Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Software Safety”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 289 records · Page 16
All sourcesNASA NTRSDOE OSTI
DOE OSTI2017

Introduction of Diverse Manual Actuation Design for APR1400

APR1400 is an Advanced Light Water Reactor (ALWR) design with enhanced plant safety and advanced design features. One unit is in commercial operation and 11 are currently under construction, 4 abroad and 7 in Korea. APR1400 adopts full digitalized Man-Machine Interface System (MMIS) to perform the function of control, indication and alarming for safety and non-safety systems APR1400 MMIS is designed to operate the plant from the Main Control Room (MCR) under all anticipated operating conditions including design basis accidents. This advanced MMIS is designed to meet the latest codes, standards and regulatory requirements including the defense-in-depth and diversity requirements, which is intended to mitigate the consequence of a total failure of the digital safety system caused by a software Common Cause Failure (CCF) coupled with anyone of the Design Basis Events. The redundancy of the safety system could be defeated during this CCF condition and the protective function could be rendered inoperable.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
DOE OSTI2019

SAS4A/SASSYS-1 Verification and Validation Plan for the Versatile Test Reactor

Software verification and validation (V&V) hold an important role in the safety analysis for nuclear facilities. Codes and models utilized in calculations that demonstrate the safety basis as part of a license application or authorization must demonstrate an acceptable pedigree with regard to key critical characteristics that are comprised of the functional and performance requirements of the software. This document describes the methodology for verification and validation of the SAS4A/SASSYS-1 systems-level liquid-metal safety analysis software in support of DOE authorization of the Versatile Test Reactor (VTR). The overall goal of this V&V effort is to demonstrate the suitability of SAS4A/SASSYS-1 for evaluation of safety performance and characterization of safety margins in VTR. To that end, the V&V methodology will be used to demonstrate the adequacy of the component and physical models of SAS4A/SASSYS-1 for the corresponding VTR design elements. This methodology, which has been derived as a generalized approach to the U.S. NRC’s evaluation model development and assessment process (EMDAP) of Regulatory Guide 1.203, entails four high-level activities: software requirements identification, assessment base development, determination of acceptance, and gap closure. The methodology has been generalized to be suitable for both verification and validation of the software for the VTR project. Several high-level engineering analysis quality assurance measures as well as supporting V&V methodology documentation are also described in this document to help support demonstration of software acceptance. To support initial development of the SAS4A/SASSYS-1 V&V basis, existing verification test problems and systems benchmarks are also identified and briefly described in this document.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
NASA NTRS2017

Advanced Software V&V for Civil Aviation and Autonomy

With the advances in high-computing platform (e.g., advanced graphical processing units or multi-core processors), computationally-intensive software techniques such as the ones used in artificial intelligence or formal methods have provided us with an opportunity to further increase safety in the aviation industry. Some of these techniques have facilitated building safety at design time, like in aircraft engines or software verification and validation, and others can introduce safety benefits during operations as long as we adapt our processes. In this talk, I will present how NASA is taking advantage of these new software techniques to build in safety at design time through advanced software verification and validation, which can be applied earlier and earlier in the design life cycle and thus help also reduce the cost of aviation assurance. I will then show how run-time techniques (such as runtime assurance or data analytics) offer us a chance to catch even more complex problems, even in the face of changing and unpredictable environments. These new techniques will be extremely useful as our aviation systems become more complex and more autonomous.

software assurance↗
NASA NTRS2023

Autonomy Verification & Validation Roadmap and Vision 2045

Advanced capabilities planned for the next generation of autonomous and increasingly autonomous air vehicles will include non-traditional components based on artificial intelligence, machine learning, and complex optimization and planning algorithms. These complex components will be used to provide enhanced safety and high-level decision-making functions. However, there are serious barriers to the deployment of autonomous aircraft in the National Airspace System (NAS). Current civil aviation certification processes are based on the concept that the correct behavior of a system or a component must be completely specified and verified prior to operation. This report from the Autonomy Verification and Validation (V&V) Roadmap and Vision 2045 project presents the most recent effort to build a comprehensive list of verification challenges and needs for autonomous aircraft, a roadmap to meet those autonomy V&V needs, the services they can enable, and point to the certification gaps they fill. To accomplish these goals, we assembled a team of world-class researchers from the aerospace industry (Boeing, Collins Aerospace, and GeneralElectric) and academia (University of Michigan, University of Texas, and Massachusetts Institute of Technology) with deep expertise in autonomy, aerospace systems, and assurance of Artificial Intelligence/machine learning systems.

