Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “risk informed design”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 325 records · Page 18

Cyber100 Compass [SWR 23-64]

Cyber100 Compass ("Compass") is a unique risk assessment framework that will enable grid system planners to understand and mitigate cybersecurity risk for grids transitioning to high levels of renewable generation, including 100%. The idea for Compass was developed by NREL based on past work on high-renewable grids and a series of discussions with DOE. Compass is part of Cyber100, a portfolio of proposed research activities that would greatly expand understanding of cybersecurity for high-renewable grids. Compass is a desktop application designed with a user-friendly interface. The tool gathers information from users, conducts probabilistic backend calculations, and outputs a series of visualizations to help users understand and analyze their cybersecurity risks based on the unique features of their future grid. Compass will take as inputs the values for different conditions and produce a risk score of the resulting grid. By trying different configurations, system planners can compare the resultant risks against their own risk tolerance and decide which system-of-system controls to implement as they transition toward a 100% renewable grid.

Martin, Maurice↗

Quantitative Risk Analysis of High Safety Significant Safety-related Digital Instrumentation and Control Systems in Nuclear Power Plants using IRADIC Technology

This report documents the activities performed by Idaho National Laboratory (INL) during fiscal year (FY) 2021 for the U.S. Department of Energy (DOE) Light Water Reactor Sustainability (LWRS) Program, Risk Informed Systems Analysis (RISA) Pathway, digital instrumentation and control (DI&C) Risk Assessment project. In FY-2019, the RISA Pathway initiated a project to develop a risk assessment strategy for delivering a strong technical basis to support effective, licensable, and secure DI&C technologies for digital upgrades/designs. An integrated risk assessment technology for the DI&C systems (IRADIC technology) was proposed for this strategy, which aims to (1) provide a best-estimate risk-informed capability to quantitatively and accurately estimate the safety margin obtained from plant modernization, especially for the High Safety Significant Safety-related (HSSSR) DI&C systems, (2) develop an advanced risk assessment technology to support transition from analog to DI&C technologies for nuclear industry, (3) assure the long-term safety and reliability of vital HSSSR DI&C systems, (4) reduce uncertainty in costs and support integration of DI&C systems in the plant. To achieve these technical goals and deal with the expensive licensing justifications from regulatory insights, the IRADIC technology is instructive for nuclear vendors and utilities to effectively lower the costs associated with digital compliance and speed industry advances by: (1) defining an integrated risk-informed analysis process for DI&C upgrade, including hazard analysis, reliability analysis, and consequence analysis, (2) applying systematic and risk-informed tools to address common cause failures (CCFs) and quantify responding failure probabilities for DI&C technologies, particularly software CCFs, (3) evaluating the impact of digital failures at the individual level, system level, and plant level, (4) providing insights and suggestions on designs to manage the risks; thus, to support the development, licensing, and deployment of advanced DI&C technologies on nuclear power plant (NPPs). In this report, an approach for performing software CCF analysis, given limited data, is developed and demonstrated using a case study of a highly redundant digital reactor trip system. Consequence analysis is also performed based on different accident scenarios. Results indicate that plant modernization including the improvement of HSSSR DI&C systems will make great benefits to plant safety by providing more safety margins to accident management. In addition, a novel approach is proposed in this report for the quantification of software hazards when sufficient operational and testing data available. The method incorporates software development quality as well as strong analysis techniques to identify and link software defects to potential failure modes. The approach includes both semantic and test-based analysis to detect failures that can exist in different stages of the software development life cycle. This method is applied to an advanced human system interface relevant to reactor trip safety developed from the APR 1400 design.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

Technical Resilience Navigator

The Technical Resilience Navigator (TRN) is a systematic approach to identifying vulnerabilities with energy and water systems, and prioritizing solutions that reduce risk. The ultimate outcome of the TRN is a set of actionable resilience solutions that address the site's most important gaps in resilience and enhance the ability to maintain mission continuity. The TRN is designed to step users through this planning process, providing a framework to: assign roles and responsibilities; collect and document information and data; document key inputs and outputs for each of the TRN modules (Site Level Planning, Baseline Development, Risk Assessment, Solution Development, and Solution Prioritization); document prioritized list of resilience solutions; and track progress through the entire process. Currently "software as a service" at the listed website.

