Search NASA⌕ Search

SEARCH · Search NASA

Results for “safety case”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 163 records · Page 9
All sourcesNASA NTRSDOE OSTI
NASA NTRS1963

Introduction to Nuclear Propulsion: Lecture 15 - Nuclear Test Operations

The test operation of nuclear power plants, specifically nuclear rockets, bears some interesting similarities to the operation of chemical rocket tests as well as, of course, many differences. A significant feature common to both nuclear and chemical rocket tests is that all the fuel for the entire operation is loaded at the start of the test. As a direct consequence of this fact, the operation of nuclear power plants must be surrounded with adequate safety precautions, as is indeed the case in the operation of chemical rockets, A second direct consequence is that in both types of testing a very thorough and complete checkout is made before starting the test.

TEST METHOD↗
NASA NTRS1976

Information and display requirements for independent landing monitors

The ways an Independent Landing Monitor (ILM) may be used to complement the automatic landing function were studied. In particular, a systematic procedure was devised to establish the information and display requirements of an ILM during the landing phase of the flight. Functionally, the ILM system is designed to aid the crew in assessing whether the total system (e.g., avionics, aircraft, ground navigation aids, external disturbances) performance is acceptable, and, in case of anomaly, to provide adequate information to the crew to select the least unsafe of the available alternatives. Economically, this concept raises the possibility of reducing the primary autoland system redundancy and associated equipment and maintenance costs. The required level of safety for the overall system would in these cases be maintained by upgrading the backup manual system capability via the ILM. A safety budget analysis was used to establish the reliability requirements for the ILM. These requirements were used as constraints in devising the fault detection scheme. Covariance propagation methods were used with a linearized system model to establish the time required to correct manually perturbed states due to the fault. Time-to-detect and time-to-correct requirements were combined to devise appropriate altitudes and strategies for fault recovery.

Karmarker, J. S.↗
NASA NTRS1989

Control of free-flying space robot manipulator systems

Control techniques for self-contained, autonomous free-flying space robots are being tested and developed. Free-flying space robots are envisioned as a key element of any successful long term presence in space. These robots must be capable of performing the assembly, maintenance, and inspection, and repair tasks that currently require astronaut extra-vehicular activity (EVA). Use of robots will provide economic savings as well as improved astronaut safety by reducing and in many cases, eliminating the need for human EVA. The focus of the work is to develop and carry out a set of research projects using laboratory models of satellite robots. These devices use air-cushion-vehicle (ACV) technology to simulate in two dimensions the drag-free, zero-g conditions of space. Current work is divided into six major projects or research areas. Fixed-base cooperative manipulation work represents our initial entry into multiple arm cooperation and high-level control with a sophisticated user interface. The floating-base cooperative manipulation project strives to transfer some of the technologies developed in the fixed-base work onto a floating base. The global control and navigation experiment seeks to demonstrate simultaneous control of the robot manipulators and the robot base position so that tasks can be accomplished while the base is undergoing a controlled motion. The multiple-vehicle cooperation project's goal is to demonstrate multiple free-floating robots working in teams to carry out tasks too difficult or complex for a single robot to perform. The Location Enhancement Arm Push-off (LEAP) activity's goal is to provide a viable alternative to expendable gas thrusters for vehicle propulsion wherein the robot uses its manipulators to throw itself from place to place. Because the successful execution of the LEAP technique requires an accurate model of the robot and payload mass properties, it was deemed an attractive testbed for adaptive control technology.

Cannon, Robert H., Jr.↗
NASA NTRS2004

Improving Performance of the System Safety Function at Marshall Space Flight Center

The Columbia Accident Investigation Board (CAIB) determined that organizational and management issues were significant contributors to the loss of Space Shuttle Columbia. In addition, the CAIB observed similarities between the organizational and management climate that preceded the Challenger accident and the climate that preceded the Columbia accident. To prevent recurrence of adverse organizational and management climates, effective implementation of the system safety function is suggested. Attributes of an effective system safety program are presented. The Marshall Space Flight Center (MSFC) system safety program is analyzed using the attributes. Conclusions and recommendations for improving the MSFC system safety program are offered in this case study.

Kiessling, Ed↗
NASA NTRS2007

Revealing the ISO/IEC 9126-1 Clique Tree for COTS Software Evaluation

Previous research has shown that acyclic dependency models, if they exist, can be extracted from software quality standards and that these models can be used to assess software safety and product quality. In the case of commercial off-the-shelf (COTS) software, the extracted dependency model can be used in a probabilistic Bayesian network context for COTS software evaluation. Furthermore, while experts typically employ Bayesian networks to encode domain knowledge, secondary structures (clique trees) from Bayesian network graphs can be used to determine the probabilistic distribution of any software variable (attribute) using any clique that contains that variable. Secondary structures, therefore, provide insight into the fundamental nature of graphical networks. This paper will apply secondary structure calculations to reveal the clique tree of the acyclic dependency model extracted from the ISO/IEC 9126-1 software quality standard. Suggestions will be provided to describe how the clique tree may be exploited to aid efficient transformation of an evaluation model.

