Search NASA⌕ Search

SEARCH · Search NASA

Results for “safety property”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 91 records · Page 5

National Renewable Energy Laboratory Wildland Fire Management Plan (August 2022-August 2025): February-August 2022

The National Renewable Energy Laboratory (NREL) is located in a moderate wildfire risk region. The region has a history of damaging wildland fire activity and is also susceptible to changing environmental conditions (drought, elevated temperatures) that may lead to an increase in wildfire frequency and consequence over time. An integrated, site-wide wildland fire management plan is required by the Department of Energy and is to be consistent with the Federal Wildland Fire Management Policy. The NREL Wildland Fire Management Plan (WFMP) provides an integrated approach to reducing risk to wildland fire at NREL. The goals of the WFMP are to protect human health and safety, protect NREL facilities and research, enhance community protection, diminish risk and consequences of wildland fires, and maintain the health of the ecosystem. The WFMP accomplishes these goals through the use of tools such as fire behavior modeling, fire growth modeling, a structure ignition risk assessment, and through the application of robust fire prevention, emergency management, and environmental programs. The NREL WFMP was developed in a collaborative manner with input from regional stakeholders including cities, counties, local fire departments, and other governmental agencies. The WFMP provides for recommendations to reduce overall wildland fire risk to life safety and property at NREL.

54 ENVIRONMENTAL SCIENCES↗

A derecho climatology (2004–2021) in the United States based on machine learning identification of bow echoes

Due to their persistent widespread severe winds, derechos pose significant threats to human safety and property, with impacts comparable to many tornadoes and hurricanes. Yet, automated detection of derechos remains challenging due to the absence of spatiotemporally continuous observations and the complex criteria employed to define the phenomenon. This study presents an objective derecho detection approach capable of automatically identifying derechos through both observations and model results. The approach is grounded in a physically based definition of derechos and integrates three algorithms: (1) the Python Flexible Object Tracker (PyFLEXTRKR) algorithm to track mesoscale convective systems (MCSs), (2) a semantic segmentation convolutional neural network to identify bow echoes, and (3) a comprehensive classification algorithm to detect derechos within MCS life cycles and distinguish derecho-producing from non-derecho-producing MCSs. Using this approach, we developed a novel high-resolution (4 km and hourly) observational dataset of derechos and accompanying derecho-producing MCSs over the United States east of the Rocky Mountains from 2004 to 2021. The dataset consists of two subsets based on different gust speed data sources and is analyzed to document the climatology of derechos in the United States. On average, 12–15 derechos are identified per year, aligning with previous estimations (∼6–21 events annually). The spatial distribution and seasonal variation patterns are consistent with prior studies, showing peak occurrences in the Great Plains and the Midwest during the warm season. Additionally, during the study period, derechos account for approximately 3.1 % of measured damaging gusts (≥25.93 m s−1) over the eastern United States. The dataset is publicly available at https://doi.org/10.5281/zenodo.14835362 (Li et al., 2025).

54 ENVIRONMENTAL SCIENCES↗

Applying formal methods and object-oriented analysis to existing flight software

Correctness is paramount for safety-critical software control systems. Critical software failures in medical radiation treatment, communications, and defense are familiar to the public. The significant quantity of software malfunctions regularly reported to the software engineering community, the laws concerning liability, and a recent NRC Aeronautics and Space Engineering Board report additionally motivate the use of error-reducing and defect detection software development techniques. The benefits of formal methods in requirements driven software development ('forward engineering') is well documented. One advantage of rigorously engineering software is that formal notations are precise, verifiable, and facilitate automated processing. This paper describes the application of formal methods to reverse engineering, where formal specifications are developed for a portion of the shuttle on-orbit digital autopilot (DAP). Three objectives of the project were to: demonstrate the use of formal methods on a shuttle application, facilitate the incorporation and validation of new requirements for the system, and verify the safety-critical properties to be exhibited by the software.

