Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Software and System Safety”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 505 records · Page 28

Chapter 12 - Flight Envelope

The term "flight envelope" is used to refer to the boundaries of aircraft loading and flight conditions within which operation of the aircraft is satisfactory, and beyond which some aspect becomes unacceptable. This flight envelope represents, in fact, the limiting conditions arising from a matrix of inter-related flight envelopes covering the appropriate variables. Thus, for each loading (i.e., external stores configuration and its associated range of weight and center of gravity (c.g.) position) and aircraft configuration (i.e., position of undercarriage (u/c), flaps, slats, etc.), the envelopes of airspeed versus altitude, airspeed versus load factor, angle of attack versus angle of sideslip, etc., must be investigated to establish the limits within which all aspects such as handling qualities, engine behavior, structural loads, etc., remain acceptable. Flight testing of new or derivative aircraft models is carried out with the initial purpose of defining a flight envelope which is, first and foremost, safe and secondarily, which enables the effective use of the vehicle for its intended purpose. Flight testing occurs only after numerous reviews of the design and review of results from ground tests and predictions of flight characteristics in such areas as structures, aerodynamics, stability and control, flight controls (particularly fly-by-wire control systems, propulsion, etc.). Accordingly, opening and expanding the envelope is a task that must be approached cautiously, systematically, and with coordination and cooperation of the many disciplines involved in the design and test of an airplane. (Sections 8 and 10 cover test planning and safety of flight considerations, respectively). The fundamental tenet in establishing a flight envelope via flight test is risk reduction. This is reflected in the typical sequence of events leading to initial flight test - design reviews (both hardware and software), then ground test involving singular disciplines (windtunnel tests for aerodynamics, structurally loading the wing/fuselage/nacelle on a ground test article with loads anticipated to occur in flight, flight control system control law checkout, propulsion test cell runs and/or flying test bed tests, etc.), and then ground tests involving multi-disciplines (See Section 9). Only after these have been accomplished will an initial, limited, low-risk, flight envelope be established. The limited envelope will typically be in the middle of the projected final flight envelope. Subsequent flight tests will then be devoted to expanding the initial envelope by operating the airplane at increasing ranges - representing increasing risk - of engine operation, airspeeds both fast and slow, altitude, load factor both above and below 1g, centers of gravity (fore and aft), and with system/subsystem failures. Whether flight tests are to define a flight envelope on a new model airplane with the attendant new airframe, new engine(s), and new subsystems (hydraulics, pressurization, etc.), or on an airplane involving only a few of these areas such as new engines in an old airframe, the fundamental approach to establishing an envelope is the same.

H Walgemoed↗

On-Board Battery Monitoring and Prognostics for Electric-Propulsion Aircraft

The reliability of the propulsion system of an aircraft is paramount for the aircraft safety and hence the aircraft health must be monitored continuously. In contrast to fuel- operated aircraft, electric battery-operated propulsion system poses specific problems, such as, the remaining battery power does not linearly decrease and cannot be measured directly. In this paper, we describe a combined monitoring and prognostics architecture that can continuously monitor all components of the electric propulsion system with respect to safety and performance properties as well as state of charge and rest of useful life for the battery. Our system combines a detailed electrochemical battery model for Li-ion batteries with a powerful prognostics engine based upon an Unscented Kalman Filter with the R2U2 monitoring device, which provides efficient observers for metric temporal logic and Bayesian reasoning. R2U2 is a real-time, realizable, responsive, unobtrusive unit, which continuously monitors sensor readings, outputs of the prognostics engine, as well as the ight software status for safety, performance, and security properties. We illustrate our architecture with two case studies, one reporting actual ight tests with an X8+ octocopter and the other a software-in-the-loop simulation with an unmanned Edge 540 electric aircraft model.

Kulkarni, Chetan↗

IVHM for the 3rd Generation RLV Program: Technology Development

The objective behind the Integrated Vehicle Health Management (IVHM) project is to develop and integrate the technologies which can provide a continuous, intelligent, and adaptive health state of a vehicle and use this information to improve safety and reduce costs of operations. Technological areas discussed include: developing, validating, and transfering next generation IVHM technologies to near term industry and government reusable launch systems; focus NASA on the next generation and highly advanced sensor and software technologies; and validating IVHM systems engineering design process for future programs.