Morris, A. Terry↗
NASA NTRS2009

Unmanned Aerial Vehicle Systems for Disaster Relief: Tornado Alley

Unmanned aerial vehicle systems are currently in limited use for public service missions worldwide. Development of civil unmanned technology in the United States currently lags behind military unmanned technology development in part because of unresolved regulatory and technological issues. Civil unmanned aerial vehicle systems have potential to augment disaster relief and emergency response efforts. Optimal design of aerial systems for such applications will lead to unmanned vehicles which provide maximum potentiality for relief and emergency response while accounting for public safety concerns and regulatory requirements. A case study is presented that demonstrates application of a civil unmanned system to a disaster relief mission with the intent on saving lives. The concept utilizes unmanned aircraft to obtain advanced warning and damage assessments for tornados and severe thunderstorms. Overview of a tornado watch mission architecture as well as commentary on risk, cost, need for, and design tradeoffs for unmanned aerial systems are provided.

DeBusk, Wesley M.↗
NASA NTRS2010

Proposal for Ground Safety Review Coordination at ISS Launch Sites

As the transportation of ISS payloads and cargo shifts from KSC to other launch sites, close coordination of ground safety review processes would be of benefit to all parties. The benefit would have the launch sites receiving consistent data that would require less effort to review while still meeting their needs. Until recently, ground safety focus for the ISS program has been almost exclusively for prelaunch processing at KSC/post-landing processing at KSC/DFRC Each launch site, used by the ISS Program, has a ground safety review process. Ground safety viewed as local prerogative. Up till now, ground processing has consisted of low risk/low hazard items; but this will not always be the case. Recent coordination issues associated with the ground safety review of ORU's to be processed at Tanegashima for HTV-2, illustrate that IP ground safety review processes are not well understood by the ISS community at large. Confusion for data providers (US only?). Lack of internal review process for data being submitted to launch sites can lead to inconsistent submittals. NCRs/HRs. Majority of IP ground safety requirements are based upon old KHB 1700.7 (now KNPR 8715.3, Chapter 20). Proposals include: Establish a ground safety working group as part of the MS&MAP. Search for efficiencies in requirements and data submittal processes. Document processes in NSTS 13830/SSP 30599. Each launch site report out its payload ground safety status at the F2F (Monthly's as required). Completions/due dates/NCRs/issues/changes. Establish internal processes for review of ground safety submittals.

Kirkpatrick, Paul D.↗
NASA NTRS2016

Orion Burn Management, Nominal and Response to Failures

An approach for managing Orion on-orbit burn execution is described for nominal and failure response scenarios. The burn management strategy for Orion takes into account per-burn variations in targeting, timing, and execution; crew and ground operator intervention and overrides; defined burn failure triggers and responses; and corresponding on-board software sequencing functionality. Burn-to- burn variations are managed through the identification of specific parameters that may be updated for each progressive burn. Failure triggers and automatic responses during the burn timeframe are defined to provide safety for the crew in the case of vehicle failures, along with override capabilities to ensure operational control of the vehicle. On-board sequencing software provides the timeline coordination for performing the required activities related to targeting, burn execution, and responding to burn failures.

Odegard, Ryan↗
NASA NTRS2018

Using ADOPT Algorithm and Operational Data to Discover Precursors to Aviation Adverse Events

The US National Airspace System (NAS) is making its transition to the NextGen system and assuring safety is one of the top priorities in NextGen. At present, safety is managed reactively (correct after occurrence of an unsafe event). While this strategy works for current operations, it may soon become ineffective for future airspace designs and high density operations. There is a need for proactive management of safety risks by identifying hidden and "unknown" risks and evaluating the impacts on future operations. To this end, NASA Ames has developed data mining algorithms that finds anomalies and precursors (high-risk states) to safety issues in the NAS. In this paper, we describe a recently developed algorithm called ADOPT that analyzes large volumes of data and automatically identifies precursors from real world data. Precursors help in detecting safety risks early so that the operator can mitigate the risk in time. In addition, precursors also help identify causal factors and help predict the safety incident. The ADOPT algorithm scales well to large data sets and to multidimensional time series, reduce analyst time significantly, quantify multiple safety risks giving a holistic view of safety among other benefits. This paper details the algorithm and includes several case studies to demonstrate its application to discover the "known" and "unknown" safety precursors in aviation operation.

