Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Software Safety”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 469 records · Page 26

Humanoid Robotics: Real-Time Object Oriented Programming

Programming of robots in today's world is often done in a procedural oriented fashion, where object oriented programming is not incorporated. In order to keep a robust architecture allowing for easy expansion of capabilities and a truly modular design, object oriented programming is required. However, concepts in object oriented programming are not typically applied to a real time environment. The Fujitsu HOAP-2 is the test bed for the development of a humanoid robot framework abstracting control of the robot into simple logical commands in a real time robotic system while allowing full access to all sensory data. In addition to interfacing between the motor and sensory systems, this paper discusses the software which operates multiple independently developed control systems simultaneously and the safety measures which keep the humanoid from damaging itself and its environment while running these systems. The use of this software decreases development time and costs and allows changes to be made while keeping results safe and predictable.

Newton, Jason E.↗

An Integrated Framework for Risk Assessment of Safety-related Digital Instrumentation and Control Systems in Nuclear Power Plants: Methodology Refinement and Exploration

This report documents activities performed by Idaho National Laboratory (INL) during Fiscal Year (FY) 2023 for the U.S. Department of Energy (DOE) Light Water Reactor Sustainability (LWRS) Program, Risk Informed Systems Analysis (RISA) Pathway, digital instrumentation and control (DI&C) risk assessment project. In FY 2019, the RISA Pathway initiated a project to develop a risk assessment strategy for delivering a technical basis to support effective, and secure DI&C technologies for digital upgrades/designs. A risk assessment-informed framework was proposed for this strategy, which aims to (1) provide a best-estimate, risk informed capability to quantitatively estimate the safety margin obtained from plant modernization, especially for safety-related DI&C systems, (2) support and supplement existing risk informed DI&C design guides by providing quantitative risk information and evidence, (3) offer a capability of design architecture evaluation of various DI&C systems, (4) assure the long-term safety and reliability of safety-related DI&C systems, and (5) reduce uncertainty in costs and support integration of DI&C systems in the plant. To achieve these technical goals, the LWRS-developed framework provides a means to address relevant technical issues by: (1) defining a risk informed analysis process for DI&C upgrade that integrates hazard analysis, reliability analysis, and consequence analysis, (2) applying risk informed tools to address common cause failures (CCFs) and quantify corresponding failure probabilities for DI&C technologies, particularly software CCFs, (3) evaluating the impact of digital failures at the component level, system level, and plant level, and (4) providing insights and suggestions on designs to manage the risks, thus to support the development and deployment of advanced DI&C technologies in nuclear power plants (NPPs). Adding diversity within a system or components is the primary means to eliminate and mitigate CCFs, but diversity also increases system complexity and may not address all sources of systematic failures. Optimization of diversity and redundancy applications for the safety-critical DI&C systems remains a challenge. To deal with the technical issues in addressing potential software CCFs in safety-related DI&C systems of NPPs and supporting relevant design optimization, the proposed framework provides: (a) A best-estimate, risk informed capability to address new technical digital issues quantitatively, focusing on software CCFs in safety-related DI&C systems of NPPs; (b) A common and a modularized platform for DI&C designers, software developers, cybersecurity analysts, and plant engineers to predict and prevent risk in the early design stage of DI&C systems; (c) Technical bases and risk informed insights to assist users address the risk informed alternatives for evaluation of CCFs in safety-related DI&C systems of NPPs; and (d) A risk informed tool that offers a capability of design architecture evaluation of various DI&C systems to support system design decisions in diversity and redundancy applications. The research and development efforts of this project in FY 2023 are focused on refining current methods on software CCF modeling and estimation and exploring additional innovative approaches to risk assessment of DI&C systems to enable a more comprehensive and complete assessment of various safety-related DI&C design architectures. The primary audience of this report are DI&C designers, engineers, and probabilistic risk assessment (PRA) practitioners. This includes stakeholders, such as the nuclear utilities and regulators who consider the deployment and upgrade of DI&C systems, DI&C software developers and reviewers, and cybersecurity specialists. It should be noted that all the analyses are performed for the demonstration of the methodology, not for the evaluation of an actual digital control system. Results are obtained based on limited design information and testing data.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

A study of software standards used in the avionics industry

Within the past decade, software has become an increasingly common element in computing systems. In particular, the role of software used in the aerospace industry, especially in life- or safety-critical applications, is rapidly expanding. This intensifies the need to use effective techniques for achieving and verifying the reliability of avionics software. Although certain software development processes and techniques are mandated by government regulating agencies, no one methodology has been shown to consistently produce reliable software. The knowledge base for designing reliable software simply has not reached the maturity of its hardware counterpart. In an effort to increase our understanding of software, the Langley Research Center conducted a series of experiments over 15 years with the goal of understanding why and how software fails. As part of this program, the effectiveness of current industry standards for the development of avionics is being investigated. This study involves the generation of a controlled environment to conduct scientific experiments on software processes.

