Search NASA⌕ Search

SEARCH · Search NASA

Results for “Safety assessment”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 55 records · Page 3

A matrix safety frame approach to robot safety for space applications

The planned use of autonomous robots in space applications has generated many new safety problems. This thesis assesses safety of autonomous robot systems through the structure of a proposed three-dimensional matrix safety frame. By identifying the common points of accidents and fatalities involving terrestrial robots, reviewing terrestrial robot safety standards, and modifying and extending these results to space applications, hazards are identified and their associated risks assessed. Three components of the safeguarding dimension of the matrix safety frame, safeguarding through design and operation for intrinsic safety, and incorporation of add-on safety systems are explained through examples for both terrestrial and space robots. A space robot hazard identification checklist, a qualitative tool for robot systems designers, is developed using the structure imparted by the matrix safety frame. The development of an expert system from the contents of the checklist is discussed.

Montgomery, T. D.↗

Flightdeck Automation Problems (FLAP) Model for Safety Technology Portfolio Assessment

NASA's Aviation Safety Program (AvSP) develops and advances methodologies and technologies to improve air transportation safety. The Safety Analysis and Integration Team (SAIT) conducts a safety technology portfolio assessment (PA) to analyze the program content, to examine the benefits and risks of products with respect to program goals, and to support programmatic decision making. The PA process includes systematic identification of current and future safety risks as well as tracking several quantitative and qualitative metrics to ensure the program goals are addressing prominent safety risks accurately and effectively. One of the metrics within the PA process involves using quantitative aviation safety models to gauge the impact of the safety products. This paper demonstrates the role of aviation safety modeling by providing model outputs and evaluating a sample of portfolio elements using the Flightdeck Automation Problems (FLAP) model. The model enables not only ranking of the quantitative relative risk reduction impact of all portfolio elements, but also highlighting the areas with high potential impact via sensitivity and gap analyses in support of the program office. Although the model outputs are preliminary and products are notional, the process shown in this paper is essential to a comprehensive PA of NASA's safety products in the current program and future programs/projects.

Ancel, Ersin↗

Formal Verification of a Conflict Resolution and Recovery Algorithm

New air traffic management concepts distribute the duty of traffic separation among system participants. As a consequence, these concepts have a greater dependency and rely heavily on on-board software and hardware systems. One example of a new on-board capability in a distributed air traffic management system is air traffic conflict detection and resolution (CD&R). Traditional methods for safety assessment such as human-in-the-loop simulations, testing, and flight experiments may not be sufficient for this highly distributed system as the set of possible scenarios is too large to have a reasonable coverage. This paper proposes a new method for the safety assessment of avionics systems that makes use of formal methods to drive the development of critical systems. As a case study of this approach, the mechanical veri.cation of an algorithm for air traffic conflict resolution and recovery called RR3D is presented. The RR3D algorithm uses a geometric optimization technique to provide a choice of resolution and recovery maneuvers. If the aircraft adheres to these maneuvers, they will bring the aircraft out of conflict and the aircraft will follow a conflict-free path to its original destination. Veri.cation of RR3D is carried out using the Prototype Verification System (PVS).

Maddalon, Jeffrey↗

Regaining Lost Separation in a Piloted Simulation of Autonomous Aircraft Operations

