A Primer on Argument
The purpose of this document is to provide a common understanding of terms, concepts, principles, and uses of argument. It emphasizes the practical over the theoretical and the simple over the complicated.
argument↗
SEARCH · Search NASA
Results for “assurance case”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Exploration of Frameworks, SysML, LLMs and Data Analytics to Optimize Reliability and Maintainability (R&M) Planning, Execution, and Evaluation for Safe and Successful Missions
Explore the source record for details and available documents.
Safety↗
Modernizing NASA’s Space Flight Safety and Mission Success (S&MS) Assurance Framework In Line With Evolving Acquisition Strategies and Systems Engineering Practices
This paper presents the objectives-driven, case-based safety and mission success (S&MS) assurance framework being developed by the NASA Office of Safety and Mission Assurance (OSMA), including its motivations and its implementation via a S&MS Assurance Standard that is under development, supplemented by supporting standards including an S&MS Analysis Management Standard that is also under development. A need to evolve NASA’s S&MS assurance framework has emerged in recent years, resulting from the need to accommodate new acquisition models; the need to accommodate evolving systems engineering (SE) practices; the need to stipulate acceptable levels of S&MS risk; the need for improved integration of S&MS into SE; and the need for clearer risk acceptance accountability. The objectives-driven, case-based S&MS assurance framework proposed here is responsive to that need. Its key features include: • The establishment, by NASA Acquirers, of fundamental S&MS performance objectives that define limits of acceptability for the likelihoods that mission technical objectives will be accomplished and that people, assets, and environments put at risk by the mission will not be adversely affected; • The development and approval of Providers’ S&MS plans for meeting Acquirers’ S&MS performance objectives, including commitments to support Acquirer audit, investigation, and reporting needs; • The development, by Providers, of S&MS assurance cases that argue, supported by evidence, that the Provider has met, or is on track to meeting, the fundamental S&MS objectives; • The evaluation, throughout the program/project life cycle, of Provider S&MS assurance cases as the primary S&MS-related technical basis for Acquirer risk acceptance and the granting to the Provider of authority to proceed through the program/project life cycle. This proposed S&MS assurance framework is notable for its lack of prescription of traditional S&MS requirements and strategies such as defined failure tolerances, margins, or analysis requirements. Instead, Providers are given latitude to propose their own strategies for meeting the fundamental S&MS performance objectives, subject to independent review and Acquirer approval. The result is a framework for S&MS assurance that is at once both rigorous and flexible.
Assurance Case↗
An Investigation of Proposed Techniques for Quantifying Confidence in Assurance Arguments
The use of safety cases in certification raises the question of assurance argument sufficiency and the issue of confidence (or uncertainty) in the argument's claims. Some researchers propose to model confidence quantitatively and to calculate confidence in argument conclusions. We know of little evidence to suggest that any proposed technique would deliver trustworthy results when implemented by system safety practitioners. Proponents do not usually assess the efficacy of their techniques through controlled experiment or historical study. Instead, they present an illustrative example where the calculation delivers a plausible result. In this paper, we review current proposals, claims made about them, and evidence advanced in favor of them. We then show that proposed techniques can deliver implausible results in some cases. We conclude that quantitative confidence techniques require further validation before they should be recommended as part of the basis for deciding whether an assurance argument justifies fielding a critical system.
Graydon, Patrick J.↗
Parameter Impact on Sharing Studies Between UAS CNPC Satellite Transmitters and Terrestrial Systems
In order to provide a control and non-payload communication (CNPC) link for civil-use unmanned aircraft systems (UAS) when operating in beyond-line-of-sight (BLOS) conditions, satellite communication links are generally required. The International Civil Aviation Organization (ICAO) has determined that the CNPC link must operate over protected aviation safety spectrum allocations. Although a suitable allocation exists in the 5030-5091 MHz band, no satellites provide operations in this band and none are currently planned. In order to avoid a very lengthy delay in the deployment of UAS in BLOS conditions, it has been proposed to use existing satellites operating in the Fixed Satellite Service (FSS), of which many operate in several spectrum bands. Regulatory actions by the International Telecommunications Union (ITU) are needed to enable such a use on an international basis, and indeed Agenda Item (AI) 1.5 for the 2015 World Radiocommunication Conference (WRC) was established to decide on the enactment of possible regulatory provisions. As part of the preparation for AI 1.5, studies on the sharing FSS bands between existing services and CNPC for UAS are being contributed by NASA and others. These studies evaluate the potential impact of satellite CNPC transmitters operating from UAS on other in-band services, and on the potential impact of other in-band services on satellite CNPC receivers operating on UAS platforms. Such studies are made more complex by the inclusion of what are essentially moving FSS earth stations, compared to typical sharing studies between fixed elements. Hence, the process of determining the appropriate technical parameters for the studies meets with difficulty. In order to enable a sharing study to be completed in a less-than-infinite amount of time, the number of parameters exercised must be greatly limited. Therefore, understanding the impact of various parameter choices is accomplished through selectivity analyses. In the case of sharing studies for AI 1.5, identification of worst-case parameters allows the studies to be focused on worst-case scenarios with assurance that other parameter combinations will yield comparatively better results and therefore do not need to be fully analyzed. In this paper, the results of such sensitivity analyses are presented for the case of sharing between UAS CNPC satellite transmitters and terrestrial receivers using the Fixed Service (FS) operating in the same bands, and the implications of these analyses on sharing study results.
