SEARCH · Search NASA

Results for “System Safety Assessment”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records

All sources NASA NTRS DOE OSTI

NASA NTRS1971

Some thoughts about system safety assessment and its current application in aerospace

The various issues and requirements which must be considered during the actual work of safety assessment are discussed. The task and its objectives are considered and the importance of presentation is stressed, so that problems and their solution are displayed adequately to the many disciplines involved. The definition of areas of influence to which the requirements can be applied, and safety objectives derived, is also discussed. Emphasis is placed on the need to determine and set out safety objectives with precision so that the analysis is not complicated with occurrences which are not relevant to safety.

Peter R. Allison↗

NASA NTRS2001

Use of System Safety Risk Assessments for the Space Shuttle Reusable Solid Rocket Motor (RSRM)

This paper discusses the System Safety approach used to assess risk for the Space Shuttle Reusable Solid Rocket Motor (RSRM). Previous to the first RSRM flight in the fall of 1988, all systems were analyzed extensively to assure that hazards were identified, assessed and that the baseline risk was understood and appropriately communicated. Since the original RSRM baseline was established, Thiokol and NASA have implemented a number of initiatives that have further improved the RSRM. The robust design, completion of rigorous testing and flight success of the RSRM has resulted in a wise reluctance to make changes. One of the primary assessments required to accompany the documentation of each proposed change and aid in the decision making process is a risk assessment. Documentation supporting proposed changes, including the risk assessments from System Safety, are reviewed and assessed by Thiokol and NASA technical management. After thorough consideration, approved changes are implemented adding improvements to and reducing risk of the Space Shuttle RSRM.

Greenhalgh, Phillip O.↗

NASA NTRS2011

Probabilistic Risk Assessment Procedures Guide for NASA Managers and Practitioners (Second Edition)

Probabilistic Risk Assessment (PRA) is a comprehensive, structured, and logical analysis method aimed at identifying and assessing risks in complex technological systems for the purpose of cost-effectively improving their safety and performance. NASA's objective is to better understand and effectively manage risk, and thus more effectively ensure mission and programmatic success, and to achieve and maintain high safety standards at NASA. NASA intends to use risk assessment in its programs and projects to support optimal management decision making for the improvement of safety and program performance. In addition to using quantitative/probabilistic risk assessment to improve safety and enhance the safety decision process, NASA has incorporated quantitative risk assessment into its system safety assessment process, which until now has relied primarily on a qualitative representation of risk. Also, NASA has recently adopted the Risk-Informed Decision Making (RIDM) process [1-1] as a valuable addition to supplement existing deterministic and experience-based engineering methods and tools. Over the years, NASA has been a leader in most of the technologies it has employed in its programs. One would think that PRA should be no exception. In fact, it would be natural for NASA to be a leader in PRA because, as a technology pioneer, NASA uses risk assessment and management implicitly or explicitly on a daily basis. NASA has probabilistic safety requirements (thresholds and goals) for crew transportation system missions to the International Space Station (ISS) [1-2]. NASA intends to have probabilistic requirements for any new human spaceflight transportation system acquisition. Methods to perform risk and reliability assessment in the early 1960s originated in U.S. aerospace and missile programs. Fault tree analysis (FTA) is an example. It would have been a reasonable extrapolation to expect that NASA would also become the world leader in the application of PRA. That was, however, not to happen. Early in the Apollo program, estimates of the probability for a successful roundtrip human mission to the moon yielded disappointingly low (and suspect) values and NASA became discouraged from further performing quantitative risk analyses until some two decades later when the methods were more refined, rigorous, and repeatable. Instead, NASA decided to rely primarily on the Hazard Analysis (HA) and Failure Modes and Effects Analysis (FMEA) methods for system safety assessment.

Stamatelatos,Michael↗

NASA NTRS2003

Probabilistic Causal Analysis for System Safety Risk Assessments in Commercial Air Transport

Aviation is one of the critical modes of our national transportation system. As such, it is essential that new technologies be continually developed to ensure that a safe mode of transportation becomes even safer in the future. The NASA Aviation Safety Program (AvSP) is managing the development of new technologies and interventions aimed at reducing the fatal aviation accident rate by a factor of 5 by year 2007 and by a factor of 10 by year 2022. A portfolio assessment is currently being conducted to determine the projected impact that the new technologies and/or interventions may have on reducing aviation safety system risk. This paper reports on advanced risk analytics that combine the use of a human error taxonomy, probabilistic Bayesian Belief Networks, and case-based scenarios to assess a relative risk intensity metric. A sample case is used for illustrative purposes.

