Results for “safety properties” — Page 5

NASA NTRSDate not supplied

Architecting Safer Autonomous Aviation Systems

The aviation literature gives relatively little guidance to practitioners about the specifics of architecting systems for safety, particularly the impact of architecture on allocating safety requirements, or the relative ease of system assurance resulting from system or subsystem level architectural choices. As an exemplar, this paper considers common architectural patterns used within traditional aviation systems and explores their safety and safety assurance implications when applied in the context of integrating artificial intelligence (AI) and machine learning (ML) based functionality. Considering safety as an architectural property, we discuss both the allocation of safety requirements and the architectural trade-offs involved early in the design lifecycle. This approach could be extended to other assured properties, similar to safety, such as security. We conclude with a discussion of the safety considerations that emerge in the context of candidate architectural patterns that have been proposed in the recent literature for enabling autonomy capabilities by integrating AI and ML. A recommendation is made for the generation of a property-driven architectural pattern catalogue.

Architecture patterns↗

NASA NTRSDate not supplied

Architecting Safer Autonomous Aviation Systems

The aviation literature gives relatively little guidance to practitioners about the specifics of architecting systems for safety, particularly the impact of architecture on allocating safety requirements, or the relative ease of system assurance resulting from system or subsystem level architectural choices. As an exemplar, this paper considers common architectural patterns used within traditional aviation systems and explores their safety and safety assurance implications when applied in the context of integrating artificial intelligence (AI) and machine learning (ML) based functionality. Considering safety as an architectural property, we discuss both the allocation of safety requirements and the architectural trade-offs involved early in the design lifecycle. This approach could be extended to other assured properties, similar to safety, such as security. We conclude with a discussion of the safety considerations that emerge in the context of candidate architectural patterns that have been proposed in the recent literature for enabling autonomy capabilities by integrating AI and ML. A recommendation is made for the generation of a property-driven architectural pattern catalogue.

Architecture patterns↗

NASA NTRS2012

Automating the Generation of Heterogeneous Aviation Safety Cases

A safety case is a structured argument, supported by a body of evidence, which provides a convincing and valid justification that a system is acceptably safe for a given application in a given operating environment. This report describes the development of a fragment of a preliminary safety case for the Swift Unmanned Aircraft System. The construction of the safety case fragment consists of two parts: a manually constructed system-level case, and an automatically constructed lower-level case, generated from formal proof of safety-relevant correctness properties. We provide a detailed discussion of the safety considerations for the target system, emphasizing the heterogeneity of sources of safety-relevant information, and use a hazard analysis to derive safety requirements, including formal requirements. We evaluate the safety case using three classes of metrics for measuring degrees of coverage, automation, and understandability. We then present our preliminary conclusions and make suggestions for future work.

Denney, Ewen W.↗

NASA NTRSDate not supplied

A Verification Framework for Runtime Assurance of Autonomous UAS

Runtime Assurance (RTA) is a design-time architecture for safety-critical systems where an internal monitor acts upon detecting a violation of a property. The simplex architecture is an instance of RTA, where the action taken is to hand control of the overall system to a trusted controller when an untrusted one violates a safety property. Simplex RTA is emerging as a method for allowing AI/ML and other unverified software to be integrated into safety-critical applications like aircraft. To this end, the American Society for Testing and Materials (ASTM) and NASA have each published guidelines on the use of RTA in such systems. In the simplex RTA framework, a system has an advanced controller (AC) and a reversionary controller (RC). The system is allowed to operate with the AC until a runtime monitor detects that some property has been violated and then the RC takes over. Assuming that the sample rate of the monitor will detect improper functioning with enough time for the RC to correct the impending problem, and that the RC is trusted, the system will operate as intended. This use of the simplex RTA framework can allow for the integration of untrusted, but possibly more performant, controllers in a safe way. This paper presents a formalization of a simplex RTA framework in the Prototype Verification System (PVS) theorem prover using an embedding of differential dynamic logic (DDL) called Plaidypvs. A novel feature of this framework is that it can be instantiated at different levels of abstraction. This feature allows for the formal verification of a system with an untrusted black box component, such as an AI/ML controller. This paper does not address the many difficulties in deploying RTA in an industrial-level system. Instead, the focus is on the formal verification of the simplex RTA framework in the language of hybrid programs. Hybrid programs are programs that include both discrete and continuous dynamics and can be used to model complex cyber-physical systems. Plaidypvs is a tool that enables formalization of hybrid programs in the PVS theorem prover. Plaidypvs enables the verification of the general simplex RTA framework and then, by specializing some components of the hybrid program, verifying instances of the framework while treating the untrusted component as a black box. A selection of Unmanned Aircraft Systems (UAS) operations are shown as instances of the general RTA framework in PVS. This offers the benefit of design time verification of relevant safety properties to the system, and it also gives requirements on the sample rate of sensors that determine the time interval in which the ‘switch’ property of the RTA framework is checked.