Rotondo, Julia↗

Sensitivity Analysis of the Bone Fracture Risk Model

Introduction: The probability of bone fracture during and after spaceflight is quantified to aid in mission planning, to determine required astronaut fitness standards and training requirements and to inform countermeasure research and design. Probability is quantified with a probabilistic modeling approach where distributions of model parameter values, instead of single deterministic values, capture the parameter variability within the astronaut population and fracture predictions are probability distributions with a mean value and an associated uncertainty. Because of this uncertainty, the model in its current state cannot discern an effect of countermeasures on fracture probability, for example between use and non-use of bisphosphonates or between spaceflight exercise performed with the Advanced Resistive Exercise Device (ARED) or on devices prior to installation of ARED on the International Space Station. This is thought to be due to the inability to measure key contributors to bone strength, for example, geometry and volumetric distributions of bone mass, with areal bone mineral density (BMD) measurement techniques. To further the applicability of model, we performed a parameter sensitivity study aimed at identifying those parameter uncertainties that most effect the model forecasts in order to determine what areas of the model needed enhancements for reducing uncertainty. Methods: The bone fracture risk model (BFxRM), originally published in (Nelson et al) is a probabilistic model that can assess the risk of astronaut bone fracture. This is accomplished by utilizing biomechanical models to assess the applied loads; utilizing models of spaceflight BMD loss in at-risk skeletal locations; quantifying bone strength through a relationship between areal BMD and bone failure load; and relating fracture risk index (FRI), the ratio of applied load to bone strength, to fracture probability. There are many factors associated with these calculations including environmental factors, factors associated with the fall event, mass and anthropometric values of the astronaut, BMD characteristics, characteristics of the relationship between BMD and bone strength and bone fracture characteristics. The uncertainty in these factors is captured through the use of parameter distributions and the fracture predictions are probability distributions with a mean value and an associated uncertainty. To determine parameter sensitivity, a correlation coefficient is found between the sample set of each model parameter and the calculated fracture probabilities. Each parameters contribution to the variance is found by squaring the correlation coefficients, dividing by the sum of the squared correlation coefficients, and multiplying by 100. Results: Sensitivity analyses of BFxRM simulations of preflight, 0 days post-flight and 365 days post-flight falls onto the hip revealed a subset of the twelve factors within the model which cause the most variation in the fracture predictions. These factors include the spring constant used in the hip biomechanical model, the midpoint FRI parameter within the equation used to convert FRI to fracture probability and preflight BMD values. Future work: Plans are underway to update the BFxRM by incorporating bone strength information from finite element models (FEM) into the bone strength portion of the BFxRM. Also, FEM bone strength information along with fracture outcome data will be incorporated into the FRI to fracture probability.

mathematical models↗

Risk Assessment System

FEAT, a software system for evaluating risks, was developed by Lockheed and later enhanced under NASA funding. FEAT uses directed graph - or digraph - models to provide information on cause and effect if a set of failure events occurs. James Miller, the program designer at Lockheed, formed DiGraphics, Inc. to market the software that has evolved from FEAT. The Diquest Analyzer, the company's flagship product, assists product designers in identifying the redundancies and weaknesses of a system. The software has applications in the chemical industry for risk assessment, design evaluation, and change management. Additional markets have been found in operations monitoring diagnostics and training of new personnel.