Luxhoj, James T.↗

NASA NTRS2003

System Safety Hazards Assessment in Conceptual Program Trade Studies

Providing a program in the concept development phase with a method of determining system safety benefits of potential concepts has always been a challenge. Lockheed Martin Space and Strategic Missiles has developed a methodology for developing a relative system safety ranking using the potential hazards of each concept. The resulting output supports program decisions with system safety as an evaluation criterion with supporting data for evaluation. This approach begins with a generic hazards list that has been tailored for the program being studied and augmented with an initial hazard analysis. Each proposed concept is assessed against the list of program hazards and ranked in three derived areas. The hazards can be weighted to show those that are of more concern to the program. Sensitivities can be also be determined to test the robustness of the conclusions

Eben, Dennis M.↗

NASA NTRS2011

NASA System Safety Handbook: System Safety Framework and Concepts for Implementation - Volume 1

System safety assessment is defined in NPR 8715.3C, NASA General Safety Program Requirements as a disciplined, systematic approach to the analysis of risks resulting from hazards that can affect humans, the environment, and mission assets. Achievement of the highest practicable degree of system safety is one of NASA's highest priorities. Traditionally, system safety assessment at NASA and elsewhere has focused on the application of a set of safety analysis tools to identify safety risks and formulate effective controls.1 Familiar tools used for this purpose include various forms of hazard analyses, failure modes and effects analyses, and probabilistic safety assessment (commonly also referred to as probabilistic risk assessment (PRA)). In the past, it has been assumed that to show that a system is safe, it is sufficient to provide assurance that the process for identifying the hazards has been as comprehensive as possible and that each identified hazard has one or more associated controls. The NASA Aerospace Safety Advisory Panel (ASAP) has made several statements in its annual reports supporting a more holistic approach. In 2006, it recommended that "... a comprehensive risk assessment, communication and acceptance process be implemented to ensure that overall launch risk is considered in an integrated and consistent manner." In 2009, it advocated for "... a process for using a risk-informed design approach to produce a design that is optimally and sufficiently safe." As a rationale for the latter advocacy, it stated that "... the ASAP applauds switching to a performance-based approach because it emphasizes early risk identification to guide designs, thus enabling creative design approaches that might be more efficient, safer, or both." For purposes of this preface, it is worth mentioning three areas where the handbook emphasizes a more holistic type of thinking. First, the handbook takes the position that it is important to not just focus on risk on an individual basis but to consider measures of aggregate safety risk and to ensure wherever possible that there be quantitative measures for evaluating how effective the controls are in reducing these aggregate risks. The term aggregate risk, when used in this handbook, refers to the accumulation of risks from individual scenarios that lead to a shortfall in safety performance at a high level: e.g., an excessively high probability of loss of crew, loss of mission, planetary contamination, etc. Without aggregated quantitative measures such as these, it is not reasonable to expect that safety has been optimized with respect to other technical and programmatic objectives. At the same time, it is fully recognized that not all sources of risk are amenable to precise quantitative analysis and that the use of qualitative approaches and bounding estimates may be appropriate for those risk sources. Second, the handbook stresses the necessity of developing confidence that the controls derived for the purpose of achieving system safety not only handle risks that have been identified and properly characterized but also provide a general, more holistic means for protecting against unidentified or uncharacterized risks. For example, while it is not possible to be assured that all credible causes of risk have been identified, there are defenses that can provide protection against broad categories of risks and thereby increase the chances that individual causes are contained. Third, the handbook strives at all times to treat uncertainties as an integral aspect of risk and as a part of making decisions. The term "uncertainty" here does not refer to an actuarial type of data analysis, but rather to a characterization of our state of knowledge regarding results from logical and physical models that approximate reality. Uncertainty analysis finds how the output parameters of the models are related to plausible variations in the input parameters and in the modeling assumptions. The evaluation of unrtainties represents a method of probabilistic thinking wherein the analyst and decision makers recognize possible outcomes other than the outcome perceived to be "most likely." Without this type of analysis, it is not possible to determine the worth of an analysis product as a basis for making decisions related to safety and mission success. In line with these considerations the handbook does not take a hazard-analysis-centric approach to system safety. Hazard analysis remains a useful tool to facilitate brainstorming but does not substitute for a more holistic approach geared to a comprehensive identification and understanding of individual risk issues and their contributions to aggregate safety risks. The handbook strives to emphasize the importance of identifying the most critical scenarios that contribute to the risk of not meeting the agreed-upon safety objectives and requirements using all appropriate tools (including but not limited to hazard analysis). Thereafter, emphasis shifts to identifying the risk drivers that cause these scenarios to be critical and ensuring that there are controls directed toward preventing or mitigating the risk drivers. To address these and other areas, the handbook advocates a proactive, analytic-deliberative, risk-informed approach to system safety, enabling the integration of system safety activities with systems engineering and risk management processes. It emphasizes how one can systematically provide the necessary evidence to substantiate the claim that a system is safe to within an acceptable risk tolerance, and that safety has been achieved in a cost-effective manner. The methodology discussed in this handbook is part of a systems engineering process and is intended to be integral to the system safety practices being conducted by the NASA safety and mission assurance and systems engineering organizations. The handbook posits that to conclude that a system is adequately safe, it is necessary to consider a set of safety claims that derive from the safety objectives of the organization. The safety claims are developed from a hierarchy of safety objectives and are therefore hierarchical themselves. Assurance that all the claims are true within acceptable risk tolerance limits implies that all of the safety objectives have been satisfied, and therefore that the system is safe. The acceptable risk tolerance limits are provided by the authority who must make the decision whether or not to proceed to the next step in the life cycle. These tolerances are therefore referred to as the decision maker's risk tolerances. In general, the safety claims address two fundamental facets of safety: 1) whether required safety thresholds or goals have been achieved, and 2) whether the safety risk is as low as possible within reasonable impacts on cost, schedule, and performance. The latter facet includes consideration of controls that are collective in nature (i.e., apply generically to broad categories of risks) and thereby provide protection against unidentified or uncharacterized risks.