PVS↗

NASA NTRS2012

Comparison of Aircraft Models and Integration Schemes for Interval Management in the TRACON

Reusable models of common elements for communication, computation, decision and control in air traffic management are necessary in order to enable simulation, analysis and assurance of emergent properties, such as safety and stability, for a given operational concept. Uncertainties due to faults, such as dropped messages, along with non-linearities and sensor noise are an integral part of these models, and impact emergent system behavior. Flight control algorithms designed using a linearized version of the flight mechanics will exhibit error due to model uncertainty, and may not be stable outside a neighborhood of the given point of linearization. Moreover, the communication mechanism by which the sensed state of an aircraft is fed back to a flight control system (such as an ADS-B message) impacts the overall system behavior; both due to sensor noise as well as dropped messages (vacant samples). Additionally simulation of the flight controller system can exhibit further numerical instability, due to selection of the integration scheme and approximations made in the flight dynamics. We examine the theoretical and numerical stability of a speed controller under the Euler and Runge-Kutta schemes of integration, for the Maintain phase for a Mid-Term (2035-2045) Interval Management (IM) Operational Concept for descent and landing operations. We model uncertainties in communication due to missed ADS-B messages by vacant samples in the integration schemes, and compare the emergent behavior of the system, in terms of stability, via the boundedness of the final system state. Any bound on the errors incurred by these uncertainties will play an essential part in a composable assurance argument required for real-time, flight-deck guidance and control systems,. Thus, we believe that the creation of reusable models, which possess property guarantees, such as safety and stability, is an innovative and essential requirement to assessing the emergent properties of novel airspace concepts of operation.

Neogi, Natasha↗

NASA NTRS2018

On-Board Battery Monitoring and Prognostics for Electric-Propulsion Aircraft

The reliability of the propulsion system of an aircraft is paramount for the aircraft safety and hence the aircraft health must be monitored continuously. In contrast to fuel- operated aircraft, electric battery-operated propulsion system poses specific problems, such as, the remaining battery power does not linearly decrease and cannot be measured directly. In this paper, we describe a combined monitoring and prognostics architecture that can continuously monitor all components of the electric propulsion system with respect to safety and performance properties as well as state of charge and rest of useful life for the battery. Our system combines a detailed electrochemical battery model for Li-ion batteries with a powerful prognostics engine based upon an Unscented Kalman Filter with the R2U2 monitoring device, which provides efficient observers for metric temporal logic and Bayesian reasoning. R2U2 is a real-time, realizable, responsive, unobtrusive unit, which continuously monitors sensor readings, outputs of the prognostics engine, as well as the ight software status for safety, performance, and security properties. We illustrate our architecture with two case studies, one reporting actual ight tests with an X8+ octocopter and the other a software-in-the-loop simulation with an unmanned Edge 540 electric aircraft model.

Kulkarni, Chetan↗

NASA NTRS2002

AutoBayes/CC: Combining Program Synthesis with Automatic Code Certification: System Description

Code certification is a lightweight approach to formally demonstrate software quality. It concentrates on aspects of software quality that can be defined and formalized via properties, e.g., operator safety or memory safety. Its basic idea is to require code producers to provide formal proofs that their code satisfies these quality properties. The proofs serve as certificates which can be checked independently, by the code consumer or by certification authorities, e.g., the FAA. It is the idea underlying such approaches as proof-carrying code [6]. Code certification can be viewed as a more practical version of traditional Hoare-style program verification. The properties to be verified are fairly simple and regular so that it is often possible to use an automated theorem prover to automatically discharge all emerging proof obligations. Usually, however, the programmer must still splice auxiliary annotations (e.g., loop invariants) into the program to facilitate the proofs. For complex properties or larger programs this quickly becomes the limiting factor for the applicability of current certification approaches.

Whalen, Michael↗

NASA NTRS1992

RICIS Symposium 1992: Mission and Safety Critical Systems Research and Applications

This conference deals with computer systems which control systems whose failure to operate correctly could produce the loss of life and or property, mission and safety critical systems. Topics covered are: the work of standards groups, computer systems design and architecture, software reliability, process control systems, knowledge based expert systems, and computer and telecommunication protocols.

