SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
We describe dynamic safety cases, a novel operationalization of the concept of through-life safety assurance, whose goal is to enable proactive safety management. Using an example from the aviation systems domain, we motivate our approach, its underlying principles, and a lifecycle. We then identify the key elements required to move towards a formalization of the associated framework.
Safety cases are typically used to certify systems at design time as being approved for operation. However, systems typically undergo changes in operation. We present ongoing work extending the safety case concept to account for operational updates.
The world-wide aviation system is one of the most complex dynamical systems ever developed and is generating data at an extremely rapid rate. Most modern commercial aircraft record several hundred flight parameters including information from the guidance, navigation, and control systems, the avionics and propulsion systems, and the pilot inputs into the aircraft. These parameters may be continuous measurements or binary or categorical measurements recorded in one second intervals for the duration of the flight. Currently, most approaches to aviation safety are reactive, meaning that they are designed to react to an aviation safety incident or accident. In this paper, we discuss a novel approach based on the theory of multiple kernel learning to detect potential safety anomalies in very large data bases of discrete and continuous data from world-wide operations of commercial fleets. We pose a general anomaly detection problem which includes both discrete and continuous data streams, where we assume that the discrete streams have a causal influence on the continuous streams. We also assume that atypical sequence of events in the discrete streams can lead to off-nominal system performance. We discuss the application domain, novel algorithms, and also discuss results on real-world data sets. Our algorithm uncovers operationally significant events in high dimensional data streams in the aviation industry which are not detectable using state of the art methods
The temporal frequency content of the dynamic pressure predicted by a 360 degree computational fluid dynamics (CFD) analysis of a turbine flow field provides indicators of forcing function excitation frequencies (e.g., multiples of blade pass frequency) for turbine components. For the Pratt and Whitney Rocketdyne J-2X engine turbopumps, Campbell diagrams generated using these forcing function frequencies and the results of NASTRAN modal analyses show a number of components with modes in the engine operating range. As a consequence, forced response and static analyses are required for the prediction of combined stress, high cycle fatigue safety factors (HCFSF). Cyclically symmetric structural models have been used to analyze turbine vane and blade rows, not only in modal analyses, but also in forced response and static analyses. Due to the tortuous flow pattern in the turbine, dynamic pressure loading is not cyclically symmetric. Furthermore, CFD analyses predict dynamic pressure waves caused by adjacent and non-adjacent blade/vane rows upstream and downstream of the row analyzed. A MATLAB script has been written to calculate displacements due to the complex cyclically asymmetric dynamic pressure components predicted by CFD analysis, for all grids in a blade/vane row, at a chosen turbopump running speed. The MATLAB displacements are then read into NASTRAN, and dynamic stresses are calculated, including an adjustment for possible mistuning. In a cyclically symmetric NASTRAN static analysis, static stresses due to centrifugal, thermal, and pressure loading at the mode running speed are calculated. MATLAB is used to generate the HCFSF at each grid in the blade/vane row. When compared to an approach assuming cyclic symmetry in the dynamic flow field, the current approach provides better assurance that the worst case safety factor has been identified. An extended example for a J-2X turbopump component is provided.
NASA uses six-degrees-of-freedom (6-DOF) simulations tools to design, test, develop Guidance Navigation and Control (GN&C) software, and certify vehicle performance prior to flight. Therefore, it is critical that the 6-DOF tools used for vehicle design and certification are validated. The focus of this work is the vali-dation of the NASA Marshall Space Flight Center 6-DOF “GeneraLized Aero-space Simulation in Simulink” (GLASS) framework tool. The GLASS tool framework is currently used to support NASA GN&C insight for the Human Landing System (HLS) project, simulating vehicle dynamics during lunar descent and as-cent. The GLASS framework utilizes the off-the-shelf Mathworks ® Simscape Multibody® toolbox to model vehicle multi-body dynamics. NASA’s Engineering and Safety Center (NESC) provides a set of 6-DOF simulation verification “check cases” that are available to any user needing to verify 6-DOF tools. The check cases contain seventeen atmospheric and twenty-six orbital test scenarios are provided to validate equations of motion, environmental models (e.g., atmosphere, gravitation, and geodesy) and tool propagators. This paper compares GLASS 6-DOF simulation results against the NESC check cases’ results via simulation-to-simulation comparisons. The comparisons demonstrate that GLASS simulation results are “in family” with the outputs of the applicable NASA NESC check cases and verifies the GLASS core framework dynamics and the correct implementation of the check case scenario models.
