Requirements discovery during the testing of safety-critical software
Explore the source record for details and available documents.
SEARCH · Engineering Papers
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Explore the source record for details and available documents.
A new Li-ion 4.0 Ah pouch cell from GS Yuasa has been tested to determine its performance and safety. The cell is of a laminate pouch design with liquid electrolyte. The rate, thermal and vacuum performance capabilities have been tested to determine the optimum parameters. Under vacuum conditions, the cells were cycled under restrained and unrestrained configurations. The burst pressure of the laminate pouch was also determined. The overcharge, overdischarge into reversal and external short circuit safety tests were also performed to determine the cell s tolerance to abuse. Key Words: Li-ion, safety, vacuum test, abuse, COTS batteries, rate capability
Safety design concepts and hardware in Gemini Test Program
A series of abuse tests on large lithium thionyl chloride cells was initiated. Performance data obtained in testing rectangular 2,000 and 10,000 ampere-hour cells are discussed and graphically presented.
A catalyst containing reactor is being tested using a fuel-rich mixture of Jet A fuel and hot input air. The reactor product is a gaseous fuel that can be utilized in aeropropulsion gas turbine engines. Because the catalyst material is susceptible to damage from high temperature conditions, fuel-rich operating conditions are attained by introducing the fuel first into an inert gas stream in the reactor and then displacing the inert gas with reaction air. Once a desired fuel-to-air ratio is attained, only limited time is allowed for a catalyst induced reaction to occur; otherwise the inert gas is substituted for the air and the fuel flow is terminated. Because there presently is not a gas turbine combustor in which to burn the reactor product gas, the gas is combusted at the outlet of the test facility flare stack. This technique in operations has worked successfully in over 200 tests.
The LiFeS2 test program was part of the study on state-of-the-art batteries/cells available in the commercial market. It was carried out in an effort to replace alkaline AA cells for Shuttle and Station applications. A large number of alkaline cells are used for numerous Shuttle and Station applications as loose cells. Other government agencies reported good performance and abuse tolerance of the AA LiFeS2 cells. In this study, only abuse testing was performed on the cells to determine their tolerance. The tests carried out were over-discharge, external short circuit, heat-to-vent, vibration and drop.
This paper will present an overview of the flight test objectives and performance of the Orion Launch Abort System during Exploration Flight Test-1. Exploration Flight Test-1, the first flight test of the Orion spacecraft, was managed and led by the Orion prime contractor, Lockheed Martin, and launched atop a United Launch Alliance Delta IV Heavy rocket. This flight test was a two-orbit, high-apogee, high-energy entry, low-inclination test mission used to validate and test systems critical to crew safety. This test included the first flight test of the Launch Abort System preforming Orion nominal flight mission critical objectives. NASA is currently designing and testing the Orion Multi-Purpose Crew Vehicle (MPCV). Orion will serve as NASA's new exploration vehicle to carry astronauts to deep space destinations and safely return them to earth. The Orion spacecraft is composed of four main elements: the Launch Abort System, the Crew Module, the Service Module, and the Spacecraft Adapter (Fig. 1). The Launch Abort System (LAS) provides two functions; during nominal launches, the LAS provides protection for the Crew Module from atmospheric loads and heating during first stage flight and during emergencies provides a reliable abort capability for aborts that occur within the atmosphere. The Orion Launch Abort System (LAS) consists of an Abort Motor to provide the abort separation from the Launch Vehicle, an Attitude Control Motor to provide attitude and rate control, and a Jettison Motor for crew module to LAS separation (Fig. 2). The jettison motor is used during a nominal launch to separate the LAS from the Launch Vehicle (LV) early in the flight of the second stage when it is no longer needed for aborts and at the end of an LAS abort sequence to enable deployment of the crew module's Landing Recovery System. The LAS also provides a Boost Protective Cover fairing that shields the crew module from debris and the aero-thermal environment during ascent. Although the Orion Program has tested a number of the critical systems of the Orion spacecraft on the ground, the launch environment cannot be replicated completely on Earth. A