SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Several requirements analysis techniques widely used in safety-critical systems are being adapted to support the analysis of secure systems. Perhaps the most relevant system safety techique for Intrusion Detection Systems is hazard analysis.
Current needs for high-reliability, reusable software; rapid, evolutionary development; and verification of innovative software architectures have focused attention on improving techniques for analyzing the safety and reliability of embedded software.
Armstrong Flight Research Center is NASA’s premier flight research center. It is located on Edwards AFB in the high desert of California. The AFRC Safety and Mission Assurance Directorates Human Factors Program is one tool that enables Armstrong to be the national center of excellence for conducting leading edge aerospace flight research, airborne science, and airborne astronomy by providing responsive, effective, and adaptive Safety & Mission Assurance support. The AFRC Human Factors Specialist is also a member of the Agency Human Factors Task Force which provides and expands the understanding and impact of Human Factors across the Agency. The Program is managed by the Office of Safety and Mission Assurance at NASA Headquarters.
In a half century of human spaceflight, NASA has continuously refined agency safety and reliability requirements in response to mission demands, critical failures, and technology development. Early spacecraft, including Mercury, Gemini and Apollo vehicles, were highly reliant on dissimilar redundancy and demonstrated test margins. Later programs, such as the reusable Space Transportation System (STS) and International Space Station (ISS), introduced probabilistic studies and isolated two-failure tolerance to improve robustness at the expense of added complexity. More recently, the Orion Multi-Program Crew Vehicle (MPCV) program adopted universal single-failure tolerance with two categorical exceptions; Zero-Failure Tolerant (0FT) and Design for Minimum Risk (DFMR) hardware. Failure tolerance variances are defined and managed in accordance with agency human-rating requirements, and require concurrence from program Technical Authorities (TA) as well as the MPCV Safety and Mission Assurance Safety and Engineering Review Panel (MSERP). To understand and reaffirm standards applied to Apollo, Space Shuttle and Orion vehicles, Orion and Deep Space Gateway Safety and Mission Assurance (S&MA) representatives conducted accelerated research to compare unique safety and reliability criteria against ground and flight anomalies, based on information contained in post-mission reports and the Problem Reporting and Corrective Action (PRACA) database. In some cases, high-profile failures and narrow escapes have reinforced decisions to maintain or adapt safety requirements. In others, empirical trends have highlighted the need for vigilance and innovative safety guidelines. Given the inability to achieve absolute compliance with evolving safety and reliability requirements, the team conducted a targeted review of DFMR and 0FT propulsion elements within the framework of changing system design, inspection, materials and process developments to formulate conclusions on technological maturity, failure density, and net changes in safety risk. Based on the aggregate performance of high-reliability and failure-tolerant systems, the authors have attempted to establish best practices and guidelines to inform future program decisions. On a somewhat cautionary note, this study is not intended to direct a universal set of requirements for future missions based on prior lessons learned. Spacecraft safety is a multi-variable problem, and attempts to mitigate past failures will not guarantee future success. However, this assessment offers a retrospective review of policy changes, implementation and effectiveness. In the future, NASA, European Space Agency (ESA) and industry partners may benefit from a more robust correlation between requirements and performance, as space-faring nations work toward more challenging, complex and long-duration commercial and deep-space ventures.
In-time integrated safety management will be paramount for safely enabling the envisioned transformations of the future National Airspace System (NAS). The path for realizing the vision includes addressing the increasing need for advanced data analytics and fusion of aviation safety data, managed by human decision-makers. The paper describes safety management systems and its’ challenges, and how the concept of In-time Aviation Safety Management Systems addresses the need to ensure an adaptable and resilient future safety system in the envisioned transformed NAS. Finally, it discusses potential human factors challenges, including new human roles and responsibilities, new information and cognitive requirements, new intelligent technologies that change human-system interaction and coordination, and new design paradigms for human system integration and teaming.
