Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Criticality Safety”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 937 records · Page 52
All sourcesNASA NTRSDOE OSTI
NASA NTRS1981

Reliability analysis of the F-8 digital fly-by-wire system

The F-8 Digital Fly-by-Wire (DFBW) flight test program intended to provide the technology for advanced control systems, giving aircraft enhanced performance and operational capability is addressed. A detailed analysis of the experimental system was performed to estimated the probabilities of two significant safety critical events: (1) loss of primary flight control function, causing reversion to the analog bypass system; and (2) loss of the aircraft due to failure of the electronic flight control system. The analysis covers appraisal of risks due to random equipment failure, generic faults in design of the system or its software, and induced failure due to external events. A unique diagrammatic technique was developed which details the combinatorial reliability equations for the entire system, promotes understanding of system failure characteristics, and identifies the most likely failure modes. The technique provides a systematic method of applying basic probability equations and is augmented by a computer program written in a modular fashion that duplicates the structure of these equations.

Brock, L. D.↗
NASA NTRS1981

Hierarchical specification of the SIFT fault tolerant flight control system

The specification and mechanical verification of the Software Implemented Fault Tolerance (SIFT) flight control system is described. The methodology employed in the verification effort is discussed, and a description of the hierarchical models of the SIFT system is given. To meet the objective of NASA for the reliability of safety critical flight control systems, the SIFT computer must achieve a reliability well beyond the levels at which reliability can be actually measured. The methodology employed to demonstrate rigorously that the SIFT computer meets as reliability requirements is described. The hierarchy of design specifications from very abstract descriptions of system function down to the actual implementation is explained. The most abstract design specifications can be used to verify that the system functions correctly and with the desired reliability since almost all details of the realization were abstracted out. A succession of lower level models refine these specifications to the level of the actual implementation, and can be used to demonstrate that the implementation has the properties claimed of the abstract design specifications.

Melliar-Smith, P. M.↗
NASA NTRS1981

Design and verification of a multiple fault tolerant control system for STS applications using computer simulation

General Dynamics/Convair is under NASA contract to integrate the Centaur upper stage into the space transportation system for future planetary missions. This requires that control of all safety critical functions be two-failure tolerant. The control system developed consists of five asynchronous computers, each contributing at their outputs to a 3-out-of-5 voting plane. Subsystem control is based on an end function redundancy management scheme. Analysis of multiple component failures and worst-case time-phase asynchrony among the computers is performed by a real-time computer simulation. The simulation emulates the hardware and subsystem interfaces, wire by wire, providing assessibility to any component for the insertion of preprogrammed failures. Observability is provided via a graphics system and diagnostic software. The simulation provides an engineering tool where the integrity of control system hardware and imbedded software can be demonstrated.

Szatkowski, G. P.↗
NASA NTRS1983

Development of software fault-tolerance techniques

As computers become more widely used, and in particular as they become used in more safety critical applications, the reliability of the computer system and its software becomes more important. There is also an increasing need for high levels of reliability in applications involving very large numbers of inexpensive units where recall of the units would be disproportionately expensive. The nature of faults and the assumptions made by different approaches to correct operation are considered. The recovery block approach is described and a probabilistic analysis of its effectiveness, with and without correlated design errors is provided. Mechanisms for generating acceptance tests from specifications, and for providing recovery in the presence of asynchrony, are described. An analysis of, and design for, the provision of recovery blocks in the microprogram of the Bendix BDX930 processor is provided. An example of the use of recovery blocks in a simple operating system is also provided.

Melliar-Smith, P. M.↗
NASA NTRS1984

Development and analysis of the Software Implemented Fault-Tolerance (SIFT) computer

SIFT (Software Implemented Fault Tolerance) is an experimental, fault-tolerant computer system designed to meet the extreme reliability requirements for safety-critical functions in advanced aircraft. Errors are masked by performing a majority voting operation over the results of identical computations, and faulty processors are removed from service by reassigning computations to the nonfaulty processors. This scheme has been implemented in a special architecture using a set of standard Bendix BDX930 processors, augmented by a special asynchronous-broadcast communication interface that provides direct, processor to processor communication among all processors. Fault isolation is accomplished in hardware; all other fault-tolerance functions, together with scheduling and synchronization are implemented exclusively by executive system software. The system reliability is predicted by a Markov model. Mathematical consistency of the system software with respect to the reliability model has been partially verified, using recently developed tools for machine-aided proof of program correctness.

