SEARCH · Search NASA

Results for “safety critical software”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 163 records · Page 9

All sources NASA NTRS DOE OSTI

NASA NTRS1978

Fault-tolerant software for aircraft control systems

Concepts for software to implement real time aircraft control systems on a centralized digital computer were discussed. A fault tolerant software structure employing functionally redundant routines with concurrent error detection was proposed for critical control functions involving safety of flight and landing. A degraded recovery block concept was devised to allow collocation of critical and noncritical software modules within the same control structure. The additional computer resources required to implement the proposed software structure for a representative set of aircraft control functions were discussed. It was estimated that approximately 30 percent more memory space is required to implement the total set of control functions. A reliability model for the fault tolerant software was described and parametric estimates of failure rate were made.

Source record↗

DOE OSTI2020

Structural, Criticality, and Radiation Dose Calculations to support SNF Loading into a DOE Standard Canister

The DOE Standard Canister Demonstration Project includes the development of an internal support structure (ISS) for the 4.6-m long and 45.7-cm diameter canister. This study presents structural evaluations, criticality safety assessments, and dose rate calculations conducted within the scope of the ISS design process to support smooth canister loading operations and to ensure safe storage, transportation, and disposal of Peach Bottom 1 Core II (PB2) and Fort St. Vrain (FSV) SNF, currently stored at the CPP-603 facility of the INL. The ISS includes a 316L stainless steel basket that holds twelve PB2 SNF rods. Further, six individual, 78.7-cm long, 316L stainless steel columns are equally spaced and welded to the inner canister wall at the lower end of the shell. These columns represent the FSV basket and can hold one FSV SNF element. An A92014 T6 aluminum spacer disc is bolted to the bottom plate of the PB2 basket to vertically restrain the FSV SNF element after the PB2 basket is placed inside the canister on top of the FSV basket. The structural evaluations of the ISS followed applicable ASME BPVC.III.3 guidelines and included finite element (FE) analyses of the PB2 basket structure; analyses of welds and bolds; buckling analyses of selected components, and acceptability assessments of the expected basket deformations under loading operations. The criticality safety assessments used the Monte Carlo N-Particle (MCNP) software architecture version 6.2 including ENDF/B-V continuous energy cross-section libraries, considering intact SNF in a single storage overpack or two multi-storage overpack configurations, and intact or failed SNF configured for disposal. The dose rate computations are based on source terms taken from the DOE Spent Fuel Database. The isotopic composition was decay corrected for the year 2022 using the ORIGEN module in the SCALE suite. A 19-group photon spectrum and 27-group neutron-source spectra were generated and used in MCNP to calculate estimated dose-equivalent rates, both on DOE Standard Canister contact and at a radial distance of from the canister surface. The results of this study indicate a structurally sound system that can uphold its criticality safety functions throughout its intended operational phases. Further, they increase confidence that sufficient radiological protection is technically achievable.

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

DOE OSTI2022

Structural, Criticality, and Radiation Dose Calculations to Support SNF Loading into a DOE Standard Canister

The DOE Standard Canister Demonstration Project includes the development of an internal support structure (ISS) for the 4.6-m-long and 45.7-cm-diameter canister. This study presents structural evaluations, criticality safety assessments, and dose rate calculations conducted within the scope of the ISS design process to support smooth canister loading operations and to ensure safe storage, transportation, and disposal of Peach Bottom 1 Core II (PB2) and Fort St. Vrain (FSV) SNF, currently stored at INL’s CPP-603 facility. The ISS includes a 316L stainless-steel basket that holds 12 PB2 SNF rods. The PB2 basket rests on top of six individual, 78.7-cm-long, 316L stainless-steel columns that are equally spaced and welded to the inner canister wall at the lower end of the shell. These columns represent the FSV basket and can hold one FSV SNF element. An A92014 T6 aluminum spacer disc is bolted to the bottom plate of the PB2 basket to vertically restrain the FSV SNF element after the PB2 basket is placed inside the canister above the FSV basket. The structural evaluations of the ISS followed applicable ASME BPVC.III.3 guidelines and included finite element (FE) analyses of the PB2 basket structure; analyses of welds and bolds; buckling analyses of selected components, and acceptability assessments of the expected basket deformations under loading operations. The criticality safety assessments used the Monte Carlo N-Particle (MCNP) software architecture Version 6.2, including ENDF/B-V continuous-energy cross-section libraries, considering intact SNF in a single storage overpack or two multistorage overpack configurations and intact or failed SNF configured for disposal. The dose rate computations are based on source terms taken from the DOE Spent Fuel Database. The isotopic composition was decay corrected for the year 2022 using the ORIGEN module in the SCALE suite. A 19-group photon spectrum and a 27-group neutron-source spectrum were generated and used in MCNP to calculate estimated dose-equivalent rates, both on DOE Standard Canister contact and at a radial distance of 1 m from the canister surface. The results of this study indicate a structurally sound system that can uphold its criticality safety functions throughout its intended operational phases. Furthermore, this study provides confidence that sufficient radiological protection is technically achievable.