Software Assurance↗
NASA NTRS2017

Risk-Significant Adverse Condition Awareness Strengthens Assurance of Fault Management Systems

As spaceflight systems increase in complexity, Fault Management (FM) systems are ranked high in risk-based assessment of software criticality, emphasizing the importance of establishing highly competent domain expertise to provide assurance. Adverse conditions (ACs) and specific vulnerabilities encountered by safety- and mission-critical software systems have been identified through efforts to reduce the risk posture of software-intensive NASA missions. Acknowledgement of potential off-nominal conditions and analysis to determine software system resiliency are important aspects of hazard analysis and FM. A key component of assuring FM is an assessment of how well software addresses susceptibility to failure through consideration of ACs. Focus on significant risk predicted through experienced analysis conducted at the NASA Independent Verification Validation (IVV) Program enables the scoping of effective assurance strategies with regard to overall asset protection of complex spaceflight as well as ground systems. Research efforts sponsored by NASA's Office of Safety and Mission Assurance defined terminology, categorized data fields, and designed a baseline repository that centralizes and compiles a comprehensive listing of ACs and correlated data relevant across many NASA missions. This prototype tool helps projects improve analysis by tracking ACs and allowing queries based on project, mission type, domaincomponent, causal fault, and other key characteristics. Vulnerability in off-nominal situations, architectural design weaknesses, and unexpected or undesirable system behaviors in reaction to faults are curtailed with the awareness of ACs and risk-significant scenarios modeled for analysts through this database. Integration within the Enterprise Architecture at NASA IVV enables interfacing with other tools and datasets, technical support, and accessibility across the Agency. This paper discusses the development of an improved workflow process utilizing this database for adaptive, risk-informed FM assurance that critical software systems will safely and securely protect against faults and respond to ACs in order to achieve successful missions.

Fault management↗
NASA NTRS2017

Risk-Significant Adverse Condition Awareness Strengthens Assurance of Fault Management Systems

As spaceflight systems increase in complexity, Fault Management (FM) systems are ranked high in risk-based assessment of software criticality, emphasizing the importance of establishing highly competent domain expertise to provide assurance. Adverse conditions (ACs) and specific vulnerabilities encountered by safety- and mission-critical software systems have been identified through efforts to reduce the risk posture of software-intensive NASA missions. Acknowledgement of potential off-nominal conditions and analysis to determine software system resiliency are important aspects of hazard analysis and FM. A key component of assuring FM is an assessment of how well software addresses susceptibility to failure through consideration of ACs. Focus on significant risk predicted through experienced analysis conducted at the NASA Independent Verification & Validation (IV&V) Program enables the scoping of effective assurance strategies with regard to overall asset protection of complex spaceflight as well as ground systems. Research efforts sponsored by NASAs Office of Safety and Mission Assurance (OSMA) defined terminology, categorized data fields, and designed a baseline repository that centralizes and compiles a comprehensive listing of ACs and correlated data relevant across many NASA missions. This prototype tool helps projects improve analysis by tracking ACs and allowing queries based on project, mission type, domain/component, causal fault, and other key characteristics. Vulnerability in off-nominal situations, architectural design weaknesses, and unexpected or undesirable system behaviors in reaction to faults are curtailed with the awareness of ACs and risk-significant scenarios modeled for analysts through this database. Integration within the Enterprise Architecture at NASA IV&V enables interfacing with other tools and datasets, technical support, and accessibility across the Agency. This paper discusses the development of an improved workflow process utilizing this database for adaptive, risk-informed FM assurance that critical software systems will safely and securely protect against faults and respond to ACs in order to achieve successful missions.