number of flight tests have been conducted and are planned to demonstrate the performance and enable certification of the Orion Spacecraft. Exploration Flight Test 1, the first flight test of the Orion spacecraft, was successfully flown on December 5, 2014 from Cape Canaveral Air Force Station's Space Launch Complex 37. Orion's first flight was a two-orbit, high-apogee, high-energy entry, low-inclination test mission used to validate and test systems critical to crew safety, such as heat shield performance, separation events, avionics and software performance, attitude control and guidance, parachute deployment and recovery operations. One of the key separation events tested during this flight was the nominal jettison of the LAS. Data from this flight will be used to verify the function of the jettison motor to separate the Launch Abort System from the crew module so it can continue on with the mission. The LAS nominal jettison event on Exploration Flight Test 1 occurred at six minutes and twenty seconds after liftoff (See Fig. 3). The abort motor and attitude control motors were inert for Exploration Flight Test 1, since the mission did not require abort capabilities. A suite of developmental flight instrumentation was included on the flight test to provide data on spacecraft subsystems and separation events. This paper will focus on the flight test objectives and performance of the LAS during ascent and nominal jettison. Selected LAS subsystem flight test data will be presented and discussed in the paper. Exploration Flight Test -1 will provide critical data that will enable engineering to improve Orion's design and reduce risk for the astronauts it will protect as NASA continues to move forward on its human journey to Mars. The lessons learned from Exploration Flight Test 1 and the other Flight Test Vehicles will certainly contribute to the vehicle architecture of a human-rated space launch vehicle.
Tests were conducted with the N.A.C.A. combustion apparatus to determine the effect of compression ratio and engine temperature on the vaporization of a hydrogenated "safety fuel" during the compression stroke under conditions similar to those in a spark-ignition engine. The effects of fuel boiling temperature on vaporization using gasoline, safety fuel, and Diesel fuel oil was also investigated. The results show that increasing the compression ratio has little effect on the rate of fuel vaporization, but that increasing the air temperature by increasing the engine temperature increases the rate of fuel vaporization. The results also show that the vaporized fuel forms a homogeneous mixture with the air more rapidly that does the atomized fuel spray.
The development of the National Aeronautics and Space Administration s (NASA) Ultra Long Duration Balloon (ULDB) has made significant strides in addressing the deployment issues experienced in the scaling up of the balloon structure. This paper concentrates on the super-pressure balloon developments that have been, and are currently being planned by the NASA Balloon Program Office at Goddard Space Flight Center s Wallops Flight Facility. The goal of the NASA ULDB development project is to attempt to extend the potential flight durations for large scientific balloon payloads. A summary of the February 2005 test flight from Ft. Sumner, New Mexico will be presented. This test flight spurred a number of investigations and advancements for this project. The development path has pursued some new approaches in the design, analysis, and testing of the balloons. New issues have been ideEti6ed throu& both analysis md testing. These have been addressed in the design stage before the next balloon construction was begun. This paper will give an overview of the recent history for this effort and the development approach pursued for ULDB. A description of the balloon design, including the modifications made as a result of the lessons learned, will be presented. Areas to be presented include the design approach, deployment issues that have been encountered and the proposed solutions, ground testing, photogrammetry, and an analysis overview. Test flight planning and considerations will be presented including test flight safety. An extended duration test flight of the National Aeronautics and Space Administration s Ultra Long Duration Balloon is planned for the May/June 2006 time frame. This flight is expected to fly from Sweden to either Canada or Alaska. Preliminary results of this flight will be presented as available. Future plans for both ground testing and additional test flights will also be presented. Goals of the future test flights, which are staged in increments of increasing suspended load and altitude, will be presented. This will include the projected balloon volumes, payload capabilities, test flight locations, and proposed flight schedule.
