SEARCH · Search NASA

Results for “safety certification”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 127 records · Page 7

All sources NASA NTRS DOE OSTI

DOE OSTI2021

Waste Compliance and Tracking System (WCATS) Version 3 Requirements Document

This document describes the end-user requirements for the Waste Compliance and Tracking System (WCATS) project in accordance with the WCATS Software Quality Management Plan, EPC-WMP-WCATSPLAN-001. The WCATS application shall support the generation, characterization, processing, and shipment of LANL radioactive, hazardous, and industrial waste. Regulatory drivers include RCRA hazardous waste, DOT shipping, NNSA nuclear material control and accountability, DOE nuclear safety, TSDF permit, and transuranic waste certification requirements. The system will utilize a task-based architecture that supports the spectrum of treatment, storage, disposal, administrative, and characterization based unit operations necessary to manage waste from cradle to grave. The application design shall readily accommodate new facilities, processes, workflow, signature requirements, and so forth, via end-user established metadata. WCATS will provide support for representing waste storage and disposal facilities, buildings, rooms, and grid layouts (x, y, z) to support waste and radioactive material inventory management. Nuclear material at risk (MAR), DOE hazard rating (e.g., Category II facility) compliance per DOE-STD-1027, and permit inventory requirements will be configurable for any storage or disposal facility, or waste operation, and the system will automatically evaluate and enforce those requirements. In addition, the application will support the characterization and management of the entire range of hazardous and radioactive wastes (TRU, MTRU, LLW, MLLW, hazardous waste, etc.) that might be colocated or processed at a permitted facility. Some capabilities not found in traditional systems include user-defined tank systems for liquid waste, user-defined work paths (i.e., sequence of operations), and an equipment subsystem for tracking the calibration, maintenance, and inspection of tools used to process waste, such as torque wrenches, scales, pH probes, etc. The application incorporates a desktop and mobile user interface as shown in Figure 1. The mobile interface supports field operations, such as waste item characterization, intra-facility transfers, internal and external audits, and shipment preparation and receipt.

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

DOE OSTI2023

Distributed Wind Certification Best Practices Guideline: January 16, 2023 - January 15, 2026

This Distributed Wind (DW) Certification Best Practices Guideline describes the typical approach for certification of distributed wind turbines above and below 150 kilowatts (kW) in size based on the conformity assessment requirements in the United States. The purpose of the guideline is to clarify and consistently describe the path to certification for various systems and components by helping the user navigate the complex path to certification compliance. This is done via clarification of both the required turbine type certification elements, as well as third-party electrical safety listing of turbine system components and subassemblies. In the United States specifically, there is no wind turbine certification scheme that governs or maintains a consistent set of conformity assessment requirements, and this can lead to wide ranging interpretations of the standards and required elements for certifications. This guideline attempts to simplify the path by organizing the information and guiding the user to the applicable set of requirements. Any wind turbine manufacturer or designer of wind turbines used in distributed generation applications in the United States would find value in the conformity assessment guidance in this guideline. Users are expected to be involved in the technical development of the product and supporting documentation, as the details provided are geared towards electrical and mechanical engineering of the system and components.

17 WIND ENERGY↗

NASA NTRS1983

A preliminary damage tolerance methodology for composite structures

The certification experience for the primary, safety-of-flight composite structure applications on the F-16 is discussed. The rationale for the selection of delamination as the major issue for damage tolerance is discussed, as well as the modeling approach selected. The development of the necessary coupon-level data base is briefly summarized. The major emphasis is on the description of a full-scale fatigue test where delamination growth was obtained to demonstrate the validity of the selected approach. A summary is used to review the generic features of the methodology.

Wilkins, D. J.↗

NASA NTRS1982

Experience with specifications applicable to certification

The Jet Propulsion Laboratory has developed a number of photovoltaic test and measurement specifications to guide the development of modules toward the requirements of future large-scale applications. Experience with these specifications and the extensive module measurement and testing that has accompanied their use is examined. Conclusions are drawn relative to three aspects of product certification: performance measurement, endurance testing and safety evaluation.