Kahle, Bill↗

Issues and Methods for Assessing COTS Reliability, Maintainability, and Availability

Many vendors produce products that are not domain specific (e.g., network server) and have limited functionality (e.g., mobile phone). In contrast, many customers of COTS develop systems that am domain specific (e.g., target tracking system) and have great variability in functionality (e.g., corporate information system). This discussion takes the viewpoint of how the customer can ensure the quality of COTS components. In evaluating the benefits and costs of using COTS, we must consider the environment in which COTS will operate. Thus we must distinguish between using a non-mission critical application like a spreadsheet program to produce a budget and a mission critical application like military strategic and tactical operations. Whereas customers will tolerate an occasional bug in the former, zero tolerance is the rule in the latter. We emphasize the latter because this is the arena where there are major unresolved problems in the application of COTS. Furthermore, COTS components may be embedded in the larger customer system. We refer to these as embedded systems. These components must be reliable, maintainable, and available, and must be with the larger system in order for the customer to benefit from the advertised advantages of lower development and maintenance costs. Interestingly, when the claims of COTS advantages are closely examined, one finds that to a great extent these COTS components consist of hardware and office products, not mission critical software [1]. Obviously, COTS components are different from custom components with respect to one or more of the following attributes: source, development paradigm, safety, reliability, maintainability, availability, security, and other attributes. However, the important question is whether they should be treated differently when deciding to deploy them for operational use; we suggest the answer is no. We use reliability as an example to justify our answer. In order to demonstrate its reliability, a COTS component must pass the same reliability evaluations as the custom components, otherwise the COTS components will be the weakest link in the chain of components and will be the determinant of software system reliability. The challenge is that there will be less information available for evaluating COTS components than for custom components but this does not mean we should despair and do nothing. Actually, there is a lot we can do even in the absence of documentation on COTS components because the customer will have information about how COTS components are to be used in the larger system. To illustrate our approach, we will consider the reliability, maintainability, and availability (RMA) of COTS components as used in larger systems. Finally, COTS suppliers might consider increasing visibility into their products to assist customers in determining the components' fitness for use in a particular application. We offer ideas of information that would be useful to customers, and what vendors might do to provide it.

Schneidewind, Norman F.↗

Risk-Informed ATF and FLEX Analysis for an Enhanced Resilient BWR Under Design-Basis and Beyond-Design-Basis Accidents

This report documents the activities performed by the Idaho National Laboratory (INL) during fiscal year (FY) 2020 for the U.S. Department of Energy (DOE) Light Water Reactor Sustainability (LWRS) Program, Risk-Informed System Analysis (RISA) Pathway, Enhanced Resilient Plant (ERP) Systems research. The purpose of the RISA Pathway research and development is to support plant owner-operator decisions with the aim to improve the economics, reliability, and maintain the high levels of safety of current nuclear power plants over periods of extended plant operations. The concept of ERP refers to the combinations of accident-tolerant fuel (ATF), optimal use of diverse and flexible coping strategy (FLEX), enhancements to plant components and systems, and the incorporation of augmented or new passive cooling systems, as well as improved fuel cycle efficiency. The objective of the ERP research effort is to use the RISA methods and toolkit in industry applications, including methods development and early demonstration of technologies, in order to enhance existing reactors’ safety features (both active and passive) and to substantially reduce operating costs through risk-informed approaches to plant design modifications to the plant and their characterization. One main focus of the FY 2020 efforts documented in this report was to extend the analyses conducted in FYs 2018 and 2019 for a pressurized water reactor (PWR) to a boiling water reactor (BWR). The same analysis process, risk analysis approaches, and analysis tools as in the previous work for PWR were used for a generic BWR with near-term ATF cladding (i.e., Iron-Chromium-Aluminum [FeCrAl] cladding and Chromium [Cr]-coated cladding) designs under the postulated station blackout (SBO) and medium loss-of-coolant (MLOCA) accident scenarios. In addition, a FLEX model was developed and incorporated into a generic BWR probabilistic risk assessment (PRA) model using the INL-developed software tool, Systems Analysis Programs for Hands-on Integrated Reliability Evaluations (SAPHIRE), to assess the risk impact from FLEX. The other main focus of the FY 2020 efforts was to advance analysis methods, including developing dynamic approach for FLEX human reliability analysis (HRA) using the INL-developed software tool, Event Modeling Risk Assessment using Linked Diagrams (EMRALD), as well as developing a multicriterion benefit evaluation (MCBE) method for evaluating costs and benefits of safety enhancements in nuclear power plants (NPPs). As a case study, the MCBE method was applied to evaluate the costs and benefits brought by FLEX implementation.

