The Future of Software Certification - A Roadmap
We present some thoughts on how automated software analysis tools can support the certification of safety-critical software.
Denney, Ewen↗
SEARCH · Search NASA
Results for “safety certification”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
International Space Station Mechanisms and Maintenance Flight Control Documentation and Training Development
International Space Station (ISS) crew and flight controller training documentation is used to aid in training operations. The Generic Simulations References SharePoint (Gen Sim) site is a database used as an aid during flight simulations. The Gen Sim site is used to make individual mission segment timelines, data, and flight information easily accessible to instructors. The Waste and Hygiene Compartment (WHC) training schematic includes simple and complex fluid schematics, as well as overall hardware locations. It is used as a teaching aid during WHC lessons for both ISS crew and flight controllers. ISS flight control documentation is used to support all aspects of ISS mission operations. The Quick Look Database and Consolidated Tool Page are imagery-based references used in real-time to help the Operations Support Officer (OSO) find data faster and improve discussions with the Flight Director and Capsule Communicator (CAPCOM). A Quick Look page was created for the Permanent Multipurpose Module (PMM) by locating photos of the module interior, labeling specific hardware, and organizing them in schematic form to match the layout of the PMM interior. A Tool Page was created for the Maintenance Work Area (MWA) by gathering images, detailed drawings, safety information, procedures, certifications, demonstration videos, and general facts of each MWA component and displaying them in an easily accessible and consistent format. Participation in ISS mechanisms and maintenance lessons, mission simulation On-the-Job Training (OJT), and real-time flight OJT was used as an opportunity to train for day-to-day operations as an OSO, as well as learn how to effectively respond to failures and emergencies during mission simulations and real-time flight operations.
Daugherty, Colin C.↗
Defining Baconian Probability for Use in Assurance Argumentation
The use of assurance cases (e.g., safety cases) in certification raises questions about confidence in assurance argument claims. Some researchers propose to assess confidence in assurance cases using Baconian induction. That is, a writer or analyst (1) identifies defeaters that might rebut or undermine each proposition in the assurance argument and (2) determines whether each defeater can be dismissed or ignored and why. Some researchers also propose denoting confidence using the counts of defeaters identified and eliminated-which they call Baconian probability-and performing arithmetic on these measures. But Baconian probabilities were first defined as ordinal rankings which cannot be manipulated arithmetically. In this paper, we recount noteworthy definitions of Baconian induction, review proposals to assess confidence in assurance claims using Baconian probability, analyze how these comport with or diverge from the original definition, and make recommendations for future practice.
Graydon, Patrick J.↗
A Distributed Simulation-to-Flight Framework to Support Investigating Trust/Trustworthiness in Multi-Agent Systems
As autonomous systems continue to grow both in use and complexity, the necessity for robust and extensible simulation-to-flight frameworks is paramount for establishing an effective architecture for autonomous systems. Hardware test flights are time-consuming and cost prohibitive during early system design and development. Simulation environments can be useful tools to accelerate algorithm development and testing. However, transitions from simulation to flight (sim-to-flight) can be challenging, unless systems are designed with this transition in mind and with the necessary capabilities built into the architecture and framework. One of the objectives of Autonomy Teaming and TRAjectories for Complex Trusted Operational Reliability (ATTRACTOR) was to design and develop a distributed mixed-reality simulation environment to begin establishing a basis for certification of autonomous systems via research into trust and trustworthiness. ATTRACTOR’s objective was to construct computational concepts of trustworthiness and justifiable trust in multi-agent autonomous teams, to inform future certification of safety-critical and time-critical autonomous systems in aviation. In this paper, we present an autonomous systems architecture and development framework paired with a persistent distributed modeling and simulation (ModSim) environment for test and evaluation of autonomous systems. They were designed under ATTRACTOR in order to measure and establish trustworthiness and trust in single-and multi-agent human-machine systems whether these machines are fixed-wing general aviation, rotary-wing Unmanned Aerial Vehicles (UAVs), ground rovers, or even spacecraft. The Autonomous Entity Operational Network (AEON) framework enables autonomous system development with an easily extensible collection of libraries and plug-n-play nodes facilitated by the Data Distribution Service (DDS) communication protocol standard. The Baseline Environment for Autonomous Modeling (BEAM) simulation environment is a distributed mixed-reality Unity™-based environment built around the same DDS communication paradigm allowing for easy integration with AEON-based autonomous applications, enabling sim-to-flight with minimal configuration changes. Using AEON and BEAM, source code that runs in simulation ports directly to hardware and has successfully flown in the National Airspace System (NAS) at NASA LaRC many times over the lifetime of ATTRACTOR.
