SEARCH · Search NASA

Results for “Safety Case Patterns”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records

All sources NASA NTRS DOE OSTI

NASA NTRS2013

A Formal Basis for Safety Case Patterns

By capturing common structures of successful arguments, safety case patterns provide an approach for reusing strategies for reasoning about safety. In the current state of the practice, patterns exist as descriptive specifications with informal semantics, which not only offer little opportunity for more sophisticated usage such as automated instantiation, composition and manipulation, but also impede standardization efforts and tool interoperability. To address these concerns, this paper gives (i) a formal definition for safety case patterns, clarifying both restrictions on the usage of multiplicity and well-founded recursion in structural abstraction, (ii) formal semantics to patterns, and (iii) a generic data model and algorithm for pattern instantiation. We illustrate our contributions by application to a new pattern, the requirements breakdown pattern, which builds upon our previous work

Formal Methods↗

NASA NTRS2015

Safety Case Patterns: Theory and Applications

We develop the foundations for a theory of patterns of safety case argument structures, clarifying the concepts involved in pattern specification, including choices, labeling, and well-founded recursion. We specify six new patterns in addition to those existing in the literature. We give a generic way to specify the data required to instantiate patterns and a generic algorithm for their instantiation. This generalizes earlier work on generating argument fragments from requirements tables. We describe an implementation of these concepts in AdvoCATE, the Assurance Case Automation Toolset, showing how patterns are defined and can be instantiated. In particular, we describe how our extended notion of patterns can be specified, how they can be instantiated in an interactive manner, and, finally, how they can be automatically instantiated using our algorithm.

Safety Assurance↗

NASA NTRS2013

Evidence Arguments for Using Formal Methods in Software Certification

We describe a generic approach for automatically integrating the output generated from a formal method/tool into a software safety assurance case, as an evidence argument, by (a) encoding the underlying reasoning as a safety case pattern, and (b) instantiating it using the data produced from the method/tool. We believe this approach not only improves the trustworthiness of the evidence generated from a formal method/tool, by explicitly presenting the reasoning and mechanisms underlying its genesis, but also provides a way to gauge the suitability of the evidence in the context of the wider assurance case. We illustrate our work by application to a real example-an unmanned aircraft system- where we invoke a formal code analysis tool from its autopilot software safety case, automatically transform the verification output into an evidence argument, and then integrate it into the former.

Argumentation↗

NASA NTRS2006

A Taxonomy of Fallacies in System Safety Arguments

Safety cases are gaining acceptance as assurance vehicles for safety-related systems. A safety case documents the evidence and argument that a system is safe to operate; however, logical fallacies in the underlying argument may undermine a system s safety claims. Removing these fallacies is essential to reduce the risk of safety-related system failure. We present a taxonomy of common fallacies in safety arguments that is intended to assist safety professionals in avoiding and detecting fallacious reasoning in the arguments they develop and review. The taxonomy derives from a survey of general argument fallacies and a separate survey of fallacies in real-world safety arguments. Our taxonomy is specific to safety argumentation, and it is targeted at professionals who work with safety arguments but may lack formal training in logic or argumentation. We discuss the rationale for the selection and categorization of fallacies in the taxonomy. In addition to its applications to the development and review of safety cases, our taxonomy could also support the analysis of system failures and promote the development of more robust safety case patterns.

Greenwell, William S.↗

NASA NTRS2020

Run Time Assurance as an Alternate Concept to Contemporary Development Assurance Processes

NASA and the FAA sought industry research to identify and evaluate alternate concepts for assuring safety of airborne systems. This report documents a research effort focused on the evaluation of Run Time Assurance (RTA) as applied to a novel, airborne system architecture. The RTA pattern is applied to a case study focused on a notional integrated flight and propulsion control system for a DEP VTOL aircraft. During flight, while the high-automation algorithms are operating, the RTA system will monitor the aircraft state for any impending violation of safety requirements. When necessary, it will switch to the low-automation software to prevent such violations. Assurance practices for both baseline industry activities and the RTA approach were captured and compared to illustrate the required engineering design considerations, and possible advantages and disadvantages of each approach as part of this case study.

