SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Safety cases are typically used to certify systems at design time as being approved for operation. However, systems typically undergo changes in operation. We present ongoing work extending the safety case concept to account for operational updates.
We describe dynamic safety cases, a novel operationalization of the concept of through-life safety assurance, whose goal is to enable proactive safety management. Using an example from the aviation systems domain, we motivate our approach, its underlying principles, and a lifecycle. We then identify the key elements required to move towards a formalization of the associated framework.
Assurance cases have emerged as a way to build trust in complex autonomous systems. Many assurance case justifications for such systems need to be constantly reevaluated based on the current system context and performance. Autonomous systems, especially those deployed in remote environments, often have a ground control system that enables monitoring and remote operations. In this paper, we propose a dynamic assurance framework that aims at connecting the assurance case with the ground control system. We use the ground control system to facilitate dynamic evaluation of quantitative assurance measures that support various justifications in the assurance case. We demonstrate the proposed dynamic assurance framework on the NASA Ames Research Center project Troupe. We use a combination of in-house and external tools to identify the assurance measures, formalize the related requirements, and generate monitors that feed the data to the external ground control system.
Assurance cases are being increasingly acknowledged as a way to build trust in complex systems with autonomous capabilities [1]. An assurance case is a comprehensive, defensible, and valid justification that a system will function as intended for the specific mission and operating environment. Such justifications for systems with autonomous capabilities are often based on various probabilistic quantifications [2]. Due to the dynamic nature of the environmental conditions in which these systems operate, as well as the changing nature of the autonomous systems themselves, these probabilistic quantifications cannot be simply estimated once during design time. Rather, they need to be continually evaluated during systems operations to ensure that the assurance case justifications are valid. We refer to the assurance case that combines both the static and dynamic elements as a Dynamic Assurance Case (DAC).
Assurance cases are being increasingly acknowledged as a way to build trust in complex systems with autonomous capabilities [1]. An assurance case is a comprehensive, defensible, and valid justification that a system will function as intended for the specific mission and operating environment. Such justifications for systems with autonomous capabilities are often based on various probabilistic quantifications [2]. Due to the dynamic nature of the environmental conditions in which these systems operate, as well as the changing nature of the autonomous systems themselves, these probabilistic quantifications cannot be simply estimated once during design time. Rather, they need to be continually evaluated during systems operations to ensure that the assurance case justifications are valid. We refer to the assurance case that combines both the static and dynamic elements as a Dynamic Assurance Case (DAC). Such complex systems with autonomous capabilities are often deployed with a Ground Control Software (GCS) component to enable remote operation. Whether the system is composed of a single unit or a fleet of units, deployed distributed or in remote environments, GCS acts as a window into the behavior of the deployed system. It receives telemetry from the system, issues commands to the system and provides various functionalities to visualize the system performance. We propose a dynamic assurance framework where the GCS acts as a relay between the autonomous system and its DAC. GCS can be used to measure both unit-specific as well as system-wide probabilistic quantifications using the incoming telemetry. We embed these quantifications throughout the DAC as variables that can be updated by external sources. We use the GCS to periodically update these variables, which allows us to continually evaluate the formally defined assurance case justifications. We demonstrate our dynamic assurance framework in the NASA Ames project Troupe1 that aims at developing a fleet of rovers capable of au- tonomously mapping their environment. The rovers work cooperatively, each collecting data for different parts of the environment. Each rover runs an identical core Flight System (cFS) [4] application. Troupe1 uses OpenC3 Cosmos [5] as the ground system, and AdvoCATE [3] to capture the system DAC. We show how we can measure both rover-specific and system-wide quantifications in Cosmos using its Ruby scripting editor and pass them into the DAC modelled in AdvoCATE. Then, we show how these incoming variables can be embedded in different parts of the DAC and how effects of their updates can be observed
The temporal frequency content of the dynamic pressure predicted by a 360 degree computational fluid dynamics (CFD) analysis of a turbine flow field provides indicators of forcing function excitation frequencies (e.g., multiples of blade pass frequency) for turbine components. For the Pratt and Whitney Rocketdyne J-2X engine turbopumps, Campbell diagrams generated using these forcing function frequencies and the results of NASTRAN modal analyses show a number of components with modes in the engine operating range. As a consequence, forced response and static analyses are required for the prediction of combined stress, high cycle fatigue safety factors (HCFSF). Cyclically symmetric structural models have been used to analyze turbine vane and blade rows, not only in modal analyses, but also in forced response and static analyses. Due to the tortuous flow pattern in the turbine, dynamic pressure loading is not cyclically symmetric. Furthermore, CFD analyses predict dynamic pressure waves caused by adjacent and non-adjacent blade/vane rows upstream and downstream of the row analyzed. A MATLAB script has been written to calculate displacements due to the complex cyclically asymmetric dynamic pressure components predicted by CFD analysis, for all grids in a blade/vane row, at a chosen turbopump running speed. The MATLAB displacements are then read into NASTRAN, and dynamic stresses are calculated, including an adjustment for possible mistuning. In a cyclically symmetric NASTRAN static analysis, static stresses due to centrifugal, thermal, and pressure loading at the mode running speed are calculated. MATLAB is used to generate the HCFSF at each grid in the blade/vane row. When compared to an approach assuming cyclic symmetry in the dynamic flow field, the current approach provides better assurance that the worst case safety factor has been identified. An extended example for a J-2X turbopump component is provided.
