Results for “criticality safety evaluation”

NASA NTRS2012

Evaluating Models of Human Performance: Safety-Critical Systems Applications

This presentation is part of panel discussion on Evaluating Models of Human Performance. The purpose of this panel is to discuss the increasing use of models in the world today and specifically focus on how to describe and evaluate models of human performance. My presentation will focus on discussions of generating distributions of performance, and the evaluation of different strategies for humans performing tasks with mixed initiative (Human-Automation) systems. I will also discuss issues with how to provide Human Performance modeling data to support decisions on acceptability and tradeoffs in the design of safety critical systems. I will conclude with challenges for the future.

Feary, Michael S.↗

NASA NTRS1998

Using Immersive Virtual Environments for Certification

Immersive virtual environments (VEs) technology has matured to the point where it can be utilized as a scientific and engineering problem solving tool. In particular, VEs are starting to be used to design and evaluate safety-critical systems that involve human operators, such as flight and driving simulators, complex machinery training, and emergency rescue strategies.

virtual reality software certification human-compu↗

NASA NTRS2004

Implementation of COTs Hardware in Non-Critical Space Applications: A Brief Tutorial

Approaches used for manned applications include limited items such as CD-players evaluated for safety to high criticality applications where the COTs hardware is evaluated on a case-by-case basis for the application and commensurate screening and qualification testing. COTS hardware is successfully implemented in both the International Space Station and Space Shuttle but requires evaluation and modifications for the application. Screening and qualification of COTs hardware used in critical applications may need to be more extensive and stringent than traditional military screening. Evaluation for: a) Suitability for the application; b) Safety; c) Reliability and maintainability; and d) Workmanship.

Yoder, Geoffrey L.↗

NASA NTRS1989

Some issues in numerical simulation of nonlinear structural response

The development of commercial finite element software is addressed. This software provides practical tools that are used in an astonishingly wide range of engineering applications that include critical aspects of the safety evaluation of nuclear power plants or of heavily loaded offshore structures in the hostile environments of the North Sea or the Arctic, major design activities associated with the development of airframes for high strength and minimum weight, thermal analysis of electronic components, and the design of sports equipment. In the more advanced application areas, the effectiveness of the product depends critically on the quality of the mechanics and mechanics related algorithms that are implemented. Algorithmic robustness is of primary concern. Those methods that should be chosen will maximize reliability with minimal understanding on the part of the user. Computational efficiency is also important because there are always limited resources, and hence problems that are too time consuming or costly. Finally, some areas where research work will provide new methods and improvements is discussed.

Hibbitt, H. D.↗

NASA NTRS2007

NASA's Software Safety Standard

NASA relies more and more on software to control, monitor, and verify its safety critical systems, facilities and operations. Since the 1960's there has hardly been a spacecraft launched that does not have a computer on board that will provide command and control services. There have been recent incidents where software has played a role in high-profile mission failures and hazardous incidents. For example, the Mars Orbiter, Mars Polar Lander, the DART (Demonstration of Autonomous Rendezvous Technology), and MER (Mars Exploration Rover) Spirit anomalies were all caused or contributed to by software. The Mission Control Centers for the Shuttle, ISS, and unmanned programs are highly dependant on software for data displays, analysis, and mission planning. Despite this growing dependence on software control and monitoring, there has been little to no consistent application of software safety practices and methodology to NASA's projects with safety critical software. Meanwhile, academia and private industry have been stepping forward with procedures and standards for safety critical systems and software, for example Dr. Nancy Leveson's book Safeware: System Safety and Computers. The NASA Software Safety Standard, originally published in 1997, was widely ignored due to its complexity and poor organization. It also focused on concepts rather than definite procedural requirements organized around a software project lifecycle. Led by NASA Headquarters Office of Safety and Mission Assurance, the NASA Software Safety Standard has recently undergone a significant update. This new standard provides the procedures and guidelines for evaluating a project for safety criticality and then lays out the minimum project lifecycle requirements to assure the software is created, operated, and maintained in the safest possible manner. This update of the standard clearly delineates the minimum set of software safety requirements for a project without detailing the implementation for those requirements. This allows the projects leeway to meet these requirements in many forms that best suit a particular project's needs and safety risk. In other words, it tells the project what to do, not how to do it. This update also incorporated advances in the state of the practice of software safety from academia and private industry. It addresses some of the more common issues now facing software developers in the NASA environment such as the use of Commercial-Off-the-Shelf Software (COTS), Modified OTS (MOTS), Government OTS (GOTS), and reused software. A team from across NASA developed the update and it has had both NASA-wide internal reviews by software engineering, quality, safety, and project management. It has also had expert external review. This presentation and paper will discuss the new NASA Software Safety Standard, its organization, and key features. It will start with a brief discussion of some NASA mission failures and incidents that had software as one of their root causes. It will then give a brief overview of the NASA Software Safety Process. This will include an overview of the key personnel responsibilities and functions that must be performed for safety-critical software.