NASA uses six-degrees-of-freedom (6-DOF) simulations tools to design, test, develop Guidance Navigation and Control (GN&C) software, and certify vehicle performance prior to flight. Therefore, it is critical that the 6-DOF tools used for vehicle design and certification are validated. The focus of this work is the validation of the NASA Marshall Space Flight Center 6-DOF “GeneraLized Aerospace Simulation in Simulink” (GLASS) framework tool. The GLASS tool framework is currently used to support NASA GN&C insight for the Human Landing System (HLS) project, simulating vehicle dynamics during lunar descent and ascent. The GLASS framework utilizes the off-the-shelf Mathworks (R) Simscape (TM) Multibody (TM) toolbox to model vehicle multi-body dynamics. NASA’s Engineering and Safety Center (NESC) provides a set of 6-DOF simulation verification “check cases” that are available to any user needing to verify 6-DOF tools. The check cases contain seventeen atmospheric and twenty-six orbital test scenarios are provided to validate equations of motion, environmental models (e.g., atmosphere, gravitation, and geodesy) and tool propagators. This paper compares GLASS 6-DOF simulation results against the NESC check cases’ results via simulation-to-simulation comparisons. The comparison demonstrates that GLASS simulation results are “in family” with the outputs of the applicable NASA NESC check-cases and verify the GLASS core framework dynamics and the implementation of the check case scenario models.
The design and capabilities of two digital controller systems for aeroelastic wind-tunnel models are described. The first allowed control of flutter while performing roll maneuvers with wing load control as well as coordinating the acquisition, storage, and transfer of data for on-line analysis. This system, which employs several digital signal multi-processor (DSP) boards programmed in high-level software languages, is housed in a SUN Workstation environment. A second DCS provides a measure of wind-tunnel safety by functioning as a trip system during testing in the case of high model dynamic response or in case the first DCS fails. The second DCS uses National Instruments LabVIEW Software and Hardware within a Macintosh environment.
Robonaut 2 (R2) has completed its fixed base activities on-board the ISS and is scheduled to receive its climbing legs in early 2014. In its continuing line of firsts, the R2 torso finished up its on-orbit activities on its stanchion with the manipulation of space blanket materials and performed multiple tasks under teleoperation control by IVA astronauts. The successful completion of these two IVA experiments is a key step in Robonaut's progression towards an EVA capability. Integration with the legs and climbing inside the ISS will provide another important part of the experience that R2 will need prior to performing tasks on the outside of ISS. In support of these on-orbit activities, R2 has been traversing across handrails in simulated zero-g environments and working with EVA tools and equipment on the ground to determine manipulation strategies for an EVA Robonaut. R2 made significant advances in robotic manipulation of deformable materials in space while working with its softgoods task panel. This panel features quarter turn latches that secure a space blanket to the task panel structure. The space blanket covers two cloth cubes that are attached with Velcro to the structure. R2 was able to open and close the latches, pull back the blanket, and remove the cube underneath. R2 simulated cleaning up an EVA worksite as well, by replacing the cube and reattaching the blanket. In order to interact with the softgoods panel, R2 has both autonomously and with a human in the loop identified and localized these deformable objects. Using stereo color cameras, R2 identified characteristic elements on the softgoods panel then extracted the location and orientation of the object in its field of view using stereo disparity and kinematic transforms. R2 used both vision processing and supervisory control to successfully accomplish this important task. Teleoperation is a key capability for Robonaut's effectiveness as an EVA system. To build proficiency, crewmembers have attempted increasingly difficult tasks using R2 inside the Station. After donning motion capture equipment and a virtual reality visor, Expedition 34/35 flight engineer Tom Marshburn began operations with simple hand movements. Having gained confidence, Marshburn guided R2's arms in a leader-follower exercise with crewmate Chris Cassidy. He was also able to use the hand to grab a tumbling roll of tape, a task only demonstrable in microgravity. Later efforts saw Cassidy handle softgoods through shared control with ground operators, mimicking an activity previously achieved using only autonomy. Robotic climbing through the ISS on handrails requires both precision motion and compliant grasps in order to both position grippers on handrails/seat track and prevent large internal forces. R2 climbs using actively controlled compliance and torque