NASA is currently investigating a new concept of operations for the National Airspace System, designed to improve capacity while maintaining or improving current levels of safety. This concept, known as Distributed Air/Ground Traffic Management (DAG-TM), allows appropriately equipped autonomous aircraft to maneuver freely for flight optimization while resolving conflicts with other traffic and staying out of special use airspace and hazardous weather. While Airborne Separation Assurance System (ASAS) tools would normally allow pilots to resolve conflicts before they become hazardous, evaluation of system performance in sudden, near-term conflicts is needed in order to determine concept feasibility. If an acceptable safety level can be demonstrated in these situations, then operations may be conducted with lower separation minimums. An experiment was conducted in NASA Langley s Air Traffic Operations Lab to address issues associated with resolving near-term conflicts and the potential use of lower separation minimums. Sixteen commercial airline pilots flew a total of 32 traffic scenarios that required them to use prototype ASAS tools to resolve close range pop-up conflicts. Required separation standards were set at either 3 or 5 NM lateral spacing, with 1000 ft vertical separation being used for both cases. Reducing the lateral separation from 5 to 3 NM did not appear to increase operational risk, as indicated by the proximity to the intruder aircraft. Pilots performed better when they followed tactical guidance cues provided by ASAS than when they didn't follow the guidance. As air-air separation concepts are evolved, further studies will consider integration issues between ASAS and existing Airborne Collision Avoidance Systems (ACAS).These types of non-normal events will require the ASAS to provide effective alerts and resolutions prior to the time that an Airborne Collision Avoidance System (ACAS) would give a Resolution Advisory (RA). When an RA is issued, a pilot must take immediate action in order to avoid a potential near miss. The Traffic Alert and Collision Avoidance System (TCAS) II currently functions as an ACAS aboard commercial aircraft. Depending on the own aircraft s altitude, TCAS only issues RA s 15-35 seconds prior to the Closest Point of Approach (CPA). Prior to an RA, DAG-TM pilots operating autonomous aircraft must rely solely on ASAS for resolution guidance. An additional area of DAG-TM concept feasibility relates to a potential reduction in separation standards. Lower separation standards are likely needed in order to improve NAS efficiency and capacity. Current separation minimums are based in large part on the capabilities of older radar systems. Safety assessments are needed to determine the feasibility of reduced separation minimums. They will give strong consideration to surveillance system performance, including accuracy, integrity, and availability. Candidate surveillance systems include Automatic Dependent Surveillance-Broadcast (ADS-B) and multi-lateration systems. Considering studies done for Reduced Vertical Separation Minimums (RVSM) operations, it is likely that flight technical errors will also be considered. In addition to a thorough evaluation of surveillance system performance, a potential decision to lower the separation standards should also take operational considerations into account. An ASAS Safety Assessment study identified improper maneuvering in response to a conflict (due to ambiguous or improper resolution commands or a pilot s failure to comply with the resolution) as a potential safety risk. If near-term conflicts with lower separation minimums were determined to be more challenging for pilots, the severity of these risks could be even greater.

Barhydt, Richard↗

Recent Experiences of the NASA Engineering and Safety Center (NESC) GN and C Technical Discipline Team (TDT)

The NASA Engineering and Safety Center (NESC), initially formed in 2003, is an independently funded NASA Program whose dedicated team of technical experts provides objective engineering and safety assessments of critical, high risk projects. The GN&C Technical Discipline Team (TDT) is one of fifteen such discipline-focused teams within the NESC organization. The TDT membership is composed of GN&C specialists from across NASA and its partner organizations in other government agencies, industry, national laboratories, and universities. This paper will briefly define the vision, mission, and purpose of the NESC organization. The role of the GN&C TDT will then be described in detail along with an overview of how this team operates and engages in its objective engineering and safety assessments of critical NASA projects. This paper will then describe selected recent experiences, over the period 2007 to present, of the GN&C TDT in which they directly performed or supported a wide variety of NESC assessments and consultations.

Dennehy, Cornelius J.↗

Recent Experiences of the NASA Engineering and Safety Center (NESC) Guidance Navigation and Control (GN and C) Technical Discipline Team (TDT)

The NASA Engineering and Safety Center (NESC) is an independently funded NASA Program whose dedicated team of technical experts provides objective engineering and safety assessments of critical, high risk projects. NESC's strength is rooted in the diverse perspectives and broad knowledge base that add value to its products, affording customers a responsive, alternate path for assessing and preventing technical problems while protecting vital human and national resources. The Guidance Navigation and Control (GN&C) Technical Discipline Team (TDT) is one of fifteen such discipline-focused teams within the NESC organization. The TDT membership is composed of GN&C specialists from across NASA and its partner organizations in other government agencies, industry, national laboratories, and universities. This paper will briefly define the vision, mission, and purpose of the NESC organization. The role of the GN&C TDT will then be described in detail along with an overview of how this team operates and engages in its objective engineering and safety assessments of critical NASA.