99 GENERAL AND MISCELLANEOUS↗

Hydrogen Plus Other Alternative Fuels Risk Assessment Models (HyRAM+) Version 4.1 Technical Reference Manual

The HyRAM+ software toolkit provides a basis for conducting quantitative risk assessment and consequence modeling for hydrogen, methane, and propane systems. HyRAM+ is designed to facilitate the use of state-of-the-art models to conduct robust, repeatable assessments of safety, hazards, and risk. HyRAM+ integrates deterministic and probabilistic models for quantifying accident scenarios, predicting physical effects, characterizing hazards (thermal effects from jet fires, overpressure effects from delayed ignition), and assessing impacts on people. HyRAM+ is developed at Sandia National Laboratories to support the development and revision of national and international codes and standards, and to provide developed models in a publicly-accessible toolkit usable by all stakeholders. This document provides a description of the methodology and models contained in HyRAM+ version 4.1. The two most significant changes for HyRAM+ version 4.1 from HyRAM+ version 4.0 are direct incorporation of unconfined overpressure into the QRA calculations and modification of the models for cryogenic liquid flow through an orifice. In QRA mode, the user no longer needs to input peak overpressure and impulse values that were calculated separately; rather, the unconfined overpressure is estimated for the given system inputs, leak size, and occupant location. The orifice flow model now solves for the maximum mass flux through the orifice at constant entropy while conserving energy, which does not require a direct speed of sound calculation. This does not affect the mass flow for all-gaseous releases; the method results in the same speed of sound for choked flow. However, this method does result in a higher (and more realistic) mass flow rate for a given leak size for liquid releases than was previously calculated.

08 HYDROGEN↗

Autonomous failure detection and correction on Landsat-4

An integrated hardware/software fault tolerant system for an earth oriented, computer controlled spacecraft is described. The design philosophy as well as the rationale behind the chosen fault tolerant system is outlined. In-flight performance of the system is included for several different instances where the Failure Detection and Correction system acted autonomously to protect the spacecraft. This system exceeded the expectations of the designers by demonstrating the capability to provide a measure of safety to the spacecraft for inadvertent and undesirable ground commands as well as satisfying its primary function of monitoring the flight hardware and software for failures.

Welch, R. V.↗

Commercial Earth Observation

Through the Earth Observation Commercial Applications Program (EOCAP) at Stennis Space Center, Applied Analysis, Inc. developed a new tool for analyzing remotely sensed data. The Applied Analysis Spectral Analytical Process (AASAP) detects or classifies objects smaller than a pixel and removes the background. This significantly enhances the discrimination among surface features in imagery. ERDAS, Inc. offers the system as a modular addition to its ERDAS IMAGINE software package for remote sensing applications. EOCAP is a government/industry cooperative program designed to encourage commercial applications of remote sensing. Projects can run three years or more and funding is shared by NASA and the private sector participant. Through the Earth Observation Commercial Applications Program (EOCAP), Ocean and Coastal Environmental Sensing (OCENS) developed SeaStation for marine users. SeaStation is a low-cost, portable, shipboard satellite groundstation integrated with vessel catch and product monitoring software. Linked to the Global Positioning System, SeaStation provides real time relationships between vessel position and data such as sea surface temperature, weather conditions and ice edge location. This allows the user to increase fishing productivity and improve vessel safety. EOCAP is a government/industry cooperative program designed to encourage commercial applications of remote sensing. Projects can run three years or more and funding is shared by NASA and the private sector participant.