Ross, R. G., Jr.↗

NASA NTRS2021

ATTRACTOR: Autonomy Teaming and TRAjectories for Complex Trusted Operational Reliability

Autonomous systems (AS) are crucial to realizing the vision of new, complex transportation modes, such as advanced air mobility (AAM) and urban air mobility (UAM). A chief barrier to induction of AS into aviation is insufficient understanding of AS reliability in time-critical and safety-critical environments—an obstacle to certification. ATTRACTOR is aimed at building a basis for certification of classes of autonomous cyber-physical-human systems (CPHS) via establishing metrics and models of trustworthiness and trust in multi-agent team interactions, analyzable trajectories, explainability of computational algorithms (explainable artificial intelligence, or XAI), and persistent modeling and simulation, in the context of missions planning and operation. By “building a basis for certification,” we mean acquiring an understanding of when a system is trustworthy and developing computable means to estimate trustworthiness and trust in order to eventually inform functional requirements that contribute to certification. The outcomes are applicable not just to aviation but to all domains that rely on autonomous systems.

Autonomy↗

NASA NTRSDate not supplied

Safety Assessment of a Machine Learning-Based Aircraft Emergency Braking System: A Case Study

Machine Learning (ML) is revolutionizing many technological fields, but its use in aviation remains restricted due to stringent certification requirements. Efforts by the aviation community to establish standards for certifying ML-based systems are progressing, yet challenges persist, particularly with safety assessment methods for ML-based systems. This research addresses these challenges through a case study of an autonomous emergency braking system utilizing a computer vision deep neural network (DNN). We demonstrate a safety assessment process tailored to ML-specific concerns, such as low integrity and performance variability in quantitative safety analysis. This study can serve as an illustrative example to facilitate the discussion and convergence on certification aspects for ML-based systems within the aviation community.

Safety certification↗

NASA NTRS2016

Safety Characteristics in System Application Software for Human Rated Exploration

NASA and its industry and international partners are embarking on a bold and inspiring development effort to design and build an exploration class space system. The space system is made up of the Orion system, the Space Launch System (SLS) and the Ground Systems Development and Operations (GSDO) system. All are highly coupled together and dependent on each other for the combined safety of the space system. A key area of system safety focus needs to be in the ground and flight application software system (GFAS). In the development, certification and operations of GFAS, there are a series of safety characteristics that define the approach to ensure mission success. This paper will explore and examine the safety characteristics of the GFAS development.

exploration↗

NASA NTRS2022

Functional Hazard Assessment for the eVTOL Aircraft Supporting Urban Air Mobility (UAM) Applications: Exploratory Demonstrations

The active development community surrounding electric vertical takeoff and landing (eVTOL) aircraft has demonstrated potential to bring new technological capabilities to market, encouraging visions of widespread and diverse Urban Air Mobility (UAM) applications. New capabilities always come with safety considerations, some familiar and others less so. OEMs who intend to obtain FAA type certification for their eVTOL designs must plan for and execute sufficient safety engineering processes to demonstrate that credible hazards associated with these eVTOL designs are adequately mitigated. This work provides an orientation for eVTOL stakeholders, especially new entrants and those in hybrid roles, to the safety and regulatory context for assuring eVTOL aircraft for UAM applications. We further present selections of functional hazard assessment (FHA) performed on a reference eVTOL concept, with process and decision narration. The exercise allows exploration of several safety considerations specific to eVTOL systems and demonstrates the FHA process together with negotiation of some of its options and variations.

Hazard Analysis↗

DOE OSTI2020

Transient Safety Filter Design for Grid-Forming Inverters

Unlike conventional generators, inverter-based generation are fundamentally incapable of providing rotational inertia. While grid-forming inverters alleviate some of that problem by synthesizing small inertia via feedback control, additional control mechanisms are needed to ensure safety and security during transients. In this paper, we propose novel real-time safety-constrained feedback controllers (``safety filters'') for droop-based (grid-forming) inverters to ensure transient security of the grid. The safety filter acts as a buffer between the network operational layer and the inverter-control layer, and only lets those dispatch control signals pass to the inverter droop-controller, which are guaranteed to not violate the safety specifications (frequency, voltage, current limits). Using a distributed barrier certificates method, we construct sector-like conditions on the control policies, which guarantee the satisfaction of transient safety specifications. Sum-of-square programming is used to synthesize the safety filters. Numerical simulation results are provided to illustrate the performance of the proposed filter on inverter-based microgrids.