Dennehy, Cornelius J.↗

Global Precipitation Measurement (GPM) Safety Inhibit Timeline Tool

The Global Precipitation Measurement (GPM) Observatory is a joint mission under the partnership by National Aeronautics and Space Administration (NASA) and the Japan Aerospace Exploration Agency (JAXA), Japan. The NASA Goddard Space Flight Center (GSFC) has the lead management responsibility for NASA on GPM. The GPM program will measure precipitation on a global basis with sufficient quality, Earth coverage, and sampling to improve prediction of the Earth's climate, weather, and specific components of the global water cycle. As part of the development process, NASA built the spacecraft (built in-house at GSFC) and provided one instrument (GPM Microwave Imager (GMI) developed by Ball Aerospace) JAXA provided the launch vehicle (H2-A by MHI) and provided one instrument (Dual-Frequency Precipitation Radar (DPR) developed by NTSpace). Each instrument developer provided a safety assessment which was incorporated into the NASA GPM Safety Hazard Assessment. Inhibit design was reviewed for hazardous subsystems which included the High Gain Antenna System (HGAS) deployment, solar array deployment, transmitter turn on, propulsion system release, GMI deployment, and DPR radar turn on. The safety inhibits for these listed hazards are controlled by software. GPM developed a "pathfinder" approach for reviewing software that controls the electrical inhibits. This is one of the first GSFC in-house programs that extensively used software controls. The GPM safety team developed a methodology to document software safety as part of the standard hazard report. As part of this process a new tool "safety inhibit time line" was created for management of inhibits and their controls during spacecraft buildup and testing during 1& Tat GSFC and at the Range in Japan. In addition to understanding inhibits and controls during 1& T the tool allows the safety analyst to better communicate with others the changes in inhibit states with each phase of hardware and software testing. The tool was very useful for communicating compliance with safety requirements especially when working with a foreign partner.

Dion, Shirley↗

Architectural Modeling and Analysis for Safety Engineering

Model-based development tools are increasingly being used for system-level development of safety-critical systems. Architectural and behavioral models provide important information that can be leveraged to improve the system safety analysis process. Model-based design artifacts produced in early stage development activities can be used to perform system safety analysis, reducing costs and providing accurate results throughout the system life-cycle. In this report we describe an extension to the Architecture Analysis and Design Language (AADL) that supports modeling of system behavior under failure conditions. This Safety Annex enables the independent modeling of component failures and allows safety engineers to weave various types of fault behavior into the nominal system model. The accompanying tool support uses model checking to propagate errors from their source to their effect on safety properties without the need to add separate propagation specifications. The tool also captures all minimal set of fault combinations that can cause violation of the safety properties, that can be compared to qualitative and quantitative objectives as part of the safety assessment process. We describe the Safety Annex, illustrate its use with a representative example, and discuss and demonstrate the tool support enabling an analyst to investigate the system behavior under failure conditions.

FTA↗

Designing a Better Spacecraft: Assessing Flight Operability of Human Rated Spacecraft

The design of a human rated spacecraft is a complex and costly process requiring the integrated assessment of many individual criteria. Historically, it has been difficult to include in that integrated assessment the design s full impact on the flight operations community and its costs. The unique "operability requirements" have not been well understood, nor has there been a well-defined set of criteria for assessing operability. As a result, flight operations organizations and program managers are often faced with difficult and costly operations phase implementations. In response, the Mission Operations Directorate at NASA s Lyndon B. Johnson Space Center has established a formal technique to evaluate and communicate the operational characteristics of spacecraft system designs for the Constellation Program. This process is not intended to replace or replicate other critical assessments such as risk, reliability and safety assessments. Instead, this new technique adds to the assessment toolset a means to address the concerns and potential cost drivers that are unique to the operational phase of a program and the flight operations community. This paper describes the implementation and application of this "Spacecraft Flight Operability Assessment Scale" in supporting vehicle design efforts. The six key factors of flight operability are defined, with guiding principles and goals stated for each factor. A standardized rating technique provides feedback that is useful to both the operations and program management communities. Sample assessments of legacy spacecraft, including the Space Shuttle and International Space Station systems, are provided to provide real world examples of this technique s application.