Source record↗

Statistical Considerations for the Design and Execution of NASA's Community Noise Surveys

The World Health Organization defines community noise as noise emitted from all sources apart from noise at an industrial workplace. Example sources include neighborhood and construction noise, noise from road and rail, and air traffic noise. In particular, overland supersonic flights have been banned in the United States since the 1970s based on data accumulated during the 1960s; the degree of reported annoyance from the resulting sonic booms was a key factor leading to the prohibition. In subsequent years, scientific and engineering understanding has led to the potential to produce low amplitude sonic booms, or ‘sonic thumps’, during supersonic flight through aircraft design choices. Aircraft manufacturers have expressed renewed interest in producing supersonic commercial aircraft, but without appropriate changes to regulation, only overseas routes can be traveled supersonically. The National Aeronautics and Space Administration (NASA) will be flying the X-59 demonstrator aircraft in a series of community tests to begin in the 2024 fiscal year. In this presentation we provide some historical context for the current prohibitions on supersonic commercial flight. Using data collected during earlier NASA risk reduction tests, we demonstrate how generalized linear mixed models can be used to inform the functional dose-response response curve. Finally, we discuss some of the challenges in designing the future community studies and generalizing them to a nationally-representative dose-response curve. The study effort will be of national and international importance as the data and models prepared during the community tests will be provided to the International Civil Aviation Organization (ICAO) in order to help noise regulators determine if supersonic flight will be permitted over land once again and at what demonstrable noise levels.

Nathan B Cruze↗

Tools And Methods to Analyze Plant Outage Schedule and Assist Schedulers in Improving Outage Resilience

Refueling outages of nuclear power plants (NPPs) are considered one of the most critical phases throughout the plant lifetime. In such instances, tens of thousands of activities (e.g., maintenance, surveillance) are performed in a short amount of time (typically 2-3 weeks unless major backfitting or modernization projects are carried out) by a large number of crews (e.g., electricians, mechanics) that are hired as contractors. As a consequence, a plant outage can be expensive not only in terms of costs (e.g., contractor labor, material), but also in terms of loss generation since the plant is taken off the grid during the full outage duration (an indicative metric is about 1.2M$/day of loss of revenue). Thus, there is a continuous need to decrease the economic impact of outages on plant finances. This can be done by: decreasing the frequency of plant outages (e.g., from 18 to 24 months), reducing the time to complete the outage, and reducing the risk of outage delays. The Optimization of Outage Activities project under the Risk Informed Systems Analysis Pathway (RISA) sponsored by Department of Energy (DOE) Light Water Reactor Sustainability (LWRS) Program focuses on developing tools and methods to support NPPs with outage schedule optimization. The developed tools and methods are designed to analyze plant outage schedule with the goal of identify critical elements in the schedule that might pose a high risk of delays. These methods and tools can be considered resource-centric in the sense that they address outage challenges as a resource optimization problem. In this context, resources are either time and crews; outage delays occurs when either (or both) resources are insufficient to complete the set of tasks assigned at a specific time instant of the outage. This report provides details on how plant resources (time and crews) can be allocated in such a way that delays are minimized. In this respect, two classes of methods have been developed: the first one focuses on the time resource and how variability of the time to complete outage tasks may impact outage delays. The second one integrates available resources to assess when dailies activities should be performed such that the risk of outage delays are minimized.

97 MATHEMATICS AND COMPUTING↗

Validating the Autonomous Science Agent

This paper describes the validation process for the Autonomous Science Agent, a software agent that will fly onboard the EO-1 spacecraft from 2003-2004. This agent will recognize science events, retarget the spacecraft to respond to the science events, and reduce data downlink to only the highest value science data. The autonomous science agent has been designed using a layered architectural approach with specific redundant safeguards to reduce the risk of an agent malfunction to the EO-1 spacecraft. This 'safe' design is also in the process of being thoroughly validated by informal validation methods and extensive testing. This paper describes the analysis used to define agent safety, elements of the design that increase the safety of the agent, and the process being used to validate agent safety prior to the agent software controlling the spacecraft.

agent safety↗

NASA Space Radiation Protection Strategies: Risk Assessment and Permissible Exposure Limits