Next decade, the Dragonfly probe will enter Titan’s atmosphere on a mission to explore and characterize its unique and complex organic chemistry. In contrast to Mars entry missions, where the challenge is to slow down in its tenuous atmosphere before impacting the surface, Titan’s thick atmosphere provides generous drag. However, Titan has its own unique EDL challenges. Among these challenges is the long time (on the order of 90 minutes!) the vehicle will need to descend unguided through flow regimes where blunt-body entry probes are known to be dynamically unstable. This elongated timeline, both prior to drogue parachute deployment, and during the ensuing descent, has the potential to allow adverse dynamic instability properties to produce large amplitude oscillations in angle-of-attack. This, in-turn may lead to non-compliance in vehicle attitude requirements for EDL events such as parachute deployment, and lander release, or in the most extreme case, tumbling of the aeroshell and near-assured loss of mission.
Next decade, the Dragonfly probe will enter Titan’s atmosphere on a mission to explore and characterize its unique and complex organic chemistry. In contrast to Mars entry missions, where the challenge is to slow down in its tenuous atmosphere before impacting the surface, Titan’s thick atmosphere provides generous drag. However, Titan has its own unique EDL challenges. Among these challenges is the long time (on the order of 90 minutes!) the vehicle will need to descend unguided through flow regimes where blunt-body entry probes are known to be dynamically unstable. This elongated timeline, both prior to drogue parachute deployment, and during the ensuing descent, has the potential to allow adverse dynamic instability properties to produce large amplitude oscillations in angle-of-attack. This, in-turn may lead to non-compliance in vehicle attitude requirements for EDL events such as parachute deployment, and lander release, or in the most extreme case, tumbling of the aeroshell and near-assured loss of mission.
The theories of differential games and generalized dynamic systems are used to deduce stabilizing controllers for quasi-linear systems. Attention is given to a class of dynamic systems subject to parameter and input uncertainty whose values range in a given compact set. Using a worst case design philosophy, a feedback control is derived that assures uniform asymptotic (Liapunov) stability of the origin under all admissible uncertainties.
The Flight Dynamics Facility (FDF) at the NASA Goddard Space Flight Center (GSFC) generates numerous products for NASA-supported spacecraft, including the Tracking and Data Relay Satellites (TDRS's), the Hubble Space Telescope (HST), the Extreme Ultraviolet Explorer (EUVE), and the space shuttle. These products include orbit determination data, acquisition data, event scheduling data, and attitude data. In most cases, product generation involves repetitive execution of many programs. The increasing number of missions supported by the FDF has necessitated the use of automated systems to schedule, execute, and quality assure these products. This automation allows the delivery of accurate products in a timely and cost-efficient manner. To be effective, these systems must automate as many repetitive operations as possible and must be flexible enough to meet changing support requirements. The FDF Orbit Determination Task (ODT) has implemented several systems that automate product generation and quality assurance (QA). These systems include the Orbit Production Automation System (OPAS), the New Enhanced Operations Log (NEOLOG), and the Quality Assurance Automation Software (QA Tool). Implementation of these systems has resulted in a significant reduction in required manpower, elimination of shift work and most weekend support, and improved support quality, while incurring minimal development cost. This paper will present an overview of the concepts used and experiences gained from the implementation of these automation systems.