Crocker, Alan R.↗

Aviation Safety Concerns for the Future

The Future Aviation Safety Team (FAST) is a multidisciplinary international group of aviation professionals that was established to identify possible future aviation safety hazards. The principle was adopted that future hazards are undesirable consequences of changes, and a primary activity of FAST became identification and prioritization of possible future changes affecting aviation. Since 2004, FAST has been maintaining a catalogue of "Areas of Change" (AoC) that could potentially influence aviation safety. The horizon for such changes is between 5 to 20 years. In this context, changes must be understood as broadly as possible. An AoC is a description of the change, not an identification of the hazards that result from the change. An ex-post analysis of the AoCs identified in 2004 demonstrates that changes catalogued many years previous were directly implicated in the majority of fatal aviation accidents over the past ten years. This paper presents an overview of the current content of the AoC catalogue and a subsequent discussion of aviation safety concerns related to these possible changes. Interactions among these future changes may weaken critical functions that must be maintained to ensure safe operations. Safety assessments that do not appreciate or reflect the consequences of significant interaction complexity will not be fully informative and can lead to inappropriate trade-offs and increases in other risks. The FAST strongly encourages a system-wide approach to safety risk assessment across the global aviation system, not just within the domain for which future technologies or operational concepts are being considered. The FAST advocates the use of the "Areas of Change" concept, considering that several possible future phenomena may interact with a technology or operational concept under study producing unanticipated hazards.

emerging risks↗

An Operational Safety and Certification Assessment of a TASAR EFB Application

This paper presents an overview of a Traffic Aware Strategic Aircrew Requests (TASAR) Electronic Flight Bag application intended to inform the pilot of trajectory improvement opportunities while en route that result in operational benefits. The results of safety analyses and a detailed review of Federal Aviation Administration (FAA) regulatory documents that establish certification and operational approval requirements are presented for TASAR. The safety analyses indicate that TASAR has a likely Failure Effects Classification of “No Effect,” and at most, is no worse than “Minor Effect.” Based on this safety assessment and the detailed review of FAA regulatory documents that determine certification and operational approval requirements, this study concludes that TASAR can be implemented in the flight deck as a Type B software application hosted on a Class 2 Portable Electronic Device (PED) Electronic Flight Bag (EFB). This implementation approach would provide a relatively low-cost path to certification and operational approval for both retrofit and forward fit implementation, while at the same time facilitating the business case for early ADS-B IN equipage. A preliminary review by FAA certification and operational approvers of the analyses presented here confirmed that the conclusions are appropriate and that TASAR will be considered a Type B application.

Koczo, Stefan↗

Enabling Assurance in the MBSE Environment

A number of specific benefits that fit within the hallmarks of effective development are realized with implementation of model-based approaches to systems and assurance. Model Based Systems Engineering (MBSE) enabled by standardized modeling languages (e.g., SysML®) is at the core. These benefits in the context of spaceflight system challenges can include [1]: • Improved management of complex development • Reduced risk in the development process • Improved cost management • Improved design decisions With appropriate modeling techniques the assurance community also can improve early oversight and insight into project development. NASA has shown the basic constructs of SysML in an MBSE environment offer several key advantages, within a Model Based Mission Assurance (MBMA) initiative [2, 3]. These include the following: • Model viewpoints that promote rapid and systematic assessment of requirements coverage, hazard tagging and risk management • Embedded safety assessments for launch vehicles • Deployment of model assisted development of reliability products - Failure Modes and Effects Analyses (FMEAs) and Fault Trees • Test Planning • Validation and Verification of complex functions • Support of Assurance Case development for complex systems In addition, while there are benefits to be harvested, there is a realization that these do not come without effort and cost. Enabling model-based approaches requires structure, not only in an organizational context, but in a modeling context as well. There can be a steep learning curve and costs associated to train skilled modelers. But, on the other hand, not all of the assurance community need to be modelers. Models themselves must conform to ontologies that enable assurance. This places constraints upon the models and modelers. Optimums have yet to be developed where resources and constraints on modeling must be traded off in the organization and modeling efforts for projects. A number of barriers need to be overcome, as well, which pose challenges to the developers of the software that supports MBSE/MBMA. Information and data must be made to flow seamlessly through the life cycle. Because there is a wide variety of tools used in the community, to avoid the problems of the past of silos, delays, and diverging interests, information should flow among these tools to support the “single source of truth” paradigm of MBSE. This will greatly facilitate MBMA and advancement of assurance functions.