Cheng, Betty H. C.↗

The Wallops Flight Facility Rapid Response Range Operations Initiative

While the dominant focus on short response missions has appropriately centered on the launch vehicle and spacecraft, often overlooked or afterthought phases of these missions have been launch site operations and the activities of launch range organizations. Throughout the history of organized spaceflight, launch ranges have been the bane of flight programs as the source of expense, schedule delays, and seemingly endless requirements. Launch Ranges provide three basic functions: (1) provide an appropriate geographical location to meet orbital other mission trajectory requirements, (2) provide project services such as processing facilities, launch complexes, tracking and data services, and expendable products, and (3) assure safety and property protection to participating personnel and third-parties. The challenge with which launch site authorities continuously struggle, is the inherent conflict arising from projects whose singular concern is execution of their mission, and the range s need to support numerous simultaneous customers. So, while tasks carried out by a launch range committed to a single mission pale in comparison to efforts of a launch vehicle or spacecraft provider and could normally be carried out in a matter of weeks, major launch sites have dozens of active projects separate sponsoring organizations. Accommodating the numerous tasks associated with each mission, when hardware failures, weather, maintenance requirements, and other factors constantly conspire against the range resource schedulers, make the launch range as significant an impediment to responsive missions as launch vehicles and their cargo. The obvious solution to the launch site challenge was implemented years ago when the Department of Defense simply established dedicated infrastructure and personnel to dedicated missions, namely an Inter Continental Ballistic Missile. This however proves to be prohibitively expensive for all but the most urgent of applications. So the challenge becomes how can a launch site provide acceptably responsive mission services to a particular customer without dedicating extensive resources and while continuing to serve other projects? NASA's Wallops Flight Facility (WFF) is pursuing solutions to exactly this challenge. NASA, in partnership with the Virginia Commercial Space Flight Authority, has initiated the Rapid Response Range Operations Initiative (R3Ops). R3Ops is a multi-phased effort to incrementally establish and demonstrate increasingly responsive launch operations, with an ultimate goal of providing ELV-class services in a maximum of 7-10 days from initial notification routinely, and shorter schedules possible with committed resources. This target will be pursued within the reality of simultaneous concurrent programs, and ideally, largely independent of specialized flight system configurations. WFF has recently completed Phase 1 of R3Ops, an in-depth collection (through extensive expert interviews) and software modeling of individual steps by various range disciplines. This modeling is now being used to identify existing inefficiencies in current procedures, to identify bottlenecks, and show interdependencies. Existing practices are being tracked to provide a baseline to benchmark against as new procedures are implemented. This paper will describe in detail the philosophies behind WFF's R3Ops, the data collected and modeled in Phase 1, and strategies for meeting responsive launch requirements in a multi-user range environment planned for subsequent phases of this initiative.

Underwood, Bruce E.↗

Applying Formal Methods and Object-Oriented Design to Existing Flight Software

This paper describes a project appling formal methods to a portion of the shuttle on-orbit digital autopilot (DAP). Three objectives of the project were to: demonstrate the use of formal methods on a shuttle application, facilitate the incorporation and validation of new requirements for the system, and verify the safety-critical properties to be exhibited by the software.

Software Failures↗

From Informal Safety-Critical Requirements to Property-Driven Formal Validation

Most of the efforts in formal methods have historically been devoted to comparing a design against a set of requirements. The validation of the requirements themselves, however, has often been disregarded, and it can be considered a largely open problem, which poses several challenges. The first challenge is given by the fact that requirements are often written in natural language, and may thus contain a high degree of ambiguity. Despite the progresses in Natural Language Processing techniques, the task of understanding a set of requirements cannot be automatized, and must be carried out by domain experts, who are typically not familiar with formal languages. Furthermore, in order to retain a direct connection with the informal requirements, the formalization cannot follow standard model-based approaches. The second challenge lies in the formal validation of requirements. On one hand, it is not even clear which are the correctness criteria or the high-level properties that the requirements must fulfill. On the other hand, the expressivity of the language used in the formalization may go beyond the theoretical and/or practical capacity of state-of-the-art formal verification. In order to solve these issues, we propose a new methodology that comprises of a chain of steps, each supported by a specific tool. The main steps are the following. First, the informal requirements are split into basic fragments, which are classified into categories, and dependency and generalization relationships among them are identified. Second, the fragments are modeled using a visual language such as UML. The UML diagrams are both syntactically restricted (in order to guarantee a formal semantics), and enriched with a highly controlled natural language (to allow for modeling static and temporal constraints). Third, an automatic formal analysis phase iterates over the modeled requirements, by combining several, complementary techniques: checking consistency; verifying whether the requirements entail some desirable properties; verify whether the requirements are consistent with selected scenarios; diagnosing inconsistencies by identifying inconsistent cores; identifying vacuous requirements; constructing multiple explanations by enabling the fault-tree analysis related to particular fault models; verifying whether the specification is realizable.