Eric M. Peterson↗

NASA NTRSDate not supplied

Understanding and Verifying Neural Networks

Deep Neural Networks (DNNs) have gained immense popularity in recent times and have widespread use in applications such as image classification, sentiment analysis, speech recognition and also in safety-critical applications such as autonomous driving. However, they suffer limitations such as lack of explainability and robustness which raise safety and security concerns in their usage. Further, the complex structure and large input spaces of DNNs act as an impediment to thorough verification and testing. The SafeDNN project at the Robust Software Engineering (RSE) group at NASA aims at exploring techniques to ensure that systems that use deep neural networks are safe, robust and interpretable. In this talk, I will be presenting our technique Prophecy that automatically infers formal properties of deep neural network models. The tool extracts patterns based on neuron activations as preconditions that imply certain desirable output properties of the model. I would be highlighting case studies that use Prophecy in obtaining explanations for network decisions, understanding correct and incorrect behavior, providing formal guarantees wrt safety and robustness, and debugging neural network models. We have applied the tool on image classification networks, neural network controllers providing turn advisories in unmanned aircrafts, regression models used for autonomous center-line tracking in aircrafts and neural network object detectors

Deep Neural Networks↗

DOE OSTI2020

Patchy snapshots of nuclear chain reactions

Stochastic fluctuations of the neutron population within a nuclear reactor are typically prevented by operating the core at a sufficiently high power. This regime, where the evolution of the neutron density is essentially deterministic, is key for automatic protection and safety systems to safely detect unwanted power excursions during an accident, and to rapidly initiate a reactor trip procedure in case it is needed. Recent works, supported by numerical simulations, have however reported that, for large reactors, the branching nature of the fission reactions might induce strongly non-Poissonian patterns in the neutron spatial distribution, and that stochastic fluctuations might still persist at reactor powers close to operating conditions (startup phase). An international program conducted by LANL, IRSN and CEA was therefore setup to experimentally detect and characterize such fluctuations and correlations. An experiment took place in 2017 at the Reactor Critical Facility (RCF) of the Rensselaer Polytechnic Institute (USA). In this paper we will report the main findings of this experimental program, supported by stochastic models and by the development of a dedicated high-fidelity Monte Carlo simulation code. We will in particular describe and explain the strong patchiness in neutron power distributions measured at the RCF, as well as a peculiar ‘blinking’ behavior of the core, and discuss the consequences of these findings on nuclear safety.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

DOE OSTI2023

Approaches for Synthesis and Deployment of Controller Models on Automated Vehicles for Car-following in Mixed Autonomy

This paper describes the software design patterns and vehicle interfaces that were employed to transition vehicle controllers from simulation environments to open-road field experiments. The approach relies on a life cycle that utilizes model-based design and code generation, along with agile software development, and both software and hardware-in-the-loop testing, with additional safety margins. Autonomous designs should consider the dynamics of mixed autonomy in traffic to safely operate among humans. The software that provides a vehicle’s behavior intelligence is often developed through simulation, which may have a mismatch between dynamics, or as a result of a reinforcement learning workflow, which may be a black box with challenges to analyze. In each of these cases, it is important to have research interfaces that provide strongly typed data streams accessible to researchers who are not software experts while continuing to satisfy safety and liveness constraints. This paper describes how we design the hardware platform interfaces and software design process for a mixed autonomy traffic experiment with a leader-follower scenario. Controller synthesis for these vehicles requires clearly articulated vehicle interfaces and software design patterns for successful onboard deployment. Testing strategies for such controllers are also described before algorithms are transitioned to full-scale field experiments with safety operators for the vehicles. Testing strategies include software-in-the-loop simulation testing, hardware-in-the-loop simulation, ghost-car testing, and read-only testing in live traffic. With our approach, we were not only able to validate our controller synthesized in scripts and simulation, but also able to scale deployment to multiple vehicles.