Evans, John W.↗

A novel tiered sensor fusion approach for terrain characterization and safe landing assessment

This paper presents a novel tiered sensor fusion methodology for real-time terrain safety assessment. A combination of active and passive sensors, specifically, radar, lidar, and camera, operate in three tiers according to their inherent ranges of operation. Low-level terrain features (e.g. slope, roughness) and high-level terrain features (e.g. hills, craters) are integrated using principles of reasoning under uncertainty. Three methodologies are used to infer landing safety: Fuzzy Reasoning, Probabilistic Reasoning, and Evidential Reasoning. The safe landing predictions from the three fusion engines are consolidated in a subsequent decision fusion stage aimed at combining the strengths of each fusion methodology. Results from simulated spacecraft descents are presented and discussed.

fuzzy reasoning↗

Safety assurance of complex integrated systems

Interface hazard analysis (IHA) is used as a 'tool' to systematically assess safety for the integration of a diverse set of experiments and payload hardware into the Spacelab carrier which flies in the Space Shuttle's Orbiter cargo bay. The IHA when performed by a thorough analysis provides safety assurance of complex integrated systems by systematically linking analysis efforts performed by the organizations thus providing the respective elements to be integrated into an objective, unique analysis. Particular attention is given to verification methods of the safety assurance of the Spacelab carrier and its experiment payload for which the IHA was performed.

Abrignani, Vincent A.↗

Mars Sample Return (MSR) Sample Receiving Facility (SRF) Assessment Study (MSAS)

NASA, in partnership with the European Space Agency (ESA), is seeking to return Martian geological and atmospheric samples to Earth for scientific study in the early 2030s. Due to the possibility that the samples could contain extraterrestrial life, Mars Sample Return (MSR) is classified as a Category V: Restricted Earth Return mission by the NASA Planetary Protection Office. As a result of this classification, a MSR Sample Receiving Facility (SRF) must not only provide a pristine environment to ensure samples are protected from terrestrial contamination for scientific investigations, it must also provide high-containment (biosafety level 4 [BSL-4]-equivalence) to isolate the samples from Earth’s biosphere until the samples are deemed safe for release and/or sterilized. The nominal utilization period for a SRF is anticipated to be 2-5 years and is intended to enable curation activities, biohazard assessment, select early science activities, and the rapid release of samples to the scientific community. However, to account for possible delays in schedule or the identification of extant life, this anticipated period of time must be flexible to accommodate schedule extensions and contingency plans. Due to requirements for high-level biological containment and cleanliness, a traditional receiving/curation facility cannot be utilized for MSR. Therefore, beginning in 2022, NASA Johnson Space Center is performing a MSR SRF Assessment Study (MSAS) to investigate the most optimal facility modality for a MSR SRF, as well as start to define programmatic early estimate of costs and schedules before the initial design phase begins. NASA is partnering with industry contractors (architectural and engineering firms with BSL-4 and cleanroom technology experience, as well as other contracted infrastructure and construction specialists) along with selected experts from NASA, ESA, existing U.S. BSL-4 facilities, and other U.S. government agencies, to carry out the assessment study. The MSAS should also aid in the future refinement of the science requirements (e.g., contamination control, equipment accommodations) before site-specific design would commence. As part of the MSAS, NASA is planning to assess an array of possibilities for a MSR SRF. One of the main considerations is the facility modality and whether an existing BSL-4 facility can be utilized (for some or all functions); or, if new constructure would be required, would a traditional fixed facility or a modular facility the best choice. MSAS will also investigate the ability of the modalities to accommodate two different facility capability endmembers: 1) a minimal facility focusing on biohazard assessment and curation tasks with a small footprint, and 2) an enhanced facility with additional capabilities to enable expedited processing and the completion of time-sensitive and (some) sterilization-sensitive science. The assessment is intended to generate information that will inform the selection of facility modalities for high-level conceptual design development. While the assessment study will focus on SRF requirements for accommodating curation, science, and sample safety assessment infrastructure, it will also consider an array of other factors, such as ease of access for international users, decommissioning, repurposing, future sale or lease following MSR’s use of the facility, and uncontained preparatory laboratory spaces. Upon completion of the study, the preferred modality and refined requirements would be utilized for site-specific design but will not be finalized until NASA’s completion of the National Environmental Policy Act (NEPA) process.

