Formalized pilot study of safety-critical software anomalie
Explore the source record for details and available documents.
anomalies safety spacecraft defect analysis↗
SEARCH · Engineering Papers
Results for “Criticality Safety”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Formalized pilot study of safety-critical software anomalie
Explore the source record for details and available documents.
anomalies safety problem reporting pilot study↗
Work Practice Simulation of Complex Human-Automation Systems in Safety Critical Situations: The Brahms Generalized berlingen Model
The transition from the current air traffic system to the next generation air traffic system will require the introduction of new automated systems, including transferring some functions from air traffic controllers to on-board automation. This report describes a new design verification and validation (V&V) methodology for assessing aviation safety. The approach involves a detailed computer simulation of work practices that includes people interacting with flight-critical systems. The research is part of an effort to develop new modeling and verification methodologies that can assess the safety of flight-critical systems, system configurations, and operational concepts. The 2002 Ueberlingen mid-air collision was chosen for analysis and modeling because one of the main causes of the accident was one crew's response to a conflict between the instructions of the air traffic controller and the instructions of TCAS, an automated Traffic Alert and Collision Avoidance System on-board warning system. It thus furnishes an example of the problem of authority versus autonomy. It provides a starting point for exploring authority/autonomy conflict in the larger system of organization, tools, and practices in which the participants' moment-by-moment actions take place. We have developed a general air traffic system model (not a specific simulation of Überlingen events), called the Brahms Generalized Ueberlingen Model (Brahms-GUeM). Brahms is a multi-agent simulation system that models people, tools, facilities/vehicles, and geography to simulate the current air transportation system as a collection of distributed, interactive subsystems (e.g., airports, air-traffic control towers and personnel, aircraft, automated flight systems and air-traffic tools, instruments, crew). Brahms-GUeM can be configured in different ways, called scenarios, such that anomalous events that contributed to the Überlingen accident can be modeled as functioning according to requirements or in an anomalous condition, as occurred during the accident. Brahms-GUeM thus implicitly defines a class of scenarios, which include as an instance what occurred at Überlingen. Brahms-GUeM is a modeling framework enabling "what if" analysis of alternative work system configurations and thus facilitating design of alternative operations concepts. It enables subsequent adaption (reusing simulation components) for modeling and simulating NextGen scenarios. This project demonstrates that BRAHMS provides the capacity to model the complexity of air transportation systems, going beyond idealized and simple flights to include for example the interaction of pilots and ATCOs. The research shows clearly that verification and validation must include the entire work system, on the one hand to check that mechanisms exist to handle failures of communication and alerting subsystems and/or failures of people to notice, comprehend, or communicate problematic (unsafe) situations; but also to understand how people must use their own judgment in relating fallible systems like TCAS to other sources of information and thus to evaluate how the unreliability of automation affects system safety. The simulation shows in particular that distributed agents (people and automated systems) acting without knowledge of each others' actions can create a complex, dynamic system whose interactive behavior is unexpected and is changing too quickly to comprehend and control.
complex systems↗
Empirical analysis of safety - critical software anomalies post-launch
Explore the source record for details and available documents.
anomalies post-launch software safety↗
Analyzing Software Errors in Safety-Critical Embedded Systems
This paper analyzes the root causes of safty-related software faults identified as potentially hazardous to the system are distributed somewhat differently over the set of possible error causes than non-safety-related software faults.
Software errors↗
Agile Approach to Assuring the Safety-Critical Embedded Software for NASA's Orion Spacecraft
Human-rated missions like those in NASA's Orion Program continue to grow in complexity. The role of software in achieving ambitious mission objectives has expanded dramatically in the last few decades. Assuring the safety and performance of the embedded flight software is quickly growing beyond the reach of traditional methods and resource levels. The methods used to build these software-dominant systems evolve in an on-going attempt to keep pace with the scope of our ambitions. Agile software development is now commonplace. The long timelines and large batches of work associated with traditional methods are being replaced by rapid delivery of small increments _ as system capabilities are realized in waves. Assurance of these critical software capabilities must therefore conquer an ever-expanding frontier of challenges, and do so with an approach matched to the evolving development methods. This paper recounts the journey of the Orion Independent Verification and Validation (IV&V) team as we addressed this dynamic environment. Widening our aperture to encompass a dramatically larger mission scope, while adjusting our cadence to synchronize with the rapid pace of agile software development, a new approach to IV&V is emerging. This approach is characterized by a sharper focus on mission capabilities, matched with a method to dynamically _follow the risk' as the IV&V team delivers more compelling assurance data in waves. Traditional methods prevalent in IV&V tend to scope the work using artifacts of the development process as they evolve from preliminary to final versions, and the pace of delivery was synchronized with the development timelines prevalent in the waterfall lifecycle. That more static approach is out of phase with the demands of the new environment. Scoping work according to the critical capabilities of the system (rather than artifacts of development) and synchronizing with the rapid pace of agile development, we are moving toward more effective parity with the demands of the environment. We explain the concrete steps we took, the principles that motivated our choices, and the results we have achieved to date.
