Search NASA⌕ Search

SEARCH · Search NASA

Results for “safety case”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 55 records · Page 3
All sourcesNASA NTRSDOE OSTI
NASA NTRS2015

NASA System Safety Handbook. Volume 2: System Safety Concepts, Guidelines, and Implementation Examples

This is the second of two volumes that collectively comprise the NASA System Safety Handbook. Volume 1 (NASASP-210-580) was prepared for the purpose of presenting the overall framework for System Safety and for providing the general concepts needed to implement the framework. Volume 2 provides guidance for implementing these concepts as an integral part of systems engineering and risk management. This guidance addresses the following functional areas: 1.The development of objectives that collectively define adequate safety for a system, and the safety requirements derived from these objectives that are levied on the system. 2.The conduct of system safety activities, performed to meet the safety requirements, with specific emphasis on the conduct of integrated safety analysis (ISA) as a fundamental means by which systems engineering and risk management decisions are risk-informed. 3.The development of a risk-informed safety case (RISC) at major milestone reviews to argue that the systems safety objectives are satisfied (and therefore that the system is adequately safe). 4.The evaluation of the RISC (including supporting evidence) using a defined set of evaluation criteria, to assess the veracity of the claims made therein in order to support risk acceptance decisions.

Safety Case↗
NASA NTRS2024

Ensuring Safety of Government Personnel During Suborbital Spaceflight

The NASA Suborbital Crew (SubC) project is focused on enabling flights by NASA civil servants, such as scientists and engineers conducting research, on suborbital vehicles. A broader goal is ensuring that commercial human spaceflight is both viable and safe. Within the Commercial Crew Program (CCP), the SubC project is exploring game-changing methods to perform safety assessments to enable NASA personnel to fly on suborbital missions. Commercial suborbital space flight capabilities are anticipated to be more accessible, affordable, and available than missions to the International Space Station and could provide additional opportunities for testing and qualification of space flight hardware, human-tended microgravity research, and further cutting-edge research enabled by the space environment. Although NASA currently permits human tended suborbital payloads for non-civil servants under auspices of NASA’s Flight Opportunities Program, the SubC effort will enable civil servant scientists, researchers, and even engineers to accompany their experiments and tests into the space microgravity environment. Figure 1 illustrates how the SubC program complements other microgravity experimental platforms. The targeted scope for SubC includes end-to-end suborbital capabilities reaching ~80km with several minutes of sustained microgravity (Table 1). The NASA SubC project office is working with the Federal Aviation Administration’s Office of Commercial Space Transportation (FAA-AST) and the commercial suborbital space transportation industry to develop an efficient and holistic approach to a safety review and eventual government participation in suborbital flight. The current FAA certification process for suborbital launches is congressionally mandated to only consider public safety. NASA is responsible for understanding the risks to its employees should they fly on a commercially available suborbital flight. The SubC project is employing a Safety Case approach, applied to commercial suborbital providers, which is not a traditional certification process as was used for the SpaceX Dragon and Boeing Starliner vehicles. Rather, it is an assessment using elements of NASA’s Risk-Informed Safety Case and the Armstrong Flight Research Center’s Airworthiness Assessment process.

Elizabeth C Blome↗
NASA NTRS2007

Software Safety Risk in Legacy Safety-Critical Computer Systems

Safety Standards contain technical and process-oriented safety requirements. Technical requirements are those such as "must work" and "must not work" functions in the system. Process-Oriented requirements are software engineering and safety management process requirements. Address the system perspective and some cover just software in the system > NASA-STD-8719.13B Software Safety Standard is the current standard of interest. NASA programs/projects will have their own set of safety requirements derived from the standard. Safety Cases: a) Documented demonstration that a system complies with the specified safety requirements. b) Evidence is gathered on the integrity of the system and put forward as an argued case. [Gardener (ed.)] c) Problems occur when trying to meet safety standards, and thus make retrospective safety cases, in legacy safety-critical computer systems.

Hill, Janice L.↗
NASA NTRS2018

Towards a Rigorous Basis for Specific Operations Risk Assessment of UAS

The Specific Operations Risk Assessment (SORA) guidance represents the consensus of various national aviation authorities on a common process to identify, qualitatively assess, and manage the safety risk posed by unmanned aircraft systems (UAS), when preparing the safety case required for regulatory approval to conduct certain types of operations. As such, it can be considered a de facto standard, being increasingly adopted by various relevant stakeholders. This paper first gives an overview of the SORA process and associated methods, identifying a number of inconsistencies in risk identification and assessment, also discussing plausible strategies to close the associated gaps. Then, we give a well-founded basis for the applicable concepts, such as barrier integrity, assurance, and robustness, following which we present a preliminary and simple probabilistic formalization of the underpinning barrier-based safety model. We illustrate our overall approach through a worked example, also discussing how a Bayesian framework can facilitate extending and enhancing our initial formalization. We conclude with a discussion of the opportunities afforded by our approach, such as a well-founded basis for barrier selection, whilst addressing the associated challenges. The main objective of this work is to complement the current SORA guidance through a principled, mathematicallybased approach to risk assessment, particularly when it is applied to higher-risk operational concepts that warrant greater rigor in safety assessment and assurance.