limiting to meet both the precision and softness requirements. During a step, the attached leg is controlled to be strong and stiff in order to maintain precision trajectory tracking. The swing leg is controlled to be stiff but weak to minimize unintentional impact forces while maintaining precision. During a simulated dual limb grasp (as shown in Figure 1), the R2 controller maintains one limb rigid and one limb soft to prevent large internal forces from building up. R2's grippers also use a form of force control to limit grip force while not fully closed on either a handrail or seat track thus limiting unintentional forces on cables/objects that may be present in R2's translational path. The on-board torso R2 safety system relies on a single end-effector velocity limit to prevent potential impact forces from exceeding Station maximum load requirements. R2's mobile configuration required modifications to the velocity limiting safety function due to its large, dynamic inertia. R2's legs maneuver the robot's mass creating configuration dependent, joint-relative inertias. A single all-encompassing velocity limit to cover worst case inertia is prohibitively low. The upgraded R2 control and safety systems solve this problem using momentum limiting, momentum control, and kinetic energy minimization. Momentum and kinetic energy take the robot mass into account relieving low velocity restrictions on low inertia end-effectors while ensuring that the overall mass of R2 is limited from hazardous velocities. The momentum of R2's five safety nodes (each of the four end-effectors and the body) is monitored and compared to a single momentum limit. If any of the five nodes exceeds the safety limit, the motor power is removed and the robot comes to a stop. Momentum control/limiting also provides a simple, reliable method to integrate hand held tools into the safety system by providing the tool mass to the control system thus automatically reducing the allowable velocity of the end-effector with the tool. Work on the ground continues to build the skill set for an EVA Robonaut. Recent experiments (Figure 2) demonstrate how a teleoperator can use R2 to manipulate a tether hook, an important safety precaution on spacewalks. Another task displayed Robonaut's ability to pull back a protective jacket over a hose and search for damage, as well as inspect a quick-disconnect fitting for debris. Demonstrations such as these are indicative of EVA work done on ISS, specifically seen during a series of spacewalks over 2012 and 2013 where astronauts searched for an ammonia leak in one of the external cooling loops. Through experiments both on ISS and on the ground, R2 is evolving and providing the information needed to plan out the upgrades that will make an EVA Robonaut an effective tool. With the addition of legs, R2 will start climbing inside the space station and supply invaluable information on how the climbing strategies and task stabilization techniques must be refined. Ground R2 systems will continue to work with additional EVA tools and equipment in preparation for onboard IVA testing and future EVA applications.
Uncertainty quantification of computational fluid dynamics (CFD) simulations is a complicated procedure which still relies in many cases on engineering judgment and factors of safety. This is in part because the computational cost of measuring the simulation's sensitivity to all meaningful parameters (e.g., body surface roughness) and hyperparameters (e.g., subiteration convergence criterion) is intractable for even a single simulation. Reduced-order modeling dramatically lowers this computational cost of simulating fluid flows, but usually only where similar data is already available. In this work, fluid reduced-order models are utilized to quantify a flow's sensitivity to certain physical parameters for the purposes of improved uncertainty quantification. Characteristic observability and sensitivity are both explored. The resulting sensitivity quantifications enable more informed CFD frameworks and more rigorous uncertainty bounds on the resulting data.
Uncertainty quantification of computational fluid dynamics (CFD) simulations is a complicated procedure which still relies in many cases on engineering judgment and factors of safety. This is in part because the computational cost of measuring the simulation's sensitivity to all meaningful parameters (e.g., body surface roughness) and hyperparameters (e.g., subiteration convergence criterion) is intractable for even a single simulation. Reduced-order modeling dramatically lowers this computational cost of simulating fluid flows, but usually only where similar data is already available. In this work, fluid reduced-order models are utilized to quantify a flow's sensitivity to certain physical parameters for the purposes of improved uncertainty quantification. Characteristic observability and sensitivity are both explored. The resulting sensitivity quantifications enable more informed CFD frameworks and more rigorous uncertainty bounds on the resulting data.