Ramsay, Christopher M.↗

NASA NTRS2006

A Silent Safety Program

NASA's Columbia Accident Investigation Board (CAIB) referred 8 times to the NASA "Silent Safety Program." This term, "Silent Safety Program" was not an original observation but first appeared in the Rogers Commission's Investigation of the Challenger Mishap. The CAIB on page 183 of its report in the paragraph titled 'Encouraging Minority Opinion,' stated "The Naval Reactor Program encourages minority opinions and "bad news." Leaders continually emphasize that when no minority opinions are present, the responsibility for a thorough and critical examination falls to management. . . Board interviews revealed that it is difficult for minority and dissenting opinions to percolate up through the agency's hierarchy. . ." The first question and perhaps the only question is - what is a silent safety program? Well, a silent safety program may be the same as the dog that didn't bark in Sherlock Holmes' "Adventure of the Silver Blaze" because system safety should behave as a devil's advocate for the program barking on every occasion to insure a critical review inclusion. This paper evaluates the NASA safety program and provides suggestions to prevent the recurrence of the silent safety program alluded to in the Challenger Mishap Investigation. Specifically targeted in the CAM report, "The checks and balances the safety system was meant to provide were not working." A silent system safety program is not unique to NASA but could emerge in any and every organization. Principles developed by Irving Janis in his book, Groupthink, listed criteria used to evaluate an organization's cultural attributes that allows a silent safety program to evolve. If evidence validates Jams's criteria, then Jams's recommendations for preventing groupthink can also be used to improve a critical evaluation and thus prevent the development of a silent safety program.

Goodin, James Ronald↗

NASA NTRS1985

Guidelines for structural verification and fracture control of Shuttle payloads

The procedures followed by the NASA Office of the Chief Engineer in developing the guidelines concerning the structures, materials, and fracture control of the Space Shuttle payloads are described. Factors controlling the payload launch safety, such as crew and passenger safety, reusability, and mixes of payloads in a single launch are emphasized. Special consideration is given to the STS design and testing approaches, materials considerations, safety criticality review processes, nondestructive evaluation inspection for STS payload fracture control, fracture mechanics screening procedures, and components of special concern (e.g., pressurized vessels, fasteners, and composite structures).