Bhadani, Rahul↗

NASA NTRS2019

Supporting Crew Autonomy in Deep Space Exploration: Preliminary Onboard Capability Requirements and Proposed Research Questions. Technical Report of the Autonomous Crew Operations Technical Interchange Meeting

Communication delays are a critical challenge posed by long duration deep space exploration. Space missions historically have relied on an ever-present Mission Control Center (MCC) to direct operations in near real-time. As unanticipated anomalies that defeat fault detection and resolution systems do arise, the lack of real-time communication will significantly weaken what the MCC support represents: a reliable safety net for the flight crew through its deep and diverse areas of expertise and investigative resources. As a consequence, future space vehicles and habitats need to be equipped with capabilities to support the flight crew to operate with little or no ground support. Considerations must be given to vehicle and mission designs that will fortify the traditionally ground-centered safety net and forge new support systems, when communication delays exist. In August 2018, NASA’s Human Research Program, through its Human Factors and Behavioral Performance Element, convened a Technical Interchange Meeting (TIM) on Autonomous Crew Operations at NASA Ames Research Center. The goal of the meeting was to gather input from NASA centers, industry, academia, and branches of the Department of Defense (DoD) to address how intelligent technologies can be applied to augment onboard capabilities to support crew anomaly response. The TIM featured 24 presentations by 29 speakers and hosted a total of 59 attendees, including 43 from 5 NASA centers (Ames, Johnson, Langley, Marshall, and Jet Propulsion Lab) and 4 from the DoD (3 from Army Research Lab and 1 from Naval Postgraduate School), with remaining attendees from academia (e.g., UC Davis, CMU) and industry (e.g., IBM, Siemens). Discussions were centered around three themes: standards and guidelines, lessons learned in analog environments, and technologies. To help provide a framework for discussion, a concept matrix describing anomaly response processes was created prior to the TIM (Figure 1, page 6). The matrix captures the steps involved (monitoring and detection, diagnosis, solution development and evaluation, solution implementation and verification, resolution documentation) as well as the resources and capabilities required to support these steps (data, knowledge, analysis, synthesis, resource management). A wallpaper size printout of the matrix was utilized at the TIM to solicit attendee inputs along the three themes; the activity garnered 108 submissions of ideas. Overall, what emerged from TIM discussions was a picture of mismatch between crew anomaly response needs and support that can be provided by existing intelligent technologies. The needs are broad, spanning multiple steps and processes/resources, with many of which lacking support from existing technologies, such as knowledge management throughout the steps of problem solving (especially in resolution documentation) and manpower management. The solutions provided by existing intelligent technologies are specific to the steps/processes that they are designed to support and constrained to solving only problems similar to those that have occurred before. What is lacking from technologies is typically made up by humans, specifically their complex critical thinking, creative problem solving, and domain expertise. In the end, the TIM highlighted the pressing need to support responses to onboard anomalies during autonomous crew operations, particularly those that have eluded the system tests, inspection, and other assurance processes. Such anomalies can potentially threaten crew and vehicle safety, as well as significantly impact overall operations with additional workload. These fairly rare events are difficult to anticipate and prepare for, given the state-of-the-art in intelligent technologies. This is true even for anomalies that stem from “unknown knowns”—cases in which there is sufficient external information to characterize the problem but the overall pattern fails to be recognized by the problem solver, or in which the internal knowledge needed to solve a problem is held tacitly and potentially accessible by the problem solver but not articulated. It follows that the ability to tackle anomalies lies not only with the availability of relevant information and knowledge but also their accessibility in times of need. To that end, we propose research questions along the following three broad themes: • How intelligent technologies can help make relevant knowledge and information available? • How intelligent technologies can help make relevant knowledge and information accessible? • How intelligent technologies can help support the crew operating as a team in anomaly response processes?

