Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Criticality Safety”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 91 records · Page 5

Health Monitor for Multitasking, Safety-Critical, Real-Time Software

Health Manager can detect Bad Health prior to a failure occurring by periodically monitoring the application software by looking for code corruption errors, and sanity-checking each critical data value prior to use. A processor s memory can fail and corrupt the software, or the software can accidentally write to the wrong address and overwrite the executing software. This innovation will continuously calculate a checksum of the software load to detect corrupted code. This will allow a system to detect a failure before it happens. This innovation monitors each software task (thread) so that if any task reports "bad health," or does not report to the Health Manager, the system is declared bad. The Health Manager reports overall system health to the outside world by outputting a square wave signal. If the square wave stops, this indicates that system health is bad or hung and cannot report. Either way, "bad health" can be detected, whether caused by an error, corrupted data, or a hung processor. A separate Health Monitor Task is started and run periodically in a loop that starts and stops pending on a semaphore. Each monitored task registers with the Health Manager, which maintains a count for the task. The registering task must indicate if it will run more or less often than the Health Manager. If the task runs more often than the Health Manager, the monitored task calls a health function that increments the count and verifies it did not go over max-count. When the periodic Health Manager runs, it verifies that the count did not go over the max-count and zeroes it. If the task runs less often than the Health Manager, the periodic Health Manager will increment the count. The monitored task zeroes the count, and both the Health Manager and monitored task verify that the count did not go over the max-count.

Zoerner, Roger↗

Safety-Critical Partitioned Software Architecture: A Partitioned Software Architecture for Robotic

The flight software on virtually every mission currently managed by JPL has several major flaws that make it vulnerable to potentially fatal software defects. Many of these problems can be addressed by recently developed partitioned operating systems (OS). JPL has avoided adopting a partitioned operating system on its flight missions, primarily because doing so would require significant changes in flight software design, and the risks associated with changes of that magnitude cannot be accepted by an active flight project. The choice of a partitioned OS can have a dramatic effect on the overall system and software architecture, allowing for realization of benefits far beyond the concerns typically associated with the choice of OS. Specifically, we believe that a partitioned operating system, when coupled with an appropriate architecture, can provide a strong infrastructure for developing systems for which reusability, modifiability, testability, and reliability are essential qualities. By adopting a partitioned OS, projects can gain benefits throughout the entire development lifecycle, from requirements and design, all the way to implementation, testing, and operations.

(Avionics Application Standard Software Interface ↗

Certification of Safety-Critical Software Under DO-178C and DO-278A

The RTCA has recently released DO-178C and DO-278A as new certification guidance for the production of airborne and ground-based air traffic management software, respectively. Additionally, RTCA special committee SC-205 has also produced, at the same time, five other companion documents. These documents are RTCA DO-248C, DO-330, DO-331, DO- 332, and DO-333. These supplements address frequently asked questions about software certification, provide guidance on tool qualification requirements, and illustrate the modifications recommended to DO-178C when using model-based software design, object oriented programming, and formal methods. The objective of this paper is to first explain the relationship of DO-178C to the former DO-178B in order to give those familiar with DO- 178B an indication of what has been changed and what has not been changed. With this background, the relationship of DO-178C and DO-278 to the new DO-278A document for ground-based software development is shown. Last, an overview of the new guidance contained in the tool qualification document and the three new supplements to DO-178C and DO-278A is presented. For those unfamiliar with DO-178B, this paper serves to provide an entry point to this new certification guidance for airborne and ground-based CNS/ATM software certification.

Jacklin, Stephen A.↗

Machine-Learning for Safety Critical Airborne Applications Part II: Case Study

The exceptional progress in the field of Artificial Intelligence (AI) systems, enabled by Machine Learning (ML) technology in recent years provides historic opportunities for the aviation industry. Current certification standards for avionics were developed prior to the ML renaissance and have several fundamental incompatibilities with the ML technology. WG-114 is working hard to release a new standard as soon as possible but for now there is no recognized means of compliance for ML based systems even of low criticality. In this talk, we present the custom ML workflow that can be used comply with all objectives of the current certification standards for a low-criticality (DAL D and C) ML-based system. To illustrate the practical application of the custom ML workflow we present a case study of a system based on a Deep Neural Network (DNN) intended to detect and identify airport runway signs. We present the system design, data generation, training, and verification in detail and describe how the design assurance objectives can be met for a DAL D and DAL C systems.