Lifer, C. E.↗

NASA NTRS2014

NASA Tech Briefs, February 2014

Topics include: JWST Integrated Simulation and Test (JIST) Core; Software for Non-Contact Measurement of an Individual's Heart Rate Using a Common Camera; Rapid Infrared Pixel Grating Response Testbed; Temperature Measurement and Stabilization in a Birefringent Whispering Gallery Resonator; JWST IV and V Simulation and Test (JIST) Solid State Recorder (SSR) Simulator; Development of a Precision Thermal Doubler for Deep Space; Improving Friction Stir Welds Using Laser Peening; Methodology of Evaluating Margins of Safety in Critical Brazed Joints; Interactive Inventory Monitoring; Sensor for Spatial Detection of Single-Event Effects in Semiconductor-Based Electronics; Reworked CCGA-624 Interconnect Package Reliability for Extreme Thermal Environments; Current-Controlled Output Driver for Directly Coupled Loads; Bulk Metallic Glasses and Matrix Composites as Spacecraft Shielding; Touch Temperature Coating for Electrical Equipment on Spacecraft; Li-Ion Electrolytes Containing Flame-Retardant Additives; Autonomous Robotic Manipulation (ARM); CARVE Log; Platform Perspective Toolkit; Convex Hull-Based Plume and Anomaly Detection; Pre-Filtration of GOSAT Data Using Only Level 1 Data and an Intelligent Filter to Remove Low Clouds; Affordability Comparison Tool - ACT; "Ascent - Commemorating Shuttle" for iPad; Cassini Mission App; Light-Weight Workflow Engine: A Server for Executing Generic Workflows; Model for System Engineering of the CheMin Instrument; Timeline Central Concepts; Parallel Particle Filter Toolkit; Particle Filter Simulation and Analysis Enabling Non-Traditional Navigation; Quasi-Terminator Orbits for Mapping Small Primitive Bodies; The Subgrid-Scale Scalar Variance Under Supercritical Pressure Conditions; Sliding Gait for ATHLETE Mobility; and Automated Generation of Adaptive Filter Using a Genetic Algorithm and Cyclic Rule Reduction.

Source record↗

NASA NTRS2015

Body of Knowledge (BOK) for Copper Wire Bonds

Copper wire bonds have replaced gold wire bonds in the majority of commercial semiconductor devices for the latest technology nodes. Although economics has been the driving mechanism to lower semiconductor packaging costs for a savings of about 20% by replacing gold wire bonds with copper, copper also has materials property advantages over gold. When compared to gold, copper has approximately: 25% lower electrical resistivity, 30% higher thermal conductivity, 75% higher tensile strength and 45% higher modulus of elasticity. Copper wire bonds on aluminum bond pads are also more mechanically robust over time and elevated temperature due to the slower intermetallic formation rate - approximately 1/100th that of the gold to aluminum intermetallic formation rate. However, there are significant tradeoffs with copper wire bonding - copper has twice the hardness of gold which results in a narrower bonding manufacturing process window and requires that the semiconductor companies design more mechanically rigid bonding pads to prevent cratering to both the bond pad and underlying chip structure. Furthermore, copper is significantly more prone to corrosion issues. The semiconductor packaging industry has responded to this corrosion concern by creating a palladium coated copper bonding wire, which is more corrosion resistant than pure copper bonding wire. Also, the selection of the device molding compound is critical because use of environmentally friendly green compounds can result in internal CTE (Coefficient of Thermal Expansion) mismatches with the copper wire bonds that can eventually lead to device failures during thermal cycling. Despite the difficult problems associated with the changeover to copper bonding wire, there are billions of copper wire bonded devices delivered annually to customers. It is noteworthy that Texas Instruments announced in October of 2014 that they are shipping microcircuits containing copper wire bonds for safety critical automotive applications. An evaluation of copper wire bond technology for applicability to spaceflight hardware may be warranted along with concurrently compiling a comprehensive understanding of the failure mechanisms involved with copper wire bonded semiconductor devices.

Body of Knowledge (BOK)↗

NASA NTRS2020

The Friendly Argument Notation (FAN)

This document defines and explains through examples the Friendly Argument Notation (FAN). FAN builds on previous work investigating text-based ways to express arguments [2, 3]. Its primary intended use is for creating and evaluating arguments about safety-critical systems, especially the types of arguments common within safety and assurance cases [4], but nothing in its design constrains its use to that domain. Compared to existing notations commonly used within this domain (for example [6]), FAN corresponds more closely to traditional argument concepts (for example [1]), allows greater flexibility in expression, provides for including counter-arguments, and requires less knowledge of computer-science-specific concepts. Only time and use will determine how beneficial these differences are in practice. This paper concentrates on showing how FAN looks to someone who is using it manually to develop or assess arguments. A later document will concentrate on providing the information necessary for software tools to be created for FAN.