Safety Cases↗
NASA NTRS2015

"Evidence" Under a Magnifying Glass: Thoughts on Safety Argument Epistemology

Common definitions of "safety case" emphasize that evidence is the basis of a safety argument, yet few widely referenced works explicitly define "evidence". Their examples suggest that similar things can be regarded as evidence. But the category evidence seems to contain (1) processes for finding things out, (2) information resulting from such processes, and (3) relevant documents. Moreover, any item of evidence could be replaced by further argument. Normative models of informal argumentation do not offer clear guidance on when a safety argument should cite evidence rather than appeal to a more detailed argument. Disciplines such as the law address the problem with a practical, domain-specific epistemology. In this paper, we explore these problems associated with evidence citations in safety arguments, identify goals for a theory of safety argument evidence and a practical safety argument epistemology, propose a model of safety evidence citation that advances the identified goals, and present a related extension to the Goal Structuring Notation (GSN).

Graydon, P. J.↗
NASA NTRS2018

FUELEAP Model-Based System Safety Analysis

NASA researchers, in a partnership with Boeing, are investigating a fuel-cell powered variant of the X-57 “Maxwell” Mod-II electric propulsion aircraft, which is itself derived from a stock Tecnam P2006T. The “Fostering Ultra-Efficient Low-Emitting Aviation Power” (FUELEAP) project will replace the X-57 power subsystem with a hybrid Solid-Oxide Fuel Cell (SOFC) system to increase the potential range of the electric-propulsion aircraft while dramatically improving efficiency and emissions over stock internal-combustion engines. Our FUELEAP safety analysis faces two primary challenges. First, the Part 23 certificated Tecnam P2006T is undergoing significant modifications to host the hybrid electric-propulsion system, and the challenge is to assure that the safety inherent in the stock aircraft (and subsequently in X-57 Mod-II) is not compromised by changes in avionics, aircraft structural loading, weight and balance, or other considerations. Secondly, because the SOFC power system has little (if any) relevant in-service precedent, our challenge is to assure that we identify and mitigate all reasonably plausible hazards introduced by unique FUELEAP equipage. We are investigating and utilizing Model-Based Safety Analysis (MBSA) methods to help us address these FUELEAP safety challenges. We captured aircraft-level system hazard conditions using instances of a SysML hazard block via aircraft-level Functional Hazard Analysis (FHA). Then, using SysML models of the FUELEAP architecture, we related the hazard conditions to initiating system events and possible mitigations, such as design architecture modifications or operational constraints. We are continuing to define our approach to MBSA by developing a component-by-component inventory of local failure modes and tracing their possible contribution to hazard conditions. Finally, we are applying an argument-based approach to FUELEAP assurance. Through a FUELEAP “safety case,” we are providing an explicit argument for FUELEAP safety by associating assurance evidence with overarching safety claims through a structured argument.

Woodham, Kurt P.↗
NASA NTRS2015

Characteristics of a Well Clear Definition and Alerting Criteria for Encounters Between UAS and Manned Aircraft in Class E Airspace

Unmanned aircraft systems (UAS) will be required to equip with a detect-and-avoid (DAA) system in order to satisfy the federal aviation regulations to remain well clear of other aircraft. For a DAA system to satisfy the requirement to stay well clear of other airborne traffic, a quantitative definition of well clear needs to be defined and evaluated. This study investigates the implications of UAS using proposed well clear definitions as a separation standard for conducting operations in the National Airspace System (NAS). The first analysis considers three well clear definitions and presents the relative state conditions of intruder aircraft as they encroach upon the well clear boundary. The second analysis focuses on the definition of the alerting criteria needed to inform the UAS operator of a potential loss of well clear. All analyses are conducted in a NAS-wide fast-time simulation environment using UAS aircraft models, proposed UAS missions, and historical air defense radar data to populate the background traffic operating under visual flight rules. The results presented in this study inform the safety case, requirements development, and the operational environment for DAA minimum operational performance standards.

