System safety - A management system for safety used in manned space flight.
Management system for safety in NASA Manned Space Flight Program, discussing hazard analyses and reduction precedence sequence
SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Management system for safety in NASA Manned Space Flight Program, discussing hazard analyses and reduction precedence sequence
Outer planet explorers design for Grand Tour mission, discussing launch parameters, flight paths, environmental hazards, communications, ground control, navigation and power generation
The potential influence of heavy rain on airfoil performance is discussed. Experimental methods for evaluating rain effects are reviewed. Important scaling considerations for extrapolating model data are presented. It is shown that considerable additional effort, both analytical and experimental, is necessary to understand the degree of hazard associated with flight operations in rain.
Alert generation and cockpit presentation issues for low-level wind shear (microburst) alerts are investigated. Alert generation issues center on development of a hazard criterion which allows integration of both ground-based and airborne wind shear detection systems to form an accurate picture of the aviation hazard posed by a particular wind shear situation. A methodology for testing of hazard criteria through flight simulation has been developed, and has been used to examine the effectiveness and feasibility of several possible criteria. Also, an experiment to evaluate candidate graphical cockpit displays for microburst alerts using a piloted simulator has been designed.
Alert generation and cockpit presentation issues for low level wind shear (microburst) alerts are investigated. Alert generation issues center on the development of a hazard criterion which allows integration of both ground based and airborne wind shear detection systems to form an accurate picture of the aviation hazard posed by a particular wind shear situation. A methodology for the testing of a hazard criteria through flight simulation has been developed, and has been used to examine the effectiveness and feasibility of several possible criteria. Also, an experiment to evaluate candidate graphical cockpit displays for microburst alerts using a piloted simulator has been designed.
The Air Transportation Research Program at Princeton University proceeded along four avenues during the past year: microburst hazards to aircraft; wind rotor hazards to aircraft; flight control system robustness; and intelligent aircraft/airspace systems. This research has resulted in a number of publications, including theses, archival papers, and conference papers. An annotated bibliography of publications that appeared between June 1993 and June 1994 appears at the end of this report.
Manned and robotic missions to the Earth's moon and Mars are exposed to a continuous flux of Galactic Cosmic Rays (GCR) and occasional, but intense, fluxes of Solar Energetic Particles (SEP). These natural radiations impose hazards to manned exploration, but also present some constraints to the design of robotic missions. The hazards to interplanetary flight crews and their uncertainties have been studied recently by a National Research Council Committee (Space Studies Board 1996). Considering the present uncertainty estimates, thick spacecraft shielding would be needed for manned missions, some of which could be accomplished with onboard equipment and expendables. For manned and robotic missions, the effects of radiation on electronics, sensors, and controls require special consideration in spacecraft design. This paper describes the GCR and SEP particle fluxes, secondary particles behind shielding, uncertainties in radiobiological effects and their impact on manned spacecraft design, as well as the major effects on spacecraft equipment. The principal calculational tools and considerations to mitigate the radiation effects are discussed, and work in progress to reduce uncertainties is included.
Toxic gases produced by the combustion or thermo-oxidative degradation of materials such as wire insulation, foam, plastics, or electronic circuit boards in space shuttle or space station crew cabins may pose a significant hazard to the flight crew. Toxic gas sensors are routinely evaluated in pure gas standard mixtures, but the possible interferences from polymer combustion products are not routinely evaluated. The NASA White Sands Test Facility (WSTF) has developed a test system that provides atmospheres containing predetermined quantities of target gases combined with the coincidental combustion products of common spacecraft materials. The target gases are quantitated in real time by infrared (IR) spectroscopy and verified by grab samples. The sensor responses are recorded in real time and are compared to the IR and validation analyses. Target gases such as carbon monoxide, hydrogen cyanide, hydrogen chloride, and hydrogen fluoride can be generated by the combustion of poly(vinyl chloride), polyimide-fluoropolymer wire insulation, polyurethane foam, or electronic circuit board materials. The kinetics and product identifications for the combustion of the various materials were determined by thermogravimetric-IR spectroscopic studies. These data were then scaled to provide the required levels of target gases in the sensor evaluation system. Multisensor toxic gas monitors from two manufacturers were evaluated using this system. In general, the sensor responses satisfactorily tracked the real-time concentrations of toxic gases in a dynamic mixture. Interferences from a number of organic combustion products including acetaldehyde and bisphenol-A were minimal. Hydrogen bromide in the products of circuit board combustion registered as hydrogen chloride. The use of actual polymer combustion atmospheres for the evaluation of sensors can provide additional confidence in the reliability of the sensor response.
