Search NASA⌕ Search

SEARCH · Search NASA

Results for “safety properties”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 109 records · Page 6
All sourcesNASA NTRSDOE OSTI
NASA NTRSDate not supplied

Architecting Safer Autonomous Aviation Systems

The aviation literature gives relatively little guidance to practitioners about the specifics of architecting systems for safety, particularly the impact of architecture on allocating safety requirements, or the relative ease of system assurance resulting from system or subsystem level architectural choices. As an exemplar, this paper considers common architectural patterns used within traditional aviation systems and explores their safety and safety assurance implications when applied in the context of integrating artificial intelligence (AI) and machine learning (ML) based functionality. Considering safety as an architectural property, we discuss both the allocation of safety requirements and the architectural trade-offs involved early in the design lifecycle. This approach could be extended to other assured properties, similar to safety, such as security. We conclude with a discussion of the safety considerations that emerge in the context of candidate architectural patterns that have been proposed in the recent literature for enabling autonomy capabilities by integrating AI and ML. A recommendation is made for the generation of a property-driven architectural pattern catalogue.

Architecture patterns↗
NASA NTRS2012

Automating the Generation of Heterogeneous Aviation Safety Cases

A safety case is a structured argument, supported by a body of evidence, which provides a convincing and valid justification that a system is acceptably safe for a given application in a given operating environment. This report describes the development of a fragment of a preliminary safety case for the Swift Unmanned Aircraft System. The construction of the safety case fragment consists of two parts: a manually constructed system-level case, and an automatically constructed lower-level case, generated from formal proof of safety-relevant correctness properties. We provide a detailed discussion of the safety considerations for the target system, emphasizing the heterogeneity of sources of safety-relevant information, and use a hazard analysis to derive safety requirements, including formal requirements. We evaluate the safety case using three classes of metrics for measuring degrees of coverage, automation, and understandability. We then present our preliminary conclusions and make suggestions for future work.

Denney, Ewen W.↗
NASA NTRSDate not supplied

A Verification Framework for Runtime Assurance of Autonomous UAS

Runtime Assurance (RTA) is a design-time architecture for safety-critical systems where an internal monitor acts upon detecting a violation of a property. The simplex architecture is an instance of RTA, where the action taken is to hand control of the overall system to a trusted controller when an untrusted one violates a safety property. Simplex RTA is emerging as a method for allowing AI/ML and other unverified software to be integrated into safety-critical applications like aircraft. To this end, the American Society for Testing and Materials (ASTM) and NASA have each published guidelines on the use of RTA in such systems. In the simplex RTA framework, a system has an advanced controller (AC) and a reversionary controller (RC). The system is allowed to operate with the AC until a runtime monitor detects that some property has been violated and then the RC takes over. Assuming that the sample rate of the monitor will detect improper functioning with enough time for the RC to correct the impending problem, and that the RC is trusted, the system will operate as intended. This use of the simplex RTA framework can allow for the integration of untrusted, but possibly more performant, controllers in a safe way. This paper presents a formalization of a simplex RTA framework in the Prototype Verification System (PVS) theorem prover using an embedding of differential dynamic logic (DDL) called Plaidypvs. A novel feature of this framework is that it can be instantiated at different levels of abstraction. This feature allows for the formal verification of a system with an untrusted black box component, such as an AI/ML controller. This paper does not address the many difficulties in deploying RTA in an industrial-level system. Instead, the focus is on the formal verification of the simplex RTA framework in the language of hybrid programs. Hybrid programs are programs that include both discrete and continuous dynamics and can be used to model complex cyber-physical systems. Plaidypvs is a tool that enables formalization of hybrid programs in the PVS theorem prover. Plaidypvs enables the verification of the general simplex RTA framework and then, by specializing some components of the hybrid program, verifying instances of the framework while treating the untrusted component as a black box. A selection of Unmanned Aircraft Systems (UAS) operations are shown as instances of the general RTA framework in PVS. This offers the benefit of design time verification of relevant safety properties to the system, and it also gives requirements on the sample rate of sensors that determine the time interval in which the ‘switch’ property of the RTA framework is checked.