Capability based assurance↗
Software Reliability Issues Concerning Large and Safety Critical Software Systems
This research was undertaken to provide NASA with a survey of state-of-the-art techniques using in industrial and academia to provide safe, reliable, and maintainable software to drive large systems. Such systems must match the complexity and strict safety requirements of NASA's shuttle system. In particular, the Launch Processing System (LPS) is being considered for replacement. The LPS is responsible for monitoring and commanding the shuttle during test, repair, and launch phases. NASA built this system in the 1970's using mostly hardware techniques to provide for increased reliability, but it did so often using custom-built equipment, which has not been able to keep up with current technologies. This report surveys the major techniques used in industry and academia to ensure reliability in large and critical computer systems.
Kamel, Khaled↗
Reliability-Based Design of a Safety-Critical Automation System: A Case Study
In 1986, NASA funded a project to modernize the NASA Ames Research Center Unitary Plan Wind Tunnels, including the replacement of obsolescent controls with a modern, automated distributed control system (DCS). The project effort on this system included an independent safety analysis (ISA) of the automation system. The purpose of the ISA was to evaluate the completeness of the hazard analyses which had already been performed on the Modernization Project. The ISA approach followed a tailoring of the risk assessment approach widely used on existing nuclear power plants. The tailoring of the nuclear industry oriented risk assessment approach to the automation system and its role in reliability-based design of the automation system is the subject of this paper.
Carroll, Carol W.↗
AI/ML Components in Safety-Critical Aviation Systems: Selected Concepts and Underlying Principles
The objective of the AI Roadmap meeting is to engage with all stakeholders in aviation in an open conversation about our approach and the guiding principles that can help us in moving forward in the technological landscape of AI/ML. The objective of the Technical Exchange Meeting is to identify categories of safety concerns associated with having an AI component in the aircraft we identified in the previous Technical Exchange Meetings. The speakers will bring their experience to the discussion to stimulate active participation with all stakeholders.
Design Safety↗
NASA Engineering and Safety Center Technical Bulletin No. 23-01: Including Key Design Features in Safety-Critical Pyrotechnic Firing Circuits
Pyrotechnic systems often fall into a unique category in that inadvertent activation of these systems resulting from a fault and/or lack of safe margins can lead directly to loss of crew. For example, untimely activation of pyrotechnics used for a flight termination system could override an abort capability. Over the years, NASA and the military have learned lessons about safe pyrotechnic circuit design and test, many of which are codified. However, with NASA’s recent efforts to move toward a development model than leans more heavily on Commercial Partners these requirements have not always been directly levied on projects and in some cases been misinterpreted. This bulletin describes key safety features of pyrotechnic firing circuit design and provides rationale for inclusion of each feature.
Pyrotechnic Firing Curcuits↗
Critical safety assurance factors for manned spacecraft - A fire safety perspective
Safety assurance factors for manned spacecraft are discussed with a focus on the Space Station Freedom. A hazard scenario is provided to demonstrate a process commonly used by safety engineers and other analysts to identify onboard safety risks. Fire strategies are described, including a review of fire extinguishing agents being considered for the Space Station. Lessons learned about fire safety technology in other areas are also noted. NASA and industry research on fire safety applications is discussed. NASA's approach to ensuring safety for manned spacecraft is addressed in the context of its multidiscipline program.
Rodney, George A.↗
Development of methodology for qualifying safety critical A286 threaded fasteners
A test program was initiated at the Jet Propulsion Laboratory to experimentally determine the cyclic fatigue life of pre-cracked A286 stainless steel fasteners which just survived a proof test to a prescribed fraction of their ultimate tensile strength. The functional dependency of the cyclic fatigue life of a fastener on the fatigue stress (mean and alternating stresses), fastener size, material tensile strength, and proof load was formulated using the NASA/FLAGRO computer program. It was found that proof load has the strongest effect on fatigue life, while the mean stress has the least effect. The fastener size only has a minor effect, but the alternating stress range has a strong influence on the fatigue life of fasteners. Limited experimental verification of the hypothesized functional relationship is provided in this program for the effect of proof load and fastener size in addition to the analytic verification.
Hsieh, Cheng↗
Collegiate Aviation Research and Education Solutions to Critical Safety Issues
This Conference Proceedings is a collection of 6 abstracts and 3 papers presented April 19-20, 2001 in Denver, CO. The conference focus was "Best Practices and Benchmarking in Collegiate and Industry Programs". Topics covered include: satellite-based aviation navigation; weather safety training; human-behavior and aircraft maintenance issues; disaster preparedness; the collegiate aviation emergency response checklist; aviation safety research; and regulatory status of maintenance resource management.