The Crew Exploration Vehicle Parachute Assembly System (CPAS) is the parachute system for NASA s Orion spacecraft. The test program consists of numerous drop tests, wherein a test article rigged with parachutes is extracted or released from an aircraft. During such tests, range safety is paramount, as is the recoverability of the parachutes and test article. It is crucial to establish an aircraft release point that will ensure that the article and all items released from it will land in safe locations. A new footprint predictor tool, called Sasquatch, was created in MATLAB. This tool takes in a simulated trajectory for the test article, information about all released objects, and atmospheric wind data (simulated or actual) to calculate the trajectories of the released objects. Dispersions are applied to the landing locations of those objects, taking into account the variability of winds, aircraft release point, and object descent rate. Sasquatch establishes a payload release point (e.g., where the payload will be extracted from the carrier aircraft) that will ensure that the payload and all objects released from it will land in a specified cleared area. The landing locations (the final points in the trajectories) are plotted on a map of the test range. Sasquatch was originally designed for CPAS drop tests and includes extensive information about both the CPAS hardware and the primary test range used for CPAS testing. However, it can easily be adapted for more complex CPAS drop tests, other NASA projects, and commercial partners. CPAS has developed the Sasquatch footprint tool to ensure range safety during parachute drop tests. Sasquatch is well correlated to test data and continues to ensure the safety of test personnel as well as the safe recovery of all equipment. The tool will continue to be modified based on new test data, improving predictions and providing added capability to meet the requirements of more complex testing.
This paper concerns itself with identifying safety problems associated with launch operations conducted during preparations for manned space flights at Cape Kennedy. This includes transportation and assembly of large space vehicles in the Vehicle Assembly Building, rollout to Launch Pad 39, test, checkout, and the launch countdown. Under these broad categories, the risks of fuel and oxidizer loading, installation of pyrotechnics, and similar hazardous operations are discussed. The many aspects for fire and rescue requirements are examined. These encompass the water deluge systems on the Mobile Service Structure and the Mobile Launcher, the insulated fire and rescue tractor, slide wire escape system, fire proximity suits, self-contained breathing apparatus and emergency cutting tools. In addition, written procedures for tests, emergencies, rescue and backout, as well as certification of personnel and TV monitoring of the launch system are detailed.-
The paper is concerned with the need for a comprehensive test plan for the Space Station Freedom (SST) that would fully verify specification compliance and be based on an error budget. In particular, attention is given to some lessons learned from other NASA programs and the principal challenges for SSF testing, including phase C/D/E agreements, testing parameters, phase testing, and the human element. The importance of close teamwork between the NASA/Contractor systems engineers and assurance engineers is emphasized.
The portable hydrazine attitude propulsion module is described that was designed and developed to support the attitude control pitch axis simulation tests performed on an air bearing table for the thermoelectric outer planet spacecraft program. The propulsion module was a self-contained, liquid hydrazine propulsion system from which the exhausted gases were generated within the catalyst bed of either of two nominal 0.22-N opposing thrusters. The module, which was designed for convenient assembly onto and removal from an air bearing table, was tested to establish its operational safety. This test history and the very conservative design of the module enabled it to be man-rated for operation in the presence of personnel. The report briefly summarizes the system operations during air bearing table tests, presents a detailed description of the propulsion module hardware, and discussing the system evolution.
This paper presents an overview of the flight test objectives and performance of the Orion Launch Abort System during Exploration Flight Test-1. Exploration Flight Test-1, the first flight test of the Orion spacecraft, was managed and led by the Orion prime contractor, Lockheed Martin, and launched atop a United Launch Alliance Delta IV Heavy rocket. This flight test was a two-orbit, high-apogee, high-energy entry, low-inclination test mission used to validate and test systems critical to crew safety. This test included the first flight test of the Launch Abort System performing Orion nominal flight mission critical objectives. Although the Orion Program has tested a number of the critical systems of the Orion spacecraft on the ground, the launch environment cannot be replicated completely on Earth. Data from this flight will be used to verify the function of the jettison motor to separate the Launch Abort System from the crew module so it can continue on with the mission. Selected Launch Abort System flight test data is presented and discussed in the paper. Through flight test data, Launch Abort System performance trends have been derived that will prove valuable to future flights as well as the manned space program.