Source record↗

NASA NTRSDate not supplied

Verifying PLC Programs via Monitors: Extending the Integration of FRET and PLCverif

Verification of Programmable Logic Controller (PLC) programs requires reasoning about propositions qualified in terms of time. CERN’s PLCverif, an open-source tool for the analysis of safety-critical PLC systems, uses Linear Temporal Logic (LTL) for the specification of properties. Until now, PLCverif depended on third-party tools that accept LTL specifications to perform verification. However, our experience with industrial PLC programs shows that, to overcome analysis limitations, a wide range of techniques are needed to successfully verify complex properties. In this paper, we extend PLCverif to enable PLC program verification of pure-past LTL (PLTL) safety properties with assertion-based verification tools. To this end, we take an algorithm from the runtime-monitoring domain, apply it to bounded model checking of PLC programs, and implement it in PLCverif. We extend the integration of NASA’s Formal Requirements Elicitation Tool (FRET) into PLCverif to use PLTL properties generated with FRET. In addition, we leverage the program structure induced by the PLC scan-cycle for a state-space reduction. Finally, we expose the algorithm to a real-world case study of critical systems at CERN.

Formal verification↗

NASA NTRSDate not supplied

Predicting Lightning Initiation using Deep Learning

Lightning occurrence presents safety challenges to people and property. The main challenge with lightning safety is that the majority of guidance is reactive. In other words, lightning has to have already occurred nearby before a person will respond and take shelter. Further, most injuries or fatalities occur as the storm approaches, or as it's moving away, when rainfall may not be present at the time of the flash. Thus, this project develops a physically-based deep learning model to produce lightning probabilities out to 15 minutes. The deep learning model combines a Convolutional Neural Network (CNN) with a Long Short-Term Memory (LSTM) network to capture both the spatial and temporal evolution of storms to predict the probability that lightning initiation will occur in the next 15 minutes. The model combines radar reflectivity, correlation coefficient and differential reflectivity to inferred storm hydrometer type and precipitation phase, which aids in the identification of electrification processes. The model is trained with data from the Geostationary Lightning Mapper (GLM), which is a near infrared sensor onboard the GOES-R series of satellites that measures optical brightness from lightning. This presentation will provide an overview of the project.

Andrew T White↗

NASA NTRSDate not supplied

Safety Expertise and the Perils of Novelty

Emerging aviation markets such as urban air mobility are giving rise to new technologies and means of operation. However, novelty may hide ‘unknown unknowns,’ raising new hazards. This paper examines how expertise and safety techniques enable transformative technologies such as reduced crew operations, hybrid wing-borne and rotor-born flight, federated air traffic services, and urban operations. We explore how analysts use expertise to address common-cause failures, collect and interpret safety data, and perform exacting tradeoffs between dissimilarity, redundancy, independence, and diversity (human, process lifecycle, or otherwise) to ensure safety. When novelty is present, analysts might not possess the expertise needed to fully understand the implications of design decisions and tradeoffs being made, especially in early lifecycle phases, on emergent properties such as safety. Safety expertise must be carefully cultivated. The conflicting views of safety experts must be unpacked to identify the divergence in fundamental assumptions, models, means, and methods that may be causing them. Once systems venture beyond the basis of what safety expertise can reliably guarantee, projects take on risk that must be managed. The paper contains key takeaways and actionable recommendations for novel OEMs and regulators touching on topics such as robust monitoring; clear and transparent reporting; incremental approaches to fielding novel systems in hazard-rich, risk-tolerant environments; the cultivation of safety culture and expertise in an organization; and the use of scientific study to reduce epistemic uncertainty in novel operations with new technologies. Since excessive novelty in aviation can undermine the current foundation of safety, humility and incrementalism are necessary to enable emerging aviation markets safely.

safety expertise↗

NASA NTRSDate not supplied

Safety Expertise and the Perils of Novelty

Emerging aviation markets such as urban air mobility are giving rise to new technologies and means of operation. However, novelty may hide ‘unknown unknowns,’ raising new hazards. This paper examines how expertise and safety techniques enable transformative technologies such as reduced crew operations, hybrid wing-borne and rotor-born flight, federated air traffic services, and urban operations. We explore how analysts use expertise to address common-cause failures, collect and interpret safety data, and perform exacting tradeoffs between dissimilarity, redundancy, independence, and diversity (human, process lifecycle, or otherwise) to ensure safety. When novelty is present, analysts might not possess the expertise needed to fully understand the implications of design decisions and tradeoffs being made, especially in early lifecycle phases, on emergent properties such as safety. Safety expertise must be carefully cultivated. The conflicting views of safety experts must be unpacked to identify the divergence in fundamental assumptions, models, means, and methods that may be causing them. Once systems venture beyond the basis of what safety expertise can reliably guarantee, projects take on risk that must be managed. The paper contains key takeaways and actionable recommendations for novel OEMs and regulators touching on topics such as robust monitoring; clear and transparent reporting; incremental approaches to fielding novel systems in hazard-rich, risk-tolerant environments; the cultivation of safety culture and expertise in an organization; and the use of scientific study to reduce epistemic uncertainty in novel operations with new technologies. Since excessive novelty in aviation can undermine the current foundation of safety, humility and incrementalism are necessary to enable emerging aviation markets safely.