Bowen, Brent↗
Questioning the Role of Requirements Engineering in the Causes of Safety-Critical Software Failures
Many software failures stem from inadequate requirements engineering. This view has been supported both by detailed accident investigations and by a number of empirical studies; however, such investigations can be misleading. It is often difficult to distinguish between failures in requirements engineering and problems elsewhere in the software development lifecycle. Further pitfalls arise from the assumption that inadequate requirements engineering is a cause of all software related accidents for which the system fails to meet its requirements. This paper identifies some of the problems that have arisen from an undue focus on the role of requirements engineering in the causes of major accidents. The intention is to provoke further debate within the emerging field of forensic software engineering.
Johnson, C. W.↗
Requirements discovery during the testing of safety-critical software
Explore the source record for details and available documents.
requirements testing software↗
From Informal Safety-Critical Requirements to Property-Driven Formal Validation
Most of the efforts in formal methods have historically been devoted to comparing a design against a set of requirements. The validation of the requirements themselves, however, has often been disregarded, and it can be considered a largely open problem, which poses several challenges. The first challenge is given by the fact that requirements are often written in natural language, and may thus contain a high degree of ambiguity. Despite the progresses in Natural Language Processing techniques, the task of understanding a set of requirements cannot be automatized, and must be carried out by domain experts, who are typically not familiar with formal languages. Furthermore, in order to retain a direct connection with the informal requirements, the formalization cannot follow standard model-based approaches. The second challenge lies in the formal validation of requirements. On one hand, it is not even clear which are the correctness criteria or the high-level properties that the requirements must fulfill. On the other hand, the expressivity of the language used in the formalization may go beyond the theoretical and/or practical capacity of state-of-the-art formal verification. In order to solve these issues, we propose a new methodology that comprises of a chain of steps, each supported by a specific tool. The main steps are the following. First, the informal requirements are split into basic fragments, which are classified into categories, and dependency and generalization relationships among them are identified. Second, the fragments are modeled using a visual language such as UML. The UML diagrams are both syntactically restricted (in order to guarantee a formal semantics), and enriched with a highly controlled natural language (to allow for modeling static and temporal constraints). Third, an automatic formal analysis phase iterates over the modeled requirements, by combining several, complementary techniques: checking consistency; verifying whether the requirements entail some desirable properties; verify whether the requirements are consistent with selected scenarios; diagnosing inconsistencies by identifying inconsistent cores; identifying vacuous requirements; constructing multiple explanations by enabling the fault-tree analysis related to particular fault models; verifying whether the specification is realizable.
Cimatti, Alessandro↗
Generating Safety-Critical PLC Code From a High-Level Application Software Specification
The benefits of automatic-application code generation are widely accepted within the software engineering community. These benefits include raised abstraction level of application programming, shorter product development time, lower maintenance costs, and increased code quality and consistency. Surprisingly, code generation concepts have not yet found wide acceptance and use in the field of programmable logic controller (PLC) software development. Software engineers at Kennedy Space Center recognized the need for PLC code generation while developing the new ground checkout and launch processing system, called the Launch Control System (LCS). Engineers developed a process and a prototype software tool that automatically translates a high-level representation or specification of application software into ladder logic that executes on a PLC. All the computer hardware in the LCS is planned to be commercial off the shelf (COTS), including industrial controllers or PLCs that are connected to the sensors and end items out in the field. Most of the software in LCS is also planned to be COTS, with only small adapter software modules that must be developed in order to interface between the various COTS software products. A domain-specific language (DSL) is a programming language designed to perform tasks and to solve problems in a particular domain, such as ground processing of launch vehicles. The LCS engineers created a DSL for developing test sequences of ground checkout and launch operations of future launch vehicle and spacecraft elements, and they are developing a tabular specification format that uses the DSL keywords and functions familiar to the ground and flight system users. The tabular specification format, or tabular spec, allows most ground and flight system users to document how the application software is intended to function and requires little or no software programming knowledge or experience. A small sample from a prototype tabular spec application is shown.
Source record↗
Aircraft Loss-of-Control: Analysis and Requirements for Future Safety-Critical Systems and Their Validation
Loss of control remains one of the largest contributors to fatal aircraft accidents worldwide. Aircraft loss-of-control accidents are complex, resulting from numerous causal and contributing factors acting alone or more often in combination. Hence, there is no single intervention strategy to prevent these accidents. This paper summarizes recent analysis results in identifying worst-case combinations of loss-of-control accident precursors and their time sequences, a holistic approach to preventing loss-of-control accidents in the future, and key requirements for validating the associated technologies.
Belcastro, Christine M.↗