The paper is concerned with the selection of a specific spacecraft power technology and the identification of technology development to meet system requirements. Requirements which influence the selection of a given technology include the power level required, whether the load is constant or transient in nature, and in the case of transient loads, the time required to recover the power, and overall system safety. Various power technologies, such as solar voltaic power, solar dynamic power, nuclear power systems, and electrochemical energy storage, are briefly described.
Telerobotic operations, whether under autonomous or teleoperated control, require a much more sophisticated safety system than that needed for most industrial applications. Industrial robots generally perform very repetitive tasks in a controlled, static environment. The safety system in that case can be as simple as shutting down the robot if a human enters the work area, or even simply building a cage around the work space. Telerobotic operations, however, will take place in a dynamic, sometimes unpredictable environment, and will involve complicated and perhaps unrehearsed manipulations. This creates a much greater potential for damage to the robot or objects in its vicinity. The Procedural Safety System (PSS) collects data from external sensors and the robot, then processes it through an expert system shell to determine whether an unsafe condition or potential unsafe condition exists. Unsafe conditions could include exceeding velocity, acceleration, torque, or joint limits, imminent collision, exceeding temperature limits, and robot or sensor component failure. If a threat to safety exists, the operator is warned. If the threat is serious enough, the robot is halted. The PSS, therefore, uses expert system technology to enhance safety thus reducing operator work load, allowing him/her to focus on performing the task at hand without the distraction of worrying about violating safety criteria.
Aircraft and spacecraft comprise the class of aerospace structures that require efficiency and wisdom in design, sophistication and accuracy in analysis and numerous and careful experimental evaluations of components and prototype, in order to achieve the necessary system reliability, performance and safety. Preliminary and/or concept design entails the assemblage of system mission requirements, system expected performance and identification of components and their connections as well as of manufacturing and system assembly techniques. This is accomplished through experience based on previous similar designs, and through the possible use of models to simulate the entire system characteristics. Detail design is heavily dependent on information and concepts derived from the previous steps. This information identifies critical design areas which need sophisticated analyses, and design and redesign procedures to achieve the expected component performance. This step may require several independent analysis models, which, in many instances, require component testing. The last step in the design process, before going to production, is the verification of the design. This step necessitates the production of large components and prototypes in order to test component and system analytical predictions and verify strength and performance requirements under the worst loading conditions that the system is expected to encounter in service. Clearly then, full-scale testing is in many cases necessary and always very expensive. In the aircraft industry, in addition to full-scale tests, certification and safety necessitate large component static and dynamic testing. Such tests are extremely difficult, time consuming and definitely absolutely necessary. Clearly, one should not expect that prototype testing will be totally eliminated in the aircraft industry. It is hoped, though, that we can reduce full-scale testing to a minimum. Full-scale large component testing is necessary in other industries as well, Ship building, automobile and railway car construction all rely heavily on testing. Regardless of the application, a scaled-down (by a large factor) model (scale model) which closely represents the structural behavior of the full-scale system (prototype) can prove to be an extremely beneficial tool. This possible development must be based on the existence of certain structural parameters that control the behavior of a structural system when acted upon by static and/or dynamic loads. If such structural parameters exist, a scaled-down replica can be built, which will duplicate the response of the full-scale system. The two systems are then said to be structurally similar. The term, then, that best describes this similarity is structural similitude. Similarity of systems requires that the relevant system parameters be identical and these systems be governed by a unique set of characteristic equations. Thus, if a relation or equation of variables is written for a system, it is valid for all systems which are similar to it. Each variable in a model is proportional to the corresponding variable of the prototype. This ratio, which plays an essential role in predicting the relationship between the model and its prototype, is called the scale factor.