Dezfuli, Homayoon↗

NASA NTRS2014

MARGInS: Model-Based Analysis of Realizable Goals in Systems

Under NASAs Constellation effort, the Exploration Technology Development Program funded research toward a system validation capability that applied machine learning and test-case generation techniques to the analysis of black-box system behavior. The behavior analysis capability scaled to spaces of hundreds of input parameters and tens of thousands of test cases. Aerospace systems at the vehicle level, especially those systems which contain some level of autonomy, are best described by hybrid and non-linear mathematics. Even simplified models of such systems need parameter dimensionalities in the hundreds or thousands of parameters in order to capture sufficient fidelity. The System Safety Assessments (such as those described in the SAE ARP 4761A Safety Assessment Process guidelines) for these systems are prone to errorinteractions between the vehicles subsystems are complex, and can display emergent behaviors. NASA captured this new analysis in the Model-based Analysis of Realizable Goals in Systems (MARGInS) tool and applied it to the Pad Abort 1 (PA-1) simulation as part of the independent validation and verification cycle before the PA-1 flight test in May of 2010. MARGInS evaluated the adherence of the high-fidelity simulation to its requirements, and deter- mined the margins to failure from the expected nominal input conditions. Following the PA-1 test, the capabilities within the MARGInS framework have been extended with sophisticated statistical and white-box test case generation techniques and applied to other NASA missions. The frame- work now includes a critical factors analysis that was applied to NASAs Orion simulation and design. NASAs Aeronautics Research Mission Directorate (ARMD) leveraged the existing MARGInS framework for work on aviation safety for civil transport vehicles and for research on autonomy issues. The NASA ARMD effort created a time series output prediction capability that has been used to characterize trajectories for a plane with an adaptive control system, and a safety boundary detection capability that has been applied to an air traffic control concept of operation for the Federal Aviation Administration. The statistical and machine- learning based techniques within MARGInS have been successfully combined with concolic execution to improve the coverage of a critical unit by driving system-level inputs. The use case driving the concolic execution and MARGInS integration was inspired by the Air France 447 disaster in which the loss of a critical functionality (the airspeed calculation from the pitot tubes) led to loss of the entire plane with the people aboard. To illustrate capabilities and limitations, we will highlight the analyses for the applications listed above. We will then discuss the future plans for MARGInS and its interfaces with other tools.