Benjamin N Kelley↗
A Concept of Operations (ConOps) of an In-time Aviation Safety Management System (IASMS) for Advanced Air Mobility (AAM)
The growth of new emerging operations involving Advanced Air Mobility (AAM) necessitates developing a perspective for an In-time Aviation Safety Management System (IASMS). This perspective advances from the National Academies report on IASMS and its recommendation for developing a Concept of Operations (ConOps) for IASMS. A ConOps has been developed for In-time System-Wide Safety Assurance (ISSA) from which the IASMS ConOps pivots to provide a robust scope commensurate with the broad vision defined by the National Academies. The IASMS ConOps focuses on emerging operations and spans innovations in Unmanned Aircraft System (UAS) and an increasingly complex ecosystem comprised of a widening mix of vehicles and technologies, Urban Air Mobility (UAM) with industry-federated services, traditional operations, as well as new supersonic aircraft and space launch systems.The challenge for the IASMS ConOps is to be broad to encompass innovations in the coming years and decades while agile to ensure levels of safety compatible with operational and certification requirements of the National Airspace System (NAS). The IASMS ConOps interweaves increasing complexity of operational safety capabilities and unlocking UAS Maturity Levels (UMLs). The relationships between increased complexity of automation and automated systems, fewer operators who are not as traditionally higher skilled, more complex operational environments, and aviation operations management with mixed aircraft and equipage pose a multi-dimensional space for IASMS capabilities essential for safety assurance and risk management. Instantiating IASMS capabilities and how they would be integral to AAM operations and increasing maturity of UAM could be accomplished through a series of Safety Demonstrators. These Safety Demonstrators could provide increased understanding and insight into use of controls for risk mitigation, means of compliance for certification, and operational experience with safety services such as in relation to contingency management. The IASMS capabilities can be viewed as initially residing with the vehicle, airspace, and Supplemental Data Service Provider (SDSP). For example, vehicle capabilities include communications including the command and control link, Remote Identification (ID), conflict advisory/alerting, and UAS system monitoring. These capabilities monitor and assess data such as battery health, aircraft state, and human performance. Complexity of ISAMS capabilities depends on a number of factors. These factors are intendedonly as a notional categorization with the purpose being to reflect the complexity of the AAM ecosystem that would drive up the complexity of ISSA capabilities including systems, sensors, models, standards, and controls. Factors could include the Vehicle Flight Management, Environment, Airspace, and Contingency Management. Each of these factors can be comprised of multiple sub-factors that contribute to increasing complexity. For example, Airspace at a lower level of complexity could be dedicated to UTM operations that are unmonitored, and at a higher level of complexity could involve mixed UTM and ATM operations. The IASMS concept includes safety services that provide data and information to different participants in AAM. The roles and responsibilities of participants can be defined using the Responsible-Accountable-Consulted-Informed (RACI) analysis. For example, for the safety service involving the Remote ID, the Operator would be accountable for providing the data, the Vehicle would be responsible for transmitting it, and the USS, SDSP, Vertiports, FIMS (FAA), and Public Entities such as safety services would be informed by receiving the data. The IASMS ConOps identifies the capabilities needed for risk mitigation and safety assurance in the increasingly complex national airspace. The ConOps serves as a pathway for engaging with industry to gain operational experience including through the Safety Demonstrator series, the RACI analysis, and operational complexity factors. The ConOps serves to integrate these different perspectives to build a cohesive and cogent approach to an AAM safety management system.