In-time integrated safety management will be paramount for safely enabling the envisioned transformations of the future National Airspace System (NAS). The path for realizing the vision includes addressing the increasing need for advanced data analytics and fusion of aviation safety data, managed by human decision-makers. The paper describes safety management systems and its’ challenges, and how the concept of In-time Aviation Safety Management Systems addresses the need to ensure an adaptable and resilient future safety system in the envisioned transformed NAS. Finally, it discusses potential human factors challenges, including new human roles and responsibilities, new information and cognitive requirements, new intelligent technologies that change human-system interaction and coordination, and new design paradigms for human system integration and teaming.
The underlying philosophy of the general approach to failure reduction and control is presented. Safety and reliability management techniques developed in the industries which have participated in the U.S. space and defense programs are described along with adaptations to nonaerospace activities. The examples given illustrate the scope of applicability of these techniques. It is indicated that any activity treated as a 'system' is a potential user of aerospace safety and reliability management techniques.
An adaptive control architecture for safe performance of a transport aircraft subject to various adverse conditions is proposed and verified in this report. This architecture combines a nominal controller based on a Linear Quadratic Regulator with integral action, and an adaptive controller that accommodates actuator saturation and bounded disturbances. The effectiveness of the baseline controller and its adaptive augmentation are evaluated using a stand-alone control veri fication methodology. Case studies that pair individual parameter uncertainties with critical flight maneuvers are studied. The resilience of the controllers is determined by evaluating the degradation in closed-loop performance resulting from increasingly larger deviations in the uncertain parameters from their nominal values. Symmetric and asymmetric actuator failures, flight upsets, and center of gravity displacements, are some of the uncertainties considered.
This poster presents the current adaptive control research being conducted at NASA ARC and LaRC in support of the Integrated Resilient Aircraft Control (IRAC) project. The technique "Approximate Stability Margin Analysis of Hybrid Direct-Indirect Adaptive Control" has been developed at NASA ARC to address the needs for stability margin metrics for adaptive control that potentially enables future V&V of adaptive systems. The technique "Direct Adaptive Control With Unknown Actuator Failures" is developed at NASA LaRC to deal with unknown actuator failures. The technique "Adaptive Control with Adaptive Pilot Element" is being researched at NASA LaRC to investigate the effects of pilot interactions with adaptive flight control that can have implications of stability and performance.
Given the current evolution of the National Airspace and future trajectory towards novel and evolving operations with varying levels of autonomy, complexity, and acceptable risk, there is an opportunity to support safety assurance by extending existing methodologies, such as Functional Hazard Assessment (FHA). In response to challenges in performing FHA for novel aviation concepts, we propose a concept for Computational Functional Hazard Assessment (CFHA), which provides processes, methods, and tools for incorporating external data to facilitate further exploration of the hazard space iterativelty throughout the design process. The core components of CFHA involve knowledge capture from historical and operational data, functional architecture specification via a formal modeling language, and simulation for hazardous scenario analysis. Through this concept, we aim to adapt conventional safety assessment to address the increasingly complex hazard space generated from emerging operations.
Given the current evolution of the National Airspace and future trajectory towards novel and evolving operations with varying levels of autonomy, complexity, and acceptable risk, there is an opportunity to support safety assurance by extending existing methodologies, such as Functional Hazard Assessment (FHA). In response to challenges in performing FHA for novel aviation concepts, we propose a concept for Computational Functional Hazard Assessment (CFHA), which provides processes, methods, and tools for incorporating external data to facilitate further exploration of the hazard space iterativelty throughout the design process. The core components of CFHA involve knowledge capture from historical and operational data, functional architecture specification via a formal modeling language, and simulation for hazardous scenario analysis. Through this concept, we aim to adapt conventional safety assessment to address the increasingly complex hazard space generated from emerging operations.