Hayhurst, Kelly J.↗

Survey of Software Assurance Techniques for Highly Reliable Systems

This document provides a survey of software assurance techniques for highly reliable systems including a discussion of relevant safety standards for various industries in the United States and Europe, as well as examples of methods used during software development projects. It contains one section for each industry surveyed: Aerospace, Defense, Nuclear Power, Medical Devices and Transportation. Each section provides an overview of applicable standards and examples of a mission or software development project, software assurance techniques used and reliability achieved.

Nelson, Stacy↗

Software Development Cost: How Much? You Sure? Technical Summary

This slide presentation reports on findings from analyzing a NASA COCOMO 81 dataset with 93 records. The current tool is called COSEEKMO, using a methodology can be applied to any set of cost models and data. The effort was part of a research initiative funded by the NASA Office of Safety and Mission and Assurance (OSMA) aimed at improving software reliability.

software effort estimation↗

Bantam System Technology Project Ground System Requirements Document

The Low Cost Booster Project (LCBP), also known as Bantam, is an element of the Advanced Space Transportation Program focused on Low Cost Booster Technologies. During FY 99 flight demonstrations are planned to demonstrate the feasibility of producing a booster capable of inserting a 150 kg payload into low earth orbit. The ground support system is an element of the full launch system. The ground support system provides for integration of the payload with the launch vehicle, preparation of the vehicle for launch (including maintenance, integration and test of the vehicle flight software), monitor and control of the launch sequence, range safety during launch, and collection of telemetry during the flight up to payload release. The ground support system is intended to make the maximum possible use of Government Off-the-Shelf (GOTS) or Commercial Off-the-Shelf (COTS) hardware and software to obtain the best value in terms of development operations support and ultimate life cycle cost for the launch system.

Moon, J. M.↗

RAVEN Theory Manual

RAVEN is a software framework able to perform parametric and stochastic analysis based on the response of complex system codes. The initial development was aimed at providing dynamic risk analysis capabilities to the thermohydraulic code RELAP-7, currently under development at Idaho National Laboratory (INL). Although the initial goal has been fully accomplished, RAVEN is now a multi-purpose stochastic and uncertainty quantification platform, capable of communicating with any system code. In fact, the provided Application Programming Interfaces (APIs) allow RAVEN to interact with any code as long as all the parameters that need to be perturbed are accessible by input files or via python interfaces. RAVEN is capable of investigating system response and explore input space using various sampling schemes such as Monte Carlo, grid, or Latin hypercube. However, RAVEN strength lies in its system feature discovery capabilities such as: constructing limit surfaces, separating regions of the input space leading to system failure, and using dynamic supervised learning techniques. The development of RAVEN started in 2012 when, within the Nuclear Energy Advanced Modeling and Simulation (NEAMS) program, the need to provide a modern risk evaluation framework arose. RAVEN’s principal assignment is to provide the necessary software and algorithms in order to employ the concepts developed by the Risk Informed Safety Margin Characterization (RISMC) program. RISMC is one of the pathways defined within the Light Water Reactor Sustainability (LWRS) program. In the RISMC approach, the goal is not just to identify the frequency of an event potentially leading to a system failure, but the proximity (or lack thereof) to key safety-related events. Hence, the approach is interested in identifying and increasing the safety margins related to those events. A safety margin is a numerical value quantifying the probability that a safety metric (e.g. peak pressure in a pipe) is exceeded under certain conditions. Most of the capabilities, implemented having RELAP-7 as a principal focus, are easily deployable to other system codes. For this reason, several side activates have been employed (e.g. RELAP5-3D, any MOOSE-based App, etc.) or are currently ongoing for coupling RAVEN with several different software. The aim of this document is to provide a set of commented examples that can help the user to become familiar with the RAVEN code usage.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗

Maintaining the Health of Software Monitors

Software health management (SWHM) techniques complement the rigorous verification and validation processes that are applied to safety-critical systems prior to their deployment. These techniques are used to monitor deployed software in its execution environment, serving as the last line of defense against the effects of a critical fault. SWHM monitors use information from the specification and implementation of the monitored software to detect violations, predict possible failures, and help the system recover from faults. Changes to the monitored software, such as adding new functionality or fixing defects, therefore, have the potential to impact the correctness of both the monitored software and the SWHM monitor. In this work, we describe how the results of a software change impact analysis technique, Directed Incremental Symbolic Execution (DiSE), can be applied to monitored software to identify the potential impact of the changes on the SWHM monitor software. The results of DiSE can then be used by other analysis techniques, e.g., testing, debugging, to help preserve and improve the integrity of the SWHM monitor as the monitored software evolves.