Source record↗

Steering Aircraft Clear of Choppy Air

AeroTech Research (U.S.A.), Inc., a leader in turbulence-detection and warning systems, has been involved with NASA Aviation Safety research since 1998. AeroTech served as a contractor for the TPAWS government/industry development project, and was funded by NASA to develop the E-Turb Mode Radar algorithms and the TAPS software. (Other contributors to this project include the National Center for Atmospheric Research, the FAA, North Carolina State University, and the Research Triangle Institute.) The radar algorithms combine an aircraft's turbulenceresponse characteristics with radar measurements to determine the predicted turbulence loads the aircraft will experience, and present this information to the pilot. The TAPS software monitors and processes onboard aircraft sensor data; generates automatic reports when an aircraft encounters turbulence and a set turbulence threshold is exceeded; and then displays the reports and underlying information to ground personnel to improve situational awareness of the location and the severity of the turbulence encounter.

Source record↗

Development of MCNP Training Modules for Safeguards Practitioners [Abstract]

The Monte-Carlo N-Particle (MCNP) software developed at LANL is the most widely used neutron transport code in the world. It is an essential tool for a variety of applications including detector development and design, nuclear fuel burnup simulation, criticality safety, and nondestructive assay system optimization. For this reason, it is indispensable within the safeguards and materials control & accountability (MC&A) communities. Multiple MCNP training courses have been created and taught over the last several decades by the MCNP development team at LANL, however there are no existing courses that cover specialized topics considered fundamental to NDA and safeguards models. To fill this gap, the MCNP team and Safeguards Science and Technology group at LANL have co-created a set of training modules customized to meet the specialized needs of the safeguards and MC&A communities. The basic modules cover concepts such as NDA system optimization, He-specific and other capture tallies, and tools for improved theoretical understanding. An advanced module was also created to cover topics including variance reduction for active interrogation simulations, use of the LANL MCNPTools post-processor, PTRAC (particle tracking) and list-mode data simulations, and fuel burnup simulations. The training modules teach to the latest and most state-of-the-art MCNP features and tools released by the development team at LANL and are intended to be taught jointly by the developers and safeguards experts. Ultimately, we hope that creation of these modules will serve to capture and convey the safeguards modeling and MCNP expertise at LANL, and that we will be able to share the modules more broadly with the MC&A and safeguards communities.

73 NUCLEAR PHYSICS AND RADIATION PHYSICS↗

An MBSE Approach for Developing an Autonomous Rover Platform

The proliferation of increasingly autonomous systems calls for new ways to address how safety is assured. As these systems become more advanced and complex, it becomes more important to model and prototype autonomous functions at the systems level and the functions that assure they are operating safely and as expected. To that effect, researchers at the National Aeronautics and Space Administration (NASA) 's Robust Software Engineering (RSE) group are working on prototyping a Research Autonomous Vehicle, commonly referred to as R-RAV. The R-RAV is an autonomous rover platform designed to act as a case study for assured autonomy research. Moreover, an overarching goal is for the R-RAV to serve as a training ground for other mission projects. In this paper, we will detail how we have used a Model-Based Systems Engineering (MBSE) approach to model a prototype of the R-RAV and test and verify its different functionalities.

MBSE↗

Upgrade of Core Conduction Cooldown Test Facility Control System

The CCCTF was designed and installed at ORNL in the 1990s for high-temperature gas-cooled reactor accident simulation. It is located within a modular hot cell housed in the IFEL facility. In 2008 and 2009, modifications were made to the CCCTF in preparation for AGR safety testing. A new airlock was designed and installed to better support periodic exchange of the fission product deposition cups while maintaining the fuel at safety test temperature, and modifications were made to add routines to the existing user interface software for computer-controlled automation of the He sweep gas flow and liquid nitrogen supply to the 85Kr cold traps. However, the furnace control hardware and software remained essentially unchanged. At the conclusion of the AGR-1 and AGR-2 PIE campaigns, continued use of the CCCTF was in question because of the gradual obsolescence of the hardware and software used to control the furnace and ancillary systems that make up the CCCTF. Therefore, an effort was undertaken to replace all the obsolete components with new hardware and update the software to increase system reliability and ensure this capability’s maintenance for future research and fuel qualification efforts. The modifications included creating a new National Instruments (NI) LabVIEW-based control system with a graphical user interface (GUI).