PVS↗
NASA NTRS2012

Comparison of Aircraft Models and Integration Schemes for Interval Management in the TRACON

Reusable models of common elements for communication, computation, decision and control in air traffic management are necessary in order to enable simulation, analysis and assurance of emergent properties, such as safety and stability, for a given operational concept. Uncertainties due to faults, such as dropped messages, along with non-linearities and sensor noise are an integral part of these models, and impact emergent system behavior. Flight control algorithms designed using a linearized version of the flight mechanics will exhibit error due to model uncertainty, and may not be stable outside a neighborhood of the given point of linearization. Moreover, the communication mechanism by which the sensed state of an aircraft is fed back to a flight control system (such as an ADS-B message) impacts the overall system behavior; both due to sensor noise as well as dropped messages (vacant samples). Additionally simulation of the flight controller system can exhibit further numerical instability, due to selection of the integration scheme and approximations made in the flight dynamics. We examine the theoretical and numerical stability of a speed controller under the Euler and Runge-Kutta schemes of integration, for the Maintain phase for a Mid-Term (2035-2045) Interval Management (IM) Operational Concept for descent and landing operations. We model uncertainties in communication due to missed ADS-B messages by vacant samples in the integration schemes, and compare the emergent behavior of the system, in terms of stability, via the boundedness of the final system state. Any bound on the errors incurred by these uncertainties will play an essential part in a composable assurance argument required for real-time, flight-deck guidance and control systems,. Thus, we believe that the creation of reusable models, which possess property guarantees, such as safety and stability, is an innovative and essential requirement to assessing the emergent properties of novel airspace concepts of operation.

Neogi, Natasha↗
NASA NTRS2018

On-Board Battery Monitoring and Prognostics for Electric-Propulsion Aircraft

The reliability of the propulsion system of an aircraft is paramount for the aircraft safety and hence the aircraft health must be monitored continuously. In contrast to fuel- operated aircraft, electric battery-operated propulsion system poses specific problems, such as, the remaining battery power does not linearly decrease and cannot be measured directly. In this paper, we describe a combined monitoring and prognostics architecture that can continuously monitor all components of the electric propulsion system with respect to safety and performance properties as well as state of charge and rest of useful life for the battery. Our system combines a detailed electrochemical battery model for Li-ion batteries with a powerful prognostics engine based upon an Unscented Kalman Filter with the R2U2 monitoring device, which provides efficient observers for metric temporal logic and Bayesian reasoning. R2U2 is a real-time, realizable, responsive, unobtrusive unit, which continuously monitors sensor readings, outputs of the prognostics engine, as well as the ight software status for safety, performance, and security properties. We illustrate our architecture with two case studies, one reporting actual ight tests with an X8+ octocopter and the other a software-in-the-loop simulation with an unmanned Edge 540 electric aircraft model.

Kulkarni, Chetan↗
NASA NTRS2002

AutoBayes/CC: Combining Program Synthesis with Automatic Code Certification: System Description

Code certification is a lightweight approach to formally demonstrate software quality. It concentrates on aspects of software quality that can be defined and formalized via properties, e.g., operator safety or memory safety. Its basic idea is to require code producers to provide formal proofs that their code satisfies these quality properties. The proofs serve as certificates which can be checked independently, by the code consumer or by certification authorities, e.g., the FAA. It is the idea underlying such approaches as proof-carrying code [6]. Code certification can be viewed as a more practical version of traditional Hoare-style program verification. The properties to be verified are fairly simple and regular so that it is often possible to use an automated theorem prover to automatically discharge all emerging proof obligations. Usually, however, the programmer must still splice auxiliary annotations (e.g., loop invariants) into the program to facilitate the proofs. For complex properties or larger programs this quickly becomes the limiting factor for the applicability of current certification approaches.

Whalen, Michael↗
NASA NTRS1992

RICIS Symposium 1992: Mission and Safety Critical Systems Research and Applications

This conference deals with computer systems which control systems whose failure to operate correctly could produce the loss of life and or property, mission and safety critical systems. Topics covered are: the work of standards groups, computer systems design and architecture, software reliability, process control systems, knowledge based expert systems, and computer and telecommunication protocols.