Safe, low-cost space transportation is the key enabler of the commercial development and civil exploration of space. Human space flight remains a hazardous endeavor in spite of advances in aerospace technology. NASA intends to reduce the resources devoted to routine space operations, thus enabling additional science research, technology development, and exploration activities. NASA developed the Integrated Space Transportation Plan (ISTP) to address the needs for space access. ISTP is a balanced and comprehensive plan that embodies strategies for achieving goals for earth-to-orbit and in-space transportation operations. ISTP calls for near-term safety related upgrades to the Space Shuttle, development of a Crew Return Vehicle, a new Space Launch Initiative (SLI), and development of an Aero-Space Base to provide foundation technology for future space systems. NASA formed the SLI to coordinate the development of the 2nd Generation Reusable Launch Vehicle (RLV) architecture, The SLI is implemented by the 2nd Generation RLV Program Office.
The unique feature of the space radiation environment is the dominance of high-energy charged particles (HZE or high LET radiation) emitted by the Sun and galactic sources, or trapped in the Van Allen radiation belts. These charged particles present a significant hazard to space flight crews, and accelerator-based experiments are underway to quantify the health risks due to unavoidable radiation exposure. There are three principal properties of charged particles that distinguish them from conventional radiation, i.e. gamma rays and x-rays. First, they have a defined range in matter rather than an exponential absorption profile. Second, they undergo nuclear reactions to produce secondary particles. Third, and most important, they deposit their energy along well-defined linear paths or tracks rather than diffuse fields. The structured energy deposition pattern interacts on multiple scales with the biological structures of DNA, cells and tissues to produce correlated patterns of damage that evade repair systems. Traditional concepts of dose and its associated normalization parameter, RBE (relative biological effectiveness), break down under experimental scrutiny, and probabilistic models of risk based on the number of particle traversals per cell may be more appropriate. Unique patterns of DNA damage, gene expression, mobilization of repair proteins, activation of cytokines and remodeling of cellular microenvironment are observed following exposure to high LET radiation. At low levels of exposure the communication of bioactive substances from irradiated to unirradiated "bystander" cells can amplify the damage and cause a significant deviation from linearity in dose vs. response relations. Under some circumstances, there is even a multigenerational delay in the expression of radiation-induced genetic damage (genomic instability) which is not strictly dose dependent. These issues and the experimental evidence derived from ground based experiments at particle accelerators are presented along with speculation about how modified inertial conditions might perturb homeostatic responses to radiation to further complicate risk assessment for space flight.
An integrated mobile field system for forecasting ground and in-flight aviation icing hazards would be a vital asset for winter operations. Improved icing forecasts are critical to managing aviation icing hazards.
Exposure to ionizing radiation is identified as one of the main hazards of space flight. Galactic cosmic rays (GCRs) are composed of energetic protons (87%), helium nuclei (12%) and high-charge and energy (HZE) ions. At the cellular scale, HZE ions have a pattern of energy deposition that depends on the ion linear energy transfer (LET), with high LET ions favoring the formation of complex DNA damages that induce chromosome aberrations (CAs). Understanding how physical (e.g., ion type and energy) and biological (e.g., cell type) parameters impact CA formation is required to assess space radiation risks such as carcinogenesis. The Monte Carlo tool RITCARD/RITRACKS [1,2] developed by NASA allows simulation of the transport of HZE ions and subsequent energy deposition at the cellular scale and models the creation of DNA double strand breaks (DSBs), DNA repair and formation of CAs. We used this radiation transport code to further understand how radiation quality and cell size affects CA formation.
In order to refine an initial Concept of Operations, explore Concepts of Use, and expose/validate requirements for future In-Time Aviation Safety Management Systems (IASMS), testing architectures were created, along with a set of capabilities and underlying information exchange protocols. These systems were conceived and developed based on hazards associated with two envisioned urban area flight domains: (1) highly autonomous small uncrewed aerial systems (sUAS) operating at low altitudes, and (2) highly autonomous air taxis. The initial scope of this development is described in [1]; this report provides an update, focusing on the subsequent developments and test activities. As stated in [1], it is important to note that there are many capabilities already in use by the industry (or soon to be in use) that will play critical roles in future IASMS designs. Those reported here were developed to address a gap in the current state-of-the-art regarding specific hazards/risks, and/or to allow for investigation of the interplay between and across hazard types — particularly regarding how overall safety risk can be reduced or managed effectively. Results of testing and development activities are organized by the operational phase wherein a particular capability would be employed (i.e., preflight, in-flight, and post-flight/off-line). Pre-flight: A set of capabilities were developed to help mitigate safety risk prior to flight (e.g., during flight and mission planning). Results of testing summarize (1) validation activities to raise the Technology Readiness Level (TRL) and (2) evaluation activities where the capabilities were applied to flight/mission planning procedures and used by operators/pilots. For the latter, flight plans were automatically assessed, and operators/pilots were notified of hazardous flight segments so as to enable adjustment of the flight plan and re-evaluation, and/or to better inform go/no-go decisions. Capabilities addressed hazards associated with power consumption, third-party risk, wind, navigation system