In-Time Aviation Safety Management System↗
Proceedings of the Third International Workshop on Proof-Carrying Code and Software Certification
This NASA conference publication contains the proceedings of the Third International Workshop on Proof-Carrying Code and Software Certification, held as part of LICS in Los Angeles, CA, USA, on August 15, 2009. Software certification demonstrates the reliability, safety, or security of software systems in such a way that it can be checked by an independent authority with minimal trust in the techniques and tools used in the certification process itself. It can build on existing validation and verification (V&V) techniques but introduces the notion of explicit software certificates, Vvilich contain all the information necessary for an independent assessment of the demonstrated properties. One such example is proof-carrying code (PCC) which is an important and distinctive approach to enhancing trust in programs. It provides a practical framework for independent assurance of program behavior; especially where source code is not available, or the code author and user are unknown to each other. The workshop wiII address theoretical foundations of logic-based software certification as well as practical examples and work on alternative application domains. Here "certificate" is construed broadly, to include not just mathematical derivations and proofs but also safety and assurance cases, or any fonnal evidence that supports the semantic analysis of programs: that is, evidence about an intrinsic property of code and its behaviour that can be independently checked by any user, intermediary, or third party. These guarantees mean that software certificates raise trust in the code itself, distinct from and complementary to any existing trust in the creator of the code, the process used to produce it, or its distributor. In addition to the contributed talks, the workshop featured two invited talks, by Kelly Hayhurst and Andrew Appel. The PCC 2009 website can be found at http://ti.arc.nasa.gov /event/pcc 091.
Ewen, Denney, W.↗
Wind Shear/Turbulence Inputs to Flight Simulation and Systems Certification
The purpose of the workshop was to provide a forum for industry, universities, and government to assess current status and likely future requirements for application of flight simulators to aviation safety concerns and system certification issues associated with wind shear and atmospheric turbulence. Research findings presented included characterization of wind shear and turbulence hazards based on modeling efforts and quantitative results obtained from field measurement programs. Future research thrusts needed to maximally exploit flight simulators for aviation safety application involving wind shear and turbulence were identified. The conference contained sessions on: Existing wind shear data and simulator implementation initiatives; Invited papers regarding wind shear and turbulence simulation requirements; and Committee working session reports.
Bowles, Roland L.↗
In Situ Multi-Species (O2, N2, Fuel, Other) Fiber Optic Sensor for Fuel Tank Ullage
A rugged and compact fiber optic sensor system for in situ real-time measurement of nitrogen (N2), oxygen (O2), hydrocarbon (HC) fuel vapors, and other gases has been developed over the past several years at Glenn Research Center. The intrinsically-safe, solid-state fiber optic sensor system provides a 1% precision measurement (by volume) of multiple gases in a 5-sec time window. The sensor has no consumable parts to wear out and requires less than 25 W of electrical power to operate. The sensor head is rugged and compact and is ideal for use in harsh environments such as inside an aircraft fuel tank, or as a feedback sensor in the vent-box of an on-board inert gas generation system (OBIGGS). Multiple sensor heads can be monitored with a single optical detection unit for a cost-effective multi-point sensor system. The present sensor technology is unique in its ability to measure N2 concentration directly, and in its ability to differentiate different types of HC fuels. The present sensor system provides value-added aircraft safety information by simultaneously and directly measuring the nitrogen-oxygen-fuel triplet, which provides the following advantages: (1) information regarding the extent of inerting by N2, (2) information regarding the chemical equivalence ratio, (3) information regarding the composition of the aircraft fuel, and (4) by providing a self-consistent calibration by utilizing a singular sensor for all species. Using the extra information made available by this sensor permits the ignitability of a fuel-oxidizer mixture to be more accurately characterized, which may permit a reduction in the amount of inerting required on a real-time basis, and yet still maintain a fire-safe fuel tank. This translates to an increase in fuel tank fire-safety through a better understanding of the physics of fuel ignition, and at the same time, a reduction in compressed bleed air usage and concomitant aircraft operational costs over the long-run. The present fiber optic sensor can also be used as a false-alarm-free engine/hidden/cargo space fire detector (by measuring increased CO2 and CO, and decreased O2), a multi-point in situ measurement and certification system for halogenated-compound fire protection systems, and for the testing and certification of other aircraft safety sensor systems. The technology (LEW-17826-1) developed in the present sensor system is patent pending.
