Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “System safety”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 415 records · Page 23
All sourcesNASA NTRSDOE OSTI
NASA NTRS2018

Range Flight Safety Requirements

The purpose of this NASA Technical Standard is to provide the technical requirements for the NPR 8715.5, Range Flight Safety Program, in regards to protection of the public, the NASA workforce, and property as it pertains to risk analysis, Flight Safety Systems (FSS), and range flight operations. This standard is approved for use by NASA Headquarters and NASA Centers, including Component Facilities and Technical and Service Support Centers, and may be cited in contract, program, and other Agency documents as a technical requirement. This standard may also apply to the Jet Propulsion Laboratory or to other contractors, grant recipients, or parties to agreements to the extent specified or referenced in their contracts, grants, or agreements, when these organizations conduct or participate in missions that involve range flight operations as defined by NPR 8715.5.1.2.2 In this standard, all mandatory actions (i.e., requirements) are denoted by statements containing the term “shall.”1.3 TailoringTailoring of this standard for application to a specific program or project shall be formally documented as part of program or project requirements and approved by the responsible Technical Authority in accordance with NPR 8715.3, NASA General Safety Program Requirements.

Flight↗
NASA NTRS1990

EVA and telerobot interaction

We are about to enter into a new era - that of astronauts working hand in hand with telerobots in space. This has been done to some degree with astronauts and the Space Station Shuttle's Remote Manipulator Arm. However, for the Space Station Freedom, not only will astronauts be working with the RMS type system but also with smaller, more dexterous systems such as the Flight Telerobotic Servicer (FTS). Because EVA time is a premium resource, the most effective use of the astronauts and the telerobot will be required. There may be some tasks for which it is most efficient to have both the EVA astronaut and the telerobot working together. This type of close integration has not occurred before and brings up many issues. Most of these issues are related to technology: communication must be infallible, new control systems and devices may be required, enhanced telerobot safety systems may be necessary. IVA operations may also be affected by the combined EVA telerobot tasks. There is also the issue of how the EVA astronaut and the telerobot work on separate tasks but at the same time. For both situations, research and development of at least some new technology is required; enhanced communication both by voice and data, sophisticated collision detection systems, more responsive controls and displays. These new systems or system enhancements may require knowledge base systems for their operation. Some of the important issues, types of tasks, the FTS capabilities, the technology that is needed to address those issues, and the possible impact on Space Station Freedom are reviewed.

Willshire, Kelli F.↗
NASA NTRS1994

Reliability-Based Design of a Safety-Critical Automation System: A Case Study

In 1986, NASA funded a project to modernize the NASA Ames Research Center Unitary Plan Wind Tunnels, including the replacement of obsolescent controls with a modern, automated distributed control system (DCS). The project effort on this system included an independent safety analysis (ISA) of the automation system. The purpose of the ISA was to evaluate the completeness of the hazard analyses which had already been performed on the Modernization Project. The ISA approach followed a tailoring of the risk assessment approach widely used on existing nuclear power plants. The tailoring of the nuclear industry oriented risk assessment approach to the automation system and its role in reliability-based design of the automation system is the subject of this paper.

Carroll, Carol W.↗
NASA NTRS2003

Discrete Abstractions of Hybrid Systems: Verification of Safety and Application to User-Interface Design

Human interaction with a complex control system involves the user, the automation’s discrete mode logic, and the underlying continuous dynamics of the physical system. The user-interface of such systems always displays a reduced set of information about the entire system. Designing interfaces such that all the pertinent information is available and assuring that this information is correct is important for any user-interface, but especially so for safety-critical systems such as automotive systems and autopilots. Here we describe a methodology for the analysis of hybrid control systems that incorporate user interaction, with the goal of assuring that the information provided to the user is correct. That is, the user-interface must contain all information necessary to safely complete a desired procedure or task. We begin with a hybrid system model which incorporates discrete mode logic as well as nonlinear continuous dynamics. Using a hybrid computational tool for reachability, we find the largest region of the state-space in which we can guarantee the state of the system can always remain – this is the safe region of operation. By implementing a controller for safety which arises from this computation, we mathematically guarantee that this safe region is invariant, meaning that the system will always remain within the safe region if the determined controller is used on the boundary of the safe region. Verification within a hybrid framework allows us to account for the continuous dynamics underlying the discrete representations displayed to the user. Using the computed invariant regions as discrete states, we can abstract a discrete event system from this hybrid system with safety restrictions. This abstraction can be used to determine what information must be provided on the display. Furthermore, in cases in which an interface already exists, the abstraction provides the necessary input into existing interface verification methods. We provide two examples: a car traveling through a yellow light at an intersection and an aircraft autopilot in an automatic landing/go-around maneuver. The examples demonstrate the applicability of this methodology to hybrid systems that have operational constraints we can pose in terms of safety. This methodology differs from existing work in hybrid system verification in that we directly account for the user’s interactions with the system.