Cimatti, Alessandro↗

Decision Engines for Software Analysis Using Satisfiability Modulo Theories Solvers

The area of software analysis, testing and verification is now undergoing a revolution thanks to the use of automated and scalable support for logical methods. A well-recognized premise is that at the core of software analysis engines is invariably a component using logical formulas for describing states and transformations between system states. The process of using this information for discovering and checking program properties (including such important properties as safety and security) amounts to automatic theorem proving. In particular, theorem provers that directly support common software constructs offer a compelling basis. Such provers are commonly called satisfiability modulo theories (SMT) solvers. Z3 is a state-of-the-art SMT solver. It is developed at Microsoft Research. It can be used to check the satisfiability of logical formulas over one or more theories such as arithmetic, bit-vectors, lists, records and arrays. The talk describes some of the technology behind modern SMT solvers, including the solver Z3. Z3 is currently mainly targeted at solving problems that arise in software analysis and verification. It has been applied to various contexts, such as systems for dynamic symbolic simulation (Pex, SAGE, Vigilante), for program verification and extended static checking (Spec#/Boggie, VCC, HAVOC), for software model checking (Yogi, SLAM), model-based design (FORMULA), security protocol code (F7), program run-time analysis and invariant generation (VS3). We will describe how it integrates support for a variety of theories that arise naturally in the context of the applications. There are several new promising avenues and the talk will touch on some of these and the challenges related to SMT solvers. Proceedings

Bjorner, Nikolaj↗

Stratway: A Modular Approach to Strategic Conflict Resolution

In this paper we introduce Stratway, a modular approach to finding long-term strategic resolutions to conflicts between aircraft. The modular approach provides both advantages and disadvantages. Our primary concern is to investigate the implications on the verification of safety-critical properties of a strategic resolution algorithm. By partitioning the problem into verifiable modules much stronger verification claims can be established. Since strategic resolution involves searching for solutions over an enormous state space, Stratway, like most similar algorithms, searches these spaces by applying heuristics, which present especially difficult verification challenges. An advantage of a modular approach is that it makes a clear distinction between the resolution function and the trajectory generation function. This allows the resolution computation to be independent of any particular vehicle. The Stratway algorithm was developed in both Java and C++ and is available through a open source license. Additionally there is a visualization application that is helpful when analyzing and quickly creating conflict scenarios.

Hagen, George E.↗

Hexavalent Chrome Free Coatings for Electronics Applications: Joint Test Report

Regardless of the corrosivity of the environment, all metals require periodic maintenance activity to guard against the insidious effects of corrosion and thus ensure that alloys meet or exceed design or performance life. The standard practice for protecting metallic substrates is the application of a coating system. Applied coating systems work via a variety of methods (barrier, galvanic, and/or inhibitor) and adhere to the substrate through a combination of chemical and physical bonds. For years hexavalent chromium has been a widely used element within applied coating systems because of its self healing and corrosion resistant properties. Occupational Safety and Health Administration (OSHA) studies have concluded that hexavalent chromium (hex chrome) is carcinogenic and poses significant risk to human health. On May 5, 2011 amendments to the Defense Federal Acquisition Regulation Supplement (DFARS) were issued in the Federal Register. Subpart 223.73 prohibits contracts from requiring hexavalent chromium in deliverables unless certain exceptions apply. These exceptions include authorization from a general or flag officer and members of the Senior Executive Service from a Program Executive Office, and unmodified legacy systems. Otherwise, Subpart 252.223-7008 provides the contract clause prohibiting contractors from using or delivering hexavalent chromium in a concentration greater than 0.1 percent by weight for all new contracts and to be included down to subcontractors for supplies, maintenance and repair services, and construction materials. National Aeronautics and Space Administration (NASA), Department of Defense (DoD), and industry stakeholders continue to search for alternatives to hex chrome in coatings applications that meet their performance requirements in corrosion protection, cost, operability, and health and safety, while typically specifying that performance must be equal to or greater than existing systems.