Permissible exposure limits (PELs) for short-term and career astronaut exposures to space radiation have been set and approved by NASA with the goal of protecting astronauts against health risks associated with ionizing radiation exposure. Short term PELs are intended to prevent clinically significant deterministic health effects, including performance decrements, which could threaten astronaut health and jeopardize mission success. Career PELs are implemented to control late occurring health effects, including a 3% risk of exposure induced death (REID) from cancer, and dose limits are used to prevent cardiovascular and central nervous system diseases. For radiation protection, meeting the cancer PEL is currently the design driver for galactic cosmic ray and solar particle event shielding, mission duration, and crew certification (e.g., 1-year ISS missions). The risk of cancer development is the largest known long-term health consequence following radiation exposure, and current estimates for long-term health risks due to cardiovascular diseases are approximately 30% to 40% of the cancer risk for exposures above an estimated threshold (Deep Space one-year and Mars missions). Large uncertainties currently exist in estimating the health risks of space radiation exposure. Improved understanding through radiobiology and physics research allows increased accuracy in risk estimation and is essential for ensuring astronaut health as well as for controlling mission costs, optimization of mission operations, vehicle design, and countermeasure assessment. We will review the Space Radiation Program Element's research strategies to increase accuracy in risk models and to inform development and validation of the permissible exposure limits.

Huff, J. L.↗

1.2.4.404 - Data-Driven Approach for Hydropower Plant Controller Prototyping Using Remote Hardware in the Loop (DR-HIL)

Real-time prototyping of hydropower plant controls is important for reducing the cost and the risk of field deployment. This project will 1) collect design and operational data from actual hydro plants and 2) use a physics-informed machine learning approach for real-time emulation of hydropower plants, including hydro turbine and hydrodynamics. The data-driven models will be interfaced with digital real-time simulation at NREL’s Flatirons campus for hardware-in-the-loop (HIL) testing of the governor hardware device or controller-HIL (CHIL). The proposed approach will also establish the connectivity based remote CHIL testing capability using real-time data streams from an actual hydro plant. This integrated hydro-plant emulation with CHIL will be used to prototype hydro-governor controls and eventually provide an opportunity to test hydropower integrated with various technologies (e.g. conventional and renewable generation, energy conversion, etc.) as HIL.

controls prototyping↗

PSA 2025 DPRA for Cyber Optimization

Cyberattacks can have many different attack paths, durations, and goals. There are also many different mitigation options involving hardware, software, and/or humans. Evaluating defense options should include quantitative evaluation of overall effectiveness to make cost and risk-informed decisions. Typical cyberattack modeling methods only provide a qualitative evaluation and have difficulty with time dependent scenarios. The main areas of cybersecurity are confidentiality, integrity, and availability. For companies with cyber-physical systems such as advanced nuclear reactors, cyber-related integrity is a requirement set by the U.S. Nuclear Regulatory Commission. But companies are also concerned about availability or reliability as a business case. As cyber threats are evolving to a business-for-hire structure, more attacks focus on disrupting business success and reliability, causing financial and economic stability risk. Companies want reliability analysis while optimizing cost, which requires more than safety modeling methods. Dynamic-state-based and Markov-based modeling provides a method for better cyber scenario modeling with timing and conditional features not found in other numerical evaluation methods. EMRALD (Event Modeling Risk Assessment using Lined Diagrams) is a dynamic risk analysis modeling and simulation tool and has features that reduce modeling issues such as state-base explosion found in Markov-based tools. It has been used to model different time-dependent events including plant behavior and operator procedures. As a general modeling tool, EMRALD can also be used to model cyberattack scenarios with varying mitigation options and quantify effectiveness, producing numerical data for risk-informed decisions. This paper uses EMRALD to demonstrate that dynamic risk analysis can be used for cyber threat modeling to provide insights for design decision-making and optimize defense strategies.