Johann Schumann↗

Investigating the Effects of Exposure to Blue-Enriched Light or Peppermint Odor on Alertness, Mood, and Performance Upon Awakening from Deep Sleep at Night

Introduction: Sleep inertia refers the transient neurobehavioral impairments experienced immediately after waking from sleep. This period of reduced alertness and performance poses a significant safety risk to on-call workers who may be required to perform a safety-critical task immediately after waking (e.g., emergency services, health care, and military). In these operations, the need for a rapid return to full alertness is critical to mission safety and success. Several factors may exacerbate sleep inertia, resulting in greater impairment upon waking, including: waking from deep sleep, (i.e., slow wave sleep, SWS), waking at night, and waking following prior sleep loss. Awakenings under these conditions are common for on-call and extended shift workers who may need to perform safety-critical tasks soon after waking from unprotected sleep opportunities. Therefore, there is a need for evidence-based reactive countermeasures (i.e., used upon waking) to the cognitive consequences sleep inertia. Specifically, countermeasures that can rapidly restore alertness and performance immediately following sleep. A recent review of the literature on reactive countermeasures highlighted several research gaps and promising candidates for further investigation. The review also emphasized the need for countermeasures that are operationally viable and readily deployed in occupational settings. This study aims to address the identified gaps and limitations by assessing the efficacy of exposure to two known acute alerting stimuli - blue-enriched light and peppermint odor - to improve cognitive performance, alertness, and mood immediately after waking from SWS at night. Materials and Methods: Twelve participants completed a two-week within-subject, randomized, cross-over intervention study including two in-laboratory overnight visits. During each experimental week, the subjects experienced one intervention (light or peppermint) and a control condition upon awakening from SWS at night. The presentation order of the two conditions (intervention or control) at wake-up and the order of intervention (light or peppermint) by week was randomized by sex. Prior to each in-laboratory visit, participants maintained a sleep schedule of 8.5 h for 5 nights and 5 h for one night. Compliance with this sleep schedule was confirmed by actigraphy. In the laboratory, participants went to bed at their habitual bedtime and were monitored by standard polysomnography. After at least five minutes of continuous SWS, participants were awoken and exposed, in a randomized order, to either the control or intervention condition. During the hour after awakening from SWS (at 2, 17, 32, and 47 minutes after waking), participants completed a battery of tasks including a 5-minute psychomotor vigilance task (PVT), a subjective scale of alertness (Karolinska Sleepiness Scale, KSS), and visual analogue scales (VAS) of mood. Following this sleep inertia measurement period, all lights were turned off and participants were allowed to return to sleep. They were then awoken again from their subsequent SWS period and exposed to the alternative condition (control or intervention). Following this second awakening, participants were allowed to sleep until their habitual wake time and were then released from the laboratory. Participants then followed the at-home sleep schedule and returned to the laboratory for the second intervention (light or peppermint) following the procedures described above. The light intervention involved exposure to a blue-enriched light canvas illuminated for 1 hour at a distance of ~56 cm from the participant (~200 lux and ~60 melanopic lux at angle of gaze). For the peppermint intervention, peppermint oil was pipetted onto a mask, and participants inhaled the odor with the mask covering the nose and mouth for 1 minute. The control condition for both weeks involved a dim, red ambient light (<1 lux). An odorless mask, without any oil pipetted onto the mask, was also worn in the peppermint control condition. Results: Compared to the control condition, participants exposed to blue-enriched light had fewer PVT lapses (χ2 = 5.285, p = .022), reported feeling more alert (KSS: F1,77 = 4.955, p = .029; VASalert: F1,77 = 8.226, p = .005), and had improved mood (VAScheerful: F1,77 = 8.615, p = .004; VASdepressed: F1,77 = 4.649, p = .034; VASlethargic: F1,77 = 5.652, p = .020). Exposure to peppermint oil did not improve any outcome measures on any of the tasks compared to control condition (p > .05). Conclusions: We found that participants had fewer lapses of attention upon awakening when exposed to blue-enriched light compared to dim, red light. In addition, participants reported feeling more alert, more cheerful, less depressed, and less lethargic in the blue-enriched light condition. Brief exposure to a peppermint odor, however, did not appear to improve performance, alertness, or mood under the experimental conditions. Our null results in the peppermint condition may have been due to methodological limitations such as the duration and method of administration. Given the need to mitigate the potential impact of sleep inertia on safety-critical tasks in on-call operations, our findings suggest that blue-enriched light exposure upon awakening may help to improve performance and alertness during the sleep inertia period following awakening from deep, nocturnal sleep. We are currently exploring the potential mechanisms for the effect of light on cognitive performance upon awakening as well as investigating its application in real-world settings to explore the translational efficacy of this countermeasure to occupational environments. Continued exploration into light and other reactive countermeasures, and potentially their combination, is needed in order to provide evidence-based guidance on effective sleep inertia countermeasures to improve the alertness and performance of those required to perform safety-critical tasks soon after waking.