arugment↗

NASA NTRS2023

The Friendly Argument Notation (FAN): 2023 Version

This document constitutes the official description of the current iteration of the Friendly Argument Notation (FAN). This new version provides several enhancements to the original 2020 instantiation, while maintaining essential compatibility with it. Specifically, the new version enables distinguishing between deductive and non-deductive arguments, removes the requirement for always providing an explicit statement of reasoning, and relaxes the rules for when labels may be used. The primary intended use of FAN is unchanged: creating and evaluating arguments about safety-critical systems, specifically the types of arguments common within safety and assurance cases.

language↗

NASA NTRS2008

Influence Map Methodology for Evaluating Systemic Safety Issues

"Raising the bar" in safety performance is a critical challenge for many organizations, including Kennedy Space Center. Contributing-factor taxonomies organize information about the reasons accidents occur and therefore are essential elements of accident investigations and safety reporting systems. Organizations must balance efforts to identify causes of specific accidents with efforts to evaluate systemic safety issues in order to become more proactive about improving safety. This project successfully addressed the following two problems: (1) methods and metrics to support the design of effective taxonomies are limited and (2) influence relationships among contributing factors are not explicitly modeled within a taxonomy.

Source record↗

NASA NTRS2014

Some Challenges in the Design of Human-Automation Interaction for Safety-Critical Systems

Increasing amounts of automation are being introduced to safety-critical domains. While the introduction of automation has led to an overall increase in reliability and improved safety, it has also introduced a class of failure modes, and new challenges in risk assessment for the new systems, particularly in the assessment of rare events resulting from complex inter-related factors. Designing successful human-automation systems is challenging, and the challenges go beyond good interface development (e.g., Roth, Malin, & Schreckenghost 1997; Christoffersen & Woods, 2002). Human-automation design is particularly challenging when the underlying automation technology generates behavior that is difficult for the user to anticipate or understand. These challenges have been recognized in several safety-critical domains, and have resulted in increased efforts to develop training, procedures, regulations and guidance material (CAST, 2008, IAEA, 2001, FAA, 2013, ICAO, 2012). This paper points to the continuing need for new methods to describe and characterize the operational environment within which new automation concepts are being presented. We will describe challenges to the successful development and evaluation of human-automation systems in safety-critical domains, and describe some approaches that could be used to address these challenges. We will draw from experience with the aviation, spaceflight and nuclear power domains.

systems engineering↗

NASA NTRSDate not supplied

Evaluating the Trustworthiness of Deep Neural Networks in Deployment – A Comparative Study (Replicability Study)

As deep neural networks (DNNs) are increasingly used in safety critical applications, there is a growing concern for their trustworthiness. Even highly trained, high-performant networks are not 100% accurate. However, it is very difficult to predict their behaviour during deployment without ground truth. In this paper, we provide a comparative and replicability study on recent approaches that have been proposed to evaluate the trustworthiness of DNNs. We find that it is very difficult to run and reproduce the results for these approaches on their replication packages, and it is even more difficult to run the tools on artifacts other than their own. Further, it is difficult to compare the effectiveness of the tools, due to lack of clearly defined evaluation metrics. Our results indicate that more effort is needed in our research community to obtain sound techniques for evaluating the trustworthiness of neural networks in safety-critical domains. To this end, we contribute an evaluation framework that incorporates the considered approaches and enables evaluation on common benchmarks, using common metrics. Using this framework, we run a comparative study of the three approaches.