97 - MATHEMATICS AND COMPUTING↗

UKy-CAER Heat Integrated Transformative CO 2 Capture Process in Pulverized Coal Power Plants

The goal of this Phase II Topical Report is to summarize the work for public domain conducted on project DE-FE0031583. Building upon the Design Basis completed during Phase I and in accordance with the Statement of Project Objectives (SOPO), the University of Kentucky (UK) Center for Applied Energy Research (CAER) (Recipient) along with team members has completed the Front End Engineering Design (FEED) for its advanced, versatile post-combustion CO 2 capture system (CCS) at the 10 MWe large pilot scale to be installed at the Wyoming (WY) Integrated Test Center (ITC), using a heat integrated process with split-rich fed, two-stage stripping and any advanced solvent to enhance the CO 2 absorber performance and lower the cost of CO 2 capture. The proposed project (Phases I-III) involves the design, fabrication, installation, testing and evaluation of a large pilot scale facility that will demonstrate the UK CAER transformative CCS integrated with an operating power plant. The work performed in Phase I, detailed in the Phase I Topical Report that was submitted in March 2019, included formation of a project team, securing the host site, and completing pre-FEED design basis, a cost estimation, a preliminary techno-economic analysis (TEA) and an environmental information volume (EIV). The work performed in Phase II, detailed in this Phase II Topical Report, includes completion of FEEDs, completion of a process risk analysis (PRA), obtaining necessary permits, updating the EIV and TEA, updating the cost and schedule estimate for the Phase III scope of work (SOW) and securing the necessary cost share. Updated information is provided on the current status of the UK CAER CCS technology and the project is ready to begin immediately detailed design, construction and operation of the proposed pilot.

20 FOSSIL-FUELED POWER PLANTS↗

Preliminary Analysis of Separation Standards for Urban Air Mobility using Unmitigated Fast-Time Simulation

This research provides a preliminary analysis of various separation standards for Urban Air Mobility (UAM) operations. This study focuses on understanding and analyzing potential conflicts between UAM flights and conflicts between UAM and conventional aircraft. Fast-time simulations are conducted with a projected high-density of UAM traffic scenario and historical conventional non-UAM traffic flying under Instrument Flight Rules (IFR) or Visual Flight Rules (VFR) in Dallas Fort Worth (DFW) airspace. The conflicts are analyzed by examining losses of separation and near mid-air collisions of UAM flights and unmitigated risk of collision. A set of varied separation standards are used to investigate the impact of the new UAM operations on safety. The preliminary conflict analysis results will help inform separation standards development and in airspace and route design activities for future UAM operations.

Urban air mobility↗

The Design and Evaluation of Zero Trust Architecture for Electric Vehicle Charging Infrastructure: EVs @ Scale Series on EV Charging Station Cybersecurity

Implementing a zero trust architecture can significantly bolster the security of electric vehicle (EV) charging infrastructure. EV charging infrastructure includes numerous networked interfaces, each of which can present potential vulnerabilities. When these vulnerabilities are exploited, they can compromise the entire system, leading to severe operational and security risks. Zero trust is a security model that operates on the principle of "never trust, always verify," which helps manage the attack surface and limit the scope of any potential compromises. Fundamentally, this model ensures that no entity, whether inside or outside the network, is trusted by default. The design principles of zero trust include continuous verification, strict deny-by-default access controls, and micro-segmentation. Continuous verification ensures that every request is thoroughly checked, regardless of its origin. Strict access controls enforce the principle of least privilege, allowing users and devices only the minimum necessary access to perform their functions. Micro-segmentation involves dividing the network into smaller, isolated segments to prevent lateral movement in case of a breach. In the context of EV charging infrastructure, zero trust can be implemented through various strategies. For example, multi-factor authentication (MFA) can be required for engineers to access the management interfaces and control systems of charging stations. Real-time monitoring and analysis of network traffic can help detect and respond to anomalies. Systems that do not need to communicate with each other can be micro-segmented to enhance security. All communications should adhere to predefined policies to be permitted. Additionally, encrypting communications can protect sensitive information exchanged between chargers and management systems. This paper presents a zero trust architecture specifically designed for EV charging infrastructure. Implementing zero trust not only mitigates risks but also builds a resilient infrastructure capable of withstanding and quickly recovering from cyber threats. The architecture addresses six defined security objectives. A comprehensive test plan is developed to assess the architecture against these objectives, and the results of the evaluation are reported. This approach is essential for maintaining the reliability and integrity of EV charging services in an increasingly interconnected and vulnerable digital landscape. This is the first in a planned series of papers exploring the implementation of zero trust in EV charging infrastructure. Each paper will delve into different aspects and applications of zero trust, highlighting how various work processes and requirements can lead to distinct architectural designs. These architectures will be tailored to address specific security challenges and operational needs within the EV charging ecosystem, ensuring a robust and adaptable security framework.