Validation↗

NASA NTRS2021

Reliability and Safety Assessment of Urban Air Mobility Concept Vehicles

The following work was commissioned by the National Aeronautics and Space Administration (NASA) to guide industry and future regulation related to urban air mobility (UAM). Prior studies compared the relative safety of NASA concept vehicles, Figure ES1, designed for UAM and provided recommendations for industry research, aircraft architectural improvements, and regulatory updates. After the prior study completed, the European Aviation Safety Agency (EASA) released regulatory guidance in the form of a special condition (SC), SC-VTOL-01, for multirotors with distributed propulsion and flight controls (DPFC). The objective of the current work was to develop DPFC architectures that will comply with SC-VTOL-01. Vehicle designs, DPFC architectures, and stability & control (S&C) models were developed to find limitations and trends to guide industry. To guide this task, NASA developed quad, hex, and an octorotor to better define vehicle attributes and trade space. Aircraft for study included electric, hybrid-electric, and turboshaft powerplants and collective and RPM control schemes. Assessments are in terms of the safety level achieved, and/or aircraft component/features needed to meet SC-VTOL-01. The most challenging criteria being the catastrophic failure rate, ≤10-9 catastrophic failures per flight hour, and that no single failures may result in a catastrophic event. A disciplined process was followed, similar to that in Aerospace Recommended Practice (ARP) 4761. A preliminary system safety assessment (PSSA) leveraged prior work as a basis of creating failure rate budgets for system design teams. System designs were updated and iterated upon, working with reliability and safety subject matter experts to develop SC-VTOL-01 compliant designs. Design changes were reflected in updated PSSAs for initial verification of compliance. The DPFC architecture was broken into four system design teams, the (1) flight control system (FCS), (2) drive and power system, (3) thermal management system (TMS), and (4) electrical power and distribution system. The FCS including elements necessary to control the aircraft, drive and power including elements necessary to generate and transmit shaft power, the TMS including elements necessary to maintain temperature limits in all operating environments, and electrical pow-er and distribution including equipment necessary to store and transmit electrical energy. Results found that all aircraft evaluated may have paths to comply with SC-VTOL-01, Figure ES2. However, S&C models showed large power transients that must be addressed and PSSA results show that future work is needed in single load path structures, high voltage power storage and distribution, and in motor/rotor overspeed protection.

Boeing↗

NASA NTRS2002

Regaining Lost Separation in a Piloted Simulation of Autonomous Aircraft Operations

