SEARCH · Search NASA
Results for “Assurance Cases”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Overarching Properties as Means of Compliance: An Industrial Case Study
The Overarching Properties (OPs) have been created by an inter-national working group and are being evaluated by the National Aeronautics and Space Administration (NASA), the Federal Aviation Administration (FAA), industry, and other certifying agencies in an effort to streamline certification processes. Their intent is to facilitate the use of alternative approaches and to al-low flexibility to combine the system, software, and complex hardware certification. The hope is that the FAA may eventually establish an Advisory Circular that offers the OPs as a Means of Compliance (MoC) for software approval (and eventually systems and hardware) by showing the product possesses the three OPs: Intent (specification of the intended behavior), Correctness (implementation of the intended behavior) and Innocuity (safety of unintended behavior). In the certification community, there is still a concern about the practicability of using such high level properties in certification. This paper aims to address that concern by showing possession of the OPs in an industrial case study using assurance arguments. The two main contributions of this paper are: a certification process based on OPs as Means of Compliance, and a certification argument for an on-board physical model of an UAV, as industrial example. We pro-pose a hybrid approach for the certification process that combines OPs with existing certification standards. Thus, OPs can be used for parts of a system that uses technologies that are not supported by current standards or for which existing standards require additional effort without commensurate additional safety assurance.
Dynamic Safety Cases for Through-Life Safety Assurance
We describe dynamic safety cases, a novel operationalization of the concept of through-life safety assurance, whose goal is to enable proactive safety management. Using an example from the aviation systems domain, we motivate our approach, its underlying principles, and a lifecycle. We then identify the key elements required to move towards a formalization of the associated framework.
International Cooperation on Model Based Development for Spaceflight Assurance: The Trilateral Assurance CubeSat (TACS) Test Case
Explore the source record for details and available documents.
Retrospectively Documenting Satisfaction of the Overarching Properties: An Exploratory Prototype
Software-intensive aviation systems are typically developed in accordance with recognized development process, safety analysis, and software development standards such as SAE ARP4754A, SAE ARP4761, and RTCA DO-178C. Efforts to streamline assurance processes and make them flexible enough to handle future assurance challenges have produced the Overarching Properties (OPs) for airworthiness approval. Each of the three OPs is a property systems must possess to be certifiable. There is no mandated means of documenting possession of the OPs. To explore possible means, we have prepared retrospective documentation showing that a specimen software system possesses the OPs. The specimen system, Safeguard, enforces geofencing restrictions on unmanned aerial vehicles. Our OP-possession case for its airborne component comprises eight arguments in the Goal Structuring Notation (GSN): a main argument for each OP and five cross-cutting auxiliary arguments. We present this argument as an example for discussion and further research, e.g., into means of assessing OP possession.
Human Spaceflight Trajectory Operations: A Case Study from STS-132/ULF4
Prior to the launch of the STS-132/ULF4 mission, the International Space Station (ISS) Flight Control Team was alerted to the approach of a space debris with a predicted time of closest approach approximately 1 hr after Space Shuttle docking. As a result, the ISS team considered performing a collision avoidance maneuver prior to the Space Shuttle s approach. The purpose of this presentation will be to use this case study to illustrate best practices of the human spaceflight trajectory operations team. The presentation will begin with an overview of the roles of the real-time ISS and Space Shuttle trajectory flight control teams. Then, the STS-132/ULF4 case study will be used to illustrate the issues and lessons learned involved in performing Space Shuttle rendezvous maneuver planning and execution. Specific elements of the STS-132 Space Shuttle rendezvous maneuver profile that can be used to provide mission assurance in cases of trajectory uncertainty will be described and discussed. Additionally, this case study will be used to provide context for identifying lessons learned in an operational environment that requires technical and decision-making coordination between two control center teams with two potentially maneuvering space vehicles.
Radiation-aware Design for Cubesat Form-Factor Experiment Using Goal Structuring Notation
A Goal Structuring Notation (GSN) model is presented to argue for the radiation reliability of a SEU SCRAM experiment in a CubeSat form-factor for a 1 year old polar LEO mission.
A Primer on Argument (Overarching Properties Edition)
The purpose of this document is to establish for the Overarching Properties Working Group (OPWG) a common understanding of the terms, concepts, principles, and uses of argument. It emphasizes the practical over the theoretical and the simple over the complicated.
A Primer on Argument
The purpose of this document is to provide a common understanding of terms, concepts, principles, and uses of argument. It emphasizes the practical over the theoretical and the simple over the complicated.
Exploration of Frameworks, SysML, LLMs and Data Analytics to Optimize Reliability and Maintainability (R&M) Planning, Execution, and Evaluation for Safe and Successful Missions
Explore the source record for details and available documents.