Kundu, Soumya↗

NASA NTRSDate not supplied

Verification and Validation of Safety-Critical Aircraft Systems Operating under Off-Nominal, Contingency, and Emergency Conditions

Verification and validation (V&V) of safety-critical technologies developed for loss of control (LOC) prevention and recovery and other aviation safety concerns pose significant challenges. Aircraft LOC can result from a wide spectrum of hazards, often occurring in combination, which cannot be fully replicated during evaluation. Technologies developed for LOC prevention and recovery must therefore be effective under a wide variety of hazardous and uncertain conditions, and the verification and validation of these technologies must provide some measure of assurance that the new vehicle safety technologies do no harm (i.e., that they themselves do not introduce new safety risks). V&V technologies must also enable the identification of system limitations and constraints, as well as enable the identification of safe and unsafe operating conditions (and their boundaries). Additionally, the V&V of complex, increasingly autonomous systems is a fundamental concern. Scalable, reproducible and cost-effective techniques for the assurance of safety critical systems during their design and operation is a key barrier to fielding new systems or updating current systems. Moreover, these techniques need to provide artifacts that enable a comprehensive evidence-based approach to certification. This briefing summarizes research performed under NASA’s Aviation Safety Program and follow-on research for the V&V of safety-critical aircraft system technologies developed for LOC prevention and recovery and increasingly autonomous systems, and for a broad assurance capability in both current and emerging aviation applications. Note that, in this briefing, the term “validation” refers to a confirmation that the system implementation (e.g., algorithms etc.) is performing the intended function(s), as well as an affirmation of effectiveness in these functions. “Verification” refers to a confirmation that the system implementation in the software and hardware meets its (hopefully validated) specifications (e.g., correctly executes algorithms as designed).

Validation↗

NASA NTRS2018

Serious Gaming for Building a Basis of Certification via Trust and Trustworthiness of Autonomous Systems

Autonomous systems governed by a variety of adaptive and nondeterministic algorithms are being planned for inclusion into safety-critical environments, such as unmanned aircraft and space systems in both civilian and military applications. However, until autonomous systems are proven and perceived to be capable and resilient in the face of unanticipated conditions, humans will be reluctant or unable to delegate authority, remaining in control aided by machine-based information and decision support. Proving capability, or trustworthiness, is a necessary component of certification. Perceived capability is a component of trust. Trustworthiness is an attribute of a cyber-physical system that requires context-driven metrics to prove and certify. Trust is an attribute of the agents participating in the system and is gained over time and multiple interactions through trustworthy behavior and transparency. Historically, artificial intelligence and machine learning systems provide answers without explanation - without a rationale or insight into the machine “thinking”. In order to function as trusted teammates, machines must be able to explain their decisions and actions. This transparency is a product of both content and communication. NASA’s Autonomy Teaming & TRAjectories for Complex Trusted Operational Reliability (ATTRACTOR) project seeks to build a basis for certification of autonomous systems via establishing metrics for trustworthiness and trust in multi-agent team interactions, using AI (Artificial Intelligence) explainability and persistent modeling and simulation, in the context of mission planning and execution, with analyzable trajectories. Inspired by Massively Multiplayer Online Role Playing Games (MMORPG) and Serious Gaming, the proposed ATTRACTOR modeling and simulation environment is similar to online gaming environments in which player (aka agent) participants interact with each other, affect their environment, and expect the simulation to persist and change regardless of any individual agent’s active participation. This persistent simulation environment will accommodate individual agents, groups of self-organizing agents, and large-scale infrastructure behavior. The effects of the emerging adaptation and coevolution can be observed and measured to building a basis of measurable trustworthiness and trust, toward certification of safety-critical autonomous systems.