sleep inertia↗

Modeling and Analysis of Mixed Synchronous/Asynchronous Systems

Practical safety-critical distributed systems must integrate safety critical and non-critical data in a common platform. Safety critical systems almost always consist of isochronous components that have synchronous or asynchronous interface with other components. Many of these systems also support a mix of synchronous and asynchronous interfaces. This report presents a study on the modeling and analysis of asynchronous, synchronous, and mixed synchronous/asynchronous systems. We build on the SAE Architecture Analysis and Design Language (AADL) to capture architectures for analysis. We present preliminary work targeted to capture mixed low- and high-criticality data, as well as real-time properties in a common Model of Computation (MoC). An abstract, but representative, test specimen system was created as the system to be modeled.

Driscoll, Kevin R.↗

Brazed Joints Design and Allowables: Discuss Margins of Safety in Critical Brazed Structures

This slide presentation tutorial discusses margins of safety in critical brazed structures. It reviews: (1) the present situation (2) definition of strength (3) margins of safety (4) design allowables (5) mechanical testing (6) failure criteria (7) design flowchart (8) braze gap (9) residual stresses and (10) delayed failures. This presentation addresses the strength of the brazed joints, the methods of mechanical testing, and our ability to evaluate the margins of safety of the brazed joints as it applies to the design of critical and expensive brazed assemblies.

FLom, Yury↗

Usability Evaluation of a Flight-Deck Airflow Hazard Visualization System

Many aircraft accidents each year are caused by encounters with unseen airflow hazards near the ground, such as vortices, downdrafts, low level wind shear, microbursts, or turbulence from surrounding vegetation or structures near the landing site. These hazards can be dangerous even to airliners; there have been hundreds of fatalities in the United States in the last two decades attributable to airliner encounters with microbursts and low level wind shear alone. However, helicopters are especially vulnerable to airflow hazards because they often have to operate in confined spaces and under operationally stressful conditions (such as emergency search and rescue, military or shipboard operations). Providing helicopter pilots with an augmented-reality display visualizing local airflow hazards may be of significant benefit. However, the form such a visualization might take, and whether it does indeed provide a benefit, had not been studied before our experiment. We recruited experienced military and civilian helicopter pilots for a preliminary usability study to evaluate a prototype augmented-reality visualization system. The study had two goals: first, to assess the efficacy of presenting airflow data in flight; and second, to obtain expert feedback on sample presentations of hazard indicators to refine our design choices. The study addressed the optimal way to provide critical safety information to the pilot, what level of detail to provide, whether to display specific aerodynamic causes or potential effects only, and how to safely and effectively shift the locus of attention during a high-workload task. Three-dimensional visual cues, with varying shape, color, transparency, texture, depth cueing, and use of motion, depicting regions of hazardous airflow, were developed and presented to the pilots. The study results indicated that such a visualization system could be of significant value in improving safety during critical takeoff and landing operations, and also gave clear indications of the best design choices in producing the hazard visual cues.