air traffic control↗
An MBSE Approach for Developing an Autonomous Rover Platform
The proliferation of increasingly autonomous systems calls for new ways to address how safety is assured. As these systems become more advanced and complex, it becomes more important to model and prototype autonomous functions at the systems level and the functions that assure they are operating safely and as expected. To that effect, researchers at the National Aeronautics and Space Administration (NASA) 's Robust Software Engineering (RSE) group are working on prototyping a Research Autonomous Vehicle, commonly referred to as R-RAV. The R-RAV is an autonomous rover platform designed to act as a case study for assured autonomy research. Moreover, an overarching goal is for the R-RAV to serve as a training ground for other mission projects. In this paper, we will detail how we have used a Model-Based Systems Engineering (MBSE) approach to model a prototype of the R-RAV and test and verify its different functionalities.
MBSE↗
Five Year Flashlight
An ultra-reliable flashlight, initially developed for rescue signaling and utility use by NASA astronauts and military aircrews, has attracted a broad commercial market. Called the Five Year Light, it has a shelf life at least that long because there is no power drain on the batteries when the flashlight is not in use. The NASA version of the light was developed under contract with Langley Research Center by ACR Electronics, Inc., now known as the Chromalloy Electronics Division of Chromalloy American Corporation, Hollywood, Florida. NASA wanted a light that had long shelf life and assured reliability in case it was needed in an emergency. Reliability was designed into the flashlight by means of a unique switch. Instead of the customary thumb-button, the Five Year Light is turned on by rotating its collar to make contact with the battery terminal; the turning motion wipes away any corrosion that might be present and makes contact virtually certain. The Five Year Light available commercially is a repackaged version of the NASA light. It is sold for car, home, industrial, police, firefighting, recreational and a variety of other uses, and sales have topped two million units.
Source record↗
A Taxonomy of Fallacies in System Safety Arguments
Safety cases are gaining acceptance as assurance vehicles for safety-related systems. A safety case documents the evidence and argument that a system is safe to operate; however, logical fallacies in the underlying argument may undermine a system s safety claims. Removing these fallacies is essential to reduce the risk of safety-related system failure. We present a taxonomy of common fallacies in safety arguments that is intended to assist safety professionals in avoiding and detecting fallacious reasoning in the arguments they develop and review. The taxonomy derives from a survey of general argument fallacies and a separate survey of fallacies in real-world safety arguments. Our taxonomy is specific to safety argumentation, and it is targeted at professionals who work with safety arguments but may lack formal training in logic or argumentation. We discuss the rationale for the selection and categorization of fallacies in the taxonomy. In addition to its applications to the development and review of safety cases, our taxonomy could also support the analysis of system failures and promote the development of more robust safety case patterns.
Greenwell, William S.↗
FUELEAP Model-Based System Safety Analysis
NASA researchers, in a partnership with Boeing, are investigating a fuel-cell powered variant of the X-57 “Maxwell” Mod-II electric propulsion aircraft, which is itself derived from a stock Tecnam P2006T. The “Fostering Ultra-Efficient Low-Emitting Aviation Power” (FUELEAP) project will replace the X-57 power subsystem with a hybrid Solid-Oxide Fuel Cell (SOFC) system to increase the potential range of the electric-propulsion aircraft while dramatically improving efficiency and emissions over stock internal-combustion engines. Our FUELEAP safety analysis faces two primary challenges. First, the Part 23 certificated Tecnam P2006T is undergoing significant modifications to host the hybrid electric-propulsion system, and the challenge is to assure that the safety inherent in the stock aircraft (and subsequently in X-57 Mod-II) is not compromised by changes in avionics, aircraft structural loading, weight and balance, or other considerations. Secondly, because the SOFC power system has little (if any) relevant in-service precedent, our challenge is to assure that we identify and mitigate all reasonably plausible hazards introduced by unique FUELEAP equipage. We are investigating and utilizing Model-Based Safety Analysis (MBSA) methods to help us address these FUELEAP safety challenges. We captured aircraft-level system hazard conditions using instances of a SysML hazard block via aircraft-level Functional Hazard Analysis (FHA). Then, using SysML models of the FUELEAP architecture, we related the hazard conditions to initiating system events and possible mitigations, such as design architecture modifications or operational constraints. We are continuing to define our approach to MBSA by developing a component-by-component inventory of local failure modes and tracing their possible contribution to hazard conditions. Finally, we are applying an argument-based approach to FUELEAP assurance. Through a FUELEAP “safety case,” we are providing an explicit argument for FUELEAP safety by associating assurance evidence with overarching safety claims through a structured argument.