The National Nuclear Security Administration’s mission includes establishing a reliable supply of 99 Mo without highly enriched uranium. Oak Ridge National Laboratory (ORNL) supports this objective through collaborative research and development with industrial partners. Niowave Inc., a current partner, is currently designing a subcritical linear accelerator-driven system (ADS) and preparing for the US Nuclear Regulatory Commission’s licensing process. Niowave’s system has the potential to efficiently supply medical radioisotopes. The technology includes a superconducting electron accelerator and a pile of both natural and low-enriched uranium (LEU) targets. The process fissions uranium and many valuable isotopes can then be extracted from the targets. Niowave is currently iterating through conceptual and detailed design processes for several system sizes. This report discusses UTA–2, which is at the demonstration stage. UTA–2 will validate numerical modeling results with experimental measurements before progressing to the detailed design of UTA–3, the commercial-sized ADS. The thermal-hydraulic behavior of the UTA–2 core design was numerically investigated using STAR-CCM+, as described in this report. STAR-CCM+, a state-of-the-art computational fluid dynamics (CFD) software that was commercially developed by Siemens, has an extensive user base and a set of validation studies. It is also compliant with the American Society of Mechanical Engineers’ Nuclear Quality Assurance 1 standard. Three cases are investigated in this report. Case 1 quantified the temperature field within the UTA–2 assembly and water tank using only conduction as the method of thermal energy transport. This simplified approach was overly conservative and yielded wetted cladding temperatures above the coolant saturation temperature. In this case, the maximum temperature of the wetted cladding surface of the highest power rod exceeded the saturation temperature of water by 63.8°C. Because of the overly conservative approach taken in Case 1 and its negative subcooled margin, buoyancy-driven natural circulation flow physics were implemented in Case 2. Adding coolant motion significantly distributed the thermal energy of the system through convective heat transfer. This relatively small amount of convective heat transfer significantly reduced system temperatures and increased the subcooled margin from –63.8 to 61.3°C. This margin confirmed that no boiling was expected during normal operation of UTA–2 at 230 W. Case 3 had no additional physics models but considered an overpower event during which the power of each LEU and natural uranium rod was at its respective peak values. This resulted in a study with the total assembly power equal to 176% of the nominal power of 230 W considered in Cases 1 and 2. The resulting natural circulation flows were slightly enhanced. The subcooled margin decreased slightly to 46.3°C, which is still a significant margin to local boiling of the water within the tank. This margin confirmed that no boiling was expected during an abnormal operation of UTA–2 at 406 W.
Currently NASA, USA, has under active study and development several large structures for deployment in space. These include for instance beam-like trusses to serve as antenna masts and/or basic building blocks for Space Station construction. An important design consideration is that of assuring adequate stability of the structure in the space environment and in addition in the case of antennas, meeting stringent pointing accuracy requirements. This paper addresses some of the basic design considerations involved such as: (1) modeling flexible multibody dynamics, including sensors and actuators, (2) identifying/monitoring model parameters in orbit, and (3) integrated controls-structures optimization with emphasis on novel concepts and techniques.
The present report is a study of the dynamic stability of a helicopter with hinged rotor blades under hovering conditions. While in this case perfect stability can in general not be obtained it is possible by means of design features to prolong the period of the spontaneous oscillations of the helicopter and reduce their amplification, and so approximately assure neutral equilibrium. The possibility of controlled stability of a helicopter fitted with hinged blades is proved by the successful flights of various helicopters, particularly of the Focker FW61 helicopter.
Spacecraft, operating with a time-to-effect faster than human command response, or with absent or delayed communication, have depended on autonomy. It is likely that this reliance will continue, and increase further in future missions. Spacecraft autonomy is used when operator intervention is not available or feasible, or when dynamic aspects of a spacecraft situation cannot be predicted in advance. This paper provides case studies of several successfully verified autonomous software systems across multiple spacecraft, flight phases (launch, transit, entry and landing, science utilization), and software classifications, and can serve as examples to future missions in methods of successfully assuring spacecraft autonomy.
There is a need to improve predictions of losses resulting from large eddy simulations (LES) of low-pressure turbines (LPT) in gas turbines. This may be done by assessing the accuracy of predictions against validation data and understanding the source of any inaccuracies. LES is a promising approach for capturing the laminar/turbulent transition process in a LPT. In previous studies, the authors utilized LES to model the flow field over a Variable Speed Power Turbine (VSPT) blade and successfully captured characteristic features of separation/reattachment and transition on the suction side at both the cruise (positive incidence) and take-off conditions (negative incidence) and as well, simulated the effect of freestream turbulence (FST) on those phenomena. The predicted pressure loading profiles agreed well with the experimental data for both a high and a low FST case at a Reynolds number of Reex=220,000. In this paper, we present wake profiles resulting from computations for a range of FST values. Although the predicted wake profiles for the lowest FST case (Tu=0.5%) matched the experimental data, at higher FST (Tu=10-15%,) the wake was wider than the experimentally measured wake and for both cases were displaced laterally when compared to the experimental measurements. In our investigation of the causes of the said discrepancies we have identified important effects which could strongly influence the predicted wake profile. Predicted losses were improved by assuring the validity of the flow solution. This was done by utilizing spectral analysis to scrutinize the dynamic behavior of the wake and determine solution accuracy resulting from low mesh density and low accuracy of convective modeling.