Source record↗
NASA NTRSDate not supplied

Verifying PLC Programs via Monitors: Extending the Integration of FRET and PLCverif

Verification of Programmable Logic Controller (PLC) programs requires reasoning about propositions qualified in terms of time. CERN’s PLCverif, an open-source tool for the analysis of safety-critical PLC systems, uses Linear Temporal Logic (LTL) for the specification of properties. Until now, PLCverif depended on third-party tools that accept LTL specifications to perform verification. However, our experience with industrial PLC programs shows that, to overcome analysis limitations, a wide range of techniques are needed to successfully verify complex properties. In this paper, we extend PLCverif to enable PLC program verification of pure-past LTL (PLTL) safety properties with assertion-based verification tools. To this end, we take an algorithm from the runtime-monitoring domain, apply it to bounded model checking of PLC programs, and implement it in PLCverif. We extend the integration of NASA’s Formal Requirements Elicitation Tool (FRET) into PLCverif to use PLTL properties generated with FRET. In addition, we leverage the program structure induced by the PLC scan-cycle for a state-space reduction. Finally, we expose the algorithm to a real-world case study of critical systems at CERN.

Formal verification↗
NASA NTRSDate not supplied

Predicting Lightning Initiation using Deep Learning

Lightning occurrence presents safety challenges to people and property. The main challenge with lightning safety is that the majority of guidance is reactive. In other words, lightning has to have already occurred nearby before a person will respond and take shelter. Further, most injuries or fatalities occur as the storm approaches, or as it's moving away, when rainfall may not be present at the time of the flash. Thus, this project develops a physically-based deep learning model to produce lightning probabilities out to 15 minutes. The deep learning model combines a Convolutional Neural Network (CNN) with a Long Short-Term Memory (LSTM) network to capture both the spatial and temporal evolution of storms to predict the probability that lightning initiation will occur in the next 15 minutes. The model combines radar reflectivity, correlation coefficient and differential reflectivity to inferred storm hydrometer type and precipitation phase, which aids in the identification of electrification processes. The model is trained with data from the Geostationary Lightning Mapper (GLM), which is a near infrared sensor onboard the GOES-R series of satellites that measures optical brightness from lightning. This presentation will provide an overview of the project.

Andrew T White↗
NASA NTRSDate not supplied

Safety Expertise and the Perils of Novelty

Emerging aviation markets such as urban air mobility are giving rise to new technologies and means of operation. However, novelty may hide ‘unknown unknowns,’ raising new hazards. This paper examines how expertise and safety techniques enable transformative technologies such as reduced crew operations, hybrid wing-borne and rotor-born flight, federated air traffic services, and urban operations. We explore how analysts use expertise to address common-cause failures, collect and interpret safety data, and perform exacting tradeoffs between dissimilarity, redundancy, independence, and diversity (human, process lifecycle, or otherwise) to ensure safety. When novelty is present, analysts might not possess the expertise needed to fully understand the implications of design decisions and tradeoffs being made, especially in early lifecycle phases, on emergent properties such as safety. Safety expertise must be carefully cultivated. The conflicting views of safety experts must be unpacked to identify the divergence in fundamental assumptions, models, means, and methods that may be causing them. Once systems venture beyond the basis of what safety expertise can reliably guarantee, projects take on risk that must be managed. The paper contains key takeaways and actionable recommendations for novel OEMs and regulators touching on topics such as robust monitoring; clear and transparent reporting; incremental approaches to fielding novel systems in hazard-rich, risk-tolerant environments; the cultivation of safety culture and expertise in an organization; and the use of scientific study to reduce epistemic uncertainty in novel operations with new technologies. Since excessive novelty in aviation can undermine the current foundation of safety, humility and incrementalism are necessary to enable emerging aviation markets safely.

safety expertise↗
NASA NTRSDate not supplied

Safety Expertise and the Perils of Novelty

Emerging aviation markets such as urban air mobility are giving rise to new technologies and means of operation. However, novelty may hide ‘unknown unknowns,’ raising new hazards. This paper examines how expertise and safety techniques enable transformative technologies such as reduced crew operations, hybrid wing-borne and rotor-born flight, federated air traffic services, and urban operations. We explore how analysts use expertise to address common-cause failures, collect and interpret safety data, and perform exacting tradeoffs between dissimilarity, redundancy, independence, and diversity (human, process lifecycle, or otherwise) to ensure safety. When novelty is present, analysts might not possess the expertise needed to fully understand the implications of design decisions and tradeoffs being made, especially in early lifecycle phases, on emergent properties such as safety. Safety expertise must be carefully cultivated. The conflicting views of safety experts must be unpacked to identify the divergence in fundamental assumptions, models, means, and methods that may be causing them. Once systems venture beyond the basis of what safety expertise can reliably guarantee, projects take on risk that must be managed. The paper contains key takeaways and actionable recommendations for novel OEMs and regulators touching on topics such as robust monitoring; clear and transparent reporting; incremental approaches to fielding novel systems in hazard-rich, risk-tolerant environments; the cultivation of safety culture and expertise in an organization; and the use of scientific study to reduce epistemic uncertainty in novel operations with new technologies. Since excessive novelty in aviation can undermine the current foundation of safety, humility and incrementalism are necessary to enable emerging aviation markets safely.