Nguyen, Quang-Viet↗
Exploration of Near-Term Potential Routes and Procedures for Urban Air Mobility
Urban air mobility is gaining interest as the need for On Demand Mobility in today's congested traffic is becoming high in metropolitan areas. Urban Air Mobility (UAM) is envisioned as a concept to transport passengers and cargo safely and efficiently using innovative aircraft in the urban areas. It is expected to improve mobility for the general public, decongest road traffic, reduce transport time and reduce the strain on existing public transport networks. There exist several challenges to Urban Air Mobility (UAM) such as integration of procedures with airspace and the airport, noise levels that are acceptable to the general public, public safety, public acceptance, vehicle certification, and more. Most of the research in the United States and European skies (DLR - German Aerospace Center) related to urban areas has focused on small UAS (Unmanned Aircraft Systems) flights (NASA's UTM (UAS Traffic Management) research) and their integration with the airspace and building safe operations in densely populated areas. Previous studies on UAM have focused on fast time simulations of the routes that are separated via a separation service and network of routes. Similarly, research in Europe has focused on the approach profile for these innovative aircraft, vertiports and battery life among others. UAM as a part of the On-Demand Mobility effort has provided some guidelines for operations as shown below: Does not require additional ATC (Air Traffic Control) infrastructure; Does not impose additional workload on ATC; Does not restrict operations of traditional airspace users; Will meet appropriate safety thresholds and requirements; Will prioritize operational scalability; Will allow flexibility where possible and structure where necessary. This paper explores potential routes and procedures in a Human-In-The-Loop (HITL) experiment that could be applied in the near-term to allow integration of UAM flights into the airspace as well as a large airport. The airspace that was explored was Dallas Fort Worth (DFW) airspace managed by the DFW East Tower in South Flow only. In addition, Dallas Love Field (DAL) and Addison (ADS) airspace were also part of the testbed. The initial set of routes investigated in this study were published helicopter routes in the DFW area. Figure 1 shows class B airspace in DFW area and the origin/destination city pairs where UAM flights flew along with helicopter routes shown in blue. The research focused on exploring procedures for integrating UAM flights into Class Bravo and Class Delta airspace. Three different communication procedures, evaluated with three different levels of UAM traffic, are shown in Table 1. The current day routes were evaluated with current day communication procedures were explored as the first condition. The current day routes were also evaluated in the second condition with reduced communications, which was assumed due to the presence of a Letter Of Agreement (LOA). The purpose of the LOA was to reduce the verbiage associated with pilots getting clearance to Class B airspace from the controllers, pre-assigning beacons codes to the UAM flights, separate routes by assigning altitudes and speeds to flights going in any one direction. Flights were expected to automatically change frequency when exiting Class B airspace, thus transition points for entry and exit points were also specified in the LOA.