There is a need to improve predictions of losses resulting from large eddy simulations (LES) of low-pressure turbines (LPT) in gas turbines. This may be done by assessing the accuracy of predictions against validation data and understanding the source of any inaccuracies. LES is a promising approach for capturing the laminar/turbulent transition process in a LPT. In previous studies, the authors utilized LES to model the flow field over a Variable Speed Power Turbine (VSPT) blade and successfully captured characteristic features of separation/reattachment and transition on the suction side at both the cruise (positive incidence) and take-off conditions (negative incidence) and as well, simulated the effect of free-stream turbulence (FST) on those phenomena. The predicted pressure loading profiles agreed well with the experimental data for both a high and a low FST case at a Reynolds number of Re(ex)=220,000. In this paper, we present wake profiles resulting from computations for a range of FST values. Although the predicted wake profiles for the lowest FST case (Tu=0.5%) matched the experimental data, at higher FST (Tu=10-15%,) the wake was wider than the experimentally measured wake and for both cases were displaced laterally when compared to the experimental measurements. In our investigation of the causes of the said discrepancies we have identified important effects which could strongly influence the predicted wake profile. Predicted losses were improved by assuring the validity of the flow solution. This was done by utilizing spectral analysis to scrutinize the dynamic behavior of the wake and determine solution accuracy resulting from low mesh density and low accuracy of convective modeling.
In this paper we present an integrated approach to in-flight damage accommodation in flight control. The approach is based on Multiple Models, Switching and Tuning (MMST), and consists of three steps: In the first step the main objective is to acquire a realistic aircraft damage model. Modeling of in-flight damage is a highly complex problem since there is a large number of issues that need to be addressed. One of the most important one is that there is strong coupling between structural dynamics, aerodynamics, and flight control. These effects cannot be studied separately due to this coupling. Once a realistic damage model is available, in the second step a large number of models corresponding to different damage cases are generated. One possibility is to generate many linear models and interpolate between them to cover a large portion of the flight envelope. Once these models have been generated, we will implement a recently developed-Model Set Reduction (MSR) technique. The technique is based on parameterizing damage in terms of uncertain parameters, and uses concepts from robust control theory to arrive at a small number of "centered" models such that the controllers corresponding to these models assure desired stability and robustness properties over a subset in the parametric space. By devising a suitable model placement strategy, the entire parametric set is covered with a relatively small number of models and controllers. The third step consists of designing a Multiple Models, Switching and Tuning (MMST) strategy for estimating the current operating regime (damage case) of the aircraft, and switching to the corresponding controller to achieve effective damage accommodation and the desired performance. In the paper present a comprehensive approach to damage accommodation using Model Set Design,MMST, and Variable Structure compensation for coupling nonlinearities. The approach was evaluated on a model of F/A-18 aircraft dynamics under control effector damage, augmented by nonlinear cross-coupling terms and a structural dynamics model. The proposed approach achieved excellent performance under severe damage effects.
Here, the dynamic mode decomposition (DMD) technique extracts the dominant modes characterizing the innate dynamical behavior of the system within the measurement data. For appropriate identification of dominant modes from the measurement data, the DMD algorithm necessitates ensuring the quality of the input measurement data sequences. On that account, for validating the usability of the dataset for the DMD algorithm, the paper proposed two conditions: Persistence of excitation (PE) and the Granger Causality Test (GCT). The virtual data sequences are designed with the hankel matrix representation such that the dimensions of the subspace spanning the essential system modes are increased with the addition of new state variables. The PE condition provides the lower bound for the trajectory length, and the GCT provides the order of the model. Satisfying the PE condition enables estimating an approximate linear model, but the predictability with the identified model is only assured with the temporal causation among data searched with GCT. The proposed methodology is validated with the application for coherency identification (CI) in a multi-machine power system (MMPS), an essential phenomenon in transient stability analysis. The significance of PE condition and GCT is demonstrated through various case studies implemented on 22 bus six generator system.