safety expertise↗
DOE OSTI2024

TRISO Fuel for High-Temperature Passively-Safe Nuclear Reactors

The poster entitled "TRISO Fuel for High-Temperature Passively-Safe Nuclear Reactors" presents reasons why TRISO fuel is a safe nuclear fuel. The poster contains four blocks: Multiple barriers to fission product release, Thermal stability, Chemical compatibility and Safety and Performance. Each block present information on the TRISO fuel in terms of the mechanical, chemical and thermal properties. In summary the safety and performance of the TRISO fuel based on the experimental results is shown.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗
NASA NTRS1991

A linear control design structure to maintain loop properties during limit operation in a multi-nozzle turbofan engine

The implementation of multi-variable control systems on turbofan engines requires the use of limit protection to maintain safe engine operation. Since a turbofan engine typically encounters limits during transient operation, the use of a limit protection scheme that modifies the feedback loop may void the desired 'guarantees' associated with linear multi-variable control design methods, necessitating considerable simulation to validate the control with limited protection. An alternative control design structure is proposed that maintains the desired linear feedback properties when certain safety limits are encountered by moving the limit protection scheme outside the feedback loop. This proposed structure is compared to a structure with a limit protection scheme that modifies the feedback loop properties. The two design structures are compared using both linear and nonlinear simulations. The evaluation emphasizes responses where the fan surge margin limit is encountered.

Mattern, Duane↗
NASA NTRS1991

A linear control design structure to maintain loop properties during limit operation in a multi-nozzle turbofan engine

The implementation of multi-variable control systems on turbofan engines requires the use of limit protection to maintain safe engine operation. Since a turbofan engine typically encounters limits during transient operation, the use of a limit protection scheme that modifies the feedback loop may void the desired 'guarantees' associated with linear multi-variable control design methods, necessitating considerable simulation to validate the control with limit protection. An alternative control design structure is proposed that maintains the desired linear feedback properties when certain safety limits are encountered by moving the limit protection scheme outside of the feedback loop. This proposed structure is compared to a structure with a limit protection scheme that modifies the feedback loop properties. The two design structures are compared using both linear and nonlinear simulations. The evaluation emphasizes responses where the fan surge margin limit is encountered.

Mattern, Duane↗
NASA NTRS2021

Assuring Intelligent Systems: Contingency Management for UAS

Unmanned aircraft systems (UAS) collaborate with humans to operate in diverse, safety-critical applications. However, assurance technologies need to be integrated into the design process in order to guarantee safe behavior, thereby enabling UAS operations in the National Airspace System (NAS). In this paper, formal methods are integrated with learning-enabled systems representations. The generation and representation of knowledge are captured via monadic second-order logic rules in the cognitive architecture Soar. These rules are translated into timed automata, and a proof of correctness for the translation is provided so that safety and liveness properties can be checked in the formal verification environment Uppaal. This approach is agnostic to the learning mechanism used to generate the learned rules (e.g., chunking, etc.). An example of a fault-tolerant, learning-enabled UAS deciding which of four contingency procedures to execute under a lost link scenario while overflying an urban area is used to illustrate the approach.

Intelligent Systems↗
DOE OSTI2022

Mechanistic Elucidation of Electronically Conductive PEDOT:PSS Tailored Binder for a Potassium‐Ion Battery Graphite Anode: Electrochemical, Mechanical, and Thermal Safety Aspects

Potassium-ion batteries (KIBs) are considered more appropriate for grid-scale storage than lithium-ion batteries (LIBs) due to similar operating chemistry, abundant precursors, and compatibility with low-cost graphite anodes. However, a larger ion reduces rate capabilities and exacerbates capacity fading from volumetric expansion. In this report, conductive polymer, poly(3,4-ethylenedioxythiophene) polystyrene sulfonate (PEDOT:PSS), is substituted for standard insulating polyvinylidene fluoride (PVDF). Half-cells using carbon black (CB) in continuously conductive PEDOT:PSS/CB binder outperforms PVDF/CB by mitigating electrically isolated “dead” graphite, improving 100 cycle capacity retention at C/10 from 63 to 80%. Enhanced electrical contact with PEDOT:PSS/CB also reduces ion impedance and improves rate capabilities. Without CB however, PEDOT:PSS binder performs poorly in electrochemical studies despite promising ex situ electronic conductivity. This discrepancy is mechanistically elucidated through identification of redox activity between PEDOT:PSS and K + which results in high impedances in the anode operating voltage window. Additionally, the impact of conducting binder on mechanical properties and thermal safety of the anode is investigated. Brittleness and poor wettability of PEDOT:PSS are identified as issues, but greater stability against reactive KC 8 reduces overall heat generation. Binder substitution offers a promising means of mitigating issues with current KIB anodes regardless of active material, and the work herein addresses issues towards further improvement.