Runtime Monitor↗

Methods to Automate Assessing the Outage Risk and Technical Specification Compliance for Planned Work and Current Plant Conditions. Light Water Reactor Sustainability Program report

This research effort is a part of the Light Water Reactor Sustainability (LWRS) Program, which is a research and development (R&D) program sponsored by the Department of Energy. The LWRS Program is performed in close collaboration with industry R&D programs that provide the technical foundations for licensing and managing the long term, safe, and economical operation of current nuclear power plants (NPPs). The LWRS Program serves to help the United States (U.S.) nuclear industry adopt new technologies and engineering solutions that facilitate the continued safe operation of these NPPs and the extension of their current operating licenses. The Outage Risk Management Improvement Pilot Project seeks to improve the management of nuclear power plant outages. This is done through the development of tools to assist in evaluating pending activities against requirements to detect undesired interactions. Significant efforts are expended to manage the nuclear risk of an outage. The utilities conduct pre outage risk assessments, based on a very detailed review of the outage schedule, to identify where combinations of outage work and out of service equipment would result in degraded conditions with respect to nuclear safety or regulatory compliance. Probabilistic risk assessment studies are conducted to quantify incremental core damage frequency as a result of the outage activities and system unavailability. These studies are usually presented to site and fleet management, the site plant operational review committee, and the NPP’s independent Nuclear Safety Review Board for concurrence that the outage is planned safely and that reasonable measures have been taken to reduce the added risk of conducting the outage. During the outage, the plant configuration is monitored continuously to ensure that it conforms to the approved safety plan. Deviations must be assessed and approved by management committees and, in some cases, the plant operational review committee. In virtually all outage meetings and job briefings, the current nuclear safety status of the plant is communicated, including information on the specific equipment necessary to meet the requirements of the nuclear safety plan. In addition, the operations and outage organizations implement several layers of physical and administrative barriers to prevent unintended interaction with the systems and equipment credited for nuclear safety. In spite of all these efforts, nuclear safety challenges still occur too frequently during outages. While some of these are due to failures of equipment credited for safety, the majority occur because of human error. These typically involve some form of interaction between work activities and plant configuration changes. Some of them are very subtle and are extremely challenging to detect in advance. Nevertheless, they are not acceptable and represent clear opportunities to improve nuclear safety during outages. This particular report will provide a demonstration of the capabilities in the development of a predictive software platform for improving configuration control and accessing the plant risks associated with outage work protocols and illustrate how the software assists in strategies to minimize these interactions. In addition to maintaining nuclear safety, there are numerous administrative requirements that must be complied with during an outage. This report will discuss the use of logic modelling to monitor planned work against technical specification requirements for given plant conditions and to integrate these requirements with shutdown risk models, clearance order requirements and other plant condition requirements.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

A qualitative assessment of current CCF guidance based on a review of safety system digital implementation changes with evolving technology - 148

This paper is a summary of a study performed in support of the US Nuclear Regulatory Commission (NRC) to evaluate current policy on software common-cause failure (CCF). The study reported in this paper is one of several that contributed to the technical basis to inform NRC staff. The study first reviewed policies and assessment guidance as discussed in the Staff Requirements Memorandum to the Secretary of the Commission, Office of the NRC (SECY) 93-087, Policy, Technical, and Licensing Issues Pertaining to Evolutionary and Advanced Light Water Reactor (ALWR) Designs, and Branch Technical Position (BTP) 7-19, Guidance on Evaluation of Defense-in-Depth and Diversity in Digital Computer-Based Instrumentation and Control Systems, as well as Chapter 7, 'Instrumentation and Controls', in NUREG-0800, Standard Review Plan for Review of Safety Analysis Reports for Nuclear Power Plants. The study then examined instrumentation and controls (I and C) technology implementations in nuclear power plants in the light of current CCF guidance. The intent was to assess whether the current position on CCF remains appropriate given the evolutions in digital safety system implementations and, if gaps in the guidance were found, to provide recommendations as to how these gaps could be closed. The methodology adopted was to review the vendors' technology and software implementation processes for digital safety systems as technology evolved. The following three representative safety systems were selected to provide illustrative examples: - Eagle 21 was selected to represent vintage microprocessor-based technology used from the 1980's to mid-1990's, - TELEPERM XS (TXS) was selected to represent second generation microprocessor-based technology used from the mid-1990's to the 2000's, and - The advanced logic system (ALS) was selected to represent the latest trend of using technology based on field programmable gate arrays (FPGAs). Technology implementations were reviewed in light of the basic premise of the NRC in BTP 7-19 (Revision 6), that software-based or software-logic-based digital system development errors are a credible source of CCF and therefore are susceptible to CCF because identical copies of the software-based logic and architecture are present in redundant divisions of safety-related systems. BTP 7-19 categorizes firmware and logic developed from software-based development systems all under software. (authors)

