SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Safety cases are typically used to certify systems at design time as being approved for operation. However, systems typically undergo changes in operation. We present ongoing work extending the safety case concept to account for operational updates.
We describe dynamic safety cases, a novel operationalization of the concept of through-life safety assurance, whose goal is to enable proactive safety management. Using an example from the aviation systems domain, we motivate our approach, its underlying principles, and a lifecycle. We then identify the key elements required to move towards a formalization of the associated framework.
Assurance cases have emerged as a way to build trust in complex autonomous systems. Many assurance case justifications for such systems need to be constantly reevaluated based on the current system context and performance. Autonomous systems, especially those deployed in remote environments, often have a ground control system that enables monitoring and remote operations. In this paper, we propose a dynamic assurance framework that aims at connecting the assurance case with the ground control system. We use the ground control system to facilitate dynamic evaluation of quantitative assurance measures that support various justifications in the assurance case. We demonstrate the proposed dynamic assurance framework on the NASA Ames Research Center project Troupe. We use a combination of in-house and external tools to identify the assurance measures, formalize the related requirements, and generate monitors that feed the data to the external ground control system.
Assurance cases are being increasingly acknowledged as a way to build trust in complex systems with autonomous capabilities [1]. An assurance case is a comprehensive, defensible, and valid justification that a system will function as intended for the specific mission and operating environment. Such justifications for systems with autonomous capabilities are often based on various probabilistic quantifications [2]. Due to the dynamic nature of the environmental conditions in which these systems operate, as well as the changing nature of the autonomous systems themselves, these probabilistic quantifications cannot be simply estimated once during design time. Rather, they need to be continually evaluated during systems operations to ensure that the assurance case justifications are valid. We refer to the assurance case that combines both the static and dynamic elements as a Dynamic Assurance Case (DAC).
Assurance cases are being increasingly acknowledged as a way to build trust in complex systems with autonomous capabilities [1]. An assurance case is a comprehensive, defensible, and valid justification that a system will function as intended for the specific mission and operating environment. Such justifications for systems with autonomous capabilities are often based on various probabilistic quantifications [2]. Due to the dynamic nature of the environmental conditions in which these systems operate, as well as the changing nature of the autonomous systems themselves, these probabilistic quantifications cannot be simply estimated once during design time. Rather, they need to be continually evaluated during systems operations to ensure that the assurance case justifications are valid. We refer to the assurance case that combines both the static and dynamic elements as a Dynamic Assurance Case (DAC). Such complex systems with autonomous capabilities are often deployed with a Ground Control Software (GCS) component to enable remote operation. Whether the system is composed of a single unit or a fleet of units, deployed distributed or in remote environments, GCS acts as a window into the behavior of the deployed system. It receives telemetry from the system, issues commands to the system and provides various functionalities to visualize the system performance. We propose a dynamic assurance framework where the GCS acts as a relay between the autonomous system and its DAC. GCS can be used to measure both unit-specific as well as system-wide probabilistic quantifications using the incoming telemetry. We embed these quantifications throughout the DAC as variables that can be updated by external sources. We use the GCS to periodically update these variables, which allows us to continually evaluate the formally defined assurance case justifications. We demonstrate our dynamic assurance framework in the NASA Ames project Troupe1 that aims at developing a fleet of rovers capable of au- tonomously mapping their environment. The rovers work cooperatively, each collecting data for different parts of the environment. Each rover runs an identical core Flight System (cFS) [4] application. Troupe1 uses OpenC3 Cosmos [5] as the ground system, and AdvoCATE [3] to capture the system DAC. We show how we can measure both rover-specific and system-wide quantifications in Cosmos using its Ruby scripting editor and pass them into the DAC modelled in AdvoCATE. Then, we show how these incoming variables can be embedded in different parts of the DAC and how effects of their updates can be observed