Kessel, Kurt↗

Software and System Health Management with R2U2

R2U2 (Realizable, Responsive, Unobtrusive Unit) is a hardware-supported tool and framework for the real-time system and software health management of cyber-physical systems. R2U2 continuously monitors properties about safety, performance, and security of the vehicle and can perform diagnostic reasoning. Efficient observers for past-time and future-time Metric Temporal Logic, reasoners for Bayesian Networks, and model-based prognostics algorithms are major components of R2U2. Their combination makes it possible to design powerful models for system runtime monitoring, diagnostics, software health management, prognostics, and security monitoring. The R2U2 monitoring engine is designed for minimal runtime overhead and is available as Simulink block or as a software component for integration into the flight software stack, and enables R2U2 to monitor complex cyber-physical systems without any instrumentation of the flight software. In this presentation, we give an overview of R2U2 architecture and reasoning algorithms, present its features, and give a life demo of the tool.

Schumann, Johann↗

Runtime Analysis with R2U2: A Tool Exhibition Report

We present R2U2 (Realizable, Responsive, Unobtrusive Unit), a hardware- supported tool and framework for the continuous monitoring of safetycritical and embedded cyber-physical systems.With the widespread advent of autonomous systems such as Unmanned Aerial Systems (UAS), satellites, rovers, and cars, real-time, on-board decision making requires unobtrusive monitoring of properties for safety, performance, security, and system health. R2U2 models combine past-time and future-time Metric Temporal Logic, “mission time” Linear Temporal Logic, probabilistic reasoning with Bayesian Networks, and modelbased prognostics. The R2U2 monitoring engine can be instantiated as a hardware solution, running on an FPGA, or as a software component. The FPGA realization enables R2U2 to monitor complex cyber-physical systems without any overhead or instrumentation of the flight software. In this tool exhibition report, we present R2U2 and demonstrate applications on system runtime monitoring, diagnostics, software health management, and security monitoring for a UAS. Our tool demonstration uses a hardware-based processor-in-the-loop “iron-bird” configuration.

Johann Martin Schumann↗

Achieving Equilibrium for Dense, Integrated, Vehicle Navigation

Drone usage has proliferated in recent years with many applications that have market-changing potential. Applications that include parcel delivery, wildlife protection, precision farming, law enforcement, and industrial inspection, just to name a few. In this paper, the term drone is used to mean both Unmanned Aerial Vehicle and small Unmanned Aircraft System vehicles. Flight infrastructure can currently only support a few thousand aircraft flying over the United States National Airspace System (NAS) at any given time. A delay atone airport sends ripple effects through the system, causing more delays and missed connections. Once regulations and safety policies are put in place to allow for the widespread use of unmanned drones, the number of aircraft in the NAS is expected to skyrocket to millions, potentially congesting the airspace resulting in possible separation violations. In air traffic control, separation is the concept of keeping an “ownship” aircraft outside a minimum distance from “intruder” aircraft to reduce the risk of the aircraft colliding, as well as preventing accidents due to secondary factors, such as wake turbulence. Maintaining proper separation is a safety critical property for drones in the airspace. This paper addresses separation in time and in distance for high volume corridors (en-route) and lanes(on ground). The requirements and necessary conditions for maintaining proper separation and reaching maximum throughput for a given corridor/lane are addressed assuming unidirectional corridors/lanes where an aircraft arrives from one side and departs from the opposite side. Simulation results are presented that show the presented solution guarantees a set of drones to reach the equilibrium state by adjusting their speed based on their distance to the aircraft in front of them. The equilibrium state is defined as a state when a set of n aircraft moving at a relatively constant speed and uniform spacing from each other in a congested system. A congested system is defined as a state when the aircraft cannot move at their maximum allowed speed. Unlike existing centralized and pre-planned approaches, the proposed solution is fully distributed and enables autonomous aircraft to decide to adjust their speed and distance with respect to the preceding aircraft, dynamically. Simulation results are presented that assess the feasibility of the approach using a large number of drones and evaluate the scalability of the proposed solution.