autonomous crew operations↗

NASA NTRSDate not supplied

Case Study: Analysis of Autonomous Center line Tracking Neural Networks

Deep neural networks have gained widespread usage in a number of applications. However, limitations such as lack of explainability and robustness inhibit building trust in their behavior, which is crucial in safety critical applications such as autonomous driving. Therefore, techniques which aid in understanding and providing guarantees for neural network behavior are the need of the hour. In this paper, we present a case study applying a recently proposed technique, Prophecy, to analyze the behavior of a neural network model, provided by our industry partner and used for autonomous guiding of airplanes on taxi runways. This regression model takes as input an image of the runway and produces two outputs, cross-track error and heading error, which represent the position of the plane relative to the center line. We use the Prophecy tool to extract neuron activation patterns for the correctness and safety properties of the model. We show the use of these patterns to identify features of the input that explain correct and incorrect behavior. We also use the patterns to provide guarantees of consistent behavior. We explore a novel idea of using sequences of images (instead of single images) to obtain good explanations and identify regions of consistent behavior.

Deep Neural Networks↗

DOE OSTI2021

Sandia 7uPCX Critical Experiments Exploring the Effects of Fuel-to-Water Ratio Variations

The Sandia Critical Experiments (SCX) Program provides a specialized facility for performing water moderated and reflected critical experiments with UO 2 fuel rod arrays. A history of safe reactor operations and flexibility in reactor core configuration has resulted in the completion of several benchmark critical experiment evaluations that are published in the International Criticality Safety Benchmark Evaluation Project (ICSBEP) Handbook. The LEUCOMP-THERM-078 and LEU-COMP-THERM-080 evaluations from the handbook provide similar cases for reference. The set of experiments described here were performed using the Seven Percent Critical Experiment (7uPCX) fuel to measure the effects of decreasing the fuel-to-water volume ratio on the critical array size. This was accomplished by using fuel loading patterns to effectively increase the pitch of the fuel arrays in the assembly. The fuel rod pitch variations provided assembly configurations that ranged from strongly undermoderated to slightly overmoderated.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗

NASA NTRS1984

Identification of vortex-induced clear-air turbulence using airline flight records

The nature and cause of clear-air turbulence is being investigated, in cooperation with the National Transportation Safety Board, using the flight records available from airline encounters with severe turbulence. This paper presents two case studies of severe turbulence which indicate that the airplanes involved encountered vortex arrays which were generated by destabilized wind-shear layers near the tropopause. In order to identify and analyze vortex patterns (i.e., vortex strength, size, and spacings), potential-flow models of vortex arrays were developed that describe reasonably well the wind patterns derived from the airliner flight records. The results of this analysis indicate that in the two cases studied, the vortex cores had diameters in the range of 900 to 1,200 ft with tangential velocities in the range of 70 to 85 ft/sec. This study presents the first identification and analysis of vortex arrays from airline flight data. The results are compared with theoretical predictions and previous observations.

Parks, E. K.↗

DOE OSTI2018

Dry and hot: the hydraulic consequences of a climate change-type drought for Amazonian trees

How plants respond physiologically to leaf warming and low water availability may determine how they will perform under future climate change. In 2015-2016 an unprecedented drought occurred across Amazonia with record-breaking high temperatures and low soil moisture, offering a unique opportunity to evaluate the performances of Amazonian trees to a severe climatic event. We quantified the responses of leaf water potential, sap velocity, whole-tree hydraulic conductance (Kwt), turgor loss and xylem embolism, during and after the 2015-2016 El Niño for five canopy-tree species. Leaf/xylem safety margins (SM), sap velocity and Kwt showed a sharp drop during warm periods. SMs were negatively correlated with vapor pressure deficit but had no significant relationship with soil water storage. Based on our calculations of canopy stomatal and xylem resistances, the decrease in sap velocity and Kwt was due to a combination of xylem cavitation, and stomatal closure. Our results suggest extremely warm droughts greatly amplify the degree of trees’ physiological stress and can lead to mortality. Given the extreme nature of the 2015-2016 El Niño and that temperatures are predicted to increase, this work can serve as a case study of the possible impact climate warming can have on tropical trees.