A.D. Harrington↗

Ensuring Safety of Government Personnel During Suborbital Spaceflight

The NASA Suborbital Crew (SubC) project is focused on enabling flights by NASA civil servants, such as scientists and engineers conducting research, on suborbital vehicles. A broader goal is ensuring that commercial human spaceflight is both viable and safe. Within the Commercial Crew Program (CCP), the SubC project is exploring game-changing methods to perform safety assessments to enable NASA personnel to fly on suborbital missions. Commercial suborbital space flight capabilities are anticipated to be more accessible, affordable, and available than missions to the International Space Station and could provide additional opportunities for testing and qualification of space flight hardware, human-tended microgravity research, and further cutting-edge research enabled by the space environment. Although NASA currently permits human tended suborbital payloads for non-civil servants under auspices of NASA’s Flight Opportunities Program, the SubC effort will enable civil servant scientists, researchers, and even engineers to accompany their experiments and tests into the space microgravity environment. Figure 1 illustrates how the SubC program complements other microgravity experimental platforms. The targeted scope for SubC includes end-to-end suborbital capabilities reaching ~80km with several minutes of sustained microgravity (Table 1). The NASA SubC project office is working with the Federal Aviation Administration’s Office of Commercial Space Transportation (FAA-AST) and the commercial suborbital space transportation industry to develop an efficient and holistic approach to a safety review and eventual government participation in suborbital flight. The current FAA certification process for suborbital launches is congressionally mandated to only consider public safety. NASA is responsible for understanding the risks to its employees should they fly on a commercially available suborbital flight. The SubC project is employing a Safety Case approach, applied to commercial suborbital providers, which is not a traditional certification process as was used for the SpaceX Dragon and Boeing Starliner vehicles. Rather, it is an assessment using elements of NASA’s Risk-Informed Safety Case and the Armstrong Flight Research Center’s Airworthiness Assessment process.

Elizabeth C Blome↗

Full Lunar Surface Visualization and Simulation Platform

This paper reports the results of the innovative work completed to facilitate the creation of a lunar surface visualization and simulation platform for the entire surface of the moon as a design, test, training, verification, and mission support environment. The mathematical approach to the visualization of the data sets utilizes fractal mathematics to generate not only the highest possible detail that the Lunar Reconnaissance Orbiter (LRO) data can provide, but it also additionally supplies an estimation of surface reflectivity and lighting based upon location on the lunar surface. This level of detail and accuracy is required to conduct accurate integrated crew / vehicle risk assessment throughout the design-to-disposal life cycle of vehicles and their supporting procedures and mission priorities. This process starts with safety assessments of integrated hardware / software / crew/ and support environments. Unlike the Apollo Program, the Artemis Program is not risk tolerant.

Simulation↗