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

NASA NTRS2001

Evolution of safety-critical requirements post-launch

This paper reports the results of a small study of requirements changes to the onboard software of three spacecraft subsequent to launch. Only those requirement changes that resulted from post-launch anoma-lies (i.e., during operations) were of interest here, since the goal was to better understand the relation-ship between critical anomalies during operations and how safety-critical requirements evolve. The results of the study were surprising in that anomaly-driven, post-launch requirements changes were rarely due to previous requirements having been incorrect. Instead, changes involved new requirements (1) for the software to handle rare events or (2) for the software to compensate for hardware failures or limitations. The prevalence of new requirements as a result of post-launch anomalies suggests a need for increased requirements-engineering support of maintenance activities in these systems. The results also confirm both the difficulty and the benefits of pursuing requirements completeness, especially in terms of fault tolerance, during development of critical systems.

Software requirements↗

NASA NTRS1997

Software Design Improvements: Software Benefits and Limitations - Part 1

Computer hardware and associated software have been used for many years to process accounting information, to analyze test data and to perform engineering analysis. Now computers and software also control everything from automobiles to washing machines and the number and type of applications are growing at an exponential rate. The size of individual program has shown similar growth. Furthermore, software and hardware are used to monitor and/or control potentially dangerous products and safety-critical systems. These uses include everything from airplanes and braking systems to medical devices and nuclear plants. The question is: how can this hardware and software be made more reliable? Also, how can software quality be improved? What methodology needs to be provided on large and small software products to improve the design and how can software be verified?

Lalli, Vincent R.↗

NASA NTRS2004

Autonomous Flight Safety System

Autonomous Flight Safety System (AFSS) is an independent flight safety system designed for small to medium sized expendable launch vehicles launching from or needing range safety protection while overlying relatively remote locations. AFSS replaces the need for a man-in-the-loop to make decisions for flight termination. AFSS could also serve as the prototype for an autonomous manned flight crew escape advisory system. AFSS utilizes onboard sensors and processors to emulate the human decision-making process using rule-based software logic and can dramatically reduce safety response time during critical launch phases. The Range Safety flight path nominal trajectory, its deviation allowances, limit zones and other flight safety rules are stored in the onboard computers. Position, velocity and attitude data obtained from onboard global positioning system (GPS) and inertial navigation system (INS) sensors are compared with these rules to determine the appropriate action to ensure that people and property are not jeopardized. The final system will be fully redundant and independent with multiple processors, sensors, and dead man switches to prevent inadvertent flight termination. AFSS is currently in Phase III which includes updated algorithms, integrated GPS/INS sensors, large scale simulation testing and initial aircraft flight testing.

Ferrell, Bob↗

NASA NTRS2001

Evolution of safety-critical requirements post-launch

requirements↗

DOE OSTI2023

"Safety First: Though on the Other Hand, Time is Critical”

This talk describes the deployment of research-quality software and hardware for open-road driving experiments by fleets of vehicles. Technological advancements in single-vehicle autonomy have expanded beyond the academic community, and are driven largely by industry stakeholders and manufacturers. However, as the penetration rate of cars with advanced driver assistance features increases, the impact on emergent behavior in traffic is still unknown. Compelling reasons to experiment within open-road conditions must be considered alongside the technical and human factor safety issues in deploying experimental controllers. This is even more challenging when it is necessary to deploy experimental fleets at scale. The talk will describe approaches for co-design of a research testbed for societal-scale systems. Discussion is devoted to the research-quality data gathering and control layers and their technical implementation, the different interfaces for experts in other fields to use these testbeds for research without violating safety requirements, and process and management considerations when deploying the platforms at scale when considering training time and operation complexity of human operators.

Sprinkle, Jonathan↗

NASA NTRS2009

A Verification-Driven Approach to Traceability and Documentation for Auto-Generated Mathematical Software

Model-based development and automated code generation are increasingly used for production code in safety-critical applications, but since code generators are typically not qualified, the generated code must still be fully tested, reviewed, and certified. This is particularly arduous for mathematical and control engineering software which requires reviewers to trace subtle details of textbook formulas and algorithms to the code, and to match requirements (e.g., physical units or coordinate frames) not represented explicitly in models or code. Both tasks are complicated by the often opaque nature of auto-generated code. We address these problems by developing a verification-driven approach to traceability and documentation. We apply the AUTOCERT verification system to identify and then verify mathematical concepts in the code, based on a mathematical domain theory, and then use these verified traceability links between concepts, code, and verification conditions to construct a natural language report that provides a high-level structured argument explaining why and how the code uses the assumptions and complies with the requirements. We have applied our approach to generate review documents for several sub-systems of NASA s Project Constellation.