Fontes, Clarissa G.↗

NASA NTRS2015

Development and Execution of the RUNSAFE Runway Safety Bayesian Belief Network Model

One focus area of the National Aeronautics and Space Administration (NASA) is to improve aviation safety. Runway safety is one such thrust of investigation and research. The two primary components of this runway safety research are in runway incursion (RI) and runway excursion (RE) events. These are adverse ground-based aviation incidents that endanger crew, passengers, aircraft and perhaps other nearby people or property. A runway incursion is the incorrect presence of an aircraft, vehicle or person on the protected area of a surface designated for the landing and take-off of aircraft; one class of RI events simultaneously involves two aircraft, such as one aircraft incorrectly landing on a runway while another aircraft is taking off from the same runway. A runway excursion is an incident involving only a single aircraft defined as a veer-off or overrun off the runway surface. Within the scope of this effort at NASA Langley Research Center (LaRC), generic RI, RE and combined (RI plus RE, or RUNSAFE) event models have each been developed and implemented as a Bayesian Belief Network (BBN). Descriptions of runway safety issues from the literature searches have been used to develop the BBN models. Numerous considerations surrounding the process of developing the event models have been documented in this report. The event models were then thoroughly reviewed by a Subject Matter Expert (SME) panel through multiple knowledge elicitation sessions. Numerous improvements to the model structure (definitions, node names, node states and the connecting link topology) were made by the SME panel. Sample executions of the final RUNSAFE model have been presented herein for baseline and worst-case scenarios. Finally, a parameter sensitivity analysis for a given scenario was performed to show the risk drivers. The NASA and LaRC research in runway safety event modeling through the use of BBN technology is important for several reasons. These include: 1) providing a means to clearly understand the cause and effect patterns leading to safety issues, incidents and accidents, 2) enabling the prioritization of specialty areas needing more attention to improve aviation safety, and 3) enabling the identification of gaps within NASA's Aviation Safety funding portfolio

Green, Lawrence L.↗

DOE OSTI2025

Eddy covariance towers as sentinels of abnormal radioactive material releases

Ensuring accurate detection and attribution of abnormal releases of radioactive material is critical for protecting human health and safety. Most commonly, such detection is accomplished via active monitoring approaches involving the collection of physical samples. Further, this is labor intensive and limits the temporal and spatial resolution of any detected events to a relatively coarse level. As an alternative first step towards passive monitoring, we developed an approach using eddy flux tower data records to identify signals from a known abnormal release and quantify the extent to which that signal also occurs at other times in the data record. Through two case studies, one of which targeted the Fukushima nuclear disaster and the other targeting an abnormal release event at a radioisotope production facility in Fleurus, Belgium, we tested our approach and identified several potential heretofore unidentified abnormal events that were consistent with atmospheric circulation patterns and/or wind direction from known release sites. Because our approach is relatively simple and is resistant to systematic errors in the observational record, it has broad applicability beyond specific constituents and ecosystem types to identify a wide variety of limited-duration anomalies in flux tower data to ensure human health and industrial safety.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2023

Highly-scalable GPU-accelerated compressible reacting flow solver for modeling high-speed flows

Emerging supercomputing systems utilize a combination of central processing units (CPUs) and graphics processing units (GPUs) in an effort to reach exascale capabilities while minimizing the energy footprint of operating such systems. Such heterogeneous machines introduce new challenges for fluids solvers because the hardware architecture and operation of a GPU are fundamentally different from conventional CPUs. In this work, a general approach for efficient implementation of finite-volume based reacting flow solvers on such heterogeneous systems is presented. Three main challenges, namely, data access pattern, thread divergence, and thread safety, are addressed. Since compressible reacting flows require special methods to deal with chemical reactions, hyperbolic and nonlinear convection terms, and the presence of turbulence, specific algorithms that ensure GPU-based efficiency are developed. The approach is demonstrated on the widely available OpenFOAM open source software by modifying core algorithms for GPU accessibility. The scalability of the resulting solver, is demonstrated using practical test cases, including flow through a scramjet engine and the dynamics of a rotating detonation engine. Here, the solver provides near-ideal scaleup on a large number of GPUs (>3000), and extremely efficient use of the GPUs, with throughput nearly a constant even when processing a large number of control volumes.