The temporal frequency content of the dynamic pressure predicted by a 360 degree computational fluid dynamics (CFD) analysis of a turbine flow field provides indicators of forcing function excitation frequencies (e.g., multiples of blade pass frequency) for turbine components. For the Pratt and Whitney Rocketdyne J-2X engine turbopumps, Campbell diagrams generated using these forcing function frequencies and the results of NASTRAN modal analyses show a number of components with modes in the engine operating range. As a consequence, forced response and static analyses are required for the prediction of combined stress, high cycle fatigue safety factors (HCFSF). Cyclically symmetric structural models have been used to analyze turbine vane and blade rows, not only in modal analyses, but also in forced response and static analyses. Due to the tortuous flow pattern in the turbine, dynamic pressure loading is not cyclically symmetric. Furthermore, CFD analyses predict dynamic pressure waves caused by adjacent and non-adjacent blade/vane rows upstream and downstream of the row analyzed. A MATLAB script has been written to calculate displacements due to the complex cyclically asymmetric dynamic pressure components predicted by CFD analysis, for all grids in a blade/vane row, at a chosen turbopump running speed. The MATLAB displacements are then read into NASTRAN, and dynamic stresses are calculated, including an adjustment for possible mistuning. In a cyclically symmetric NASTRAN static analysis, static stresses due to centrifugal, thermal, and pressure loading at the mode running speed are calculated. MATLAB is used to generate the HCFSF at each grid in the blade/vane row. When compared to an approach assuming cyclic symmetry in the dynamic flow field, the current approach provides better assurance that the worst case safety factor has been identified. An extended example for a J-2X turbopump component is provided.
Next decade, the Dragonfly probe will enter Titan’s atmosphere on a mission to explore and characterize its unique and complex organic chemistry. In contrast to Mars entry missions, where the challenge is to slow down in its tenuous atmosphere before impacting the surface, Titan’s thick atmosphere provides generous drag. However, Titan has its own unique EDL challenges. Among these challenges is the long time (on the order of 90 minutes!) the vehicle will need to descend unguided through flow regimes where blunt-body entry probes are known to be dynamically unstable. This elongated timeline, both prior to drogue parachute deployment, and during the ensuing descent, has the potential to allow adverse dynamic instability properties to produce large amplitude oscillations in angle-of-attack. This, in-turn may lead to non-compliance in vehicle attitude requirements for EDL events such as parachute deployment, and lander release, or in the most extreme case, tumbling of the aeroshell and near-assured loss of mission.
Next decade, the Dragonfly probe will enter Titan’s atmosphere on a mission to explore and characterize its unique and complex organic chemistry. In contrast to Mars entry missions, where the challenge is to slow down in its tenuous atmosphere before impacting the surface, Titan’s thick atmosphere provides generous drag. However, Titan has its own unique EDL challenges. Among these challenges is the long time (on the order of 90 minutes!) the vehicle will need to descend unguided through flow regimes where blunt-body entry probes are known to be dynamically unstable. This elongated timeline, both prior to drogue parachute deployment, and during the ensuing descent, has the potential to allow adverse dynamic instability properties to produce large amplitude oscillations in angle-of-attack. This, in-turn may lead to non-compliance in vehicle attitude requirements for EDL events such as parachute deployment, and lander release, or in the most extreme case, tumbling of the aeroshell and near-assured loss of mission.
The theories of differential games and generalized dynamic systems are used to deduce stabilizing controllers for quasi-linear systems. Attention is given to a class of dynamic systems subject to parameter and input uncertainty whose values range in a given compact set. Using a worst case design philosophy, a feedback control is derived that assures uniform asymptotic (Liapunov) stability of the origin under all admissible uncertainties.