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

Software assurance standard

This standard specifies the software assurance program for the provider of software. It also delineates the assurance activities for the provider and the assurance data that are to be furnished by the provider to the acquirer. In any software development effort, the provider is the entity or individual that actually designs, develops, and implements the software product, while the acquirer is the entity or individual who specifies the requirements and accepts the resulting products. This standard specifies at a high level an overall software assurance program for software developed for and by NASA. Assurance includes the disciplines of quality assurance, quality engineering, verification and validation, nonconformance reporting and corrective action, safety assurance, and security assurance. The application of these disciplines during a software development life cycle is called software assurance. Subsequent lower-level standards will specify the specific processes within these disciplines.

Source record↗

NASA's approach to flight confidence

NASA's confidence in the flight readiness of aerospace hardware and software is achieved by a thorough integration of safety activities into every program facet, from concept through the mission. This involves technical and administrative personnel, organizations that specify requirements, design, manufacturing, test and the operators. Reviews by inhouse and external specialists form an integral part of the assurance process. Examples of safety issues and their resolution for some power and propulsion functions are given (lithium cells, autoignition/fretting in high pressure oxygen environments, ignition sources from auxiliary power unit, and low thrust rocket engines). Finally, some comments on NASA's integrated safety activities and the Aerospace Safety Advisory Panel's role in the NASA review and assessment process all of which provides added confidence in achieving a high level of mission safety and success.

Roth, G. L.↗

Colossal Tooling Design: 3D Simulation for Ergonomic Analysis

The application of high-level 3D simulation software to the design phase of colossal mandrel tooling for composite aerospace fuel tanks was accomplished to discover and resolve safety and human engineering problems. The analyses were conducted to determine safety, ergonomic and human engineering aspects of the disassembly process of the fuel tank composite shell mandrel. Three-dimensional graphics high-level software, incorporating various ergonomic analysis algorithms, was utilized to determine if the process was within safety and health boundaries for the workers carrying out these tasks. In addition, the graphical software was extremely helpful in the identification of material handling equipment and devices for the mandrel tooling assembly/disassembly process.

Hunter, Steve L.↗

An overview of the V&V of Flight-Critical Systems effort at NASA

As the US is getting ready for the Next Generation (NextGen) of Air Traffic System, there is a growing concern that the current techniques for verification and validation will not be adequate for the changes to come. The JPDO (in charge of implementing NextGen) has given NASA a mandate to address the problem and it resulted in the formulation of the V&V of Flight-Critical Systems effort. This research effort is divided into four themes: argument-based safety assurance, distributed systems, authority and autonomy, and, software intensive systems. This paper presents an overview of the technologies that will address the problem.

validation↗

Analysis of Phoenix Anomalies and IV & V Findings Applied to the GRAIL Mission

NASA IV&V was established in 1993 to improve safety and cost-effectiveness of mission critical software. Since its inception the tools and strategies employed by IV&V have evolved. This paper examines how lessons learned from the Phoenix project were developed and applied to the GRAIL project. Shortly after selection, the GRAIL project initiated a review of the issues documented by IV&V for Phoenix. The motivation was twofold: the learn as much as possible about the types of issues that arose from the flight software product line slated for use on GRAIL, and to identify opportunities for improving the effectiveness of IV&V on GRAIL. The IV&V Facility provided a database dump containing 893 issues. These were categorized into 16 bins, and then analyzed according to whether the project responded by changing the affected artifacts or using as-is. The results of this analysis were compared to a similar assessment of post-launch anomalies documented by the project. Results of the analysis were discussed with the IV&V team assigned to GRAIL. These discussions led to changes in the way both the project and IV&V approached the IV&V task, and improved the efficiency of the activity.