42 ENGINEERING↗

NASA NTRS1989

Flight Motor Set 360L003 (STS-29R)

The redesigned solid rocket motor (RSRM) flight set 360L003 was launched on March 13, 1989 as part of NASA space shuttle mission STS-29R. As was the case with flight sets 360L001 and 360L002 (STS-26R and STS-27R), both motors (360L003A and 360L003B) performed in an excellent manner. Evaluation of the ground environment instrumentation measurements verified thermal model analysis data and showed agreement with predicted environmental effects. The right-hand aft field joint primary heater failed during the countdown; the secondary heater was activated and performed as designed. All other field joint heaters and aft skirt thermal conditioning systems had no anomalies. Shuttle thermal imager infrared readings compared favorably with measured ground environment instrumentation data. No thermal launch commit criteria violations occurred at any time. Evaluation of the development flight instrumentation showed exceptional propulsion performance. All ballistic parameters closely matched the predicted values and were well within the required specification levels. Girth and biaxial strain gage measurements compared closely with corresponding gages on previous flight motors, static tests, and with preflight predictions. Adequate safety factors were verified. (Some ignition transient spiking was noted in a few girth gages; the spiking was determined not to be representative of actual case behavior, but an instrumentation phenomena.) The accelerometers again measured high vibration amplitude levels during the ignition transient and the reentry Max Q phases. Postflight inspection showed that all combustion gas was contained by the insulation in the field and case-to-nozzle joints. No anomalous insulation erosion patterns were found, and the seals that did directly contain motor pressure showed no heat effects, erosion, or blowby. All anomalies identified were a result of splashdown damage, with the exception of fretting in the case field joint interference (nonsealing) surfaces and a prelaunch field joint heater failure. The disposition of all anomalies and the complete results are reported.

Riehr, Glen A.↗

NASA NTRS2011

Comprehensive Forced Response Analysis of J2X Turbine Bladed-Discs with 360 Degree Variation in CFD Loading

The temporal frequency content of the dynamic pressure predicted by a 360 degree computational fluid dynamics (CFD) analysis of a turbine flow field provides indicators of forcing function excitation frequencies (e.g., multiples of blade pass frequency) for turbine components. For the Pratt and Whitney Rocketdyne J-2X engine turbopumps, Campbell diagrams generated using these forcing function frequencies and the results of NASTRAN modal analyses show a number of components with modes in the engine operating range. As a consequence, forced response and static analyses are required for the prediction of combined stress, high cycle fatigue safety factors (HCFSF). Cyclically symmetric structural models have been used to analyze turbine vane and blade rows, not only in modal analyses, but also in forced response and static analyses. Due to the tortuous flow pattern in the turbine, dynamic pressure loading is not cyclically symmetric. Furthermore, CFD analyses predict dynamic pressure waves caused by adjacent and non-adjacent blade/vane rows upstream and downstream of the row analyzed. A MATLAB script has been written to calculate displacements due to the complex cyclically asymmetric dynamic pressure components predicted by CFD analysis, for all grids in a blade/vane row, at a chosen turbopump running speed. The MATLAB displacements are then read into NASTRAN, and dynamic stresses are calculated, including an adjustment for possible mistuning. In a cyclically symmetric NASTRAN static analysis, static stresses due to centrifugal, thermal, and pressure loading at the mode running speed are calculated. MATLAB is used to generate the HCFSF at each grid in the blade/vane row. When compared to an approach assuming cyclic symmetry in the dynamic flow field, the current approach provides better assurance that the worst case safety factor has been identified. An extended example for a J-2X turbopump component is provided.

Elrod, David↗