Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Criticality Safety”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 1,063 records · Page 59
All sourcesNASA NTRSDOE OSTI
NASA NTRS2015

Software Assurance Challenges for the Commercial Crew Program

This paper will provide a description of some of the challenges NASA is facing in providing software assurance within the new commercial space services paradigm, namely with the Commercial Crew Program (CCP). The CCP will establish safe, reliable, and affordable access to the International Space Station (ISS) by purchasing a ride from commercial companies. The CCP providers have varying experience with software development in safety-critical space systems. NASA's role in providing effective software assurance support to the CCP providers is critical to the success of CCP. These challenges include funding multiple vehicles that execute in parallel and have different rules of engagement, multiple providers with unique proprietary concerns, providing equivalent guidance to all providers, permitting alternates to NASA standards, and a large number of diverse stakeholders. It is expected that these challenges will exist in future programs, especially if the CCP paradigm proves successful. The proposed CCP approach to address these challenges includes a risk-based assessment with varying degrees of engagement and a distributed assurance model. This presentation will describe NASA IV&V Program's software assurance support and responses to these challenges.

Commercial Crew↗
NASA NTRS2010

Kriging as a Means of Improving WAAS Availability

The Wide Area Augmentation System (WAAS), an augmentation of the Global Positioning System (GPS), provides safe and reliable use of GPS signals for airline navigation over much of North America. Currently the largest source of positioning error in the system is signal delay caused by the ionosphere. To allow the user to take account of such error, WAAS computes and broadcasts ionospheric vertical delays at a set of regularly-spaced grid points. In addition, WAAS computes and broadcasts a safety-critical integrity bound at each ionospheric grid point (IGP) called the Grid Ionospheric Vertical Error (GIVE). GIVEs are constructed to be sufficiently large to protect the user against positioning error due to the presence of ionospheric irregularity. In the initial operating capability (IOC) of WAAS, the vertical delay estimate at each IGP is determined from a planar fit of neighboring slant delay measurements, projected to vertical using an obliquity factor specified by the standard thin-shell model of the ionosphere. In WAAS Follow-On (WFO) Release 3, however, the vertical delay will be estimated by an established, geo-statistical technique known as kriging. Compared to the planar fit model, the kriging model is found, in general, to match better the observed random structure of the vertical delay. This paper presents the kriging methodology that will be used to estimate the vertical delay and its uncertainty at each IGP, and it assesses the subsequent improvement in WAAS availability enabled by kriging.

GPS↗
NASA NTRS2015

Multi-Axis Independent Electromechanical Load Control for Docking System Actuation Development and Verification Using dSPACE

The development of highly complex and advanced actuation systems to meet customer demands has accelerated as the use of real-time testing technology expands into multiple markets at Moog. Systems developed for the autonomous docking of human rated spacecraft to the International Space Station (ISS), envelope multi-operational characteristics which place unique constraints on an actuation system. Real-time testing hardware has been used as a platform for incremental testing and development for the linear actuation system which controls initial capture and docking for vehicles visiting the ISS. This presentation will outline the role of dSPACE hardware as a platform for rapid control-algorithm prototyping as well as an Electromechanical Actuator (EMA) system dynamic loading simulator, both conducted at Moog to develop the safety critical Linear Actuator System (LAS) of the NASA Docking System (NDS).

Oesch, Christopher↗
NASA NTRS2015

On-Line Safe Flight Envelope Determination for Impaired Aircraft

The design and simulation of an on-line algorithm which estimates the safe maneuvering envelope of aircraft is discussed in this paper. The trim envelope is estimated using probabilistic methods and efficient high-fidelity model based computations of attainable equilibrium sets. From this trim envelope, a robust reachability analysis provides the maneuverability limitations of the aircraft through an optimal control formulation. Both envelope limits are presented to the flight crew on the primary flight display. In the results section, scenarios are considered where this adaptive algorithm is capable of computing online changes to the maneuvering envelope due to impairment. Furthermore, corresponding updates to display features on the primary flight display are provided to potentially inform the flight crew of safety critical envelope alterations caused by the impairment.

algorithms↗
NASA NTRS2016

Study of Material Consolidation at Higher Throughput Parameters in Selective Laser Melting of Inconel 718

Selective Laser Melting (SLM) is a powder bed fusion additive manufacturing process used increasingly in the aerospace industry to reduce the cost, weight, and fabrication time for complex propulsion components. SLM stands poised to revolutionize propulsion manufacturing, but there are a number of technical questions that must be addressed in order to achieve rapid, efficient fabrication and ensure adequate performance of parts manufactured using this process in safety-critical flight applications. Previous optimization studies for SLM using the Concept Laser M1 and M2 machines at NASA Marshall Space Flight Center have centered on machine default parameters. The objective of this work is to characterize the impact of higher throughput parameters (a previously unexplored region of the manufacturing operating envelope for this application) on material consolidation. In phase I of this work, density blocks were analyzed to explore the relationship between build parameters (laser power, scan speed, hatch spacing, and layer thickness) and material consolidation (assessed in terms of as-built density and porosity). Phase II additionally considers the impact of post-processing, specifically hot isostatic pressing and heat treatment, as well as deposition pattern on material consolidation in the same higher energy parameter regime considered in the phase I work. Density and microstructure represent the "first-gate" metrics for determining the adequacy of the SLM process in this parameter range and, as a critical initial indicator of material quality, will factor into a follow-on DOE that assesses the impact of these parameters on mechanical properties. This work will contribute to creating a knowledge base (understanding material behavior in all ranges of the AM equipment operating envelope) that is critical to transitioning AM from the custom low rate production sphere it currently occupies to the world of mass high rate production, where parts are fabricated at a rapid rate with confidence that they will meet or exceed all stringent functional requirements for spaceflight hardware. These studies will also provide important data on the sensitivity of material consolidation to process parameters that will inform the design and development of future flight articles using SLM.