performance, radiofrequency interference, and proximity to geo-spatial threats (e.g., buildings, trees, and no-fly zones). In-flight: Flight experiments tested capabilities that detect and respond to hazards encountered during flight. In the first series, safety hazards were monitored and assessed onboard, and system-generated mitigation maneuvers were recorded (but not acted upon by the vehicle). In the second series, mitigation maneuver commands directed the aircraft in response to safety hazards (i.e., auto-mitigation). The sUAS used for testing is described in full, as is the test architecture, which included commercial avionics, research avionics, and onboard software designed to detect, assess, and respond to hazards. The onboard system was designed as a run-time assurance framework, consistent with [2] and supportive of both supervisory and automated modes. The primary functions included: real-time risk assessment (RTRA), auto-pilot monitoring, constraint monitoring, and contingency select/triggering. RTRA performs integrated risk assessment considering data from several hazard-related monitors (e.g., battery, motors, navigation, communications, population density, and loss-of-control). Post-flight/off-line: Data monitored and recorded during flights can enable IASMS capabilities that execute after flights have completed (or “off-line”). These include: (1) the ability to identify anomalies and trends that may only be observable when comparing data spanning a number of similar flights; (2) the ability to update and validate pre-flight and in-flight capabilities and any underlying models to improve their performance; (3) the ability to report anomalies/off-nominals that may indicate design changes or maintenance actions are needed; and (4) the ability for humans involved in operations to report safety-relevant observations to help in understanding the flight data and/or the operational context of a flight. Progress on three such capabilities is summarized; the first investigates anomaly detection given a limited set of flight logs and applies an approach previously used for space operations. The second explores what could be identified using a larger set of flight logs, including from web-based forums where flight logs are posted by sUAS autopilot users. The third creates a new means of collecting information on UAS incidents and accidents via the Aviation Safety Reporting System (ASRS).
A great deal of effort has been invested in attempts to define situational awareness, and subsequently to measure this construct. However, relatively less work has focused on the sensitivity of these measures to manipulations that affect the SA of the pilot. This investigation was designed to manipulate SA and examine the sensitivity of commonly used measures of SA. In this experiment, we tested the most commonly accepted measures of SA: SAGAT, objective performance measures, and SART, against different levels of SA manipulation to determine the sensitivity of such measures in the rotorcraft flight environment. SAGAT is a measure in which the simulation blanks in the middle of a trial and the pilot is asked specific, situation-relevant questions about the state of the aircraft or the objective of a particular maneuver. In this experiment, after the pilot responded verbally to several questions, the trial continued from the point frozen. SART is a post-trial questionnaire that asked for subjective SA ratings from the pilot at certain points in the previous flight. The objective performance measures included: contacts with hazards (power lines and towers) that impeded the flight path, lateral and vertical anticipation of these hazards, response time to detection of other air traffic, and response time until an aberrant fuel gauge was detected. An SA manipulation of the flight environment was chosen that undisputedly affects a pilot's SA-- visibility. Four variations of weather conditions (clear, light rain, haze, and fog) resulted in a different level of visibility for each trial. Pilot SA was measured by either SAGAT or the objective performance measures within each level of visibility. This enabled us to not only determine the sensitivity within a measure, but also between the measures. The SART questionnaire and the NASA-TLX, a measure of workload, were distributed after every trial. Using the newly developed rotorcraft part-task laboratory (RPTL) at NASA Ames Research Center, each pilot flew eight trials, four using SAGAT and four using performance measures. Each set of four trials differed by level of visibility as well. The flight paths were very similar in appearance and hazard number, allowing comparison between flight paths. The pilots were tasked with flying along a road at an assigned altitude and speed while avoiding any hazards that they happened upon. The attempt here was not to find a single best measure of SA, but rather to begin an investigation of the sensitivity of common measures of SA. Upon completion of this study, its results, in combination with future studies, should allow us to develop an empirically based taxonomy of SA measures and the contexts for their appropriate use.
The general approach and products of the NASA/FAA Airborne Windshear Program conducted by NASA Langley Research Center are summarized, with references provided for the major technical contributions. During this period, NASA conducted 2 years of flight testing to characterize forward-looking sensor performance. The NASA/FAA Airborne Windshear Program was divided into three main elements: Hazard Characterization, Sensor Technology, and Flight Management Systems. Simulation models developed under the Hazard Characterization element are correlated with flight test data. Flight test results comparing the performance and characteristics of the various Sensor Technologies (microwave radar, lidar, and infrared) are presented. Most of the activities in the Flight Management Systems element were conducted in simulation. Simulation results from a study evaluating windshear crew procedures and displays for forward-looking sensor-equipped airplanes are discussed. NASA Langley researchers participated heavily in the FAA process of generating certification guidelines for predictive windshear detection systems. NASA participants felt that more valuable technology products were generated by the program because of this interaction. NASA involvement in the process and the resulting impact on products and technology transfer are discussed in this paper.