IV&V↗
DOE OSTI2024

Shifting institutional culture to develop climate solutions with Open Science

To address our climate emergency, “we must rapidly, radically reshape society”—Johnson & Wilkinson, All We Can Save. In science, reshaping requires formidable technical (cloud, coding, reproducibility) and cultural shifts (mindsets, hybrid collaboration, inclusion). We are a group of cross-government and academic scientists that are exploring better ways of working and not being too entrenched in our bureaucracies to do better science, support colleagues, and change the culture at our organizations. We share much-needed success stories and action for what we can all do to reshape science as part of the Open Science movement and 2023 Year of Open Science.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2015

SU-E-T-776: Use of Quality Metrics for a New Hypo-Fractionated Pre-Surgical Mesothelioma Protocol

Purpose: The “SMART” (Surgery for Mesothelioma After Radiation Therapy) approach involves hypo-fractionated radiotherapy of the lung pleura to 25Gy over 5 days followed by surgical resection within 7. Early clinical results suggest that this approach is very promising, but also logistically challenging due to the multidisciplinary involvement. Due to the compressed schedule, high dose, and shortened planning time, the delivery of the planned doses were monitored for safety with quality metric software. Methods: Hypo-fractionated IMRT treatment plans were developed for all patients and exported to Quality Reports™ software. Plan quality metrics or PQMs™ were created to calculate an objective scoring function for each plan. This allows for an objective assessment of the quality of the plan and a benchmark for plan improvement for subsequent patients. The priorities of various components were incorporated based on similar hypo-fractionated protocols such as lung SBRT treatments. Results: Five patients have been treated at our institution using this approach. The plans were developed, QA performed, and ready within 5 days of simulation. Plan Quality metrics utilized in scoring included doses to OAR and target coverage. All patients tolerated treatment well and proceeded to surgery as scheduled. Reported toxicity included grade 1 nausea (n=1), grade 1 esophagitis (n=1), grade 2 fatigue (n=3). One patient had recurrent fluid accumulation following surgery. No patients experienced any pulmonary toxicity prior to surgery. Conclusion: An accelerated course of pre-operative high dose radiation for mesothelioma is an innovative and promising new protocol. Without historical data, one must proceed cautiously and monitor the data carefully. The development of quality metrics and scoring functions for these treatments allows us to benchmark our plans and monitor improvement. If subsequent toxicities occur, these will be easy to investigate and incorporate into the metrics. This will improve the safe delivery of large doses for these patients.

60 APPLIED LIFE SCIENCES↗
DOE OSTI2016

Final report on the MAGARC software consulting support contract (WFO No. 15904) for ITER magnet safety assessment

he ITER (not an acronym but Latin for "the Way”) International Organization (IO) is building a large-scale scientific experiment that is now under construction in Cadarache, France. The ITER Tokamak fusion reactor aims to demonstrate that it is possible to produce energy from fusion. The ITER’s power output goal is to deliver ten times the power it consumes. During its operational lifetime, ITER will test key technologies necessary for the next step: the demonstration fusion power plant that will prove that it is possible to capture fusion energy for commercial use. General information on the ITER project can be found at http://www.iter.org. The ITER reactor’s superconducting magnet systems create ~41GJ of stored magnetic field energy when fully energized. The consequences of such energy dissipating via electrical arcs under faulted conditions gives rise to safety concerns even though these fault events are extremely unlikely. As part of the ITER licensing procedure, and as a result of such safety concerns, this contract was established to benchmark a developing magnet safety analysis tool at Culham Centre for Fusion Energy against the MAGARC computer code. MAGARC was developed by the U.S. Idaho National Laboratory (INL) under the ITER Engineering Design Activity (EDA) Project and was applied to produce previous analyses, in order to support magnet fault and safety assessment for the ITER design description document. This contract report documents the completion of requested modifications to the MAGARC code by the ITER IO, a time-step size sensitivity analysis with MAGARC during an unmitigated quench event, a comparison of the modeling approaches taken in developing MAGARC and the CCFE analysis package, and the data required for the benchmarking activity for these codes.