Meeko Oishi↗
NASA NTRS2000

Remote Diagnosis of the International Space Station Utilizing Telemetry Data

Modern systems such as fly-by-wire aircraft, nuclear power plants, manufacturing facilities, battlefields, etc., are all examples of highly connected network enabled systems. Many of these systems are also mission critical and need to be monitored round the clock. Such systems typically consist of embedded sensors in networked subsystems that can transmit data to central (or remote) monitoring stations. Moreover, many legacy are safety systems were originally not designed for real-time onboard diagnosis, but a critical and would benefit from such a solution. Embedding additional software or hardware in such systems is often considered too intrusive and introduces flight safety and validation concerns. Such systems can be equipped to transmit the sensor data to a remote-processing center for continuous health monitoring. At Qualtech Systems, we are developing a Remote Diagnosis Server (RDS) that can support multiple simultaneous diagnostic sessions from a variety of remote subsystems.

Deb, Somnath↗
NASA NTRS1993

Analyzing Software Requirements Errors in Safety-Critical, Embedded Systems

This paper analyzes the root causes of safety-related software errors in safety-critical, embedded systems. The results show that software errors identified as potentially hazardous to the system tend to be produced by different error mechanisms than non- safety-related software errors. Safety-related software errors are shown to arise most commonly from (1) discrepancies between the documented requirements specifications and the requirements needed for correct functioning of the system and (2) misunderstandings of the software's interface with the rest of the system. The paper uses these results to identify methods by which requirements errors can be prevented. The goal is to reduce safety-related software errors and to enhance the safety of complex, embedded systems.

Lutz, Robyn R.↗
NASA NTRS1968

The jumbo jet and public safety.

Safety of jumbo jet aircraft, accident reduction, traffic control, systems safety engineering, landing approach, midair collision prevention and crash survival

Lederer, J.↗
NASA NTRS2004

Fact Sheets of CTAS and NASA Decision-Support Tools and Concepts

Distributed Air/Ground (DAG) Traffic Management (TM) is an integrated operational concept in which flight deck crews, air traffic service providers and aeronautical operational control personnel use distributed decision-making to enable user preferences and increase system capacity, while meeting air traffic management (ATM) requirements. It is a possible operational mode under the Free Flight concept outlined by the RTCA Task Force 3. The goal of DAG-TM is to enhance user flexibility/efficiency and increase system capacity, without adversely affecting system safety or restricting user accessibility to the National Airspace System (NAS). DAG-TM will be accomplished with a human-centered operational paradigm enabled by procedural and technological innovations. These innovations include automation aids, information sharing and Communication, Navigation, and Surveillance (CNS) / ATM technologies. The DAG-TM concept is intended to eliminate static restrictions to the maximum extent possible. In this paradigm, users may plan and operate according to their preferences - as the rule rather than the exception - with deviations occumng eyond the year 2015. Out of a total of 15 concept elements, 4 have been selected for initial sutidies (see Key Elements in sidebar). DAG-TM research is being performed at Ames, Glenn, and Langley Research Centers.

Lee, Katharine↗
NASA NTRS2002

Mechanical Systems

The presentation provides an overview of requirement and interpretation letters, mechanical systems safety interpretation letter, design and verification provisions, and mechanical systems verification plan.

Davis, Robert E.↗
NASA NTRS2002

CATS-based Agents That Err

This report describes preliminary research on intelligent agents that make errors. Such agents are crucial to the development of novel agent-based techniques for assessing system safety. The agents extend an agent architecture derived from the Crew Activity Tracking System that has been used as the basis for air traffic controller agents. The report first reviews several error taxonomies. Next, it presents an overview of the air traffic controller agents, then details several mechanisms for causing the agents to err in realistic ways. The report presents a performance assessment of the error-generating agents, and identifies directions for further research. The research was supported by the System-Wide Accident Prevention element of the FAA/NASA Aviation Safety Program.