Safety↗
NASA NTRSDate not supplied

A Systems Approach to AI Model Integration and Performance Evaluation for the Generic UAM Simulation Framework

This paper introduces py-guam, an open-source experimentation framework developed for the NASA Generic Urban Air Mobility simulation (GUAM) environment, facilitating the integration and evaluation of advanced artificial intelligence (AI) algorithms. We present a systems approach which enables the seamless incorporation of data-driven models, including off-nominal and failure state detection, into the GUAM’s Cognitive Architecture (CA). The framework supports customizable experimentation parameters, derives Safety Performance Indicators (SPIs) from UL 4600 safety case analyses, and employs rapid UAM simulations to assess AI impacts on flight performance across diverse scenarios. Through comprehensive testing and validation experiments, we demonstrate GUAM’s capability to enhance safety and efficiency in urban air mobility operations. Additionally, the open-source nature of py-guam fosters community collaboration, ensuring continuous improvement and adaptability to evolving technological advancements. This work establishes a robust tool for developing and testing AI-driven urban air mobility (UAM) systems, advancing the safety and reliability of autonomous urban air vehicles.

Artificial Intelligence↗
NASA NTRS2016

An Investigation of Proposed Techniques for Quantifying Confidence in Assurance Arguments

The use of safety cases in certification raises the question of assurance argument sufficiency and the issue of confidence (or uncertainty) in the argument's claims. Some researchers propose to model confidence quantitatively and to calculate confidence in argument conclusions. We know of little evidence to suggest that any proposed technique would deliver trustworthy results when implemented by system safety practitioners. Proponents do not usually assess the efficacy of their techniques through controlled experiment or historical study. Instead, they present an illustrative example where the calculation delivers a plausible result. In this paper, we review current proposals, claims made about them, and evidence advanced in favor of them. We then show that proposed techniques can deliver implausible results in some cases. We conclude that quantitative confidence techniques require further validation before they should be recommended as part of the basis for deciding whether an assurance argument justifies fielding a critical system.

Graydon, Patrick J.↗
NASA NTRS2008

Product Engineering Class in the Software Safety Risk Taxonomy for Building Safety-Critical Systems

When software safety requirements are imposed on legacy safety-critical systems, retrospective safety cases need to be formulated as part of recertifying the systems for further use and risks must be documented and managed to give confidence for reusing the systems. The SEJ Software Development Risk Taxonomy [4] focuses on general software development issues. It does not, however, cover all the safety risks. The Software Safety Risk Taxonomy [8] was developed which provides a construct for eliciting and categorizing software safety risks in a straightforward manner. In this paper, we present extended work on the taxonomy for safety that incorporates the additional issues inherent in the development and maintenance of safety-critical systems with software. An instrument called a Software Safety Risk Taxonomy Based Questionnaire (TBQ) is generated containing questions addressing each safety attribute in the Software Safety Risk Taxonomy. Software safety risks are surfaced using the new TBQ and then analyzed. In this paper we give the definitions for the specialized Product Engineering Class within the Software Safety Risk Taxonomy. At the end of the paper, we present the tool known as the 'Legacy Systems Risk Database Tool' that is used to collect and analyze the data required to show traceability to a particular safety standard

Hill, Janice↗
NASA NTRS2013

Evidence Arguments for Using Formal Methods in Software Certification

We describe a generic approach for automatically integrating the output generated from a formal method/tool into a software safety assurance case, as an evidence argument, by (a) encoding the underlying reasoning as a safety case pattern, and (b) instantiating it using the data produced from the method/tool. We believe this approach not only improves the trustworthiness of the evidence generated from a formal method/tool, by explicitly presenting the reasoning and mechanisms underlying its genesis, but also provides a way to gauge the suitability of the evidence in the context of the wider assurance case. We illustrate our work by application to a real example-an unmanned aircraft system- where we invoke a formal code analysis tool from its autopilot software safety case, automatically transform the verification output into an evidence argument, and then integrate it into the former.