NASA is currently investigating a new concept of operations for the National Airspace System, designed to improve capacity while maintaining or improving current levels of safety. This concept, known as Distributed Air/Ground Traffic Management (DAG-TM), allows appropriately equipped autonomous aircraft to maneuver freely for flight optimization while resolving conflicts with other traffic and staying out of special use airspace and hazardous weather. While Airborne Separation Assurance System (ASAS) tools would normally allow pilots to resolve conflicts before they become hazardous, evaluation of system performance in sudden, near-term conflicts is needed in order to determine concept feasibility. If an acceptable safety level can be demonstrated in these situations, then operations may be conducted with lower separation minimums. An experiment was conducted in NASA Langley s Air Traffic Operations Lab to address issues associated with resolving near-term conflicts and the potential use of lower separation minimums. Sixteen commercial airline pilots flew a total of 32 traffic scenarios that required them to use prototype ASAS tools to resolve close range pop-up conflicts. Required separation standards were set at either 3 or 5 NM lateral spacing, with 1000 ft vertical separation being used for both cases. Reducing the lateral separation from 5 to 3 NM did not appear to increase operational risk, as indicated by the proximity to the intruder aircraft. Pilots performed better when they followed tactical guidance cues provided by ASAS than when they didn't follow the guidance. As air-air separation concepts are evolved, further studies will consider integration issues between ASAS and existing Airborne Collision Avoidance Systems (ACAS).These types of non-normal events will require the ASAS to provide effective alerts and resolutions prior to the time that an Airborne Collision Avoidance System (ACAS) would give a Resolution Advisory (RA). When an RA is issued, a pilot must take immediate action in order to avoid a potential near miss. The Traffic Alert and Collision Avoidance System (TCAS) II currently functions as an ACAS aboard commercial aircraft. Depending on the own aircraft s altitude, TCAS only issues RA s 15-35 seconds prior to the Closest Point of Approach (CPA). Prior to an RA, DAG-TM pilots operating autonomous aircraft must rely solely on ASAS for resolution guidance. An additional area of DAG-TM concept feasibility relates to a potential reduction in separation standards. Lower separation standards are likely needed in order to improve NAS efficiency and capacity. Current separation minimums are based in large part on the capabilities of older radar systems. Safety assessments are needed to determine the feasibility of reduced separation minimums. They will give strong consideration to surveillance system performance, including accuracy, integrity, and availability. Candidate surveillance systems include Automatic Dependent Surveillance-Broadcast (ADS-B) and multi-lateration systems. Considering studies done for Reduced Vertical Separation Minimums (RVSM) operations, it is likely that flight technical errors will also be considered. In addition to a thorough evaluation of surveillance system performance, a potential decision to lower the separation standards should also take operational considerations into account. An ASAS Safety Assessment study identified improper maneuvering in response to a conflict (due to ambiguous or improper resolution commands or a pilot s failure to comply with the resolution) as a potential safety risk. If near-term conflicts with lower separation minimums were determined to be more challenging for pilots, the severity of these risks could be even greater.

Barhydt, Richard↗

NASA NTRS1992

Making the Hubble Space Telescope servicing mission safe

This paper will detail how the Hubble Space Telescope (HST) system safety program is conducted. Numerous safety analyses are conducted through the various phases of design, test, and fabrication, and results are presented to NASA management for discussion during dedicated safety reviews. This paper will then address the system safety assessment and risk analysis methodologies used (i.e. hazard analysis, fault tree analysis, and failure modes and effects analysis), and how they are coupled with enginering and test analyses for a 'synergistic picture' of the system. Some preliminary safety analysis results, showing the relationship between hazard identification, control or abatement, and finally control verification, will be presented as examples of this safety process.

Bahr, N. J.↗

NASA NTRS1992

Making the Hubble Space Telescope servicing mission safe

The implementation of the HST system safety program is detailed. Numerous safety analyses are conducted through various phases of design, test, and fabrication, and results are presented to NASA management for discussion during dedicated safety reviews. Attention is given to the system safety assessment and risk analysis methodologies used, i.e., hazard analysis, fault tree analysis, and failure modes and effects analysis, and to how they are coupled with engineering and test analysis for a 'synergistic picture' of the system. Some preliminary safety analysis results, showing the relationship between hazard identification, control or abatement, and finally control verification, are presented as examples of this safety process.

Bahr, N. J.↗

NASA NTRS2002

CATS-based Agents That Err

This report describes preliminary research on intelligent agents that make errors. Such agents are crucial to the development of novel agent-based techniques for assessing system safety. The agents extend an agent architecture derived from the Crew Activity Tracking System that has been used as the basis for air traffic controller agents. The report first reviews several error taxonomies. Next, it presents an overview of the air traffic controller agents, then details several mechanisms for causing the agents to err in realistic ways. The report presents a performance assessment of the error-generating agents, and identifies directions for further research. The research was supported by the System-Wide Accident Prevention element of the FAA/NASA Aviation Safety Program.