Modernizing NASA’s Space Flight Safety and Mission Success (S&MS) Assurance Framework In Line With Evolving Acquisition Strategies and Systems Engineering Practices
This paper presents the objectives-driven, case-based safety and mission success (S&MS) assurance framework being developed by the NASA Office of Safety and Mission Assurance (OSMA), including its motivations and its implementation via a S&MS Assurance Standard that is under development, supplemented by supporting standards including an S&MS Analysis Management Standard that is also under development. A need to evolve NASA’s S&MS assurance framework has emerged in recent years, resulting from the need to accommodate new acquisition models; the need to accommodate evolving systems engineering (SE) practices; the need to stipulate acceptable levels of S&MS risk; the need for improved integration of S&MS into SE; and the need for clearer risk acceptance accountability. The objectives-driven, case-based S&MS assurance framework proposed here is responsive to that need. Its key features include: • The establishment, by NASA Acquirers, of fundamental S&MS performance objectives that define limits of acceptability for the likelihoods that mission technical objectives will be accomplished and that people, assets, and environments put at risk by the mission will not be adversely affected; • The development and approval of Providers’ S&MS plans for meeting Acquirers’ S&MS performance objectives, including commitments to support Acquirer audit, investigation, and reporting needs; • The development, by Providers, of S&MS assurance cases that argue, supported by evidence, that the Provider has met, or is on track to meeting, the fundamental S&MS objectives; • The evaluation, throughout the program/project life cycle, of Provider S&MS assurance cases as the primary S&MS-related technical basis for Acquirer risk acceptance and the granting to the Provider of authority to proceed through the program/project life cycle. This proposed S&MS assurance framework is notable for its lack of prescription of traditional S&MS requirements and strategies such as defined failure tolerances, margins, or analysis requirements. Instead, Providers are given latitude to propose their own strategies for meeting the fundamental S&MS performance objectives, subject to independent review and Acquirer approval. The result is a framework for S&MS assurance that is at once both rigorous and flexible.
An Investigation of Proposed Techniques for Quantifying Confidence in Assurance Arguments
The use of safety cases in certification raises the question of assurance argument sufficiency and the issue of confidence (or uncertainty) in the argument's claims. Some researchers propose to model confidence quantitatively and to calculate confidence in argument conclusions. We know of little evidence to suggest that any proposed technique would deliver trustworthy results when implemented by system safety practitioners. Proponents do not usually assess the efficacy of their techniques through controlled experiment or historical study. Instead, they present an illustrative example where the calculation delivers a plausible result. In this paper, we review current proposals, claims made about them, and evidence advanced in favor of them. We then show that proposed techniques can deliver implausible results in some cases. We conclude that quantitative confidence techniques require further validation before they should be recommended as part of the basis for deciding whether an assurance argument justifies fielding a critical system.
Parameter Impact on Sharing Studies Between UAS CNPC Satellite Transmitters and Terrestrial Systems
In order to provide a control and non-payload communication (CNPC) link for civil-use unmanned aircraft systems (UAS) when operating in beyond-line-of-sight (BLOS) conditions, satellite communication links are generally required. The International Civil Aviation Organization (ICAO) has determined that the CNPC link must operate over protected aviation safety spectrum allocations. Although a suitable allocation exists in the 5030-5091 MHz band, no satellites provide operations in this band and none are currently planned. In order to avoid a very lengthy delay in the deployment of UAS in BLOS conditions, it has been proposed to use existing satellites operating in the Fixed Satellite Service (FSS), of which many operate in several spectrum bands. Regulatory actions by the International Telecommunications Union (ITU) are needed to enable such a use on an international basis, and indeed Agenda Item (AI) 1.5 for the 2015 World Radiocommunication Conference (WRC) was established to decide on the enactment of possible regulatory provisions. As part of the preparation for AI 1.5, studies on the sharing FSS bands between existing services and CNPC for UAS are being contributed by NASA and others. These studies evaluate the potential impact of satellite CNPC transmitters operating from UAS on other in-band services, and on the potential impact of other in-band services on satellite CNPC receivers operating on UAS platforms. Such studies are made more complex by the inclusion of what are essentially moving FSS earth stations, compared to typical sharing studies between fixed elements. Hence, the process of determining the appropriate technical parameters for the studies meets with difficulty. In order to enable a sharing study to be completed in a less-than-infinite amount of time, the number of parameters exercised must be greatly limited. Therefore, understanding the impact of various parameter choices is accomplished through selectivity analyses. In the case of sharing studies for AI 1.5, identification of worst-case parameters allows the studies to be focused on worst-case scenarios with assurance that other parameter combinations will yield comparatively better results and therefore do not need to be fully analyzed. In this paper, the results of such sensitivity analyses are presented for the case of sharing between UAS CNPC satellite transmitters and terrestrial receivers using the Fixed Service (FS) operating in the same bands, and the implications of these analyses on sharing study results.