electrochemical impedance spectroscopy↗
DOE OSTI2023

Autonomous Inversion of In Situ Deformation Measurement Data for Injection-Induced Stress Change

Geologic carbon storage (GCS) is likely to play a key part of the global effort to dramatically reduce CO2 emissions and perhaps even reduce atmospheric CO2 concentrations through carbon negative operations. A critical part of effort to commercialize and widely deploy this technology is developing the capability to rapidly assimilate real-time monitoring data into a form that will enable site operators to make decisions to manage the safe and efficient operations. Two of the risks associate with GCS are the risk of inducing fractures in the sealing formations that can create leakage pathways and the risk of inducing earthquakes of sufficient magnitude to cause public concern, property damage, or safety risks. To properly manage these risks the site operator needs to know the initial state of stress, the change in stress induced by injection, and the relationship between operational parameters such as injection rate and pressure and the change in stress. Current methods of estimating the change in stress require choosing the type of constitutive model and the model parameters based on core, log, and geophysical data during the characterization phase, with little feedback from operational observations to validate or refine these choices. These characterization methods interrogate the geologic formations using length scales, loading rates or magnitudes that are quite different from those encountered by the actual storage system. It is shown that errors in the assumed constitutive response, even when informed by laboratory tests on core samples, are likely to be common, large, and underestimate the magnitude of stress change caused by injection. Recent advances in borehole-based strain instruments and borehole and surface-based tilt and displacement instruments have now enabled monitoring of the deformation of the storage system throughout its operational lifespan. This data can enable validation and refinement of the knowledge of the geomechanical properties and state of the system, but brings with it a challenge to transform the raw data into actionable knowledge. We demonstrate a method that uses automatic differentiation and a finite-element based geomechanical model perform a gradient-based deterministic inversion of geomechanical monitoring data. This approach allows autonomous integration of the instrument data without the need for time consuming manual interpretation and selection of updated model parameters. Furthermore, only isotropic linear elasticity is considered in this paper, the approach presented is very flexible as to what type of geomechanical constitutive response can be used. The approach is easily adaptable to nonlinear physics-based constitutive models to account for common rock behaviors such as creep and plasticity. The approach also enables training of machine learning-based constitutive models by allowing back propagation of errors through the finite element calculations. This enables strongly enforcing known physics, such as conservation of momentum and continuity, while allowing data-driven models to learn the truly unknown physics such as the constitutive or petrophysical responses.

Burghardt, Jeffrey A.↗
DOE OSTI2022

Formal verification and validation of run-to-completion style state charts using Event-B

State chart notations with ‘run to completion’ semantics are popular with engineers for designing controllers that react to environment events with a sequence of state transitions but lack formal refinement and rigorous verification methods. State chart models are typically used to design complex control systems that respond to environmental triggers with a sequential process. The model is usually constructed at a concrete level and verified and validated using animation techniques relying on human judgement. Event-B, on the other hand, is based on refinement from an initial abstraction and is designed to make formal verification by automatic theorem provers feasible. Abstraction and formal verification provide greater assurance that critical (e.g. safety or security) properties are not violated by the control system. In this paper, we introduce a notion of refinement into a ‘run to completion’ state chart modelling notation and leverage Event-B’s tool support for theorem proving. We describe the difficulties in translating ‘run to completion’ semantics into Event-B refinements and suggest a solution. We illustrate our approach and show how models can be validated at different refinement levels using our scenario checker animation tools. We show how critical invariant properties can be verified by proof despite the reactive nature of the system and how behavioural aspects of the system can be verified by testing the expected reactions using a temporal logic, model checking approach. To verify liveness, we outline a proof that the run to completion is deadlock-free and converges to complete the run.

97 MATHEMATICS AND COMPUTING↗