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗

Hydrogen Plus Other Alternative Fuels Risk Assessment Models (HyRAM+) Version 5.0 Technical Reference Manual

The HyRAM+ software toolkit provides a basis for conducting quantitative risk assessment and consequence modeling for hydrogen, natural gas, and autogas systems. HyRAM+ is designed to facilitate the use of state-of-the-art models to conduct robust, repeatable assessments of safety, hazards, and risk. HyRAM+ integrates deterministic and probabilistic models for quantifying leak sizes and rates, predicting physical effects, characterizing hazards (thermal effects from jet fires, overpressure effects from delayed ignition), and assessing impacts on people. HyRAM+ is developed at Sandia National Laboratories to support the development and revision of national and international codes and standards, and to provide developed models in a publicly-accessible toolkit usable by all stakeholders. This document provides a description of the methodology and models contained in HyRAM+ version 5.0. The most significant change for HyRAM+ version 5.0 from HyRAM+ version 4.1 is the ability to model blends of different fuels. HyRAM+ was previously only suitable for use with hydrogen, methane, or propane, with users having the ability to use methane as a proxy for natural gas and propane as a proxy for autogas/liquefied petroleum gas. In version 5.0, real natural gas or autogas compositions can be modeled as the fuel, or even blends of natural gas with hydrogen. These blends can be used in the standalone physics models, but not yet in the quantitative risk assessment mode of HyRAM+.

03 NATURAL GAS↗

Hydrogen Plus Other Alternative Fuels Risk Assessment Models (HyRAM+) Version 5.1 Technical Reference Manual

The HyRAM+ software toolkit provides a basis for conducting quantitative risk assessment and consequence modeling for hydrogen, natural gas, and autogas systems. HyRAM+ is designed to facilitate the use of state-of-the-art models to conduct robust, repeatable assessments of safety, hazards, and risk. HyRAM+ integrates deterministic and probabilistic models for quantifying leak sizes and rates, predicting physical effects, characterizing hazards (thermal effects from jet fires, overpressure effects from delayed ignition), and assessing impacts on people. HyRAM+ is developed at Sandia National Laboratories to support the development and revision of national and international codes and standards, and to provide developed models in a publicly-accessible toolkit usable by all stakeholders. This document provides a description of the methodology and models contained in HyRAM+ version 5.1. The most significant changes for HyRAM+ version 5.1 from HyRAM+ version 5.0 are updated default leak frequency values for propane, new default component counts for different fuel types, and an improved fuel specification view in the graphical user interface.

02 PETROLEUM↗

WRATS Integrated Data Acquisition System

The Wing and Rotor Aeroelastic Test System (WRATS) data acquisition system (DAS) is a 64-channel data acquisition display and analysis system specifically designed for use with the WRATS 1/5-scale V-22 tiltrotor model of the Bell Osprey. It is the primary data acquisition system for experimental aeroelastic testing of the WRATS model for the purpose of characterizing the aeromechanical and aeroelastic stability of prototype tiltrotor configurations. The WRATS DAS was also used during aeroelastic testing of Bell Helicopter Textron s Quad-Tiltrotor (QTR) design concept, a test which received international attention. The LabVIEW-based design is portable and capable of powering and conditioning over 64 channels of dynamic data at sampling rates up to 1,000 Hz. The system includes a 60-second circular data archive, an integrated model swashplate excitation system, a moving block damping application for calculation of whirl flutter mode subcritical damping, a loads and safety monitor, a pilot-control console display, data analysis capabilities, and instrumentation calibration functions. Three networked computers running custom-designed LabVIEW software acquire data through National Instruments data acquisition hardware. The aeroelastic model (see figure) was tested with the DAS at two facilities at NASA Langley, the Transonic Dynamics Tunnel (TDT) and the Rotorcraft Hover Test Facility (RHTF). Because of the need for seamless transition between testing at these facilities, DAS is portable. The software is capable of harmonic analysis of periodic time history data, Fast Fourier Transform calculations, power spectral density calculations, and on-line calibration of test instrumentation. DAS has a circular buffer archive to ensure critical data is not lost in event of model failure/incident, as well as a sample-and-hold capability for phase-correct time history data.

