often contain legacy or proprietary materials, which have poor or no characterization. Obtaining correct material properties is the first step in assuring vessel safety and predicting life and critical failure modes before they happen. This report details the efforts of the LPV Project related to material properties and characterization. The goal in testing materials from deconstructed vessels was to provide material characterization utilizing modern test methods that would give a strong probabilistic base as an option for future analysis. ASTM E1820, Standard Test Method for Measurement of Fracture Toughness was used for fracture toughness; ASTM E1921, Standard Test Method for Determination of Reference Temperature, T0, for Ferritic Steels in the Transition Range for transition temperature; and ASTM E647, Standard Test Method for Measurement of Fatigue Crack Growth Rates for fatigue crack growth. Particular focus was placed on determination of transition temperature through evaluation of the T0 reference temperature in accordance with ASTM E1921. Transition temperature testing allows for a probabilistic analysis of vessel materials that may be operating at temperatures below the transition from ductile tearing to brittle cleavage failure. This test method was not available at the time of construction and has proved invaluable to the characterization of older ferritic steels. The values reported are specific to the largest body of materials found in the current NASA fleet, but do not claim to be all inclusive. As demonstrated in this report, some materials contain extreme lot-to-lot variability. In some cases, this can be comfortably bounded by worst case probabilistic methods, however it is always recommended that vessel specific data be collected in as much depth as possible to ensure correct assumptions and avoid unduly restricting vessel usage.

Layered Pressure Vessel↗

NASA NTRS1990

Improving system reliability through formal analysis and use of checks in software

Software is playing increasingly important roles in avionics systems. It is widely used in navigation and, in some cases, in control loops that maintain aircraft stability. To guarantee the safety of flight systems, the FAA requires that critical components have a probability of failure no greater than 10(exp -9) per hour of flight. Software is being used to diagnose system components for failure. SIFT (Software Implemented Fault Tolerance) was a computer system developed to study the use of software to check for failure and manage processor reconfiguration. To guarantee that software satisfies its specifications, formal verification can be used. With this a program and its specification are viewed as mathematical objects, and a mathematical proof is used to show that the program and its specification are equivalent. In previous research, a theory of checking was developed to offer assistance in analyzing specifications and designing run-time checks. In the theory, checking is considered abstractly in terms of n-ary relations much like those of relational database theory. Within the theory check are categorized, checks on input and checks on results are considered, and formal attention is given to the minimization and logical combination of checks. The focus is upon input checks and the obstacles in checking input to critical systems. A central concern is with a property referred to as independence. The concern is with circumstances under which it is possible to apply isolated, independent checks to separate sensor inputs and be assure that all illegal input will be properly detected. Presently, independence is being investigated and checked in the context of the GCS (Guidance and Control System). The GCS simulator is intended for testing software that implements control laws for landing spacecraft. The large number of inputs and their complex interrelationships provide an exciting context in which to investigate independence and the difficulties of supplying input checks.

Staknis, Mark E.↗

NASA NTRSDate not supplied

Initial Performance Evaluation of Flight Path Management Onboard Automation

Significant developments in automation are necessary to achieve safe and efficient operations in advanced aerial mobility related concepts. Urban Air Mobility (UAM) is rapidly growing, emerging field that poses a challenging use case with a tighter scale of operations compared to the traditional commercial transport paradigm. A large part of the challenge is the uncharted territory; as of this paper, no set of operational standards or guidelines for UAM operations have been established and automated en route operations for UAM level 4 (UML-4) have not been studied. Flight Path Management (FPM) automation provides a set of capabilities that are critical toward enabling airborne vehicles to achieve mission success while maintaining operational safety. An initial performance evaluation of FPM automation was conducted using a UAM-adapted version of the Autonomous Operations Planner (AOP), an onboard trajectory management capability developed over years of research targeting commercial transport operations, as its reference implementation. This paper describes the evaluation, including the approach and methodology for simulating FPM automation in UML-4, key results, future work, and conclusions.

flight path management↗

NASA NTRS1998

Assessment Study of the State of the Art in Adaptive Control and its Applications to Aircraft Control