Denney, Ewen W.↗

NASA NTRS1997

The Need for V&V in Reuse-Based Software Engineering

V&V is currently performed during application development for many systems, especially safety-critical and mission-critical systems. The V&V process is intended to discover errors, especially errors related to entire' domain or product line rather than a critical processing, as early as possible during the development process. The system application provides the context under which the software artifacts are validated. engineering. This paper describes a framework that extends V&V from an individual application system to a product line of systems that are developed within an architecture-based software engineering environment. This framework includes the activities of traditional application-level V&V, and extends these activities into the transition between domain engineering and application engineering. The framework includes descriptions of the types of activities to be performed during each of the life-cycle phases, and provides motivation for activities.

Addy, Edward A.↗

NASA NTRS2012

Tools Ensure Reliability of Critical Software

In November 2006, after attempting to make a routine maneuver, NASA's Mars Global Surveyor (MGS) reported unexpected errors. The onboard software switched to backup resources, and a 2-day lapse in communication took place between the spacecraft and Earth. When a signal was finally received, it indicated that MGS had entered safe mode, a state of restricted activity in which the computer awaits instructions from Earth. After more than 9 years of successful operation gathering data and snapping pictures of Mars to characterize the planet's land and weather communication between MGS and Earth suddenly stopped. Months later, a report from NASA's internal review board found the spacecraft's battery failed due to an unfortunate sequence of events. Updates to the spacecraft's software, which had taken place months earlier, were written to the wrong memory address in the spacecraft's computer. In short, the mission ended because of a software defect. Over the last decade, spacecraft have become increasingly reliant on software to carry out mission operations. In fact, the next mission to Mars, the Mars Science Laboratory, will rely on more software than all earlier missions to Mars combined. According to Gerard Holzmann, manager at the Laboratory for Reliable Software (LaRS) at NASA's Jet Propulsion Laboratory (JPL), even the fault protection systems on a spacecraft are mostly software-based. For reasons like these, well-functioning software is critical for NASA. In the same year as the failure of MGS, Holzmann presented a new approach to critical software development to help reduce risk and provide consistency. He proposed The Power of 10: Rules for Developing Safety-Critical Code, which is a small set of rules that can easily be remembered, clearly relate to risk, and allow compliance to be verified. The reaction at JPL was positive, and developers in the private sector embraced Holzmann's ideas.

Source record↗

DOE OSTI2025

Success Path Method: Introduction to the Success Path Method Software Tool©

As part of its commitment to advancing safety and reliability assessment methodologies, Argonne National Laboratory pioneered the use of an evaluation method called the Success Path Method (SPM) to improve risk management for offshore oil and gas operations. The development of the SPM at Argonne has been driven by the need to improve existing risk assessment methodologies by focusing on the steps necessary for success rather than failure modes alone. This is particularly important for industrial environments like offshore facilities that perform multiple functions under a continuously evolving set of operational conditions – such as water depth and temperature, currents, and weather conditions. In these dynamic environments, the traditional Probabilistic Risk Assessment (PRA) approach is far too complex as it focuses on what can go wrong – which comprises an infinite failure space that must be fully explored and understood. By shifting the focus to a finite space of success paths, the SPM enables operators and decision makers to prioritize a manageable number of steps that must go right to ensure success. Building on its five decades of experience in safety assessments for the nuclear industry, Argonne made major adaptations to existing risk assessment methods utilizing features similar to fault trees that are traditionally used in PRA to map all pathways in which the system can malfunction. In contrast, SPM identifies the components and processes that must function correctly to achieve specific outcomes – such as preventing the uncontrolled release of hydrocarbons during drilling operations. The SPM framework integrates equipment, procedures, software, processes, and human actions to ensure that physical barriers meet critical safety functions in dynamic operational conditions. This approach helps identify failure modes and improve operational risk management by narrowing the focus to key success elements, which in turn reduces uncertainty and helps users understand, manage, and respond to failures.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2020

Gaussian Process Optimization of Sensitivity-Based Similarity Metrics between New Nuclear Applications and New/Existing Benchmarks