Callantine, Todd J.↗

NASA NTRS2019

Electrified Aircraft Propulsion Systems: Potential Failure Modes and Failure Mitigation Strategies

Electrified aircraft propulsion (EAP) systems hold great potential for the reduction of aircraft fuel burn, emissions, and noise. Currently, NASA and other organizations are actively working to identify and mature technologies necessary to bring EAP designs to reality. A requirement for the development of any civil aircraft and its systems is to ensure that potential hazards in the design are identified and appropriately mitigated to ensure that the system is safe. During aircraft development, a system safety assessment that consists of a functional hazard assessment is conducted to identify all potential failure conditions of each function, and classify those failures according to the severity of their effects on the aircraft or its occupants. The more severe a function's failure condition classification, the greater the development assurance level required for the function to ensure that the probability of the hazard is acceptably low. Today, aircraft engines and their control systems receive type certificate approval as a stand-alone system to signify their airworthiness. However, the complex coupling and distributed nature of EAP designs are expected to place added challenges on the certification of these systems. This presentation will provide an initial high-level review of the potential failure modes and hazards posed by a generic EAP system along with potential mitigation strategies for those failures. The EAP system is assumed to be a hybrid design consisting of gas turbine engines, mechanical drives, electric machines, power electronics and distribution systems, energy storage devices, and motor driven propulsors. The functionality provided by each of these EAP subsystems will be discussed along with the potential failure modes they may encounter. This will include a discussion of coupled failure effects, where a fault in one EAP subsystem effects the operation of other subsystems in the architecture. Next, potential failure mitigation strategies are discussed including both software-based and hardware-based mitigation strategies. The presentation will conclude with an example evaluation of the potential failure modes and mitigation strategies for a concept EAP system proposed by NASA.

Simon, Donald L.↗

NASA NTRS2005

Business Intelligence Modeling in Launch Operations

This technology project is to advance an integrated Planning and Management Simulation Model for evaluation of risks, costs, and reliability of launch systems from Earth to Orbit for Space Exploration. The approach builds on research done in the NASA ARC/KSC developed Virtual Test Bed (VTB) to integrate architectural, operations process, and mission simulations for the purpose of evaluating enterprise level strategies to reduce cost, improve systems operability, and reduce mission risks. The objectives are to understand the interdependency of architecture and process on recurring launch cost of operations, provide management a tool for assessing systems safety and dependability versus cost, and leverage lessons learned and empirical models from Shuttle and International Space Station to validate models applied to Exploration. The systems-of-systems concept is built to balance the conflicting objectives of safety, reliability, and process strategy in order to achieve long term sustainability. A planning and analysis test bed is needed for evaluation of enterprise level options and strategies for transit and launch systems as well as surface and orbital systems. This environment can also support agency simulation .based acquisition process objectives. The technology development approach is based on the collaborative effort set forth in the VTB's integrating operations. process models, systems and environment models, and cost models as a comprehensive disciplined enterprise analysis environment. Significant emphasis is being placed on adapting root cause from existing Shuttle operations to exploration. Technical challenges include cost model validation, integration of parametric models with discrete event process and systems simulations. and large-scale simulation integration. The enterprise architecture is required for coherent integration of systems models. It will also require a plan for evolution over the life of the program. The proposed technology will produce long-term benefits in support of the NASA objectives for simulation based acquisition, will improve the ability to assess architectural options verses safety/risk for future exploration systems, and will facilitate incorporation of operability as a systems design consideration, reducing overall life cycle cost for future systems. The future of business intelligence of space exploration will focus on the intelligent system-of-systems real-time enterprise. In present business intelligence, a number of technologies that are most relevant to space exploration are experiencing the greatest change. Emerging patterns of set of processes rather than organizational units leading to end-to-end automation is becoming a major objective of enterprise information technology. The cost element is a leading factor of future exploration systems.

Bardina, Jorge E.↗

NASA NTRS2003

NASA Aviation Safety Program Systems Analysis/Program Assessment Metrics Review

The goal of this project is to evaluate the metrics and processes used by NASA's Aviation Safety Program in assessing technologies that contribute to NASA's aviation safety goals. There were three objectives for reaching this goal. First, NASA's main objectives for aviation safety were documented and their consistency was checked against the main objectives of the Aviation Safety Program. Next, the metrics used for technology investment by the Program Assessment function of AvSP were evaluated. Finally, other metrics that could be used by the Program Assessment Team (PAT) were identified and evaluated. This investigation revealed that the objectives are in fact consistent across organizational levels at NASA and with the FAA. Some of the major issues discussed in this study which should be further investigated, are the removal of the Cost and Return-on-Investment metrics, the lack of the metrics to measure the balance of investment and technology, the interdependencies between some of the metric risk driver categories, and the conflict between 'fatal accident rate' and 'accident rate' in the language of the Aviation Safety goal as stated in different sources.