Many papers relevant to reconfigurable flight control have appeared over the past fifteen years. In general these have consisted of theoretical issues, simulation experiments, and in some cases, actual flight tests. Results indicate that reconfiguration of flight controls is certainly feasible for a wide class of failures. However many of the proposed procedures although quite attractive, need further analytical and experimental studies for meaningful validation. Many procedures assume the availability of failure detection and identification logic that will supply adequately fast, the dynamics corresponding to the failed aircraft. This in general implies that the failure detection and fault identification logic must have access to all possible anticipated faults and the corresponding dynamical equations of motion. Unless some sort of explicit on line parameter identification is included, the computational demands could possibly be too excessive. This suggests the need for some form of adaptive control, either by itself as the prime procedure for control reconfiguration or in conjunction with the failure detection logic. If explicit or indirect adaptive control is used, then it is important that the identified models be such that the corresponding computed controls deliver adequate performance to the actual aircraft. Unknown changes in trim should be modelled, and parameter identification needs to be adequately insensitive to noise and at the same time capable of tracking abrupt changes. If however, both failure detection and system parameter identification turn out to be too time consuming in an emergency situation, then the concepts of direct adaptive control should be considered. If direct model reference adaptive control is to be used (on a linear model) with stability assurances, then a positive real or passivity condition needs to be satisfied for all possible configurations. This condition is often satisfied with a feedforward compensator around the plant. This compensator must be robustly designed such that the compensated plant satisfies the required positive real conditions over all expected parameter values. Furthermore, with the feedforward only around the plant, a nonzero (but bounded error) will exist in steady state between the plant and model outputs. This error can be removed by placing the compensator also in the reference model. Design of such a compensator should not be too difficult a problem since for flight control it is generally possible to feedback all the system states.

Kaufman, Howard↗

NASA NTRSDate not supplied

Initial Performance Evaluation of Flight Path Management Onboard Automation

flight path management↗

NASA NTRS2022

Reliability-Aware Requirements Development for Autonomy Software

Autonomy is the ability of a system to make decisions and take actions in the presence of uncertainty. Validating autonomy, therefore, is a matter of validating that the system makes intelligent decisions even when there might be discrepancies between the observed and the expected state of the world as well as when the possible outcome of each of the possible courses of action is uncertain. During the requirements engineering phase, the functions, including those that are required to be autonomous and their expected behavior are specified. However, in the case of autonomous software system, it is challenging to specify all possible scenarios that the software may encounter. Additionally, since autonomous behaviors cannot always be fully predetermined, it is difficult to reason about their completeness and correctness. While these challenges are also faced with non-autonomous system, they are more prevalent for autonomous system due to their complexity and emergent behavior. Our efforts have been three-fold. On one hand, we have developed a goal-based method for requirements decomposition. We have embedded this approach into a higher-level systems engineering framework and then developed methods for decision and reliability analysis within this framework. And finally, we use simulation analysis to validate the more theoretical methods and provide a feedback mechanism. The decision analysis approach (DA) helps in identifying and mitigating the run-time risks, by bringing to the forefront the uncertainties, decisions, interactions, and other factors that may cause autonomous software to make erroneous decisions. The DA framework is used to quantify, for each decision that the software can make, failure risk due to uncertainties. The information about the key decisions and circumstances that can cause autonomous system to make incorrect decisions are used to generate test scenarios to be run in a simulator to ensure that the system can handle error-prone circumstances. The results or outcomes from decisions, based on the simulated scenarios, can then be leveraged to further gain insight of the assured system. We combine a goal-based approach with simulation analysis to facilitate requirements development for autonomous systems and further provide a method for run-time systems level reliability considerations during the autonomous software development process. The DA and the reliability analysis methods provide a formalism for the consideration of uncertainty in the run time decision-making process for autonomous software. This formalism considers the uncertainty involved in the outcome of different courses of action, in terms of performance and cost, as well as a method to consider the system level reliability implications. System level reliability considerations for autonomous software decision making contribute to the satisfaction of the system level goals over the lifecycle of a given mission. We demonstrate our approach using a hypothetical rover path planning example. The requirements for our rover simulator are based on existing literature about Mars rovers and lessons learned from real world observations at JPL. The specifics of the autonomy design for the Mars rovers, that have not been previously cleared for external release, are not used for our demonstrations.

Lindvall, Mikael↗

NASA NTRS1978

Inspection error and its adverse effects - A model with implications for practitioners

Inspection error has clearly been shown to have adverse effects upon the results desired from a quality assurance sampling plan. These effects upon performance measures have been well documented from a statistical point of view. However, little work has been presented to convince the QC manager of the unfavorable cost consequences resulting from inspection error. This paper develops a very general, yet easily used, mathematical cost model. The basic format of the well-known Guthrie-Johns model is used. However, it is modified as required to assess the effects of attributes sampling errors of the first and second kind. The economic results, under different yet realistic conditions, will no doubt be of interest to QC practitioners who face similar problems daily. Sampling inspection plans are optimized to minimize economic losses due to inspection error. Unfortunately, any error at all results in some economic loss which cannot be compensated for by sampling plan design; however, improvements over plans which neglect the presence of inspection error are possible. Implications for human performance betterment programs are apparent, as are trade-offs between sampling plan modification and inspection and training improvements economics.