Confidently designing safe, new nuclear criticality experiments requires expert judgement, which could take years of experience. Sensitivity/uncertainty (S/U) analysis can be utilized by less experienced individuals to conservatively estimate uncertainties in important parameters, such as k eff , in newly proposed nuclear applications. This type of analysis relies on matching new nuclear applications with existing benchmark experiments. The Whisper-1.1 software package included in MCNP6.2 ®1 contains more than 1,100 International Criticality Safety Benchmark Evaluation Project (ICSBEP) benchmarks. These benchmarks however rarely match new nuclear applications. The number of benchmarks available to match a given set of materials or geometric configurations varies significantly. Furthermore, recently performed benchmark experiments may not have had enough time to be properly documented and published. Benchmarks are vital for determining the accuracy of nuclear data and can assist nuclear physics and evaluators in improving nuclear data libraries. Exhaustively exploring the parameter space using simulations with software such as MCNP is too computationally expensive. In this work, Gaussian process optimization was implemented to reduce the number of simulations needed for optimization over multiple parameters. This optimization scheme was designed to selectively generate new benchmarks with high sensitivity-based similarity metrics to user-defined nuclear applications. Two benchmark models of spherically nested shells containing plutonium, uranium, tantalum, and water were used in the optimization to match an application containing plutonium plates, stacked in a tantalum reflector, surrounded by water.

73 NUCLEAR PHYSICS AND RADIATION PHYSICS↗

NASA NTRS2012

Statechart Analysis with Symbolic PathFinder

We report here on our on-going work that addresses the automated analysis and test case generation for software systems modeled using multiple Statechart formalisms. The work is motivated by large programs such as NASA Exploration, that involve multiple systems that interact via safety-critical protocols and are designed with different Statechart variants. To verify these safety-critical systems, we have developed Polyglot, a framework for modeling and analysis of model-based software written using different Statechart formalisms. Polyglot uses a common intermediate representation with customizable Statechart semantics and leverages the analysis and test generation capabilities of the Symbolic PathFinder tool. Polyglot is used as follows: First, the structure of the Statechart model (expressed in Matlab Stateflow or Rational Rhapsody) is translated into a common intermediate representation (IR). The IR is then translated into Java code that represents the structure of the model. The semantics are provided as "pluggable" modules.

Pasareanu, Corina S.↗

NASA NTRS1991

Safety

Software requirements, design, implementation, verification and validation, and especially management are affected by the need to produce safe software. This paper discusses the changes in the software life cycle that are necessary to ensure that software will execute without resulting in unacceptable risk. Software is being used increasingly to monitor and control safety-critical processes in which a run-time failure or error could result in unacceptable losses such as death, injury, loss of property, or environmental harm. Examples of such processes maybe found in transportation, energy, aerospace, basic industry, medicine, and defense systems.

Leveson, Nancy G.↗

NASA NTRS2023

Trades, Architecture, and Design of the Joint Augmented Reality Visual Informatics System (Joint AR) Product

Future expeditions will enable exploration and study of the planetary surfaces of the Moon and Mars by performing extravehicular activity (EVA) operations. Present-day International Space Station (ISS) EVA operations require an intricate choreography of crew, space suits, tools, systems, and flight teams to plan, train, and execute with limited advanced informatics. In this paper, the Joint Augmented Reality Visual Informatics System (Joint AR) project team at NASA Johnson Space Center (JSC) characterizes the design space for developing a modular augmented reality (AR) device for a spacesuit form factor that can support crew decision-making for EVA. The Joint AR product was defined via trade studies and market analysis of previous EVA display efforts, various AR components such as optics, commercial AR systems, light engines, data interfaces, and graphics engine software. This paper outlines the defining architectural design decisions, including safety criticality considerations, interfaces, and computer architectures. The outcomes of these studies result in a prototype design which is defined here as the Joint AR product. This work aims to enable a community-wide discussion toward realizing necessary suit-compatible AR features and capabilities for future missions.

Paromita Mitra↗

NASA NTRS2023

Trades, Architecture, and Design of the Joint Augmented Reality Visual Informatics System (Joint AR) Product

Paromita Mitra↗

NASA NTRS1997

A Framework for Performing Verification and Validation in Reuse Based Software Engineering

Verification and Validation (V&V) is currently performed during application development for many systems, especially safety-critical and mission- critical systems. The V&V process is intended to discover errors, especially errors related to critical processing, as early as possible during the development process. The system application provides the context under which the software artifacts are validated. This paper describes a framework that extends V&V from an individual application system to a product line of systems that are developed within an architecture-based software engineering environment. This framework includes the activities of traditional application-level V&V, and extends these activities into domain engineering and into the transition between domain engineering and application engineering. The framework includes descriptions of the types of activities to be performed during each of the life-cycle phases, and provides motivation for the activities.

Addy, Edward A.↗