The Weather Accident Prevention Concept of Operations (CONOPS) serves as a decision-making framework for research and technology development planning. It is intended for use by the WxAP members and other related programs in NASA and the FAA that support aircraft accident reduction initiatives. The concept outlines the project overview for program level 3 elements-such as AWIN, WINCOMM, and TPAWS (Turbulence)-that develop the technologies and operating capabilities to form the building blocks for WxAP. Those building blocks include both retrofit of equipment and systems and development of new aircraft, training technologies, and operating infrastructure systems and capabilities. This Concept of operations document provides the basis for the WxAP project to develop requirements based on the operational needs ofthe system users. It provides the scenarios that the flight crews, airline operations centers (AOCs), air traffic control (ATC), and flight service stations (FSS) utilize to reduce weather related accidents. The provision to the flight crew of timely weather information provides awareness of weather situations that allows replanning to avoid weather hazards. The ability of the flight crew to locate and avoid weather hazards, such as turbulence and hail, contributes to safer flight practices.
This paper reviews the evolution and current state of atmospheric monitoring on the International Space Station to provide context from which we can imagine a more advanced and integrated system. The unique environmental hazards of human space flight are identified and categorized into groups, taking into consideration the time required for the hazard to become a threat to human health or performance. The key functions of a comprehensive monitoring strategy for a closed ecological life support system are derived from past experience and a survey of currently available technologies for monitoring air quality. Finally, a system architecture is developed incorporating the lessons learned from ISS and other analogous closed life support systems. The paper concludes by presenting recommendations on how to proceed with requirements definition and conceptual design of an air monitoring system for exploration missions.
For the first time, a suite of three lidar sensors have been used in flight to scan a lunar-like hazard field, identify a safe landing site, and, in concert with an experimental Guidance, Navigation, and Control (GN&C) system, guide the Morpheus autonomous, rocket-propelled, free-flying test bed to a safe landing on the hazard field. The lidar sensors and GN&C system are part of the Autonomous Precision Landing and Hazard Detection and Avoidance Technology (ALHAT) project which has been seeking to develop a system capable of enabling safe, precise crewed or robotic landings in challenging terrain on planetary bodies under any ambient lighting conditions. The 3-D imaging flash lidar is a second generation, compact, real-time, air-cooled instrument developed from a number of cutting-edge components from industry and NASA and is used as part of the ALHAT Hazard Detection System (HDS) to scan the hazard field and build a 3-D Digital Elevation Map (DEM) in near-real time for identifying safe sites. The flash lidar is capable of identifying a 30 cm hazard from a slant range of 1 km with its 8 cm range precision at 1 sigma. The flash lidar is also used in Hazard Relative Navigation (HRN) to provide position updates down to a 250m slant range to the ALHAT navigation filter as it guides Morpheus to the safe site. The Doppler Lidar system has been developed within NASA to provide velocity measurements with an accuracy of 0.2 cm/sec and range measurements with an accuracy of 17 cm both from a maximum range of 2,200 m to a minimum range of several meters above the ground. The Doppler Lidar's measurements are fed into the ALHAT navigation filter to provide lander guidance to the safe site. The Laser Altimeter, also developed within NASA, provides range measurements with an accuracy of 5 cm from a maximum operational range of 30 km down to 1 m and, being a separate sensor from the flash lidar, can provide range along a separate vector. The Laser Altimeter measurements are also fed into the ALHAT navigation filter to provide lander guidance to the safe site. The flight tests served as the culmination of the TRL 6 journey for the lidar suite and included launch from a pad situated at the NASA-Kennedy Space Center Shuttle Landing Facility (SLF) runway, a lunar-like descent trajectory from an altitude of 250m, and landing on a lunar-like hazard field of rocks, craters, hazardous slopes, and safe sites 400m down-range just off the North end of the runway. The tests both confirmed the expected performance and also revealed several challenges present in the flight-like environment which will feed into future TRL advancement of the sensors. The flash lidar identified hazards as small as 30 cm from the maximum slant range of 450 m which Morpheus could provide, however, it was occasionally susceptible to an increase in range noise due to heated air from the Morpheus rocket plume which entered its Field-of-View (FOV). The flash lidar was also susceptible to pre-triggering on dust during the HRN phase which was created during launch and transported by the wind. The Doppler Lidar provided velocity and range measurements to the expected accuracy levels yet it was also susceptible to signal degradation due to air heated by the rocket engine. The Laser Altimeter, operating with a degraded transmitter laser, also showed signal attenuation over a few seconds at a specific phase of the flight due to the heat plume generated by the rocket engine.