Collins, R. D., Jr.↗

NASA NTRS2004

The Training Process of the Organization Development and Training Office

The Organization Development and Training Office provides training and development opportunities to employees at NASA Glenn Research Center, as a division of the Office of Human Resources and Workforce Planning. Center-wide required trainings, new employee trainings, workshops and career development programs are organized by the OD&TO staff. They also arrange all academic, non-academic, headquarters, fellowship and learning center sponsored courses. They also service organizations wishing to work more effectively by facilitating teambuilding exercises. Equal Opportunity programs and upward mobility programs such as the STEP and GO programs for administrative staff. In working with my mentor I am very involved with Cuyahoga Community College classes, mandatory supervisory training and administrative staff workshops. My largest tasks are in the secretarial training category. The Supporting Organizations And Relationships workshop for administrative personnel, commonly known as SOAR, began last year and continued this summer with follow-up workshops. Months before a workshop or class is brought to Glenn, a need has to be realized. In this case, administrative staff did not feel they had an opportunity to receive relevant training and develop skills through teambuilding, networking and communication. A Statement of work is then created as several companies are contacted about providing the training. After the company best suited to meet the target group s needs is selected, the course is announced with an outline of all pertinent information. A reservation for a facility is made and applications or nominations, depending on the announcement s guidelines, are received from interested employees. Confirmations are sent to participants and final preparations are made but there are still several concluding steps. A training office staff member also assists the facilitator with setting up the facility and introducing the class. After the class, participants evaluations are read and summarized to determine the effectiveness of the class and instructor. In addition to the SOAR workshops, I have several projects and daily tasks to complete. Coding training applications, which require me to be familiar with Glenn s budgetary allocations and policies on training, is an ongoing process. It also requires verifying information reported by an employee via her C-478 form, more commonly known as the training application. I am also the point of contact for the Cuyahoga Community College Advising Sessions held here at NASA Glenn which involves coordinating counselors visits with employees schedules. Two databases had to be created. The first database holds information on administrative staff, and the other tracks supervisors training histories. Through these assignments I gained experience in Microsoft Access 2002 and spreadsheet creation, communicating with co-workers, and successfully facilitating a training to serve specific purposes. With trainings and evaluations to assessment them, the Organization Development and Training Office can assure a quality product and continued customer satisfaction.

Johnson, Melissa S.↗

NASA NTRS2016

Modeling in the State Flow Environment to Support Launch Vehicle Verification Testing for Mission and Fault Management Algorithms in the NASA Space Launch System