Mahyar R. Malekpour↗

Runtime Monitoring with R2U2 for Aircraft Systems with Neural Networks

R2U2 (Realizable, Responsive, Unobtrusive Unit) is a hardware-supported tool and framework for real-time system monitoring and software health management of cyber-physical systems. During system operation, R2U2 continuously monitors properties about safety, performance, and security of the vehicle and its vital components and can perform diagnostic reasoning. Efficient observers for past-time and future-time Metric Temporal Logic, fast reasoners for Bayesian Networks, and model-based prognostics algorithms are key components of R2U2 and designed for minimal computational footprint. R2U2 has been implemented in software supporting ROS, NASA's cFS/cFE, and Simulink and as an FPGA configuration. The synergistic combination of monitors and observers in R2U2 makes it possible to design powerful models for system runtime monitoring, diagnostics, software health management, prognostics, and security monitoring. In this presentation, I will give a detailed overview of the R2U2 architecture and its features and will discuss the application of R2U2 for safety-monitoring of a neural-network based autonomous centerline tracking system (ACT) for autonomous aircraft.

Runtime Monitoring↗

A Strategic Approach for Dense, Integrated, Vehicle Navigation

Drone usage has been on the rise in recent years with applications that include parcel delivery, wildlife protection, precision farming, law enforcement, and industrial inspection, just to name a few. Once regulations and safety policies are put in place to allow for the widespread use of unmanned drones, the number of aircraft in the National Airspace System (NAS) is expected to skyrocket to millions, potentially congesting the airspace which increases the likelihood of separation violations and possibly incidents. Currently, flight infrastructure can only support a few thousand aircraft flying over the United States National Airspace System (NAS) at any given time. A delay at one airport can send ripple effects throughout the system, causing more delays and missed connections. In air traffic control, separation is the concept of keeping an “ownship” aircraft outside a minimum distance from “intruder” aircraft to reduce the risk of the aircraft colliding, as well as preventing accidents due to secondary factors, such as wake turbulence. Maintaining proper separation is often a safety critical property for fixed-wing drones in the airspace. This paper addresses drone separation in time and distance for high volume corridors (en route) and lanes (on ground), merging as well as crossing intersections of multiple corridors/lanes. In this paper, the term drone is applied to both Unmanned Aerial Vehicle (UAV) and small Unmanned Aircraft System (UAS) vehicles operating autonomously. There exists a gamut of approaches to the merging and crossing problems. At one end of the extreme are the conservative yet low cost and verifiable solutions of today that deal with two drones at a time. At the other end are complex Machine Learning-based solutions with high computing requirements for fully autonomous drones of the future that are expected to handle all contentions. This paper presents a feasible and verifiable strategic approach to these problems that is based on distributed cooperation between the drones and the infrastructure. Three phases of the strategic approach (Prepare, Adjust, Commit) are presented. Simulation results are presented that show the proposed approach is stable and resilient to induced perturbations and guarantees a set of fixed-wing drones to merge and cross intersections by adjusting their speed based on their distance to the aircraft in front of them while remaining in the equilibrium state. The equilibrium state is defined as the state when a set of n aircraft move at a relatively constant speed and uniform spacing from each other in a congested system. A congested system is defined as the state when at least one aircraft cannot move at its maximum allowed speed. Unlike existing centralized and pre-planned approaches, the proposed solution is fully distributed and enables autonomous aircraft to decide to adjust their speed and distance with respect to the preceding aircraft, dynamically. Simulation results are presented that assess the feasibility of the approach.