Piatak, David J.↗

The Legacy of Space Shuttle Flight Software

The initial goals of the Space Shuttle Program required that the avionics and software systems blaze new trails in advancing avionics system technology. Many of the requirements placed on avionics and software were accomplished for the first time on this program. Examples include comprehensive digital fly-by-wire technology, use of a digital databus for flight critical functions, fail operational/fail safe requirements, complex automated redundancy management, and the use of a high-order software language for flight software development. In order to meet the operational and safety goals of the program, the Space Shuttle software had to be extremely high quality, reliable, robust, reconfigurable and maintainable. To achieve this, the software development team evolved a software process focused on continuous process improvement and defect elimination that consistently produced highly predictable and top quality results, providing software managers the confidence needed to sign each Certificate of Flight Readiness (COFR). This process, which has been appraised at Capability Maturity Model (CMM)/Capability Maturity Model Integration (CMMI) Level 5, has resulted in one of the lowest software defect rates in the industry. This paper will present an overview of the evolution of the Primary Avionics Software System (PASS) project and processes over thirty years, an argument for strong statistical control of software processes with examples, an overview of the success story for identifying and driving out errors before flight, a case study of the few significant software issues and how they were either identified before flight or slipped through the process onto a flight vehicle, and identification of the valuable lessons learned over the life of the project.

Hickey, Christopher J.↗

Autonomy Verification & Validation Roadmap and Vision 2045

Advanced capabilities planned for the next generation of autonomous and increasingly autonomous air vehicles will include non-traditional components based on artificial intelligence, machine learning, and complex optimization and planning algorithms. These complex components will be used to provide enhanced safety and high-level decision-making functions. However, there are serious barriers to the deployment of autonomous aircraft in the National Airspace System (NAS). Current civil aviation certification processes are based on the concept that the correct behavior of a system or a component must be completely specified and verified prior to operation. This report from the Autonomy Verification and Validation (V&V) Roadmap and Vision 2045 project presents the most recent effort to build a comprehensive list of verification challenges and needs for autonomous aircraft, a roadmap to meet those autonomy V&V needs, the services they can enable, and point to the certification gaps they fill. To accomplish these goals, we assembled a team of world-class researchers from the aerospace industry (Boeing, Collins Aerospace, and GeneralElectric) and academia (University of Michigan, University of Texas, and Massachusetts Institute of Technology) with deep expertise in autonomy, aerospace systems, and assurance of Artificial Intelligence/machine learning systems.

Software Assurance↗

Automatic Generation of Chemical Mechanisms for Electrochemical Systems: Solid Electrolyte Interphase Formation in Lithium Batteries

Electrolytes in many lithium ion batteries decompose at the low potentials near the anode. The decomposition products form a layer termed the solid electrolyte interphase (SEI). The composition and growth of the SEI layer significantly affect both the capacity fade and safety of lithium ion batteries. However, SEI formation and growth kinetics are not well understood. In this work, we present an extension of the Reaction Mechanism Generator (RMG) software to automatically generate mechanisms for SEI formation. We extend RMG’s solvation correction framework to account for kinetic solvent effects and demonstrate the accuracy of our technique. We calculate thermochemical parameters for 252 species and rate coefficients for 69 reactions, most with associated solvation corrections. This and additional quantum chemistry data are used to extend RMG’s thermodynamic group additivity and solute parameter estimation schemes to handle lithiated species and add 14 new reaction families to RMG. RMG is additionally extended to simulate electrocatalytic systems. Lastly, we demonstrate RMG on the decomposition of acetonitrile and ethylene carbonate near a battery anode. Furthermore, while this framework does not yet resolve individual ions, as appropriate thermochemistry estimators are not available, and thus, cannot yet resolve more complex electrochemical pathways, RMG is able to generate reasonable pathways for SEI formation that match literature pathways and products. In particular, RMG identifies a new important reaction pathway that is not present in literature.

Chemical reactions↗