Over the last five decades, extensive research has been performed to design and develop adaptive control systems for aerospace systems and other applications where the capability to change controller behavior at different operating conditions is highly desirable. Although adaptive flight control has been partially implemented through the use of gain-scheduled control, truly adaptive control systems using learning algorithms and on-line system identification methods have not seen commercial deployment. The reason is that the certification process for adaptive flight control software for use in national air space has not yet been decided. The purpose of this paper is to examine the gaps between the state-of-the-art methodologies used to certify conventional (i.e., non-adaptive) flight control system software and what will likely to be needed to satisfy FAA airworthiness requirements. These gaps include the lack of a certification plan or process guide, the need to develop verification and validation tools and methodologies to analyze adaptive controller stability and convergence, as well as the development of metrics to evaluate adaptive controller performance at off-nominal flight conditions. This paper presents the major certification gap areas, a description of the current state of the verification methodologies, and what further research efforts will likely be needed to close the gaps remaining in current certification practices. It is envisioned that closing the gap will require certain advances in simulation methods, comprehensive methods to determine learning algorithm stability and convergence rates, the development of performance metrics for adaptive controllers, the application of formal software assurance methods, the application of on-line software monitoring tools for adaptive controller health assessment, and the development of a certification case for adaptive system safety of flight.
Enhanced engine operation--operation that is beyond normal limits--has the potential to improve the adaptability and safety of aircraft in emergency situations. Intelligent use of enhanced engine operation to improve the handling qualities of the aircraft requires sophisticated risk estimation techniques and a risk management system that spans the flight and propulsion controllers. In this paper, an architecture that weighs the risks of the emergency and of possible engine performance enhancements to reduce overall risk to the aircraft is described. Two examples of emergency situations are presented to demonstrate the interaction between the flight and propulsion controllers to facilitate the enhanced operation.
Soft robot arms offer safety and adaptability due to their passive compliance, but this compliance typically limits their payload capacity and prevents them from performing many tasks. This paper presents a model-based design approach to effectively increase the payload capacity of soft robot arms. The proposed approach uses localized body stiffening to decrease the compliance at the end effector without sacrificing the robot’s range of motion. This approach is validated on both a simulated and a real soft robot arm, where experiments show that increasing the stiffness of localized regions of their bodies reduces the compliance at the end effector and increases the height to which the arm can lift a payload. By increasing the payload capacity of soft robot arms, this approach has the potential to improve their efficacy in a variety of tasks including object manipulation and exploration of cluttered environments.
The goal of the Autonomous Propulsion System Technology (APST) project is to reduce pilot workload under both normal and anomalous conditions. Ongoing work under APST develops and leverages technologies that provide autonomous engine monitoring, diagnosing, and controller adaptation functions, resulting in an integrated suite of algorithms that maintain the propulsion system's performance and safety throughout its life. Engine-to-engine performance variation occurs among new engines because of manufacturing tolerances and assembly practices. As an engine wears, the performance changes as operability limits are reached. In addition to these normal phenomena, other unanticipated events such as sensor failures, bird ingestion, or component faults may occur, affecting pilot workload as well as compromising safety. APST will adapt the controller as necessary to achieve optimal performance for a normal aging engine, and the safety net of APST algorithms will examine and interpret data from a variety of onboard sources to detect, isolate, and if possible, accommodate faults. Situations that cannot be accommodated within the faulted engine itself will be referred to a higher level vehicle management system. This system will have the authority to redistribute the faulted engine's functionality among other engines, or to replan the mission based on this new engine health information. Work is currently underway in the areas of adaptive control to compensate for engine degradation due to aging, data fusion for diagnostics and prognostics of specific sensor and component faults, and foreign object ingestion detection. In addition, a framework is being defined for integrating all the components of APST into a unified system. A multivariable, adaptive, multimode control algorithm has been developed that accommodates degradation-induced thrust disturbances during throttle transients. The baseline controller of the engine model currently being investigated has multiple control modes that are selected according to some performance or operational criteria. As the engine degrades, parameters shift from their nominal values. Thus, when a new control mode is swapped in, a variable that is being brought under control might have an excessive initial error. The new adaptive algorithm adjusts the controller gains on the basis of the level of degradation to minimize the disruptive influence of the large error on other variables and to recover the desired thrust response.