Larson, Steve↗

Event Report for The Ethical Artificial Intelligence Quantification Workshop

Artificial Intelligence (AI) is a powerful emerging technology area which requires special attention to using it ethically. AI ethics is still an emerging field, and the partners for this workshop and report seek to move AI ethics discussion ahead by experimenting with ways to measure AI ethics criteria. The following document describes the outcomes and learnings from The Ethical Artificial Intelligence Quantification Workshop held at the National Institute for Aerospace (NIA), Hampton, Virginia on May 12th, 2022. The purpose of the workshop was for participants to evaluate and experiment-with the methodology and process presented by AIEthics.World in cooperation with Intel Corporation. The meeting participants learned about the Ethical AI Certification and Maturity Model™ and applied the methodology to selected notional AI systems. The workshop facilitated the evaluation of the maturity of the AI system according to ethical considerations relevant to NASA, NIA and other participants. The workshop consisted of three main phases. The first phase focused on understanding and summarizing NASA’s ethical approaches, mission and values based on published documentation, discussions and individual insights & opinions of participants. This information was prioritized, weighted, ordered, and quantified in phase two, to formulate an alignment between human values (ethics) and their applicability to AI systems during all lifecycle phases. The first two phases were summarized as a form of ethical genealogy for artificial intelligence, specific to NASA’s ethical approaches. In the third and last phase of the workshop the participants evaluated notional examples of artificial intelligence to qualify and quantify its ability to adhere to the organizational ethics approaches, using the Ethical AI Certification and Maturity Model™. The workshop uses the concept of genealogy, in the traditional sense: the study and traceability of lines of ancestors in the process of evolutionary development from earlier forms. However, as it is applied to an Ethical AI definition, it is providing the insights to the necessary and mandatory traceability of content, data, metrics, telemetry, elements, and structures which are used in the AI’s lifecycle to foster and measure AI ethics in all steps of its lifecycle. The Ethical Artificial Intelligence Quantification Workshop provided NASA with the opportunity to apply the Ethical AI Certification and Maturity Model™, in combination with existing and well-known decision-making and quality control methods to identify the metrics and measurements for an Ethical AI and assess its ethical condition and quality aligned with NASA ethics approaches. The result of the workshop is the capacity for NASA to apply the maturity model assessment to its AI Systems as desired and if necessary, publish the ability of these AI Systems to adhere to the organizational ethical goals. AI ethics frameworks need to be customized for each application domain, for example, individual NASA Mission Directorates. General principles that work in one area such as AI/Machine Learning-based text analysis (the ethics of information-extraction) may need to be adapted for another such as sense-and-avoid decision-making in a flight environment. The workshop was conducted among approximately twenty NASA subject matter experts, so the elements noted above should be considered examples, not definitive NASA ethical AI principles, genealogy, etc. Generating a definitive AI ethics framework for an organization as diverse as NASA would require far more discussion, debate, review, etc. However, the workshop provided valuable insight into mechanisms and processes for quantifying AI ethical qualities.

Artificial Intelligence↗

Space ROS: Architecture Roadmap

Space ROS is a matured version of ROS 2 using flight software engineering practices to facilitate mission- and safety-critical applications. This roadmap was developed by the team to communicate the planned future evolution of Space ROS

Austin Probe↗

MPATH (Measuring Performance for Autonomy Teaming with Humans) Ground Control Station: Design Approach and Initial Usability Results

Envisioned future Advanced Air Mobility (AAM) operations will require a transition of aircraft command and control from onboard pilots to remote operators. The National Aeronautics and Space Administration (NASA) has developed a research ground control station (GCS) software called MPATH (Measuring Performance for Autonomy Teaming with Humans) to study the human factors of remote operators in a representative AAM environment, where small uncrewed aerial systems (sUAS; simulated or real) act as surrogates for larger AAM aircraft. A primary focus of the research being conducted with the MPATH GCS is scalability (i.e., one human managing multiple vehicles). MPATH has demonstrated to be a useful capability for human factors research and remote operations. Two initial usability studies and a multi-vehicle control assessment were recently conducted, and usability data and operator feedback were collected. Generally, participants rated MPATH high on usability and interface quality, whereas information quality was rated slightly lower. These results were supported by specific feedback. Several generalized GCS design recommendations are proposed based on the results and feedback from these flight activities. Future updates to MPATH will incorporate the proposed recommendations. In practice, these recommendations could be used by any GCS software designer or developer to promote usability and safety.

Advanced Air Mobility↗