Argumentation↗
NASA NTRS2013

Prospective Safety Analysis and the Complex Aviation System

Fatal accident rates in commercial passenger aviation are at historic lows yet have plateaued and are not showing evidence of further safety advances. Modern aircraft accidents reflect both historic causal factors and new unexpected "Black Swan" events. The ever-increasing complexity of the aviation system, along with its associated technology and organizational relationships, provides fertile ground for fresh problems. It is important to take a proactive approach to aviation safety by working to identify novel causation mechanisms for future aviation accidents before they happen. Progress has been made in using of historic data to identify the telltale signals preceding aviation accidents and incidents, using the large repositories of discrete and continuous data on aircraft and air traffic control performance and information reported by front-line personnel. Nevertheless, the aviation community is increasingly embracing predictive approaches to aviation safety. The "prospective workshop" early assessment tool described in this paper represents an approach toward this prospective mindset-one that attempts to identify the future vectors of aviation and asks the question: "What haven't we considered in our current safety assessments?" New causation mechanisms threatening aviation safety will arise in the future because new (or revised) systems and procedures will have to be used under future contextual conditions that have not been properly anticipated. Many simulation models exist for demonstrating the safety cases of new operational concepts and technologies. However the results from such models can only be as valid as the accuracy and completeness of assumptions made about the future context in which the new operational concepts and/or technologies will be immersed. Of course that future has not happened yet. What is needed is a reasonably high-confidence description of the future operational context, capturing critical contextual characteristics that modulate both the likelihood of occurrence of hazards, and the likelihood that those hazards will lead to negative safety events. Heuristics extracted from scenarios, questionnaires, and observed trends from scanning the aviation horizon may be helpful in capturing those future changes in a way conducive to safety assessment. What is also needed is a checklist of potential sources of emerging risk that arise from organizational features that are frequently overlooked. The ultimate goal is to develop a pragmatic, workable method for using descriptions of the future aviation context, to generate valid predictions of safety risks.

prospection↗
NASA NTRS2011

Comprehensive Forced Response Analysis of J2X Turbine Bladed-Discs with 360 Degree Variation in CFD Loading

The temporal frequency content of the dynamic pressure predicted by a 360 degree computational fluid dynamics (CFD) analysis of a turbine flow field provides indicators of forcing function excitation frequencies (e.g., multiples of blade pass frequency) for turbine components. For the Pratt and Whitney Rocketdyne J-2X engine turbopumps, Campbell diagrams generated using these forcing function frequencies and the results of NASTRAN modal analyses show a number of components with modes in the engine operating range. As a consequence, forced response and static analyses are required for the prediction of combined stress, high cycle fatigue safety factors (HCFSF). Cyclically symmetric structural models have been used to analyze turbine vane and blade rows, not only in modal analyses, but also in forced response and static analyses. Due to the tortuous flow pattern in the turbine, dynamic pressure loading is not cyclically symmetric. Furthermore, CFD analyses predict dynamic pressure waves caused by adjacent and non-adjacent blade/vane rows upstream and downstream of the row analyzed. A MATLAB script has been written to calculate displacements due to the complex cyclically asymmetric dynamic pressure components predicted by CFD analysis, for all grids in a blade/vane row, at a chosen turbopump running speed. The MATLAB displacements are then read into NASTRAN, and dynamic stresses are calculated, including an adjustment for possible mistuning. In a cyclically symmetric NASTRAN static analysis, static stresses due to centrifugal, thermal, and pressure loading at the mode running speed are calculated. MATLAB is used to generate the HCFSF at each grid in the blade/vane row. When compared to an approach assuming cyclic symmetry in the dynamic flow field, the current approach provides better assurance that the worst case safety factor has been identified. An extended example for a J-2X turbopump component is provided.

Elrod, David↗
NASA NTRS2004

Mars Radiator Characterization Experimental Program

Radiators are an enabling technology for the human exploration and development of the moon and Mars. As standard components of the heat rejection subsystem of space vehicles, radiators are used to reject waste heat to space and/or a planetary environment. They are typically large components of the thermal control system for a space vehicle or human habitation facility, and in some cases safety factors are used to oversize them when the operating environment cannot be fully characterized. Over-sizing can impose significant weight and size penalties that might be prohibitive for future missions. Radiator performance depends on the size of the radiator surface, its emittance and absorptance, the radiator temperature, the effective sky temperature surrounding the radiator, solar radiation and atmospheric irradiation levels, convection to or from the atmosphere (on Mars), and other conditions that could affect the nature of the radiator surface, such as dust accumulation. Most particularly, dust is expected to be a major contributor to the local environmental conditions on either the lunar or Martian surface. This conclusion regarding Mars is supported by measurements of dust accumulation on the Mars Sojourner Rover solar array during the Pathfinder mission. This Final Report describes a study of the effect of Martian dust accumulation on radiator performance. It is comprised of quantitative measurements of effective emittance for a range of dust accumulation levels on surfaces of known emittance under clean conditions. The test radiator coatings were Z-93P, NS-43G, and Silver Teflon (10 mil) film. The Martian dust simulant was Carbondale Red Clay. Results were obtained under vacuum conditions sufficient to reduce convection effects virtually to zero. The experiments required the development of a calorimetric apparatus that allows simultaneous measurements of the effective emittance for all the coatings at each set of experimental conditions. A method of adding dust to multiple radiator coupons was developed and shown to be capable of depositing dust on the surfaces with acceptable uniformity. In these experiments, the dust layer accumulates under earth gravity and in the presence of an earth atmosphere. An invention disclosure for the dust deposition apparatus is being filed through NASA and University of Houston.