The ASTM G72/G72M-15 Standard Test Method for Autogenous Ignition Temperature of Liquids and Solids in a High-Pressure Oxygen-Enriched Environment is currently used to evaluate materials for the ignition susceptibility driven by exposure to external heat in an enriched oxygen environment. Testing performed on highly volatile liquids such as cleaning solvents has proven problematic due to inconsistent test results (non-ignitions). Non-ignition results can be misinterpreted as favorable oxygen compatibility, although they are more likely associated with inadequate fuel-to-oxidizer ratios. Forced evaporation during purging and inadequate sample size were identified as two potential causes for inadequate available sample material during testing. In an effort to maintain adequate fuel-to-oxidizer ratios within the reaction vessel during test, several parameters were considered, including sample size, pretest sample chilling, pretest purging, and test pressure. Tests on a variety of solvents exhibiting a range of volatilities are presented in this paper. A proposed improvement to the standard test protocol as a result of this evaluation is also presented. Execution of the final proposed improved test protocol outlines an incremental step method of determining optimal conditions using increased sample sizes while considering test system safety limits. The proposed improved test method increases confidence in results obtained by utilizing the ASTM G72 autogenous ignition temperature test method and can aid in the oxygen compatibility assessment of highly volatile liquids and other conditions that may lead to false non-ignition results.
The ASTM G72/G72M-15 Standard Test Method for Autogenous Ignition Temperature of Liquids and Solids in a High-Pressure Oxygen-Enriched Environment is currently used to evaluate materials for the ignition susceptibility driven by exposure to external heat in an enriched oxygen environment. Testing performed on highly volatile liquids such as cleaning solvents has proven problematic due to inconsistent test results (non-ignitions). Non-ignition results can be misinterpreted as favorable oxygen compatibility, although they are more likely associated with inadequate fuel-to-oxidizer ratios. Forced evaporation during purging and inadequate sample size were identified as two potential causes for inadequate available sample material during testing. In an effort to maintain adequate fuel-to-oxidizer ratios within the reaction vessel during test, several parameters were considered, including sample size, pretest sample chilling, pretest purging, and test pressure. Tests on a variety of solvents exhibiting a range of volatilities are presented in this paper. A proposed improvement to the standard test protocol as a result of this evaluation is also presented. Execution of the final proposed improved test protocol outlines an incremental step method of determining optimal conditions using increased sample sizes while considering test system safety limits. The proposed improved test method increases confidence in results obtained by utilizing the ASTM G72 autogenous ignition temperature test method and can aid in the oxygen compatibility assessment of highly volatile liquids and other conditions that may lead to false non-ignition results.
This report describes the first aircraft test of the Autonomous Flight Safety System (AFSS). The test was conducted on September 27, 2005, near Kennedy Space Center (KSC) using a privately-owned single-engine plane and evaluated the performance of several basic flight safety rules using real-time data onboard a moving aerial vehicle. This test follows the first road test of AFSS conducted in February 2005 at KSC. AFSS is a joint KSC and Wallops Flight Facility (WEF) project that is in its third phase of development. AFSS is an independent subsystem intended for use with Expendable Launch Vehicles that uses tracking data from redundant onboard sensors to autonomously make flight termination decisions using software-based rules implemented on redundant flight processors. The goals of this project are to increase capabilities by allowing launches from locations that do not have or cannot afford extensive ground-based range safety assets, to decrease range costs, and to decrease reaction time for special situations. The mission rules are configured for each operation by the responsible Range Safety authorities and can be loosely categorized in four major categories: Parameter Threshold Violations, Physical Boundary Violations present position and instantaneous impact point (TIP), Gate Rules static and dynamic, and a Green-Time Rule. Examples of each of these rules were evaluated during this aircraft test.
Presentation will: (1) Examine applicable life safety requirements and the context in which they were evaluated (2) Means by which occupant safety was ensured