Callantine, Todd J.↗
NASA NTRS2021

Decentralized Control Synthesis for Air Traffic Management in Urban Air Mobility

Urban air mobility (UAM) refers to air transportation services within an urban area, often in an on-demand fashion. We study air traffic management (ATM) for vehicles in a UAM fleet, while guaranteeing system safety requirements such as traffic separation. Existing ATM methods for unmanned aerial systems, such as UAS traffic management, utilize alternative approaches which do not provide strict safety guarantees. No established infrastructure exists for providing ATM at scale for UAM. We provide a decentralized, hierarchical approach for UAM ATM that allows for scalability to high traffic densities as well as providing theoretical guarantees of correctness with respect to user-provided safety specifications. Our main contributions are two-fold. First, we propose a novel UAM ATM architecture that divides the control authority between vertihubs that are each in charge of all UAM vehicles in their local airspace. Each vertihub also contains a number of vertiports that are in charge of UAM vehicle takeoffs and landings. The resulting architecture is decentralized and hierarchical, which not only enables scalability, but also robustness in the event of any individual vertihub or vertiport no longer being operational. Second, we provide a contract-based correct-by-construction reactive synthesis approach that provably guarantees safety properties with respect to user-provided specifications in linear temporal logic. We demonstrate the approach on large-volume UAM air traffic data.

Urban Air Mobility↗
NASA NTRS1980

Helicopter technology benefits and needs. Volume 2: Appendices

Vehicle design, avionics and flight systems; safety and reliability; navigation, guidance and flight control; propulsion; auxiliary systems; human factors; and monitoring and diagnostic systems are the technology areas involved in solving operational and technical problems related to the use of helicopters. Tables show the problems encountered and the proposed research and technology for helicopter use for search and rescue; emergency medical services; law enforcement; environmental control; fire fighting; and resource management.

Zuk, J.↗
NASA NTRS1986

Oxygen/hydrogen Space Station propulsion system concept definition for IOC

The potential for the reduction in propulsion system life cycle costs through the use of on-board water electrolysis to generate oxygen and hydrogen propellants, as well as the potential advantages of improved system safety and contamination impact, led to a study to evaluate candidate oxygen-/hydrogen-based propulsion systems. In this study a representative set of propulsion system requirements were compiled and candidate oxygen/hydrogen-based propulsion systems synthesized. These candidate concepts were screened and a systems evaluation was performed on the remaining eight candidate concepts. Detailed system schematics were prepared. Operational design conditions were determined and system weight, volume, energy requirements, and costs were calculated. Evaluation results indicated that the oxygen/hydrogen propulsion systems can provide simple, low cost, and viable systems for the IOC Space Station. Based on these data, a relative concept evaluation was conducted using as selection criteria reliability, safety, cost, technical risk, contamination, operational utility, growth potential, and integration potential. Top ranked candidate systems were recommended to NASA/MSFC for consideration for the IOC Space Station.

Shoji, J. M.↗
NASA NTRS2007

Recovery of Space Shuttle Columbia and Return to Flight of Space Shuttle Discovery

NASA has come a long way in our journey to reduce the risks of operating the Spse Shuttle system. The External Tank bipod Thermal Protection System has been redesigned to eliminate the proximate cause of the Columbia accident. In all areas, we have applied the collective knowledge and capabilities of our Nation to comply with the Columbia Accident Investigation Board recommendations and to raise the bar beyond that. We have taken prudent technical action on potential threats to review and verify the material condition of all critical areas where failure could result in catastrophic loss of the crew and vehicle. We are satisfied that critical systems and elements should operate as intended-safely and reliably. While we will never eliminate all the risks from our human space flight programs, we have eliminated those we can and reduced, controlled, and/or mitigated others. The remaining identified risks will be evaluated for acceptance. Our risk reduction approach has its roots in the system safety engineering hierarchy for hazard abatement long employed in aerospace systems engineering. The components of the hierarchy are, in order of precedence, to: design/redesign; eliminate the hazard/risk; reduce the hazard/risk; and control the hazard/risk and/or mitigate the consequence of the remaining hazard/risk through warning devices, special procedures/capabilities, and/or training. This proven approach to risk reduction has been applied to potential hazards and risks in all critical areas of the Space Shuttle and has guided us through the technical challenges, failures, and successes present in return to flight endeavors. This approach provides the structured deliberation process required to verify and form the foundation for accepting any residual risk across the entire Space Shuttle Program by NASA leadership.

Rudolphi, Michael U.↗
NASA NTRS2014

Investigation of HZETRN 2010 as a Tool for Single Event Effect Qualification of Avionics Systems