Woodham, Kurt P.↗
Comprehensive Forced Response Analysis of J2X Turbine Bladed-Discs with 360 Degree Variation in CFD Loading
The temporal frequency content of the dynamic pressure predicted by a 360 degree computational fluid dynamics (CFD) analysis of a turbine flow field provides indicators of forcing function excitation frequencies (e.g., multiples of blade pass frequency) for turbine components. For the Pratt and Whitney Rocketdyne J-2X engine turbopumps, Campbell diagrams generated using these forcing function frequencies and the results of NASTRAN modal analyses show a number of components with modes in the engine operating range. As a consequence, forced response and static analyses are required for the prediction of combined stress, high cycle fatigue safety factors (HCFSF). Cyclically symmetric structural models have been used to analyze turbine vane and blade rows, not only in modal analyses, but also in forced response and static analyses. Due to the tortuous flow pattern in the turbine, dynamic pressure loading is not cyclically symmetric. Furthermore, CFD analyses predict dynamic pressure waves caused by adjacent and non-adjacent blade/vane rows upstream and downstream of the row analyzed. A MATLAB script has been written to calculate displacements due to the complex cyclically asymmetric dynamic pressure components predicted by CFD analysis, for all grids in a blade/vane row, at a chosen turbopump running speed. The MATLAB displacements are then read into NASTRAN, and dynamic stresses are calculated, including an adjustment for possible mistuning. In a cyclically symmetric NASTRAN static analysis, static stresses due to centrifugal, thermal, and pressure loading at the mode running speed are calculated. MATLAB is used to generate the HCFSF at each grid in the blade/vane row. When compared to an approach assuming cyclic symmetry in the dynamic flow field, the current approach provides better assurance that the worst case safety factor has been identified. An extended example for a J-2X turbopump component is provided.
Elrod, David↗
Lunar Entry Downmode Options for Orion
For Exploration Missions 1 and 2, the Orion capsules will be entering the Earth's atmosphere with speeds in excess of 11 km/s. In the event of a degraded Guidance, Navigation, and Control system, attempting the nominal guided entry may be inadvisable due to the potential for failures that result in a loss of vehicle (or crew, when crew are aboard). In such a case, a method of assuring Earth capture, water landing, and observence of trajectory constraints (heating, loads) is desired. Such a method should also be robust to large state uncertainty and variations in entry interface states. This document will explore four approaches evaluated and their performance in ensuring a safe return of the Orion capsule in the event of onboard system degradation.
Smith, Kelly M.↗
Identifying Where Mission Assurance Can Benefit from Model Based Systems Engineering
Model Based Systems Engineering (MBSE) is being introduced and used to support many aspects of the engineering of complex systems. Our focus is on space systems, with a particular interest in Mission Assurance of those systems. We seek to identify where Mission Assurance can potentially benefit when a space system is developed using an MBSE approach. To do so we consider how MBSE can help provide the evidence that Mission Assurance needs, using the recently developed NASA Reliability and Maintainability Objective Hierarchy as the exposition of those needs. We illustrate this MBSE’s potential contributions using examples drawn from our prior survey of the MBSE literature addressing space mission assurance concerns. The overall conclusion we draw from this is that there are numerous ways in which MBSE may, and in some cases already does, support Mission Assurance.
Feather, Martin S.↗
Safety of hydrogen pressure gauges.
Study of the relative safety afforded an operator by various hydrogen-pressure gauge case designs. It is shown that assurance of personnel safety, should a failure occur, requires careful selection of available gauge designs, together with proper mounting. Specific gauge case features and mounting requirements are recommended.
Voth, R. O.↗
On wave stability in relativistic cosmic-ray hydrodynamics
Wave stability of a two-fluid hydrodynamical model describing the acceleration of cosmic rays by the first-order Fermi mechanism in relativistic, cosmic-ray-modified shocks is investigated. For a uniform background state, the short- and long-wavelength wave speeds are shown to interlace, thus assuring wave stability in this case. A JWKB analysis is performed to investigate the stability of short-wavelength thermal gas sound waves in the smooth, decelerating supersonic flow upstream of a relativistic, cosmic-ray-modified shock. The stability of the waves is assessed both in terms of the fluid velocity and density perturbations, as well as in terms of the wave action. The stability and interaction of the short-wavelength cosmic-ray coherent mode with the background flow is also studied.