70 PLASMA PHYSICS AND FUSION TECHNOLOGY↗
DOE OSTI2024

Self-Aware Local Autonomous and Semi-Cooperative Control for Cross-Layered Resilience (SLAC3R)

The objective of this work is to develop and demonstrate novel, adaptive, lightweight algorithms that enable the decision-making agents in a large cyber-physical network to act both autonomously and in collaborative harmony to enforce assured resilience across spatiotemporal layers, even under unforeseen adversarial scenarios (e.g., high- impact-low-probability events). Towards this end, the proposed solution will serve as minimally invasive add-on layers that bridge the existing (faster, reactive) local myopic controls and (slower, predictive) centralized optimization. Importantly, the proposed algorithms will enable the multi-agent network to autonomously and collaboratively enforce resilient operation under no or limited communication environment typical of severe cyber- physical adversarial events. The expected outcome of this effort is a suite of prototype, open-source, software algorithms for safety-aware local autonomous and semi-cooperative control (SLAC3R), demonstrated on networked microgrids (via RD2C/Thrust-1 OPAL-RT testbed).

97 MATHEMATICS AND COMPUTING↗
NASA NTRS1997

Formal Methods of V&V of Partial Specifications: An Experience Report

This paper describes our work exploring the suitability of formal specification methods for independent verification and validation (IV&V) of software specifications for large, safety critical systems. An IV&V contractor often has to perform rapid analysis on incomplete specifications, with no control over how those specifications are represented. Lightweight formal methods show significant promise in this context, as they offer a way of uncovering major errors, without the burden of full proofs of correctness. We describe an experiment in the application of the method SCR. to testing for consistency properties of a partial model of requirements for Fault Detection Isolation and Recovery on the space station. We conclude that the insights gained from formalizing a specification is valuable, and it is the process of formalization, rather than the end product that is important. It was only necessary to build enough of the formal model to test the properties in which we were interested. Maintenance of fidelity between multiple representations of the same requirements (as they evolve) is still a problem, and deserves further study.

Easterbrook, Steve↗
NASA NTRS1997

Formal Methods for Verification and Validation of Partial Specifications: A Case Study

This paper describes our work exploring the suitability of formal specification methods for independent verification and validation (IV&V) of software specifications for large, safety critical systems. An IV&V contractor often has to perform rapid analysis on incomplete specifications, with no control over how those specifications are represented. Lightweight formal methods show significant promise in this context, as they offer a way of uncovering major errors, without the burden of full proofs of correctness. We describe a case study of the use of partial formal models for V&V of the requirements for Fault Detection Isolation and Recovery on the space station. We conclude that the insights gained from formalizing a specification are valuable, and it is the process of formalization, rather than the end product that is important. It was only necessary to build enough of the formal model to test the properties in which we were interested. Maintenance of fidelity between multiple representations of the same requirements (as they evolve) is still a problem, and deserves further study.

Easterbrook, Steve↗
NASA NTRS1999

Practical Issues in Implementing Software Reliability Measurement

Many ways of estimating software systems' reliability, or reliability-related quantities, have been developed over the past several years. Of particular interest are methods that can be used to estimate a software system's fault content prior to test, or to discriminate between components that are fault-prone and those that are not. The results of these methods can be used to: 1) More accurately focus scarce fault identification resources on those portions of a software system most in need of it. 2) Estimate and forecast the risk of exposure to residual faults in a software system during operation, and develop risk and safety criteria to guide the release of a software system to fielded use. 3) Estimate the efficiency of test suites in detecting residual faults. 4) Estimate the stability of the software maintenance process.

Nikora, Allen P.↗
NASA NTRS2001

A Cognitive Engineering Analysis of the Vertical Navigation (VNAV) Function

A cognitive engineering analysis of the Flight Management System (FMS) Vertical Navigation (VNAV) function has identified overloading of the VNAV button and overloading of the Flight Mode Annunciator (FMA) used by the VNAV function. These two types of overloading, resulting in modal input devices and ambiguous feedback, are well known sources of operator confusion, and explain, in part, the operational issues experienced by airline pilots using VNAV in descent and approach. A proposal to modify the existing VNAV design to eliminate the overloading is discussed. The proposed design improves pilot's situational awareness of the VNAV function, and potentially reduces the cost of software development and improves safety.