33 ADVANCED PROPULSION SYSTEMS↗

NASA CARA Prelaunch Analysis and Process

NASA implemented an official Procedural Requirement (NPR) 8079.1 in June 2023, establishing the minimum collision avoidance requirements and associated operational protocols for NASA space flight programs, projects, and spacecraft to protect the space environment by reducing the risk of collision to an acceptable level. Part of the requirement employs a two-fold approach to analyze the satellite design process with conjunction assessment and risk mitigation in mind, during the pre-launch process, led by the Conjunction Assessment Risk Analysis (CARA) Program for non-Human Space Flight (HSF) Missions. This presentation outlines CARA coordination with missions, informed by the NPR, that spans early mission development to operations. CARA is an Agency-level resource that provides support to all NASA non-HSF missions. CARA protects the orbital environment from collision between NASA non-HSF missions and other tracked on-orbit objects. During the pre-formulation and formulation phases, NASA missions undergo a series of conjunction assessment analyses captured in the Orbital Collision Avoidance Plan (OCAP) prior to transitioning to the implementation phase (typically at the Preliminary Design Review (PDR) or equivalent). The OCAP analyses consist of a thorough review of the spacecraft(s) orbit selection and placement, deployment, cataloguing performance, trackability, ephemeris generation, conjunction mitigation options, autonomous maneuvering, and risk assessment parameters which are performed by a dedicated CARA Analysis Team. The results of these analyses, CARA’s formal recommendations, and the mission’s methods for implementing them, are documented in the OCAP. The intent of engaging in this process so early in the mission design phase, is to ensure that conjunction assessment is considered from the outset, thus mitigating costly design changes and operational risks down the road. NASA missions are also required to coordinate their operational processes and conjunction mitigation procedures with CARA in a Conjunction Assessment Operations Implementation Agreement (CAOIA). The aim of this process is to document the conjunction assessment screening process, conjunction risk assessment parameters, conjunction mitigation steps, flight dynamics operations concepts and maneuvers, and the communication and coordination process between the mission’s project manager and CARA. The intent of the CAOIA document is for it to be completed iteratively, and as missions update these elements, corresponding changes are made in the CAOIA. With this process in place, the engagement and coordination between the missions and CARA from early in the design process into mission operations, helps to ensure that missions not only have a robust conjunction assessment concept of operations to reduce conjunction risk for space sustainability, but are also able to achieve their science goals and have a successful mission.