NASA's future missions are focused on long-duration deep space missions for human exploration which offers no options for a quick emergency return to Earth. The combination of long mission duration with no quick emergency return option leads to unprecedented spacecraft system safety and reliability requirements. It is important that spacecraft avionics systems for human deep space missions are not susceptible to Single Event Effect (SEE) failures caused by space radiation (primarily the continuous galactic cosmic ray background and the occasional solar particle event) interactions with electronic components and systems. SEE effects are typically managed during the design, development, and test (DD&T) phase of spacecraft development by using heritage hardware (if possible) and through extensive component level testing, followed by system level failure analysis tasks that are both time consuming and costly. The ultimate product of the SEE DD&T program is a prediction of spacecraft avionics reliability in the flight environment produced using various nuclear reaction and transport codes in combination with the component and subsystem level radiation test data. Previous work by Koontz, et al.1 utilized FLUKA, a Monte Carlo nuclear reaction and transport code, to calculate SEE and single event upset (SEU) rates. This code was then validated against in-flight data for a variety of spacecraft and space flight environments. However, FLUKA has a long run-time (on the order of days). CREME962, an easy to use deterministic code offering short run times, was also compared with FLUKA predictions and in-flight data. CREME96, though fast and easy to use, has not been updated in several years and underestimates secondary particle shower effects in spacecraft structural shielding mass. Thus, this paper will investigate the use of HZETRN 20103, a fast and easy to use deterministic transport code, similar to CREME96, that was developed at NASA Langley Research Center primarily for flight crew ionizing radiation dose assessments. HZETRN 2010 includes updates to address secondary particle shower effects more accurately, and might be used as another tool to verify spacecraft avionics system reliability in space flight SEE environments.

Rojdev, Kristina↗
NASA NTRS2017

Quantifying Pilot Contribution to Flight Safety During Dual Generator Failure

Accident statistics cite flight crew error in over 60% of accidents involving transport category aircraft. Yet, a well-trained and well-qualified pilot is acknowledged as the critical center point of aircraft systems safety and an integral safety component of the entire commercial aviation system. No data currently exists that quantifies the contribution of the flight crew in this role. Neither does data exist for how often the flight crew handles non-normal procedures or system failures on a daily basis in the National Airspace System. A pilot-in-the-loop high fidelity motion simulation study was conducted by the NASA Langley Research Center in partnership with the Federal Aviation Administration (FAA) to evaluate the pilot's contribution to flight safety during normal flight and in response to aircraft system failures. Eighteen crews flew various normal and non-normal procedures over a two-day period and their actions were recorded in response to failures. To quantify the human's contribution, crew complement was used as the experiment independent variable in a between-subjects design. Pilot actions and performance when one of the flight crew was unavailable were also recorded for comparison against the nominal two-crew operations. This paper details diversion decisions, perceived safety of flight, workload, time to complete pertinent checklists, and approach and landing results while dealing with a complete loss of electrical generators. Loss of electrical power requires pilots to complete the flight without automation support of autopilots, flight directors, or auto throttles. For reduced crew complements, the additional workload and perceived safety of flight was considered unacceptable.

Etherington, Timothy J.↗
NASA NTRS2017

Quantifying Pilot Contribution to Flight Safety during Drive Shaft Failure

Accident statistics cite the flight crew as a causal factor in over 60% of large transport aircraft fatal accidents. Yet, a well-trained and well-qualified pilot is acknowledged as the critical center point of aircraft systems safety and an integral safety component of the entire commercial aviation system. The latter statement, while generally accepted, cannot be verified because little or no quantitative data exists on how and how many accidents/incidents are averted by crew actions. A joint NASA/FAA high-fidelity motion-base simulation experiment specifically addressed this void by collecting data to quantify the human (pilot) contribution to safety-of-flight and the methods they use in today's National Airspace System. A human-in-the-loop test was conducted using the FAA's Oklahoma City Flight Simulation Branch Level D-certified B-737-800 simulator to evaluate the pilot's contribution to safety-of-flight during routine air carrier flight operations and in response to aircraft system failures. These data are fundamental to and critical for the design and development of future increasingly autonomous systems that can better support the human in the cockpit. Eighteen U.S. airline crews flew various normal and non-normal procedures over a two-day period and their actions were recorded in response to failures. To quantify the human's contribution to safety of flight, crew complement was used as the experiment independent variable in a between-subjects design. Pilot actions and performance during single pilot and reduced crew operations were measured for comparison against the normal two-crew complement during normal and non-normal situations. This paper details the crew's actions, including decision-making, and responses while dealing with a drive shaft failure - one of 6 non-normal events that were simulated in this experiment.

Kramer, Lynda J.↗
NASA NTRS2004

My Summer Experience as an Administrative Officer Assistant

The motto of the Safety and Assurance Directorate (SAAD) at NASA Glenn Research Center is "mission success starts with safety." SAAD has the functions of providing reliability, quality assurance, and system safety management to all GRC projects, programs and offices. Product assurance personnel within SAAD supervise the product assurance efforts by contractors on major contracts within GRC. The directorate includes five division offices and the Plum brook Decommissioning Office. SAAD oversees Glenn's Emergency Preparedness Program which handles security, hazmat, and disaster response and supervision.

Jones, Janelle C.↗