Sherry, Lance↗
NASA NTRS2003

Distributed and Centralized Conflict Management Under Traffic Flow Management Constraints

Current air transportation in the United States relies on a system born half a century ago. While demand for air travel has kept increasing over the years, technologies at the heart of the National Airspace System (NAS) have not been able to follow an adequate evolution. For instance, computers used to centralize flight data in airspace sectors run a software developed in 1972. Safety, as well as certification and portability issues arise as major obstacles for the improvement of the system. The NAS is a structure that has never been designed, but has rather evolved over time. This has many drawbacks, mainly due to a lack of integration and engineering leading to many inefficiencies and losses of performance. To improve the operations, understanding of this complex needs to be built up to a certain level. This work presents research done on Air Traffic Management (ATM) at the level of the en-route sector.

Feron, Eric↗
NASA NTRS2004

From Bridges and Rockets, Lessons for Software Systems

Although differences exist between building software systems and building physical structures such as bridges and rockets, enough similarities exist that software engineers can learn lessons from failures in traditional engineering disciplines. This paper draws lessons from two well-known failures the collapse of the Tacoma Narrows Bridge in 1940 and the destruction of the space shuttle Challenger in 1986 and applies these lessons to software system development. The following specific applications are made: (1) the verification and validation of a software system should not be based on a single method, or a single style of methods; (2) the tendency to embrace the latest fad should be overcome; and (3) the introduction of software control into safety-critical systems should be done cautiously.

Holloway, C. Michael↗
NASA NTRS2008

Generating Safety-Critical PLC Code From a High-Level Application Software Specification

The benefits of automatic-application code generation are widely accepted within the software engineering community. These benefits include raised abstraction level of application programming, shorter product development time, lower maintenance costs, and increased code quality and consistency. Surprisingly, code generation concepts have not yet found wide acceptance and use in the field of programmable logic controller (PLC) software development. Software engineers at Kennedy Space Center recognized the need for PLC code generation while developing the new ground checkout and launch processing system, called the Launch Control System (LCS). Engineers developed a process and a prototype software tool that automatically translates a high-level representation or specification of application software into ladder logic that executes on a PLC. All the computer hardware in the LCS is planned to be commercial off the shelf (COTS), including industrial controllers or PLCs that are connected to the sensors and end items out in the field. Most of the software in LCS is also planned to be COTS, with only small adapter software modules that must be developed in order to interface between the various COTS software products. A domain-specific language (DSL) is a programming language designed to perform tasks and to solve problems in a particular domain, such as ground processing of launch vehicles. The LCS engineers created a DSL for developing test sequences of ground checkout and launch operations of future launch vehicle and spacecraft elements, and they are developing a tabular specification format that uses the DSL keywords and functions familiar to the ground and flight system users. The tabular specification format, or tabular spec, allows most ground and flight system users to document how the application software is intended to function and requires little or no software programming knowledge or experience. A small sample from a prototype tabular spec application is shown.

Source record↗
NASA NTRS2010

ISS Solar Array Management

The International Space Station (ISS) Solar Array Management (SAM) software toolset provides the capabilities necessary to operate a spacecraft with complex solar array constraints. It monitors spacecraft telemetry and provides interpretations of solar array constraint data in an intuitive manner. The toolset provides extensive situational awareness to ensure mission success by analyzing power generation needs, array motion constraints, and structural loading situations. The software suite consists of several components including samCS (constraint set selector), samShadyTimers (array shadowing timers), samWin (visualization GUI), samLock (array motion constraint computation), and samJet (attitude control system configuration selector). It provides high availability and uptime for extended and continuous mission support. It is able to support two-degrees-of-freedom (DOF) array positioning and supports up to ten simultaneous constraints with intuitive 1D and 2D decision support visualizations of constraint data. Display synchronization is enabled across a networked control center and multiple methods for constraint data interpolation are supported. Use of this software toolset increases flight safety, reduces mission support effort, optimizes solar array operation for achieving mission goals, and has run for weeks at a time without issues. The SAM toolset is currently used in ISS real-time mission operations.

Williams, James P.↗