conjunction assessment↗

NASA CARA Prelaunch Analysis and Process

NASA implemented an official Procedural Requirement (NPR) 8079.1 in June 2023, establishing the minimum collision avoidance requirements and associated operational protocols for NASA space flight programs, projects, and spacecraft to protect the space environment by reducing the risk of collision to an acceptable level. Part of the requirement employs a two-fold approach to analyze the satellite design process with conjunction assessment and risk mitigation in mind, during the pre-launch process, led by the Conjunction Assessment Risk Analysis (CARA) Program for non-Human Space Flight (HSF) Missions. This presentation outlines CARA coordination with missions, informed by the NPR, that spans early mission development to operations. CARA is an Agency-level resource that provides support to all NASA non-HSF missions. CARA protects the orbital environment from collision between NASA non-HSF missions and other tracked on-orbit objects. During the pre-formulation and formulation phases, NASA missions undergo a series of conjunction assessment analyses captured in the Orbital Collision Avoidance Plan (OCAP) prior to transitioning to the implementation phase (typically at the Preliminary Design Review (PDR) or equivalent). The OCAP analyses consist of a thorough review of the spacecraft(s) orbit selection and placement, deployment, cataloguing performance, trackability, ephemeris generation, conjunction mitigation options, autonomous maneuvering, and risk assessment parameters which are performed by a dedicated CARA Analysis Team. The results of these analyses, CARA’s formal recommendations, and the mission’s methods for implementing them, are documented in the OCAP. The intent of engaging in this process so early in the mission design phase, is to ensure that conjunction assessment is considered from the outset, thus mitigating costly design changes and operational risks down the road. NASA missions are also required to coordinate their operational processes and conjunction mitigation procedures with CARA in a Conjunction Assessment Operations Implementation Agreement (CAOIA). The aim of this process is to document the conjunction assessment screening process, conjunction risk assessment parameters, conjunction mitigation steps, flight dynamics operations concepts and maneuvers, and the communication and coordination process between the mission’s project manager and CARA. The intent of the CAOIA document is for it to be completed iteratively, and as missions update these elements, corresponding changes are made in the CAOIA. With this process in place, the engagement and coordination between the missions and CARA from early in the design process into mission operations, helps to ensure that missions not only have a robust conjunction assessment concept of operations to reduce conjunction risk for space sustainability, but are also able to achieve their science goals and have a successful mission.

conjunction assessment↗

Engineering in Cyber Resilience with Cyber-Informed Engineering

Engineers have super powers to provide cybersecurity resilience with deterministic engineering solutions and to protect systems from the most catastrophic consequences that a cyber saboteur could cause. Come to this session to learn how to use engineering risk management skills to harden your engineered systems from cyberattacks. Objective 1 Identify what system functions could be digitally induced to cause undesired high-impact consequences. Objective 2 Analyze how loss or instability of digital controls in a subsystem could lead to high-impact consequences. Objective 3 Analyze how loss or instability in the digital connectivity between systems could lead to high-impact consequences. Objective 4 Identify engineering controls which could build resilience by eliminating digital loss or instability pathways or reduce the impact of digital loss or instability. This presentation will introduce Cyber-Informed Engineering, described below, and walk participants through specific engineering use cases to show how engineers can consider the potential for cyber sabotage in their existing system designs and enact deterministic engineering-based controls which eliminate pathways for attack or mitigate specific consequences. A wide variety of application use cases will be considered so that audience members can align the material with familiar engineering applications. CIE is an engineering approach that integrates cyber resilience into the conception, design, build, and operation of any physical system that has digital connectivity, sensors, monitoring, or control. CIE offers the opportunity to use engineering to eliminate or mitigate avenues for cyber attack—starting from the earliest stage of design and continuing throughout the system’s lifecycle. Today, engineers and industrial control system (ICS) technicians build engineered systems with specific goals for safety, reliability, and functionality. While systems engineering includes considerable safety and failure mode analysis, cybersecurity risks are often not specifically addressed—particularly the risks of intentional cyber compromise, exploitation, and misuse. Cyber-Informed Engineering pairs well with traditional cyber defenses and offers an extra designed-in protection to eliminate the most catastrophic consequences which can be realized by an adversary should traditional cyber defenses fail.

42 ENGINEERING↗

NASA Armstrong Flight Research Center Dynamics and Controls (530)

AFRC Controls and Dynamics Branch - Research Areas: - Traditional GN&C - Classical and advanced control algorithms - Risk based approaches for safety critical applications - Integration of novel sensors and sensor fusion (FOSS, LIDAR, etc.) - Trajectory optimization and control - Flight/System Dynamics - Equations of Motion and integrated modeling of vehicles and vehicle systems - Unique and novel vehicle dynamics - Methods for extracting relevant vehicle dynamic information from flight data - Human and vehicle interfaces and interactions - Handling Qualities and Pilot-in-the-loop oscillations (PIO) predictions and design metrics - Ride quality research - Autonomy - Novel algorithms, sensors, and sensor fusion - Bounding risk for testing automated systems - Pilot/Operator interactions - Engineering Support and Airworthiness Assessments - Aircraft modifications and experimental configurations

Chris Miller↗