Allen, B. Danette↗

NASA NTRS2008

Certifying Auto-Generated Flight Code

Model-based design and automated code generation are being used increasingly at NASA. Many NASA projects now use MathWorks Simulink and Real-Time Workshop for at least some of their modeling and code development. However, there are substantial obstacles to more widespread adoption of code generators in safety-critical domains. Since code generators are typically not qualified, there is no guarantee that their output is correct, and consequently the generated code still needs to be fully tested and certified. Moreover, the regeneration of code can require complete recertification, which offsets many of the advantages of using a generator. Indeed, manual review of autocode can be more challenging than for hand-written code. Since the direct V&V of code generators is too laborious and complicated due to their complex (and often proprietary) nature, we have developed a generator plug-in to support the certification of the auto-generated code. Specifically, the AutoCert tool supports certification by formally verifying that the generated code is free of different safety violations, by constructing an independently verifiable certificate, and by explaining its analysis in a textual form suitable for code reviews. The generated documentation also contains substantial tracing information, allowing users to trace between model, code, documentation, and V&V artifacts. This enables missions to obtain assurance about the safety and reliability of the code without excessive manual V&V effort and, as a consequence, eases the acceptance of code generators in safety-critical contexts. The generation of explicit certificates and textual reports is particularly well-suited to supporting independent V&V. The primary contribution of this approach is the combination of human-friendly documentation with formal analysis. The key technical idea is to exploit the idiomatic nature of auto-generated code in order to automatically infer logical annotations. The annotation inference algorithm itself is generic, and parametrized with respect to a library of coding patterns that depend on the safety policies and the code generator. The patterns characterize the notions of definitions and uses that are specific to the given safety property. For example, for initialization safety, definitions correspond to variable initializations while uses are statements which read a variable, whereas for array bounds safety, definitions are the array declarations, while uses are statements which access an array variable. The inferred annotations are thus highly dependent on the actual program and the properties being proven. The annotations, themselves, need not be trusted, but are crucial to obtain the automatic formal verification of the safety properties without requiring access to the internals of the code generator. The approach has been applied to both in-house and commercial code generators, but is independent of the particular generator used. It is currently being adapted to flight code generated using MathWorks Real-Time Workshop, an automatic code generator that translates from Simulink/Stateflow models into embedded C code.

Denney, Ewen↗

NASA NTRS1999

Streamlining Software Aspects of Certification: Report on the SSAC Survey

The aviation system now depends on information technology more than ever before to ensure safety and efficiency. To address concerns about the efficacy of software aspects of the certification process, the Federal Aviation Administration (FAA) began the Streamlining Software Aspects of Certification (SSAC) program. The SSAC technical team was commissioned to gather data, analyze results, and propose recommendations to maximize efficiency and minimize cost and delay, without compromising safety. The technical team conducted two public workshops to identify and prioritize software approval issues, and conducted a survey to validate the most urgent of those issues. The SSAC survey, containing over two hundred questions about the FAA's software approval process, reached over four hundred industry software developers, aircraft manufacturers, and FAA designated engineering representatives. Three hundred people responded. This report presents the SSAC program rationale, survey process, preliminary findings, and recommendations.

Hayhurst, Kelly J.↗

DOE OSTI2026

Distributed Wind Certification Best Practices Guideline: January 16, 2023-January 15, 2026

17 WIND ENERGY↗

NASA NTRSDate not supplied

Adaptive Stress Testing of Collision Avoidance Systems for Small UASs with Deep Reinforcement Learning

The next-generation Airborne Collision Avoidance System for smaller UASs (ACAS sXu) is currently being developed and tested by the Federal Aviation Administration (FAA) to provide detect-and-avoid capability for small unmanned aircraft operating beyond line-of-sight. Due to the complexity and safety-critical nature of the system, safety validation is important not only for the certification of the final system, but also for informing changes during the iterative development process. In this paper, we analyze a prototype of ACAS sXu in simulated aircraft encounters to discover scenarios of small near mid-air collisions (sNMACs), an important safety event in which two aircraft come closer than 50 feet horizontally and 15 feet vertically. Due to the size and complexity of the system as well as rarity of sNMAC events, traditional methods such as Monte Carlo testing often require informed setup and targeting to elicit failures. However, such a dependence on domain knowledge can be incompatible with the independent verification and validation (IV&V) process, the aim of which is to discover unforeseen issues. To address these challenges, we apply an accelerated validation method called adaptive stress testing (AST) to find the most likely sNMAC scenarios without reliance on system introspection. AST uses reinforcement learning to adapt the search towards the most promising areas of the search space as it progresses. We use a state-of-the-art deep reinforcement learning algorithm, proximate policy optimization, to more efficiently search the large and continuous state space. We find that this approach significantly improves the performance of AST compared to a prior approach based on Monte Carlo tree search. We perform experiments using AST to find sNMAC events under various encounter configurations, varying parameters pertaining to dynamics and coordination. Our experiments show AST to be very effective at finding sNMAC scenarios. We summarize our findings, presenting high-level categories of discovered sNMACs and specific examples of encounters in each category.