Goldberg, J.↗
NASA NTRS1985

Guidelines for structural verification and fracture control of Shuttle payloads

The procedures followed by the NASA Office of the Chief Engineer in developing the guidelines concerning the structures, materials, and fracture control of the Space Shuttle payloads are described. Factors controlling the payload launch safety, such as crew and passenger safety, reusability, and mixes of payloads in a single launch are emphasized. Special consideration is given to the STS design and testing approaches, materials considerations, safety criticality review processes, nondestructive evaluation inspection for STS payload fracture control, fracture mechanics screening procedures, and components of special concern (e.g., pressurized vessels, fasteners, and composite structures).

Lifer, C. E.↗
NASA NTRS1986

Mars Observer: Phase 0 safety review data package

The Mars Observer Program has as its primary objectives a study of the geochemistry, atmospheric dynamics, atmosphere/surface interactions, seasonal variations, and magnetic field characteristics of Mars. The Mars Observer Spacecraft, safety critical spacecraft subsystems, ground support equipment, ground operations scenario, requirements matrix, and equipment specifications are described.

Source record↗
NASA NTRS1987

Design verification of SIFT

A SIFT reliable aircraft control computer system, designed to meet the ultrahigh reliability required for safety critical flight control applications by use of processor replications and voting, was constructed for SRI, and delivered to NASA Langley for evaluation in the AIRLAB. To increase confidence in the reliability projections for SIFT, produced by a Markov reliability model, SRI constructed a formal specification, defining the meaning of reliability in the context of flight control. A further series of specifications defined, in increasing detail, the design of SIFT down to pre- and post-conditions on Pascal code procedures. Mechanically checked mathematical proofs were constructed to demonstrate that the more detailed design specifications for SIFT do indeed imply the formal reliability requirement. An additional specification defined some of the assumptions made about SIFT by the Markov model, and further proofs were constructed to show that these assumptions, as expressed by that specification, did indeed follow from the more detailed design specifications for SIFT. This report provides an outline of the methodology used for this hierarchical specification and proof, and describes the various specifications and proofs performed.

Moser, Louise↗
NASA NTRS1988

A design and implementation methodology for diagnostic systems

A methodology for design and implementation of diagnostic systems is presented. Also discussed are the advantages of embedding a diagnostic system in a host system environment. The methodology utilizes an architecture for diagnostic system development that is hierarchical and makes use of object-oriented representation techniques. Additionally, qualitative models are used to describe the host system components and their behavior. The methodology architecture includes a diagnostic engine that utilizes a combination of heuristic knowledge to control the sequence of diagnostic reasoning. The methodology provides an integrated approach to development of diagnostic system requirements that is more rigorous than standard systems engineering techniques. The advantages of using this methodology during various life cycle phases of the host systems (e.g., National Aerospace Plane (NASP)) include: the capability to analyze diagnostic instrumentation requirements during the host system design phase, a ready software architecture for implementation of diagnostics in the host system, and the opportunity to analyze instrumentation for failure coverage in safety critical host system operations.

Williams, Linda J. F.↗
NASA NTRS1989

Predicting software reliability

A detailed look is given to software reliability techniques. A conceptual model of the failure process is examined, and some software reliability growth models are discussed. Problems for which no current solutions exist are addressed, emphasizing the very difficult problem of safety-critical systems for which the reliability requirements can be enormously demanding.

Littlewood, B.↗
NASA NTRS1987

RICIS research

The principle focus of one of the RICIS (Research Institute for Computing and Information Systems) components is computer systems and software engineering in-the-large of the lifecycle of large, complex, distributed systems which: (1) evolve incrementally over a long time; (2) contain non-stop components; and (3) must simultaneously satisfy a prioritized balance of mission and safety critical requirements at run time. This focus is extremely important because of the contribution of the scaling direction problem to the current software crisis. The Computer Systems and Software Engineering (CSSE) component addresses the lifestyle issues of three environments: host, integration, and target.

Mckay, Charles W.↗
NASA NTRS1991

Portable Common Execution Environment (PCEE) project review: Peer review

The purpose of the review was to conduct an independent, in-depth analysis of the PCEE project and to provide the results of said review. The review team was tasked with evaluating the potential contribution of the PCEE project to the improvement of the life cycle support of mission and safety critical (MASC) computing components for large, complex, non-stop, distributed systems similar to those planned for such NASA programs as the space station, lunar outpost, and manned missions to Mars. Some conclusions of the review team are as follow: The PCEE project was given high marks for its breath of vision on the overall problem with MASC software; Correlated with the sweeping vision, the Review Team is very skeptical that any research project can successfully attack such a broad range of problems; and several recommendations are made such as to identify the components of the broad solution envisioned, prioritizing them with respect to their impact and the likely ability of the PCEE or others to attack them successfully, and to rewrite its Concept Document differentiating the problem description, objectives, approach, and results so that the project vision becomes assessible to others.