Trustworthy AI↗

NASA NTRS2019

Novel Classifier of Neural Impairment

The proposed research aligns with Ames Core Competency within the area of Intelligent/Adaptive Systems under Human Systems Integration. This will serve as a robust, efficient, and user-friendly human performance assessment tool that could provide immediate neural status of crewmembers in low-orbit and deep space missions. The human operator is a critical element of crew safety and should be evaluated consistently to mitigate potential off-nominal situations propagated from human error. Flagged deficits in oculomotor performance could act as an alert signal for crewmembers to opt out of cognitively demanding tasks or to prevent irreversible compromise in crewmember health.

impairment↗

NASA NTRSDate not supplied

A Prognostics Framework for Battery Health Monitoring Integrated with Thermal Modeling

Urban Air Mobility (UAM) promises to revolutionize transportation in major cities, offering passenger travel, cargo delivery, and emergency medical services through a network of electric vertical takeoff and landing (eVTOL) aircraft. However, the limited range of current eVTOLs, due to the low specific energy of lithium-ion batteries along with a possibility of thermal runaway conditions poses significant safety concerns, leading to potentially compromising operational safety. To address this critical challenge, researchers are actively evaluating the impact of flight and environmental conditions on onboard lithium-ion battery health. This involves carefully assessing the performance of battery packs under laboratory and operational conditions for developing models to estimate future health using prognostics framework. This study examines the effectiveness of evaluating battery degradation leading to catastrophic failures under varying operational conditions in laboratory. These are captured using physics based models of underlying phenomenons and integrated into the prognostics framework. A fully charged battery undergoes controlled discharge cycles at varying C-rates based on the simulated power draw profile, with current and voltage, temperature data recorded throughout the experiment. The observed data provides valuable insights into how different operating conditions and mission profiles affect battery performance. This information is crucial for developing strategies to optimize battery systems, enhance range, and ultimately ensure the safe and reliable operation of UAM vehicles.

Thermal Modeling↗

NASA NTRSDate not supplied

A Prognostics Framework for Battery Health Monitoring Integrated with Thermal Modeling

Urban Air Mobility (UAM) promises to revolutionize transportation in major cities, offering passenger travel, cargo delivery, and emergency medical services through a network of electric vertical takeoff and landing (eVTOL) aircraft. However, the limited range of current eVTOLs, due to the low specific energy of lithium-ion batteries along with a possibility of thermal runaway conditions poses significant safety concerns, leading to potentially compromising operational safety. To address this critical challenge, researchers are actively evaluating the impact of flight and environmental conditions on onboard lithium-ion battery health. This involves carefully assessing the performance of battery packs under laboratory and operational conditions for developing models to estimate future health using prognostics framework. This study examines the effectiveness of evaluating battery degradation leading to catastrophic failures under varying operational conditions in laboratory. These are captured using physics based models of underlying phenomenons and integrated into the prognostics framework. A fully charged battery undergoes controlled discharge cycles at varying C-rates based on the simulated power draw profile, with current and voltage, temperature data recorded throughout the experiment. The observed data provides valuable insights into how different operating conditions and mission profiles affect battery performance. This information is crucial for developing strategies to optimize battery systems, enhance range, and ultimately ensure the safe and reliable operation of UAM vehicles.

Thermal Modeling↗

NASA NTRSDate not supplied

A Prognostics Framework for Battery Health Monitoring Integrated with Thermal Modeling

Urban Air Mobility (UAM) promises to revolutionize transportation in major cities, offering passenger travel, cargo delivery, and emergency medical services through a network of electric vertical takeoff and landing (eVTOL) aircraft. However, the limited range of current eVTOLs, due to the low specific energy of lithium-ion batteries along with a possibility of thermal runaway conditions poses significant safety concerns, leading to potentially compromising operational safety. To address this critical challenge, researchers are actively evaluating the impact of flight and environmental conditions on onboard lithium-ion battery health. This involves carefully assessing the performance of battery packs under laboratory and operational conditions for developing models to estimate future health using prognostics framework. This study examines the effectiveness of evaluating battery degradation leading to catastrophic failures under varying operational conditions in laboratory. These are captured using physics based models of underlying phenomenons and integrated into the prognostics framework. A fully charged battery undergoes controlled discharge cycles at varying C-rates based on the simulated power draw profile, with current and voltage, temperature data recorded throughout the experiment. The observed data provides valuable insights into how different operating conditions and mission profiles affect battery performance. This information is crucial for developing strategies to optimize battery systems, enhance range, and ultimately ensure the safe and reliable operation of UAM vehicles.

Thermal Modeling↗