Urban Air Mobility↗
Dynamic Open-Rotor Composite Shield Impact Test Report
The Federal Aviation Administration (FAA) is working with the European Aviation Safety Agency to determine the certification base for proposed new engines that would not have a containment structure on large commercial aircraft. Equivalent safety to the current fleet is desired by the regulators, which means that loss of a single fan blade will not cause hazard to the aircraft. NASA Glenn and Naval Air Warfare Center (NAWC) China Lake collaborated with the FAA Aircraft Catastrophic Failure Prevention Program to design and test a shield that would protect the aircraft passengers and critical systems from a released blade that could impact the fuselage. This report documents the live-fire test from a full-scale rig at NAWC China Lake. NASA provided manpower and photogrammetry expertise to document the impact and damage to the shields. The test was successful: the blade was stopped from penetrating the shield, which validates the design analysis method and the parameters used in the analysis. Additional work is required to implement the shielding into the aircraft.
Shielding↗
Analysis and Testing of a Composite Fuselage Shield for Open Rotor Engine Blade-Out Protection
The Federal Aviation Administration is working with the European Aviation Safety Agency to determine the certification base for proposed new engines that would not have a containment structure on large commercial aircraft. Equivalent safety to the current fleet is desired by the regulators, which means that loss of a single fan blade will not cause hazard to the Aircraft. The NASA Glenn Research Center and The Naval Air Warfare Center (NAWC), China Lake, collaborated with the FAA Aircraft Catastrophic Failure Prevention Program to design and test lightweight composite shields for protection of the aircraft passengers and critical systems from a released blade that could impact the fuselage. In the test, two composite blades were pyrotechnically released from a running engine, each impacting a composite shield with a different thickness. The thinner shield was penetrated by the blade and the thicker shield prevented penetration. This was consistent with pre-test predictions. This paper documents the live fire test from the full scale rig at NAWC China Lake and describes the damage to the shields as well as instrumentation results.
safety↗
Analysis and Testing of a Composite Fuselage Shield for Open Rotor Engine Blade-Out Protection
The Federal Aviation Administration is working with the European Aviation Safety Agency to determine the certification base for proposed new engines that would not have a containment structure on large commercial aircraft. Equivalent safety to the current fleet is desired by the regulators, which means that loss of a single fan blade will not cause hazard to the Aircraft. The NASA Glenn Research Center and The Naval Air Warfare Center (NAWC), China Lake, collaborated with the FAA Aircraft Catastrophic Failure Prevention Program to design and test lightweight composite shields for protection of the aircraft passengers and critical systems from a released blade that could impact the fuselage. LS-DYNA® was used to predict the thickness of the composite shield required to prevent blade penetration. In the test, two composite blades were pyrotechnically released from a running engine, each impacting a composite shield with a different thickness. The thinner shield was penetrated by the blade and the thicker shield prevented penetration. This was consistent with pre-test LS-DYNA predictions. This paper documents the analysis conducted to predict the required thickness of a composite shield, the live fire test from the full scale rig at NAWC China Lake and describes the damage to the shields as well as instrumentation results.
Composite↗
Prediction of noise constrained optimum takeoff procedures
An optimization method is used to predict safe, maximum-performance takeoff procedures which satisfy noise constraints at multiple observer locations. The takeoff flight is represented by two-degree-of-freedom dynamical equations with aircraft angle-of-attack and engine power setting as control functions. The engine thrust, mass flow and noise source parameters are assumed to be given functions of the engine power setting and aircraft Mach number. Effective Perceived Noise Levels at the observers are treated as functionals of the control functions. The method is demonstrated by applying it to an Advanced Supersonic Transport aircraft design. The results indicate that automated takeoff procedures (continuously varying controls) can be used to significantly reduce community and certification noise without jeopardizing safety or degrading performance.
Padula, S. L.↗
Distributed and Centralized Conflict Management Under Traffic Flow Management Constraints
Current air transportation in the United States relies on a system born half a century ago. While demand for air travel has kept increasing over the years, technologies at the heart of the National Airspace System (NAS) have not been able to follow an adequate evolution. For instance, computers used to centralize flight data in airspace sectors run a software developed in 1972. Safety, as well as certification and portability issues arise as major obstacles for the improvement of the system. The NAS is a structure that has never been designed, but has rather evolved over time. This has many drawbacks, mainly due to a lack of integration and engineering leading to many inefficiencies and losses of performance. To improve the operations, understanding of this complex needs to be built up to a certain level. This work presents research done on Air Traffic Management (ATM) at the level of the en-route sector.