aviation safet↗
NASA NTRS2018

Off-Nominal Planning for the Cryogenic Vacuum Test of the JWST Optical Telescope Element/Integrated Science Instrument Module at JSC

The cryogenic thermal vacuum/thermal balance test of the James Webb Space Telescope (JWST) combined Optical Telescope Element (OTE)/Integrated Science Instrument Module (ISIM), known as the OTIS, at the Johnson Space Center (JSC) Chamber A in 2017 was likely the most complex test ever performed by NASA for an unmanned mission. The test of the combined flight Optical Telescope and ISIM elements was prefaced by years of modifications to chamber facilities, and included three extensive precursor tests of non-flight and flight hardware to establish safe and optimal test operational procedures. One critical part of the test preparation was planning for off-nominal events that could arise, including appropriate responses. In some cases, assurance of personnel and payload safety required modification of original test hardware and procedures which had to be validated before the final test could begin. This planning proved especially prescient for the OTIS test, as Hurricane Harvey struck the Houston area during the test in August 2017, and consequences for the precious payload could have been severe. This paper describes the extent of the thermal off-nominal planning undertaken for the OTIS test, including including safing for hurricanes, and some real-life effects of Hurricane Harvey on the test conduct. Documentation of the consequences and mitigations for these events are discussed. The importance of off-nominal planning for future thermal vacuum/thermal balance tests is illustrated.

Off-Nominal Planning↗
NASA NTRS1992

Space Station Furnace Facility. Volume 2: Requirements Definition and Conceptual Design Study. Appendix 3: Environment Analysis

A Preliminary Safety Analysis (PSA) is being accomplished as part of the Space Station Furnace Facility (SSFF) contract. This analysis is intended to support SSFF activities by analyzing concepts and designs as they mature to develop essential safety requirements for inclusion in the appropriate specifications, and designs, as early as possible. In addition, the analysis identifies significant safety concerns that may warrant specific trade studies or design definition, etc. The analysis activity to date concentrated on hazard and hazard cause identification and requirements development with the goal of developing a baseline set of detailed requirements to support trade study, specifications development, and preliminary design activities. The analysis activity will continue as the design and concepts mature. Section 2 defines what was analyzed, but it is likely that the SSFF definitions will undergo further changes. The safety analysis activity will reflect these changes as they occur. The analysis provides the foundation for later safety activities. The hazards identified will in most cases have Preliminary Design Review (PDR) applicability. The requirements and recommendations developed for each hazard will be tracked to ensure proper and early resolution of safety concerns.

Source record↗
NASA NTRS2011

Automated Test Case Generation for an Autopilot Requirement Prototype

Designing safety-critical automation with robust human interaction is a difficult task that is susceptible to a number of known Human-Automation Interaction (HAI) vulnerabilities. It is therefore essential to develop automated tools that provide support both in the design and rapid evaluation of such automation. The Automation Design and Evaluation Prototyping Toolset (ADEPT) enables the rapid development of an executable specification for automation behavior and user interaction. ADEPT supports a number of analysis capabilities, thus enabling the detection of HAI vulnerabilities early in the design process, when modifications are less costly. In this paper, we advocate the introduction of a new capability to model-based prototyping tools such as ADEPT. The new capability is based on symbolic execution that allows us to automatically generate quality test suites based on the system design. Symbolic execution is used to generate both user input and test oracles user input drives the testing of the system implementation, and test oracles ensure that the system behaves as designed. We present early results in the context of a component in the Autopilot system modeled in ADEPT, and discuss the challenges of test case generation in the HAI domain.

Giannakopoulou, Dimitra↗
NASA NTRSDate not supplied

Overarching Properties as Means of Compliance: An Industrial Case Study

The Overarching Properties (OPs) have been created by an inter-national working group and are being evaluated by the National Aeronautics and Space Administration (NASA), the Federal Aviation Administration (FAA), industry, and other certifying agencies in an effort to streamline certification processes. Their intent is to facilitate the use of alternative approaches and to al-low flexibility to combine the system, software, and complex hardware certification. The hope is that the FAA may eventually establish an Advisory Circular that offers the OPs as a Means of Compliance (MoC) for software approval (and eventually systems and hardware) by showing the product possesses the three OPs: Intent (specification of the intended behavior), Correctness (implementation of the intended behavior) and Innocuity (safety of unintended behavior). In the certification community, there is still a concern about the practicability of using such high level properties in certification. This paper aims to address that concern by showing possession of the OPs in an industrial case study using assurance arguments. The two main contributions of this paper are: a certification process based on OPs as Means of Compliance, and a certification argument for an on-board physical model of an UAV, as industrial example. We pro-pose a hybrid approach for the certification process that combines OPs with existing certification standards. Thus, OPs can be used for parts of a system that uses technologies that are not supported by current standards or for which existing standards require additional effort without commensurate additional safety assurance.