Distributed↗

A Strategic Approach for Dense, Integrated, Vehicle Navigation

Drone usage has been on the rise in recent years with applications that include parcel delivery, wildlife protection, precision farming, law enforcement, and industrial inspection, just to name a few. Once regulations and safety policies are put in place to allow for the widespread use of unmanned drones, the number of aircraft in the National Airspace System (NAS) is expected to skyrocket to millions, potentially congesting the airspace which increases the likelihood of separation violations and possibly incidents. Currently, flight infrastructure can only support a few thousand aircraft flying over the United States National Airspace System (NAS) at any given time. A delay at one airport can send ripple effects throughout the system, causing more delays and missed connections. In air traffic control, separation is the concept of keeping an “ownship” aircraft outside a minimum distance from “intruder” aircraft to reduce the risk of the aircraft colliding, as well as preventing accidents due to secondary factors, such as wake turbulence. Maintaining proper separation is often a safety critical property for fixed-wing drones in the airspace. This paper addresses drone separation in time and distance for high volume corridors (en route) and lanes (on ground), merging as well as crossing intersections of multiple corridors/lanes. In this paper, the term drone is applied to both Unmanned Aerial Vehicle (UAV) and small Unmanned Aircraft System (UAS) vehicles operating autonomously. There exists a gamut of approaches to the merging and crossing problems. At one end of the extreme are the conservative yet low cost and verifiable solutions of today that deal with two drones at a time. At the other end are complex Machine Learning-based solutions with high computing requirements for fully autonomous drones of the future that are expected to handle all contentions. This paper presents a feasible and verifiable strategic approach to these problems that is based on distributed cooperation between the drones and the infrastructure. Three phases of the strategic approach (Prepare, Adjust, Commit) are presented. Simulation results are presented that show the proposed approach is stable and resilient to induced perturbations and guarantees a set of fixed-wing drones to merge and cross intersections by adjusting their speed based on their distance to the aircraft in front of them while remaining in the equilibrium state. The equilibrium state is defined as the state when a set of n aircraft move at a relatively constant speed and uniform spacing from each other in a congested system. A congested system is defined as the state when at least one aircraft cannot move at its maximum allowed speed. Unlike existing centralized and pre-planned approaches, the proposed solution is fully distributed and enables autonomous aircraft to decide to adjust their speed and distance with respect to the preceding aircraft, dynamically. Simulation results are presented that assess the feasibility of the approach.

Distributed↗

Exploring the Potential of Hydrogen as a Lift Gas for Nasa’s Scientific Balloon Program

The United States National Aeronautics and Space Administration (NASA) Balloon Program has a rich history of conducting scientific research in the stratosphere, offering a unique platform for experiments in the near-space environment. One critical component of these high-altitude balloons is the choice of lift gas, which is pivotal to achieving the desired altitude and, thus, mission objectives. Traditionally, helium has been the preferred lift gas due to its inert properties and safety considerations. However, the increasing demand and limited global helium reserves have prompted NASA to explore alternative lift gases, with hydrogen emerging as the most logical choice. Hydrogen boasts several advantages, including its abundant availability, cost-effectiveness, and enhanced lift capability compared to helium. Moreover, it can support a wide range of scientific payloads, enabling extended mission durations and increased payload capacities, ultimately strengthening the program’s scientific potential. However, adopting hydrogen as a lift gas is not without challenges. Safety concerns, especially during the launch and recovery phases, are paramount. NASA and the other major players in the scientific ballooning community have been developing stringent safety protocols and engineering solutions to mitigate these risks. This development includes specialized support systems, leak detection mechanisms, and enhanced launch and recovery procedures. Additionally, environmental considerations must be carefully evaluated. Hydrogen release has the potential to increase concentrations of various greenhouse gases, and its usage must be balanced against the benefits it offers to scientific research and exploration. This paper delves into the ongoing research and development efforts to ensure balloon-based research’s long-term sustainability and its ability to continue pushing the boundaries of scientific discovery. This research demonstrates NASA’s commitment to innovation, safety, and environmental responsibility while maintaining its mission to advance our understanding of the Earth and the cosmos.

balloon↗

Architecting Safer Autonomous Aviation Systems

The aviation literature gives relatively little guidance to practitioners about the specifics of architecting systems for safety, particularly the impact of architecture on allocating safety requirements, or the relative ease of system assurance resulting from system or subsystem level architectural choices. As an exemplar, this paper considers common architectural patterns used within traditional aviation systems and explores their safety and safety assurance implications when applied in the context of integrating artificial intelligence (AI) and machine learning (ML) based functionality. Considering safety as an architectural property, we discuss both the allocation of safety requirements and the architectural trade-offs involved early in the design lifecycle. This approach could be extended to other assured properties, similar to safety, such as security. We conclude with a discussion of the safety considerations that emerge in the context of candidate architectural patterns that have been proposed in the recent literature for enabling autonomy capabilities by integrating AI and ML. A recommendation is made for the generation of a property-driven architectural pattern catalogue.

Architecture patterns↗