The Flight Dynamics Facility (FDF) at the NASA Goddard Space Flight Center (GSFC) generates numerous products for NASA-supported spacecraft, including the Tracking and Data Relay Satellites (TDRS's), the Hubble Space Telescope (HST), the Extreme Ultraviolet Explorer (EUVE), and the space shuttle. These products include orbit determination data, acquisition data, event scheduling data, and attitude data. In most cases, product generation involves repetitive execution of many programs. The increasing number of missions supported by the FDF has necessitated the use of automated systems to schedule, execute, and quality assure these products. This automation allows the delivery of accurate products in a timely and cost-efficient manner. To be effective, these systems must automate as many repetitive operations as possible and must be flexible enough to meet changing support requirements. The FDF Orbit Determination Task (ODT) has implemented several systems that automate product generation and quality assurance (QA). These systems include the Orbit Production Automation System (OPAS), the New Enhanced Operations Log (NEOLOG), and the Quality Assurance Automation Software (QA Tool). Implementation of these systems has resulted in a significant reduction in required manpower, elimination of shift work and most weekend support, and improved support quality, while incurring minimal development cost. This paper will present an overview of the concepts used and experiences gained from the implementation of these automation systems.
Currently NASA, USA, has under active study and development several large structures for deployment in space. These include for instance beam-like trusses to serve as antenna masts and/or basic building blocks for Space Station construction. An important design consideration is that of assuring adequate stability of the structure in the space environment and in addition in the case of antennas, meeting stringent pointing accuracy requirements. This paper addresses some of the basic design considerations involved such as: (1) modeling flexible multibody dynamics, including sensors and actuators, (2) identifying/monitoring model parameters in orbit, and (3) integrated controls-structures optimization with emphasis on novel concepts and techniques.
The present report is a study of the dynamic stability of a helicopter with hinged rotor blades under hovering conditions. While in this case perfect stability can in general not be obtained it is possible by means of design features to prolong the period of the spontaneous oscillations of the helicopter and reduce their amplification, and so approximately assure neutral equilibrium. The possibility of controlled stability of a helicopter fitted with hinged blades is proved by the successful flights of various helicopters, particularly of the Focker FW61 helicopter.
Spacecraft, operating with a time-to-effect faster than human command response, or with absent or delayed communication, have depended on autonomy. It is likely that this reliance will continue, and increase further in future missions. Spacecraft autonomy is used when operator intervention is not available or feasible, or when dynamic aspects of a spacecraft situation cannot be predicted in advance. This paper provides case studies of several successfully verified autonomous software systems across multiple spacecraft, flight phases (launch, transit, entry and landing, science utilization), and software classifications, and can serve as examples to future missions in methods of successfully assuring spacecraft autonomy.
There is a need to improve predictions of losses resulting from large eddy simulations (LES) of low-pressure turbines (LPT) in gas turbines. This may be done by assessing the accuracy of predictions against validation data and understanding the source of any inaccuracies. LES is a promising approach for capturing the laminar/turbulent transition process in a LPT. In previous studies, the authors utilized LES to model the flow field over a Variable Speed Power Turbine (VSPT) blade and successfully captured characteristic features of separation/reattachment and transition on the suction side at both the cruise (positive incidence) and take-off conditions (negative incidence) and as well, simulated the effect of freestream turbulence (FST) on those phenomena. The predicted pressure loading profiles agreed well with the experimental data for both a high and a low FST case at a Reynolds number of Reex=220,000. In this paper, we present wake profiles resulting from computations for a range of FST values. Although the predicted wake profiles for the lowest FST case (Tu=0.5%) matched the experimental data, at higher FST (Tu=10-15%,) the wake was wider than the experimentally measured wake and for both cases were displaced laterally when compared to the experimental measurements. In our investigation of the causes of the said discrepancies we have identified important effects which could strongly influence the predicted wake profile. Predicted losses were improved by assuring the validity of the flow solution. This was done by utilizing spectral analysis to scrutinize the dynamic behavior of the wake and determine solution accuracy resulting from low mesh density and low accuracy of convective modeling.