aircraft collision avoidance↗

NASA NTRS2018

FUELEAP Model-Based System Safety Analysis

NASA researchers, in a partnership with Boeing, are investigating a fuel-cell powered variant of the X-57 “Maxwell” Mod-II electric propulsion aircraft, which is itself derived from a stock Tecnam P2006T. The “Fostering Ultra-Efficient Low-Emitting Aviation Power” (FUELEAP) project will replace the X-57 power subsystem with a hybrid Solid-Oxide Fuel Cell (SOFC) system to increase the potential range of the electric-propulsion aircraft while dramatically improving efficiency and emissions over stock internal-combustion engines. Our FUELEAP safety analysis faces two primary challenges. First, the Part 23 certificated Tecnam P2006T is undergoing significant modifications to host the hybrid electric-propulsion system, and the challenge is to assure that the safety inherent in the stock aircraft (and subsequently in X-57 Mod-II) is not compromised by changes in avionics, aircraft structural loading, weight and balance, or other considerations. Secondly, because the SOFC power system has little (if any) relevant in-service precedent, our challenge is to assure that we identify and mitigate all reasonably plausible hazards introduced by unique FUELEAP equipage. We are investigating and utilizing Model-Based Safety Analysis (MBSA) methods to help us address these FUELEAP safety challenges. We captured aircraft-level system hazard conditions using instances of a SysML hazard block via aircraft-level Functional Hazard Analysis (FHA). Then, using SysML models of the FUELEAP architecture, we related the hazard conditions to initiating system events and possible mitigations, such as design architecture modifications or operational constraints. We are continuing to define our approach to MBSA by developing a component-by-component inventory of local failure modes and tracing their possible contribution to hazard conditions. Finally, we are applying an argument-based approach to FUELEAP assurance. Through a FUELEAP “safety case,” we are providing an explicit argument for FUELEAP safety by associating assurance evidence with overarching safety claims through a structured argument.

Woodham, Kurt P.↗

NASA NTRSDate not supplied

Certification Concepts for AI/ML Systems

This presentation goes over some of the tools developed at NASA Ames in the Robust Software Engineering group for the assurance and certification of autonomous systems. The research themes presented include improving safety and risk assessment as early as possible in the lifecycle, elicitation and formalization of requirements to facilitate traceability throughout the lifecycle, especially when formal methods are used, algorithms, tools and techniques for the V&V of ML-enabled systems, advanced testing, use of runtime monitoring to ease use of untrusted components, and contribution to draft regulatory standards and assistance in producing and presenting certification evidences.

Autonomy↗

DOE OSTI2025

Multi-criteria thermal resilience certification scheme for indoor built environments during heat waves

With climate change, the indoor built environment is expected to significantly influence the occupant's safety and well-being. A novel multi-criteria thermal resilience certification scheme for indoor built environments during extreme heat events is proposed in this paper. The certification scheme considers overheating, thermal comfort, heat stress, and hygrothermal discomfort in built environments. These criteria are quantified using key performance indicators like indoor overheating degree, hours of exceedance, wet-bulb globe temperature, and heat index, respectively. This scheme is developed based on existing best practices like standards, rating systems, and literature. The scheme is implemented on a benchmark building energy performance model for detached post-World War II dwellings in Belgium as a case study using weather data measured from the City of Brussels. The indoor overheating in the reference dwelling is assessed with a static threshold of 27 °C for the bedrooms and adaptive thresholds for other areas. The analysis found that the building performance is within the defined threshold levels throughout the heat wave duration for all criteria. Therefore, the reference dwelling got a maximum attainable score of four points and is rated five-star for thermal resilience during heat waves. The proposed certification scheme is intended as a standardized framework and highlights the need for further revisions in building performance policies and guidelines.

Climate change↗