Feron, Eric↗
Safe to Fly: Certifying COTS Hardware for Spaceflight
Providing hardware for the astronauts to use on board the Space Shuttle or International Space Station (ISS) involves a certification process that entails evaluating hardware safety, weighing risks, providing mitigation, and verifying requirements. Upon completion of this certification process, the hardware is deemed safe to fly. This process from start to finish can be completed as quickly as 1 week or can take several years in length depending on the complexity of the hardware and whether the item is a unique custom design. One area of cost and schedule savings that NASA implements is buying Commercial Off the Shelf (COTS) hardware and certifying it for human spaceflight as safe to fly. By utilizing commercial hardware, NASA saves time not having to develop, design and build the hardware from scratch, as well as a timesaving in the certification process. By utilizing COTS hardware, the current detailed certification process can be simplified which results in schedule savings. Cost savings is another important benefit of flying COTS hardware. Procuring COTS hardware for space use can be more economical than custom building the hardware. This paper will investigate the cost savings associated with certifying COTS hardware to NASA s standards rather than performing a custom build.
Fichuk, Jessica L.↗
International Space Station Acoustics - A Status Report
It is important to control acoustic noise aboard the International Space Station (ISS) to provide a satisfactory environment for voice communications, crew productivity, and restful sleep, and to minimize the risk for temporary and permanent hearing loss. Acoustic monitoring is an important part of the noise control process on ISS, providing critical data for trend analysis, noise exposure analysis, validation of acoustic analysis and predictions, and to provide strong evidence for ensuring crew health and safety, thus allowing Flight Certification. To this purpose, sound level meter (SLM) measurements and acoustic noise dosimetry are routinely performed. And since the primary noise sources on ISS include the environmental control and life support system (fans and airflow) and active thermal control system (pumps and water flow), acoustic monitoring will indicate changes in hardware noise emissions that may indicate system degradation or performance issues. This paper provides the current acoustic levels in the ISS modules and sleep stations, and is an update to the status presented in 20031. Many new modules, and sleep stations have been added to the ISS since that time. In addition, noise mitigation efforts have reduced noise levels in some areas. As a result, the acoustic levels on the ISS have improved.
Allen, Christopher S.↗
NASA-KSC/SA STS-123 Safety and Mission Success Review SMSR (SMSR) Launch Vehicle Processing Certificate of Flight Readiness Matrix
No abstract available
Osgood, Jeffery M.↗
International Space Station Acoustics - A Status Report
It is important to control acoustic noise aboard the International Space Station (ISS) to provide a satisfactory environment for voice communications, crew productivity, alarm audibility, and restful sleep, and to minimize the risk for temporary and permanent hearing loss. Acoustic monitoring is an important part of the noise control process on ISS, providing critical data for trend analysis, noise exposure analysis, validation of acoustic analyses and predictions, and to provide strong evidence for ensuring crew health and safety, thus allowing Flight Certification. To this purpose, sound level meter (SLM) measurements and acoustic noise dosimetry are routinely performed. And since the primary noise sources on ISS include the environmental control and life support system (fans and airflow) and active thermal control system (pumps and water flow), acoustic monitoring will reveal changes in hardware noise emissions that may indicate system degradation or performance issues. This paper provides the current acoustic levels in the ISS modules and sleep stations and is an update to the status presented in 2011. Since this last status report, many payloads (science experiment hardware) have been added and a significant number of quiet ventilation fans have replaced noisier fans in the Russian Segment. Also, noise mitigation efforts are planned to reduce the noise levels of the T2 treadmill and levels in Node 3, in general. As a result, the acoustic levels on the ISS continue to improve.
Allen, Christopher S.↗