There is a need to improve predictions of losses resulting from large eddy simulations (LES) of low-pressure turbines (LPT) in gas turbines. This may be done by assessing the accuracy of predictions against validation data and understanding the source of any inaccuracies. LES is a promising approach for capturing the laminar/turbulent transition process in a LPT. In previous studies, the authors utilized LES to model the flow field over a Variable Speed Power Turbine (VSPT) blade and successfully captured characteristic features of separation/reattachment and transition on the suction side at both the cruise (positive incidence) and take-off conditions (negative incidence) and as well, simulated the effect of free-stream turbulence (FST) on those phenomena. The predicted pressure loading profiles agreed well with the experimental data for both a high and a low FST case at a Reynolds number of Re(ex)=220,000. In this paper, we present wake profiles resulting from computations for a range of FST values. Although the predicted wake profiles for the lowest FST case (Tu=0.5%) matched the experimental data, at higher FST (Tu=10-15%,) the wake was wider than the experimentally measured wake and for both cases were displaced laterally when compared to the experimental measurements. In our investigation of the causes of the said discrepancies we have identified important effects which could strongly influence the predicted wake profile. Predicted losses were improved by assuring the validity of the flow solution. This was done by utilizing spectral analysis to scrutinize the dynamic behavior of the wake and determine solution accuracy resulting from low mesh density and low accuracy of convective modeling.
In this paper we present an integrated approach to in-flight damage accommodation in flight control. The approach is based on Multiple Models, Switching and Tuning (MMST), and consists of three steps: In the first step the main objective is to acquire a realistic aircraft damage model. Modeling of in-flight damage is a highly complex problem since there is a large number of issues that need to be addressed. One of the most important one is that there is strong coupling between structural dynamics, aerodynamics, and flight control. These effects cannot be studied separately due to this coupling. Once a realistic damage model is available, in the second step a large number of models corresponding to different damage cases are generated. One possibility is to generate many linear models and interpolate between them to cover a large portion of the flight envelope. Once these models have been generated, we will implement a recently developed-Model Set Reduction (MSR) technique. The technique is based on parameterizing damage in terms of uncertain parameters, and uses concepts from robust control theory to arrive at a small number of "centered" models such that the controllers corresponding to these models assure desired stability and robustness properties over a subset in the parametric space. By devising a suitable model placement strategy, the entire parametric set is covered with a relatively small number of models and controllers. The third step consists of designing a Multiple Models, Switching and Tuning (MMST) strategy for estimating the current operating regime (damage case) of the aircraft, and switching to the corresponding controller to achieve effective damage accommodation and the desired performance. In the paper present a comprehensive approach to damage accommodation using Model Set Design,MMST, and Variable Structure compensation for coupling nonlinearities. The approach was evaluated on a model of F/A-18 aircraft dynamics under control effector damage, augmented by nonlinear cross-coupling terms and a structural dynamics model. The proposed approach achieved excellent performance under severe damage effects.
The conceptual design studies of a Block 2 Solid Rocket Motor (SRM) require the elimination of asbestos-filled insulation and was open to alternate designs, such as case changes, different propellants, modified burn rate - to improve reliability and performance. Limitations were placed on SRM changes such that the outside geometry should not impact the physical interfaces with other Space Shuttle elements and should have minimum changes to the aerodynamic and dynamic characteristics of the Space Shuttle vehicle. Previous Space Shuttle SRM experience was assessed and new design concepts combined to define a valid approach to assured flight success and economic operation of the STS. Trade studies, preliminary designs, analyses, plans, and cost estimates are documented.
An experiment to evaluate the applicability of the Verifiable Integrated Processor for Enhanced Reliability (VIPER) microprocessor to real time control is described. The VIPER microprocessor was invented by the Royal Signals and Radar Establishment (RSRE), U.K., and is an example of the use of formal mathematical methods for developing electronic digital systems with a high degree of assurance on the system design and implementation correctness. The experiment consisted of selecting a control law, writing the control law algorithm for the VIPER processor, and providing real time, dynamic inputs into the processor and monitoring the outputs. The control law selected and coded for the VIPER processor was the yaw damper function of an automatic landing program for a 737 aircraft. The mechanisms for interfacing the VIPER Single Board Computer to the VAX host are described. Results include run time experiences, performance evaluation, and comparison of VIPER and FORTRAN yaw damper algorithm output for accuracy estimation.