Locke, C. Douglass↗
NASA NTRS1991

Report on the formal specification and partial verification of the VIPER microprocessor

The formal specification and partial verification of the VIPER microprocessor is reviewed. The VIPER microprocessor was designed by RSRE, Malvern, England, for safety critical computing applications (e.g., aircraft, reactor control, medical instruments, armaments). The VIPER was carefully specified and partially verified in an attempt to provide a microprocessor with completely predictable operating characteristics. The specification of VIPER is divided into several levels of abstraction, from a gate-level description up to an instruction execution model. Although the consistency between certain levels was demonstrated with mechanically-assisted mathematical proof, the formal verification of VIPER was never completed.

Brock, Bishop↗
NASA NTRS1991

Lightning protection of full authority digital electronic systems

Modern electronic systems are vulnerable to transient and they now provide safety critical functions such as full authority digital electronic control (FADEC) units for fly by wire aircraft. Of the traditional suppression technologies available diodes have gained the wider acceptance, however, they lack the current handling capacity to meet existing threat levels. The development of high speed fold back devices where, at a specified voltage, the off state resistance switches to a very low on state one has provided the equivalent to a semiconductor spark gap. The size of the technology enables it to be integrated into connectors of interconnection cables. To illustrate the performance the technology was developed to meet the Lightning Protection requirements for FADEC units within aeroengines. Work was also carried out to study switching behavior with the waveform 5, the 500 us, 10 kA pulse applied to cable assemblies. This test enabled all the switches in a connector to be fired simultaneously.

Crofts, David↗
NASA NTRS1991

Safety

Software requirements, design, implementation, verification and validation, and especially management are affected by the need to produce safe software. This paper discusses the changes in the software life cycle that are necessary to ensure that software will execute without resulting in unacceptable risk. Software is being used increasingly to monitor and control safety-critical processes in which a run-time failure or error could result in unacceptable losses such as death, injury, loss of property, or environmental harm. Examples of such processes maybe found in transportation, energy, aerospace, basic industry, medicine, and defense systems.

Leveson, Nancy G.↗
NASA NTRS1992

An EVACS simulation with nested transactions

Documented here is the recent effort of the MISSION Kernel Team on an Extra-Vehicular Activity Control System (EVACS) simulation with nested transactions. The team has implemented the EVACS simulation along with a design for nested transactions. The EVACS simulation is a project wide aid to exploring Mission and Safety Critical (MASC) applications and their support software. For this effort it served as a trial scenario for demonstrating nested transactions and exercising the transaction support design. The EVACS simulation is a simulation of some aspects of the Extra-Vehicular Activity Control System, in particular, just the selection of communication frequencies. Its current definition is quite narrow, serving only as a starting point for prototyping purposes. (EVACS itself may be supplanted in a larger scenario of a lunar outpost with astronauts and a lunar rover.) Initially the simulation of frequency selection was written without consideration of nested transactions. This scenario was then modified to embed its processing in nested transactions. To simplify the prototyping effort, only two aspects of the general design for transaction support have been implemented: the basic architecture and state recovery. The simulation has been implemented in the programming language Smalltalk. It consists of three components: (1) a simulation support code which provides the framework for initiating, interacting and tracing the system; (2) the EVACS application code itself, including its calls upon nested transaction support; and (3) a transaction support code which implements the logic necessary for nested transactions. Each of these components deserves further description, but for now only the transaction support is discussed.

Auty, David↗
NASA NTRS1993

An artificial intelligence-based structural health monitoring system for aging aircraft

To reduce operating expenses, airlines are now using the existing fleets of commercial aircraft well beyond their originally anticipated service lives. The repair and maintenance of these 'aging aircraft' has therefore become a critical safety issue, both to the airlines and the Federal Aviation Administration. This paper presents the results of an innovative research program to develop a structural monitoring system that will be used to evaluate the integrity of in-service aerospace structural components. Currently in the final phase of its development, this monitoring system will indicate when repair or maintenance of a damaged structural component is necessary.

Grady, Joseph E.↗
NASA NTRS1993

Development of a methodology for assessing the safety of embedded software systems

A Dynamic Flowgraph Methodology (DFM) based on an integrated approach to modeling and analyzing the behavior of software-driven embedded systems for assessing and verifying reliability and safety is discussed. DFM is based on an extension of the Logic Flowgraph Methodology to incorporate state transition models. System models which express the logic of the system in terms of causal relationships between physical variables and temporal characteristics of software modules are analyzed to determine how a certain state can be reached. This is done by developing timed fault trees which take the form of logical combinations of static trees relating the system parameters at different point in time. The resulting information concerning the hardware and software states can be used to eliminate unsafe execution paths and identify testing criteria for safety critical software functions.

Garrett, C. J.↗