Aragon, Cecilia R.↗

Prognostics and Health Monitoring in Li-Ion Batteries and Capacitors Using Physics-Based Modeling Approach

In order to tackle and solve the prediction problem of the lifetime of Li-ion batteries, it is essential to have awareness of the current state and health of the battery pack. To be able to accurately predict the future state of any system, one must possess knowledge of its current and future operations. Using derived models of the current and future system behavior, a model-based prognostics approach can be implemented as a solution to the prediction problem. As more and more autonomous electric vehicles progressively emerge in our daily life, a very critical challenge lies in accurate prediction of remaining useful life of the systems/subsystems. Batteries, power electronics conditioning systems, and motors are integrated to form the powertrain in electric vehicles; one of the most critical systems. In the case of electric aircrafts, computing remaining flying time is critical for safety, since an aircraft that runs out of power (battery charge) while in the air will eventually lose control leading to catastropheThis presentation covers a physics-based modeling approach implemented for case studies in capacitor and battery prognostics which are an integral part of an electrical powertrain system. The general approach of model-based prognostics will be examined as a potential solution for safety critical problems related to battery state of charge and state of health.

Physics based modeling↗

NASA's Software Safety Standard

NASA relies more and more on software to control, monitor, and verify its safety critical systems, facilities and operations. Since the 1960's there has hardly been a spacecraft launched that does not have a computer on board that will provide command and control services. There have been recent incidents where software has played a role in high-profile mission failures and hazardous incidents. For example, the Mars Orbiter, Mars Polar Lander, the DART (Demonstration of Autonomous Rendezvous Technology), and MER (Mars Exploration Rover) Spirit anomalies were all caused or contributed to by software. The Mission Control Centers for the Shuttle, ISS, and unmanned programs are highly dependant on software for data displays, analysis, and mission planning. Despite this growing dependence on software control and monitoring, there has been little to no consistent application of software safety practices and methodology to NASA's projects with safety critical software. Meanwhile, academia and private industry have been stepping forward with procedures and standards for safety critical systems and software, for example Dr. Nancy Leveson's book Safeware: System Safety and Computers. The NASA Software Safety Standard, originally published in 1997, was widely ignored due to its complexity and poor organization. It also focused on concepts rather than definite procedural requirements organized around a software project lifecycle. Led by NASA Headquarters Office of Safety and Mission Assurance, the NASA Software Safety Standard has recently undergone a significant update. This new standard provides the procedures and guidelines for evaluating a project for safety criticality and then lays out the minimum project lifecycle requirements to assure the software is created, operated, and maintained in the safest possible manner. This update of the standard clearly delineates the minimum set of software safety requirements for a project without detailing the implementation for those requirements. This allows the projects leeway to meet these requirements in many forms that best suit a particular project's needs and safety risk. In other words, it tells the project what to do, not how to do it. This update also incorporated advances in the state of the practice of software safety from academia and private industry. It addresses some of the more common issues now facing software developers in the NASA environment such as the use of Commercial-Off-the-Shelf Software (COTS), Modified OTS (MOTS), Government OTS (GOTS), and reused software. A team from across NASA developed the update and it has had both NASA-wide internal reviews by software engineering, quality, safety, and project management. It has also had expert external review. This presentation and paper will discuss the new NASA Software Safety Standard, its organization, and key features. It will start with a brief discussion of some NASA mission failures and incidents that had software as one of their root causes. It will then give a brief overview of the NASA Software Safety Process. This will include an overview of the key personnel responsibilities and functions that must be performed for safety-critical software.

Ramsay, Christopher M.↗

Cyclomatic Complexity and Basis Path Testing Study

The NASA Chief Engineer requested the NASA Engineering and Safety Center (NESC) to conduct a study to determine the benefits of cyclomatic complexity and basis path testing (BPT) for software and whether they should be required. The principal focus of the assessment was to assess the use of cyclomatic complexity and BPT on safety-critical software. The purpose was to ensure that safety-critical software is not overly complicated to the point of increasing coding errors and that verification is more robust than for non-safety-critical software. This document contains the outcome of the assessment.

Cyclomatic Complexity; NASA Engineering and Safety↗