Louis, Garrick E.↗

NASA NTRS1993

Development of a methodology for assessing the safety of embedded software systems

A Dynamic Flowgraph Methodology (DFM) based on an integrated approach to modeling and analyzing the behavior of software-driven embedded systems for assessing and verifying reliability and safety is discussed. DFM is based on an extension of the Logic Flowgraph Methodology to incorporate state transition models. System models which express the logic of the system in terms of causal relationships between physical variables and temporal characteristics of software modules are analyzed to determine how a certain state can be reached. This is done by developing timed fault trees which take the form of logical combinations of static trees relating the system parameters at different point in time. The resulting information concerning the hardware and software states can be used to eliminate unsafe execution paths and identify testing criteria for safety critical software functions.

Garrett, C. J.↗

NASA NTRS2011

L-Band Digital Aeronautical Communications System Engineering - Initial Safety and Security Risk Assessment and Mitigation

This document is being provided as part of ITT's NASA Glenn Research Center Aerospace Communication Systems Technical Support (ACSTS) contract NNC05CA85C, Task 7: "New ATM Requirements--Future Communications, C-Band and L-Band Communications Standard Development." ITT has completed a safety hazard analysis providing a preliminary safety assessment for the proposed L-band (960 to 1164 MHz) terrestrial en route communications system. The assessment was performed following the guidelines outlined in the Federal Aviation Administration Safety Risk Management Guidance for System Acquisitions document. The safety analysis did not identify any hazards with an unacceptable risk, though a number of hazards with a medium risk were documented. This effort represents a preliminary safety hazard analysis and notes the triggers for risk reassessment. A detailed safety hazards analysis is recommended as a follow-on activity to assess particular components of the L-band communication system after the technology is chosen and system rollout timing is determined. The security risk analysis resulted in identifying main security threats to the proposed system as well as noting additional threats recommended for a future security analysis conducted at a later stage in the system development process. The document discusses various security controls, including those suggested in the COCR Version 2.0.

Zelkin, Natalie↗

NASA NTRSDate not supplied

Development of a Safety Hazards Risk Assessment Tool for Uncrewed Aircraft System Traffic Management during Preflight Planning

Tremendous growth in the uncrewed and remotely piloted vehicle market is expected in low-altitude, uncontrolled airspace, resulting in potential decreases in safety without systems that support monitoring, assessing, and mitigating risk. At NASA, the System-Wide Safety (SWS) project has been developing a suite of data-driven tools to predict hazards so that the potential risks that these hazards pose can be mitigated. Services to predict various hazards have been developed, including battery capacity, proximity to static obstacles, population risks, global positioning system signal strength, radio frequency spectrum interference risk, and vertiport congestion. These services can monitor hazards along a flight path and if any risks posed by these hazards exceed a threshold, the uncrewed aircraft system (UAS) fleet manager can be alerted to mitigate the risk by modifying the flight path, changing the scheduled departure or arrival times, and/or diverting the vehicle to an alternate vertiport. These services were originally developed to monitor and assess risks during flight, but they have been adapted to assess hazard risks prior to departure so that a fleet manager can evaluate the potential risks for a fleet of UAS along their planned flight paths. These services have been integrated into a prototype tool called the Supplemental Data Service Provider-Consolidated Dashboard (SDSP-CD), developed at NASA Ames Research Center. The tool consists of a dashboard which provides a comprehensive overview for a number of risks and a map display that shows the details of the hazards along each flight’s path. Based on the findings from three previous studies, the SDSP-CD has been updated with new design elements and functions. In this paper, we describe lessons learned from the previous studies, changes made to the interface, and the feedback received during a follow-up usability study. Overall, participants reported that there is a substantial benefit of having a fleet manager use a consolidated dashboard to assess hazards for the vehicles in their fleet and to provide situational awareness to potential risks so that they can be mitigated prior to flight. Once the SDSP-CD matures, it will need to be integrated into flight and mission planning tools. Some initial thoughts on how this integration should be accomplished are shared in this paper. Finally, the functional differences between preflight vs. in-flight risk assessment and the differences in fleet manager vs. UAS pilot roles that may require different information and user interactions are discussed.

preflight↗