safety expertise↗

NASA NTRS1991

A linear control design structure to maintain loop properties during limit operation in a multi-nozzle turbofan engine

The implementation of multi-variable control systems on turbofan engines requires the use of limit protection to maintain safe engine operation. Since a turbofan engine typically encounters limits during transient operation, the use of a limit protection scheme that modifies the feedback loop may void the desired 'guarantees' associated with linear multi-variable control design methods, necessitating considerable simulation to validate the control with limited protection. An alternative control design structure is proposed that maintains the desired linear feedback properties when certain safety limits are encountered by moving the limit protection scheme outside the feedback loop. This proposed structure is compared to a structure with a limit protection scheme that modifies the feedback loop properties. The two design structures are compared using both linear and nonlinear simulations. The evaluation emphasizes responses where the fan surge margin limit is encountered.

Mattern, Duane↗

NASA NTRS1991

A linear control design structure to maintain loop properties during limit operation in a multi-nozzle turbofan engine

The implementation of multi-variable control systems on turbofan engines requires the use of limit protection to maintain safe engine operation. Since a turbofan engine typically encounters limits during transient operation, the use of a limit protection scheme that modifies the feedback loop may void the desired 'guarantees' associated with linear multi-variable control design methods, necessitating considerable simulation to validate the control with limit protection. An alternative control design structure is proposed that maintains the desired linear feedback properties when certain safety limits are encountered by moving the limit protection scheme outside of the feedback loop. This proposed structure is compared to a structure with a limit protection scheme that modifies the feedback loop properties. The two design structures are compared using both linear and nonlinear simulations. The evaluation emphasizes responses where the fan surge margin limit is encountered.

Mattern, Duane↗

NASA NTRS2021

Assuring Intelligent Systems: Contingency Management for UAS

Unmanned aircraft systems (UAS) collaborate with humans to operate in diverse, safety-critical applications. However, assurance technologies need to be integrated into the design process in order to guarantee safe behavior, thereby enabling UAS operations in the National Airspace System (NAS). In this paper, formal methods are integrated with learning-enabled systems representations. The generation and representation of knowledge are captured via monadic second-order logic rules in the cognitive architecture Soar. These rules are translated into timed automata, and a proof of correctness for the translation is provided so that safety and liveness properties can be checked in the formal verification environment Uppaal. This approach is agnostic to the learning mechanism used to generate the learned rules (e.g., chunking, etc.). An example of a fault-tolerant, learning-enabled UAS deciding which of four contingency procedures to execute under a lost link scenario while overflying an urban area is used to illustrate the approach.

Intelligent Systems↗

NASA NTRS1977

Study to develop improved fire resistant aircraft passenger seat materials, phase 1

The procurement and testing of a wide range of candidate materials is reported. Improved fire resistant nonmetallic materials were subjected to tests to evaluate their thermal characteristics, such as burn, smoke generation, heat release rate and toxicity. In addition, candidate materials were evaluated for mechanical, physical and aesthetic properties. Other properties considered included safety, comfort, durability and maintainability. The fiscal year 1977 and the projected 1980 cost data were obtained for aircraft seat materials.

Trabold, E. L.↗

NASA NTRS1978

Beach erosion control study at Pass Christian

The methods of measuring the existence of erosion and the effects of sand stabilization control systems are described. The mechanics of sand movement, the nature of sand erosion, and the use of satellite data to measure these factors and their surrogates are discussed using the locational and control aspects of aeolian and litoral erosion zones along the sand beach of the Mississippi coast. The aeolian erosion is highlighted due to the redeposition of the sand which causes high cleanup costs, property damage, and safety and health hazards. The areas of differential erosion and the patterns of beach sand movement are illustrated and the use of remote sensing methods to identify the areas of erosion are evaluated.

Source record↗

NASA NTRS1982

Flame Resistant Fibrous Materials Development

Since 1973, Albany International Research Co. has been engaged by NASA-JSC under Contract No. NAS9-13673 to conduct studies aimed at developing fibers and flexible structures made therefrom which would provide improved flame resistance over existing commercially available materials in oxygen enriched atmospheres. A portion of the crew bay area life support system and crew equipment for the space shuttle was initially designed to function at a 30% oxygen, 70% nitrogen atmosphere at 9 psia pressure. This oxygen concentration imposed certain fire safety and smoke generation requirements which could not be completely met by commonly accepted textiles. Potentially useful new polymers were investigated both for fire safety and mechanical properties. During the course of the work, three candidate fibers were studied and evaluated and the results of each of these efforts are summarized.

Coskren, R. J.↗