Witte, Larry C.↗
NASA NTRS2007

NASA Dryden's UAS Service Capabilities

The vision of NASA s Dryden Flight Research Center is to "fly what others only imagine." Its mission is to advance technology and science through flight. Objectives supporting the mission include performing flight research and technology integration to revolutionize aviation and pioneer aerospace technology, validating space exploration concepts, conducting airborne remote sensing and science missions, and supporting operations of the Space Shuttle and the International Space Station. A significant focus of effort in recent years has been on Unmanned Aircraft Systems (UAS), both in support of the Airborne Science Program and as research vehicles to advance the state of the art in UAS. Additionally, the Center has used its piloted aircraft in support of UAS technology development. In order to facilitate greater access to the UAS expertise that exists at the Center, that expertise has been organized around three major capabilities. The first is access to high-altitude, long-endurance UAS. The second is the establishment of a test range for small UAS. The third is safety case assessment support.

Bauer, Jeff↗
NASA NTRS2008

Proceedings of the Sixth NASA Langley Formal Methods (LFM) Workshop

Today's verification techniques are hard-pressed to scale with the ever-increasing complexity of safety critical systems. Within the field of aeronautics alone, we find the need for verification of algorithms for separation assurance, air traffic control, auto-pilot, Unmanned Aerial Vehicles (UAVs), adaptive avionics, automated decision authority, and much more. Recent advances in formal methods have made verifying more of these problems realistic. Thus we need to continually re-assess what we can solve now and identify the next barriers to overcome. Only through an exchange of ideas between theoreticians and practitioners from academia to industry can we extend formal methods for the verification of ever more challenging problem domains. This volume contains the extended abstracts of the talks presented at LFM 2008: The Sixth NASA Langley Formal Methods Workshop held on April 30 - May 2, 2008 in Newport News, Virginia, USA. The topics of interest that were listed in the call for abstracts were: advances in formal verification techniques; formal models of distributed computing; planning and scheduling; automated air traffic management; fault tolerance; hybrid systems/hybrid automata; embedded systems; safety critical applications; safety cases; accident/safety analysis.

Rozier, Kristin Yvonne↗
NASA NTRS2011

State-Based Implicit Coordination and Applications

In air traffic management, pairwise coordination is the ability to achieve separation requirements when conflicting aircraft simultaneously maneuver to solve a conflict. Resolution algorithms are implicitly coordinated if they provide coordinated resolution maneuvers to conflicting aircraft when only surveillance data, e.g., position and velocity vectors, is periodically broadcast by the aircraft. This paper proposes an abstract framework for reasoning about state-based implicit coordination. The framework consists of a formalized mathematical development that enables and simplifies the design and verification of implicitly coordinated state-based resolution algorithms. The use of the framework is illustrated with several examples of algorithms and formal proofs of their coordination properties. The work presented here supports the safety case for a distributed self-separation air traffic management concept where different aircraft may use different conflict resolution algorithms and be assured that separation will be maintained.

Narkawicz, Anthony J.↗
NASA NTRS2014

Neither Pollyanna nor Chicken Little: Thoughts on the Ethics of Automation

This paper has raised issues concerning the ethics of automation in aviation systems, and outlined ways of thinking about the issues that may help in ethical decision making. It is very easy to be carried along by technology and the Pollyanna view, but just because we can do something, doesn't mean we should - which is perhaps a little milder than the Chicken Little view. Both views have merits, and we would view ethical decisions as ones that more appropriately balance or reconcile these conflicting viewpoints. We have set out some of the background to the problems of automation in aviation systems, but are aware that there is much more that could be said (considering military UAS, for example). We hope, however, that the brief introduction provides a foundation for the ethical questions that we have set out. The underlying aim in proposing ESCs is to make understanding ethical issues easier so that ethically-informed decisions can be made. Whilst we have not linked the discussion directly back to specific ethical decisions, we believe that making explicit those issues on which such judgments are based is a contribution to ethically informed decision making. We also believe that the four principles set out by the RAEng are reflected in this approach. We acknowledge that what we have set out, especially the ideas of ESC, goes some way beyond current practice and principles and there are significant technical issues to resolve before such an approach could be implemented. It is hoped, however, that the ideas will help improve the production and presentation of safety cases in a range of industries not just aviation - a Pollyanna view, of course!

Holloway, C. Michael↗