An MBSE Approach for Developing an Autonomous Rover Platform
The proliferation of increasingly autonomous systems calls for new ways to address how safety is assured. As these systems become more advanced and complex, it becomes more important to model and prototype autonomous functions at the systems level and the functions that assure they are operating safely and as expected. To that effect, researchers at the National Aeronautics and Space Administration (NASA) 's Robust Software Engineering (RSE) group are working on prototyping a Research Autonomous Vehicle, commonly referred to as R-RAV. The R-RAV is an autonomous rover platform designed to act as a case study for assured autonomy research. Moreover, an overarching goal is for the R-RAV to serve as a training ground for other mission projects. In this paper, we will detail how we have used a Model-Based Systems Engineering (MBSE) approach to model a prototype of the R-RAV and test and verify its different functionalities.
Five Year Flashlight
An ultra-reliable flashlight, initially developed for rescue signaling and utility use by NASA astronauts and military aircrews, has attracted a broad commercial market. Called the Five Year Light, it has a shelf life at least that long because there is no power drain on the batteries when the flashlight is not in use. The NASA version of the light was developed under contract with Langley Research Center by ACR Electronics, Inc., now known as the Chromalloy Electronics Division of Chromalloy American Corporation, Hollywood, Florida. NASA wanted a light that had long shelf life and assured reliability in case it was needed in an emergency. Reliability was designed into the flashlight by means of a unique switch. Instead of the customary thumb-button, the Five Year Light is turned on by rotating its collar to make contact with the battery terminal; the turning motion wipes away any corrosion that might be present and makes contact virtually certain. The Five Year Light available commercially is a repackaged version of the NASA light. It is sold for car, home, industrial, police, firefighting, recreational and a variety of other uses, and sales have topped two million units.
A Taxonomy of Fallacies in System Safety Arguments
Safety cases are gaining acceptance as assurance vehicles for safety-related systems. A safety case documents the evidence and argument that a system is safe to operate; however, logical fallacies in the underlying argument may undermine a system s safety claims. Removing these fallacies is essential to reduce the risk of safety-related system failure. We present a taxonomy of common fallacies in safety arguments that is intended to assist safety professionals in avoiding and detecting fallacious reasoning in the arguments they develop and review. The taxonomy derives from a survey of general argument fallacies and a separate survey of fallacies in real-world safety arguments. Our taxonomy is specific to safety argumentation, and it is targeted at professionals who work with safety arguments but may lack formal training in logic or argumentation. We discuss the rationale for the selection and categorization of fallacies in the taxonomy. In addition to its applications to the development and review of safety cases, our taxonomy could also support the analysis of system failures and promote the development of more robust safety case patterns.
FUELEAP Model-Based System Safety Analysis
NASA researchers, in a partnership with Boeing, are investigating a fuel-cell powered variant of the X-57 “Maxwell” Mod-II electric propulsion aircraft, which is itself derived from a stock Tecnam P2006T. The “Fostering Ultra-Efficient Low-Emitting Aviation Power” (FUELEAP) project will replace the X-57 power subsystem with a hybrid Solid-Oxide Fuel Cell (SOFC) system to increase the potential range of the electric-propulsion aircraft while dramatically improving efficiency and emissions over stock internal-combustion engines. Our FUELEAP safety analysis faces two primary challenges. First, the Part 23 certificated Tecnam P2006T is undergoing significant modifications to host the hybrid electric-propulsion system, and the challenge is to assure that the safety inherent in the stock aircraft (and subsequently in X-57 Mod-II) is not compromised by changes in avionics, aircraft structural loading, weight and balance, or other considerations. Secondly, because the SOFC power system has little (if any) relevant in-service precedent, our challenge is to assure that we identify and mitigate all reasonably plausible hazards introduced by unique FUELEAP equipage. We are investigating and utilizing Model-Based Safety Analysis (MBSA) methods to help us address these FUELEAP safety challenges. We captured aircraft-level system hazard conditions using instances of a SysML hazard block via aircraft-level Functional Hazard Analysis (FHA). Then, using SysML models of the FUELEAP architecture, we related the hazard conditions to initiating system events and possible mitigations, such as design architecture modifications or operational constraints. We are continuing to define our approach to MBSA by developing a component-by-component inventory of local failure modes and tracing their possible contribution to hazard conditions. Finally, we are applying an argument-based approach to FUELEAP assurance. Through a FUELEAP “safety case,” we are providing an explicit argument for FUELEAP safety by associating assurance evidence with overarching safety claims through a structured argument.
Sandia's Uncertainty Calculator: A case study in the graded approach to software quality assurance.
Abstract not provided.