certification↗
NASA NTRS2023

NASA Engineering and Safety Center Technical Bulletin No. 23-01: Including Key Design Features in Safety-Critical Pyrotechnic Firing Circuits

Pyrotechnic systems often fall into a unique category in that inadvertent activation of these systems resulting from a fault and/or lack of safe margins can lead directly to loss of crew. For example, untimely activation of pyrotechnics used for a flight termination system could override an abort capability. Over the years, NASA and the military have learned lessons about safe pyrotechnic circuit design and test, many of which are codified. However, with NASA’s recent efforts to move toward a development model than leans more heavily on Commercial Partners these requirements have not always been directly levied on projects and in some cases been misinterpreted. This bulletin describes key safety features of pyrotechnic firing circuit design and provides rationale for inclusion of each feature.

Pyrotechnic Firing Curcuits↗
NASA NTRS1976

Study leading to the refinement of the SRB structural analysis program

The constructed SRB math model was used for the analysis of the 85/32/5(VV/VH/theta) cavity collapse load condition for the aft end of the SRB structure. Linear, nonlinear collapse and bifurcation buckling analyses were performed. The linear and bifurcation buckling analyses showed that structural integrity and positive margins of safety are maintained for the applied maximum load case using a design factor of 1.25. The nonlinear collapse analysis predicts stresses in the skirt above the yield for a load factor of 1.0. Applying the 1.25 design factor gives a negative margin of safety against the material ultimate. The predicted collapse occurs at a load factor higher than 1.25.

Jones, W. E.↗
NASA NTRS2017

Modelling the Risks Remotely Piloted Aircraft Pose to People on the Ground

Worldwide there is much e ort being directed towards the development of a framework of air- worthiness regulations for remotely piloted aircraft systems (RPAS). It is now broadly accepted that regulations should have a strong foundation in, and traceability to, the management of the safety risks. Existing risk models for RPAS operations do not provide a simple means for incorporating the wide range of technical and operational controls into the risk analysis and evaluation processes. This paper describes a new approach for modelling and evaluating the risks associated with RPAS operations near populous areas based on the barrier bow tie (BBT) model. A BBT model is used to structure the underlying risk management problem. The model focuses risk analysis, evaluation, and decision making activities on the devices, people, and processes that can be employed to reduce risk. The BBT model and a comprehensive set of example risk controls are presented. The general model can be applied to any RPAS operation. The foundations for quantitative and qualitative assessments using a BBT model are also presented. The modelling and evaluation framework is illustrated through its application to a case-study rotary wing RPAS for two operational scenarios. The model can be used as a basis for determining airworthiness certification requirements for RPAS.

Barrier bow tie model↗
NASA NTRS1995

Safety analysis

We are engaged in a research program in safety-critical computing that is based on two case studies. We use these case studies to provide application-specific details of the various research issues, and as targets for evaluation of research ideas. The first case study is the Magnetic Stereotaxis System (MSS), an investigational device for performing human neurosurgery being developed in a joint effort between the Department of Physics at the University of Virginia and the Department of Neurosurgery at the University of Iowa. The system operates by manipulating a small permanent magnet (known as a 'seed') within the brain using an externally applied magnetic field. By varying the magnitude and gradient of the external magnetic field, the seed can be moved along a non-linear path and positioned at a site requiring therapy, e.g., a tumor. The magnetic field required for movement through brain tissue is extremely high, and is generated by a set of six superconducting magnets located in a housing surrounding the patient's head. The system uses two X-ray cameras positioned at right angles to detect in real time the locations of the seed and of X-ray opaque markers affixed to the patient's skull. the X-ray images are used to locate the objects of interest in a canonical frame of reference. the second case study is the University of Virginia Research Nuclear Reactor (UVAR). It is a 2 MW thermal, concrete-walled pool reactor. The system operates using 20 to 25 plate-type fuel assemblies placed on a rectangular grid plate. There are three scramable safety rods, and one non-scramable regulating rod that can be put in automatic mode. It was originally constructed in 1959 as a 1 MW system, and it was upgraded to 2 MW in 1973. Though only a research reactor rather than a power reactor, the issues raised are significant and can be related to the problems faced by full-scale reactor systems.

Knight, John C.↗