Space suit carbon dioxide (CO2) washout refers to the removal of CO2 gas from the oral-nasal area of a suited astronaut's (or crewmember's) helmet using the suit's ventilation system. Inadequate washout of gases can result in diminished mental/cognitive abilities as well as headaches and light headedness. In addition to general discomfort, these ailments can impair an astronaut s ability to perform mission-critical tasks ranging from flying the space vehicle to performing lunar extravehicular activities (EVAs). During design development for NASA s Constellation Program (CxP), conflicting requirements arose between the volume of air flow that the new Orion manned space vehicle is allocated to provide to the suited crewmember and the amount of air required to achieve CO2 washout in a space suit. Historically, space suits receive 6.0 actual cubic feet per minute (acfm) of air flow, which has adequately washed out CO2 for EVAs. For CxP, the Orion vehicle will provide 4.5 acfm of air flow to the suit. A group of subject matter experts (SM Es) among the EVA Systems community came to an early consensus that 4.5 acfm may be acceptable for low metabolic rate activities. However, this value appears very risky for high metabolic rates, hence the need for further analysis and testing. An analysis was performed to validate the 4.5 acfm value and to determine if adequate CO2 washout can be achieved with the new suit helmet design concepts. The analysis included computational fluid dynamic (CFD) modeling cases, which modeled the air flow and breathing characteristics of a human wearing suit helmets. Helmet testing was performed at the National Institute of Occupational Safety and Health (NIOSH) in Pittsburgh, Pennsylvania, to provide a gross-level validation of the CFD models. Although there was not a direct data correlation between the helmet testing and the CFD modeling, the testing data showed trends that are very similar to the CFD modeling. Overall, the analysis yielded results that were better than anticipated, with a few unexpected findings that could not easily be explained. Results indicate that 4.5 acfm is acceptable for CO2 washout and helmet design. This paper summarizes the results of this CO2 washout study.
Aviation is a problem domain characterized by a high level of system complexity and uncertainty. Safety risk analysis in such a domain is especially challenging given the multitude of operations and diverse stakeholders. The Federal Aviation Administration (FAA) projects that by 2025 air traffic will increase by more than 50 percent with 1.1 billion passengers a year and more than 85,000 flights every 24 hours contributing to further delays and congestion in the sky (Circelli, 2011). This increased system complexity necessitates the application of structured safety risk analysis methods to understand and eliminate where possible, reduce, and/or mitigate risk factors. The use of expert judgments for probabilistic safety analysis in such a complex domain is necessary especially when evaluating the projected impact of future technologies, capabilities, and procedures for which current operational data may be scarce. Management of an R&D product portfolio in such a dynamic domain needs a systematic process to elicit these expert judgments, process modeling results, perform sensitivity analyses, and efficiently communicate the modeling results to decision makers. In this paper a case study focusing on the application of an R&D portfolio of aeronautical products intended to mitigate aircraft Loss of Control (LOC) accidents is presented. In particular, the knowledge elicitation process with three subject matter experts who contributed to the safety risk model is emphasized. The application and refinement of a verbal-numerical scale for conditional probability elicitation in a Bayesian Belief Network (BBN) is discussed. The preliminary findings from this initial step of a three-part elicitation are important to project management practitioners as they illustrate the vital contribution of systematic knowledge elicitation in complex domains.