This report summarizes a three-hour hybrid in-person/online workshop on June 7, 2024 on the topic of design assurance and the Safety Demonstrator Series (SDS), which was held at NASA Ames Research Center. The SDS provides an operational demonstration of, and recommendations for, requirements and standards necessary to monitor, assess, and mitigate risks to assure safety in disaster-oriented operations. Over sixty NASA personnel participated in the workshop. Four main topics were discussed: (1) assurance needs for the Safety Demonstrator Series, (2) assurance and the In-Time Aviation Safety Management System (IASMS), (3) in-time assurance: existing efforts and future opportunities, and (4) demonstrating assurance tools in the Safety Demonstrators. Key takeaways are as follows: 1. Design assurance tools can be used to assure an In-Time Aviation Safety Management System, the systems that comprise it, and other systems or missions. Assurance must consider both systems and components and include the interactions between elements in both a systems/aircraft context and a systems-of-systems/airspace context. 2. Design-time assurance activities can support the identification of monitors needed for operational assurance activities (i.e., the “monitor” function in the monitor-assess-mitigate paradigm at the heart of the IASMS concept). 3. A major opportunity for design-time assurance tools to contribute to the IASMS concept is to support rapid re-validation of systems. This will be particularly important for (1) supporting novel operations in the IASMS, where operational data may disprove design-time assumptions (motivating re-analysis of system safety) and (2) adapting technologies (e.g., AI/ML for autonomous operations) to new operational domains, where there may be new or different safety considerations not included in the initial scope of operations. 4. There are several design assurance tools under development in the System-Wide Safety project that can support assurance of Services, Functions, and Capabilities (SFCs) in the Safety Demonstrators. Transitioning these tools from one-off research projects into a functioning part of IASMS assurance will require closer integration between these tools. 5. It is not clear whether the role of design assurance tools is primarily as a part of IASMS architecture or as an external check on IASMS. The workshop consisted of four discussion topics initiated via four lightning talks by System-Wide Safety researchers. Discussions utilized Mural to engage both in-person and online participants in the hybrid format. Polls and surveys were also utilized to gather participant input. The workshop closed with a reflection activity for participants, as well as new ideas for collaboration and coordination of ongoing System-Wide Safety research.
The sensors were examined for adaptability to shuttle by reviewing pertinent information regarding sensor characteristics as they related to the shuttle and Multimission Modular Spacecraft environments. This included physical and electrical characteristics, data output and command requirements, attitude and orientation requirements, thermal and safety requirements, and adaptability and modification for space. The sensor requirements and characteristics were compared with the corresponding shuttle and Multimission Modular Spacecraft characteristics and capabilities. On this basis the adaptability and necessary modifications for each sensor were determined. A number of the sensors were examined in more detail and estimated cost for the modifications was provided.
This study assesses the in-time safety management services, functions, and capabilities (SFCs)being investigated by NASA’s System Wide Safety (SWS) project to determine applicability to the project’s planned safety demonstrator (SD-1) for wildland fire management. The purpose of this work is to evaluate how effectively existing SFCs address the different hazards presented by a safety demonstrator operating in a wildland fire management scenario. This will help inform decision makers which SFCs would provide the most cost-effective solutions to fill the hazard gaps for further research. Hazards for the safety demonstrator wildland fire management scenario were collated, and the SFCs were evaluated for each hazard based on how applicable and effective the unmodified SFCs are at addressing the hazard. The SFCs are also evaluated for the gap type that needs to be addressed to improve the SFC effectiveness for the given hazard. The key finding of this assessment is that all the existing SFCs require at least some research and development to adapt to the safety demonstrator. No single SFC fully addresses any of the safety demonstrator operation hazards. The result of this study will be used to determine the performance of current SFCs and suggest strategies to adapt existing SFCs or add new SFCs.