Analysis methods and testing processes are essential activities in the engineering development and verification of the National Aeronautics and Space Administration's (NASA) new Space Launch System (SLS). Central to mission success is reliable verification of the Mission and Fault Management (M&FM) algorithms for the SLS launch vehicle (LV) flight software. This is particularly difficult because M&FM algorithms integrate and operate LV subsystems, which consist of diverse forms of hardware and software themselves, with equally diverse integration from the engineering disciplines of LV subsystems. M&FM operation of SLS requires a changing mix of LV automation. During pre-launch the LV is primarily operated by the Kennedy Space Center (KSC) Ground Systems Development and Operations (GSDO) organization with some LV automation of time-critical functions, and much more autonomous LV operations during ascent that have crucial interactions with the Orion crew capsule, its astronauts, and with mission controllers at the Johnson Space Center. M&FM algorithms must perform all nominal mission commanding via the flight computer to control LV states from pre-launch through disposal and also address failure conditions by initiating autonomous or commanded aborts (crew capsule escape from the failing LV), redundancy management of failing subsystems and components, and safing actions to reduce or prevent threats to ground systems and crew. To address the criticality of the verification testing of these algorithms, the NASA M&FM team has utilized the State Flow environment6 (SFE) with its existing Vehicle Management End-to-End Testbed (VMET) platform which also hosts vendor-supplied physics-based LV subsystem models. The human-derived M&FM algorithms are designed and vetted in Integrated Development Teams composed of design and development disciplines such as Systems Engineering, Flight Software (FSW), Safety and Mission Assurance (S&MA) and major subsystems and vehicle elements such as Main Propulsion Systems (MPS), boosters, avionics, Guidance, Navigation, and Control (GN&C), Thrust Vector Control (TVC), liquid engines, and the astronaut crew office. Since the algorithms are realized using model-based engineering (MBE) methods from a hybrid of the Unified Modeling Language (UML) and Systems Modeling Language (SysML), SFE methods are a natural fit to provide an in depth analysis of the interactive behavior of these algorithms with the SLS LV subsystem models. For this, the M&FM algorithms and the SLS LV subsystem models are modeled using constructs provided by Matlab which also enables modeling of the accompanying interfaces providing greater flexibility for integrated testing and analysis, which helps forecast expected behavior in forward VMET integrated testing activities. In VMET, the M&FM algorithms are prototyped and implemented using the same C++ programming language and similar state machine architectural concepts used by the FSW group. Due to the interactive complexity of the algorithms, VMET testing thus far has verified all the individual M&FM subsystem algorithms with select subsystem vendor models but is steadily progressing to assessing the interactive behavior of these algorithms with LV subsystems, as represented by subsystem models. The novel SFE applications has proven to be useful for quick look analysis into early integrated system behavior and assessment of the M&FM algorithms with the modeled LV subsystems. This early MBE analysis generates vital insight into the integrated system behaviors, algorithm sensitivities, design issues, and has aided in the debugging of the M&FM algorithms well before full testing can begin in more expensive, higher fidelity but more arduous environments such as VMET, FSW testing, and the Systems Integration Lab7 (SIL). SFE has exhibited both expected and unexpected behaviors in nominal and off nominal test cases prior to full VMET testing. In many findings, these behavioral characteristics were used to correct the M&FM algorithms, enable better test coverage, and develop more effective test cases for each of the LV subsystems. This has improved the fidelity of testing and planning for the next generation of M&FM algorithms as the SLS program evolves from non-crewed to crewed flight, impacting subsystem configurations and the M&FM algorithms that control them. SFE analysis has improved robustness and reliability of the M&FM algorithms by revealing implementation errors and documentation inconsistencies. It is also improving planning efficiency for future VMET testing of the M&FM algorithms hosted in the LV flight computers, further reducing risk for the SLS launch infrastructure, the SLS LV, and most importantly the crew.

Trevino, Luis↗

NASA NTRS1997

Cultural Variability in Crew Communication

In this study we examined what linguistic strategies pilots use when they have to challenge the actions of a colleague, and how their communications balance the need for informativeness with the need for assuring the other's cooperation. Two strategies emerged for captains. They either gave commands or they made suggestions that referred to actions of the crew. Both strategies explicitly state what action should be taken but they differ in their social implications. Commands are direct insofar as they entail a strong obligation for the listener to comply with the speaker' s request. Suggestions are less direct in this respect. However, by using the collegial "Let's do," speakers appeal to the solidarity between themselves and their listeners and seek compliance in this way. Commands, in contrast, are inherently authoritative and imply an asymmetry in status. Speakers by giving a command, express their belief that they are socially more powerful than their listeners and that they are thus licensed to command. That is, speakers seek listener compliance by appeal to their status. Status-based commands were more frequent among male captains than among female captains. Female captains instead were likely to shift the motivation for their commands away from their status to some objective necessity by referring to some problem or goal It remains to be seen, however, how captains' strategies were affected by the severity of a problem situation. Results in a preliminary study involving only male participants, suggests that pilots increased the directness of their utterances in situations that they perceived to be risky. Thus the observation that male captains used complex communications half of the time while female captains did so 75% of the time, could indicate that male captains were more likely than female captains to change their strategies with the severity of situations. Both male and female first officers in this study were less direct than captains. The most common strategy of first officers was to point to some problem or to remind the captain of a given goal. What corrective action should be taken and by whom was not explicitly stated but implied and left to the captain. In their other strategies, permission seeking and confirmation-seeking questions, first officers were more explicit about a corrective action. In the first case, they volunteered to do some course of action but left the final decision to the captain. In the latter case, they inquired or confirmed whether the captain wanted some action. Although all three strategies seek the compliance of the listener by appeal to his authority, there are important differences: By asking permission seeking and confirmation-seeking questions, first officers specify the action for which they want the captain's compliance. Compliance, however, is not demanded but requested. By alerting to a problem or to a goal, in contrast, first of officers seek the captain's compliance only with their assessment of the situation but not with a particular course of action. That is, they place the captain under no explicit obligation to initiate a corrective action but do so only indirectly by assuming that a course of action is self-evident once the problem has been acknowledged.

Fischer, Ute↗