A low-gravity environment, in space or ground-based facilities such as drop towers, provides a unique setting for study of combustion mechanisms. Understanding the physical phenomena controlling the ignition and spread of flames in microgravity has importance for space safety as well as better characterization of dynamical and chemical combustion processes which are normally masked by buoyancy and other gravity-related effects. Even the use of so-called 'limiting cases' or the construction of 1-D or 2-D models and experiments fail to make the analysis of combustion simultaneously simple and accurate. Ideally, to bridge the gap between chemistry and fluid mechanics in microgravity combustion, species concentrations and temperature profiles are needed throughout the flame. However, restrictions associated with performing measurements in reduced gravity, especially size and weight considerations, have generally limited microgravity combustion studies to the capture of flame emissions on film or video laser Schlieren imaging and (intrusive) temperature measurements using thermocouples. Given the development of detailed theoretical models, more sophisticated studies are needed to provide the kind of quantitative data necessary to characterize the properties of microgravity combustion processes as well as provide accurate feedback to improve the predictive capabilities of the computational models. While there have been a myriad of fluid mechanical visualization studies in microgravity combustion, little experimental work has been completed to obtain reactant and product concentrations within a microgravity flame. This is largely due to the fact that traditional sampling methods (quenching microprobes using GC and/or mass spec analysis) are too heavy, slow, and cumbersome for microgravity experiments. Non-intrusive optical spectroscopic techniques have - up until now - also required excessively bulky, power hungry equipment. However, with the advent of near-IR diode lasers, the possibility now exists to obtain reactant and product concentrations and temperatures non-intrusively in microgravity combustion studies. Over the past ten years, Southwest Sciences has focused its research on the high sensitivity, quantitative detection of gas phase species using diode lasers. Our research approach combines three innovations in an experimental system resulting in a new capability for nonintrusive measurement of major combustion species. FM spectroscopy or high frequency Wavelength Modulation Spectroscopy (WMS) have recently been applied to sensitive absorption measurements at Southwest Sciences and in other laboratories using GaAlAs or InGaAsP diode lasers in the visible or near-infrared as well as lead-salt lasers in the mid-infrared spectral region. Because these lasers exhibit essentially no source noise at the high detection frequencies employed with this technique, the achievement of sensitivity approaching the detector shot noise limit is possible.
Aircraft structures are designed to guarantee safety of flight in some required operational envelope. When the aircraft becomes structurally impaired, safety of flight may not be guaranteed within that previously safe operational envelope. In this case the safe operational envelope must be redefined in-flight and a means to prevent excursion from this new envelope must be implemented. A specific structural failure mode that may result in a reduced safe operating envelope, the exceedance of which could lead to catastrophic structural failure of the aircraft, will be addressed. The goal of the DFEAP program is the detection of this failure mode coupled with flight controls adaptation to limit critical loads in the damaged aircraft structure. The DFEAP program is working with an F/A-18 aircraft model. The composite wing skins are bonded to metallic spars in the wing substructure. Over time, it is possible that this bonding can deteriorate due to fatigue. In this case, the ability of the wing spar to transfer loading between the wing skins is reduced. This failure mode can translate to a reduced allowable compressive strain on the wing skin and could lead to catastrophic wing buckling if load limiting of the wing structure is not applied. The DFEAP program will make use of a simplified wing strain model for the healthy aircraft. The outputs of this model will be compared in real-time to onboard strain measurements at several locations on the aircraft wing. A damage condition is declared at a given location when the strain measurements differ sufficiently from the strain model. Parameter identification of the damaged structure wing strain parameters will be employed to provide load limiting control adaptation for the aircraft. This paper will discuss the simplified strain models used in the implementation and their interaction with the strain sensor measurements. Also discussed will be the damage detection and identification schemes employed and the means by which the damaged aircraft parameters will be used to provide load limiting that keeps the aircraft within the safe operational envelope.
This work supports a larger effort at NASA to reduce airframe noise and, thus, environmental noise around airports. The leading-edge slat of conventional high-lift systems is a prominent source of airframe noise, and two technologies were previously identified as promising for noise reduction without significant aerodynamic or weight penalty: the slat cove filler (SCF) and the slat gap filler (SGF). NASA fabricated a 10%-scale semispan aircraft model for wind tunnel testing based upon the High-Lift Common Research Model (CRM-HL). NASA embarked on a test campaign with the 10% CRM-HL to determine the noise reduction effectiveness and other performance metrics of 3D SCF and SGF treatments in flow conditions representative of flight. The highly flexible SCF and SGF treatments posed a risk to the model and aeroelastic instability would compromise research integrity, so aeroelastic stability assessment was required. This work briefly describes the 10% CRM-HL, design of the SCF and SGF treatments to the model, and supporting fluid structure interaction (FSI) research. Relations for static and dynamic aeroelastic similitude are then developed for convenience of reference, and simplifications are introduced of particular utility to the cases considered in this study. The similitude relations are employed to assess the stability of the treatments under wind tunnel flow conditions based upon known behaviors from the supporting research. It is shown that the treatments are safe for test under the anticipated wind tunnel flow conditions with significant margins/factors of safety. It is furthermore demonstrated that the SCF is more susceptible to aeroelastic instability than the SGF, which has implications for flight feasibility.