Webb, G. M.↗
Model Checking Failed Conjectures in Theorem Proving: A Case Study
Interactive mechanical theorem proving can provide high assurance of correct design, but it can also be a slow iterative process. Much time is spent determining why a proof of a conjecture is not forthcoming. In some cases, the conjecture is false and in others, the attempted proof is insufficient. In this case study, we use the SAL family of model checkers to generate a concrete counterexample to an unproven conjecture specified in the mechanical theorem prover, PVS. The focus of our case study is the ROBUS Interactive Consistency Protocol. We combine the use of a mechanical theorem prover and a model checker to expose a subtle flaw in the protocol that occurs under a particular scenario of faults and processor states. Uncovering the flaw allows us to mend the protocol and complete its general verification in PVS.
Pike, Lee↗
Toward Design Assurance of Machine-Learning Airborne Systems
In recent years, Artificial Intelligence (AI) systems, enabled by Machine Learning (ML)technology, have demonstrated impressive progress and provides historic opportunities for the aviation industry. However, several key aspects of ML technology are not compatible with existing design assurance standards and make certification problematic. In this paper, we present a case study of a visual system with a Deep Neural Network (DNN) intended to detect and identify airport runway signs. Different use cases and variants of this system exhibit different levels of criticality ranging from design assurance level (DAL) D to B. We use the case study to illustrate the challenges of certification according to the current standards, such asDO-178C. We present the system design, data generation, training, and verification in detail and describe how the design assurance objectives can be met for a DAL D variant of the system. We also discuss gaps and potential approaches for the higher design assurance levels.
Avionics↗
Assessment and Assurance of Microelectronics Packaging Technology of Microelectromechanical Systems (MEMS)
Microelectromechanical systems (MEMS) have shown a significant promise in the last decade for a variety of applications such as air-bag, pressure sensors, accelerometer, microgyro, etc. Standard semiconductor microelectronics packaging needs the integrated circuits to be protected from the harsh environment, and provide electrical communication with the other parts of the circuit, facilitate thermal dissipation efficiently, and impart mechanical strength to the silicon die. Microelectronics packaging involves wafer dicing, bonding, lead attachment, encapsulation to protect from the environment, electrical integrity, and package leak tests to assure the packaging technology. In the case of MEMS the microstructures (active elements) often interfaces with the hostile environment where packaging leak tests and testing of such devices using chemical and mechanical parameters will be very difficult and expensive. Packaging of MEMS is significantly complex as they serve to protect from the environment and microstructures interact with the same environment to measure or affect the desired physical or chemical parameters. The most of the silicon circuitry is sensitive to temperature, moisture, magnetic field, light, and electromagnetic interference. The package must then protect the on-board silicon circuitry while simultaneously exposing the microsensor to the effect it 'measures to assure the MEMS technology by lowering the risk to zero. MEMS technology has a major application in developing a microspacecraft for space systems provided assurance of MEMS technology is sufficiently addressed nondestructively. This technology would eventually miniaturize many of the components of the spacecraft to reach the NASA's safety and mission assurance goal by building faster, cheaper, better, smaller spacecraft to explore the space more effectively by teaming-up with the other NASA centers using the limited resources available. This paper discusses the latest developments in the MEMS technology and challenging issues in the packaging of hermetically sealed and non-hermetically sealed MEMS sensor devices based on silicon, poly-silicon, and other materials for microspacecraft applications considering the space environment and reliability assurance qualification guidelines in perspective. Acknowledgments: The above research work is supported by the NASA Electronics Parts and Packaging Program (NEPP) and performed by the Jet Propulsion Laboratory, California Institute of Technology, Pasadena, CA under a contract with the NASA - Code Q for the Office of Safety and Mission Assurance Program 323-79.
Ramesham, Rajeshuni↗
Formal Foundations for Hierarchical Safety Cases
Safety cases are increasingly being required in many safety-critical domains to assure, using structured argumentation and evidence, that a system is acceptably safe. However, comprehensive system-wide safety arguments present appreciable challenges to develop, understand, evaluate, and manage, partly due to the volume of information that they aggregate, such as the results of hazard analysis, requirements analysis, testing, formal verification, and other engineering activities. Previously, we have proposed hierarchical safety cases, hicases, to aid the comprehension of safety case argument structures. In this paper, we build on a formal notion of safety case to formalise the use of hierarchy as a structuring technique, and show that hicases satisfy several desirable properties. Our aim is to provide a formal, theoretical foundation for safety cases. In particular, we believe that tools for high assurance systems should be granted similar assurance to the systems to which they are applied. To this end, we formally specify and prove the correctness of key operations for constructing and managing hicases, which gives the specification for implementing hicases in AdvoCATE, our toolset for safety case automation. We motivate and explain the theory with the help of a simple running example, extracted from a real safety case and developed using AdvoCATE.
Hierarchy↗