Prater, Tracie↗
NASA NTRS2014

Spot: A Programming Language for Verified Flight Software

The C programming language is widely used for programming space flight software and other safety-critical real time systems. C, however, is far from ideal for this purpose: as is well known, it is both low-level and unsafe. This paper describes Spot, a language derived from C for programming space flight systems. Spot aims to maintain compatibility with existing C code while improving the language and supporting verification with the SPIN model checker. The major features of Spot include actor-based concurrency, distributed state with message passing and transactional updates, and annotations for testing and verification. Spot also supports domain-specific annotations for managing spacecraft state, e.g., communicating telemetry information to the ground. We describe the motivation and design rationale for Spot, give an overview of the design, provide examples of Spot's capabilities, and discuss the current status of the implementation.

validation↗
NASA NTRS2015

On-Demand Mobility (ODM) Technical Pathway: Enabling Ease of Use and Safety

On-demand mobility (ODM) through aviation refers to the ability to quickly and easily move people or equivalent cargo without delays introduced by lack of, or infrequently, scheduled service. A necessary attribute of ODM is that it be easy to use, requiring a minimum of special training, skills, or workload. Fully-autonomous vehicles would provide the ultimate in ease-of-use (EU) but are currently unproven for safety-critical applications outside of a few, situationally constrained applications (e.g. automated trains operating in segregated systems). Applied to aviation, the current and near-future state of the art of full-autonomy, may entail undesirable trade-offs such as very conservative operational margins resulting in reduced trip reliability and transportation utility. Furthermore, acceptance by potential users and regulatory authorities will be challenging without confidence in autonomous systems in developed in less critical, but still challenging applications. A question for the aviation community is how we can best develop practical ease-of-use for aircraft that are sized to carry a small number of passengers (e.g. 1-9) or equivalent cargo. Such development is unlikely to be a single event, but rather a managed, evolutionary process where responsibility and authority transitions from human to automation agents as operational experience is gained with increasingly intelligent systems. This talk presents a technology road map being developed at NASA Langley, as part of an overall strategy to foster ODM, for the development of ease-of-use for ODM aviation.

Goodrich, Ken↗
NASA NTRS2016

Analyzing and Predicting Effort Associated with Finding and Fixing Software Faults

Context: Software developers spend a significant amount of time fixing faults. However, not many papers have addressed the actual effort needed to fix software faults. Objective: The objective of this paper is twofold: (1) analysis of the effort needed to fix software faults and how it was affected by several factors and (2) prediction of the level of fix implementation effort based on the information provided in software change requests. Method: The work is based on data related to 1200 failures, extracted from the change tracking system of a large NASA mission. The analysis includes descriptive and inferential statistics. Predictions are made using three supervised machine learning algorithms and three sampling techniques aimed at addressing the imbalanced data problem. Results: Our results show that (1) 83% of the total fix implementation effort was associated with only 20% of failures. (2) Both safety critical failures and post-release failures required three times more effort to fix compared to non-critical and pre-release counterparts, respectively. (3) Failures with fixes spread across multiple components or across multiple types of software artifacts required more effort. The spread across artifacts was more costly than spread across components. (4) Surprisingly, some types of faults associated with later life-cycle activities did not require significant effort. (5) The level of fix implementation effort was predicted with 73% overall accuracy using the original, imbalanced data. Using oversampling techniques improved the overall accuracy up to 77%. More importantly, oversampling significantly improved the prediction of the high level effort, from 31% to around 85%. Conclusions: This paper shows the importance of tying software failures to changes made to fix all associated faults, in one or more software components and/or in one or more software artifacts, and the benefit of studying how the spread of faults and other factors affect the fix implementation effort.

software fix implementation effort↗
NASA NTRS2016

Cardiac-Activity Measures for Assessing Airport Ramp-Tower Controller's Workload

Heart rate (HR) and heart rate variability (HRV) potentially offer objective, continuous, and non-intrusive measures of human-operator's mental workload. Such measurement capability is attractive for workload assessment in complex laboratory simulations or safety-critical field testing. The present study compares mean HR and HRV data with self-reported subjective workload ratings collected during a high-fidelity human-in-the-loop simulation of airport ramp traffic control operations, which involve complex cognitive and coordination tasks. Mean HR was found to be weakly sensitive to the workload ratings, while HRV was not sensitive or even contradictory to the assumptions. Until more knowledge on stress response mechanisms of the autonomic nervous system is obtained, it is recommended that these cardiac-activity measures be used with other workload assessment tools, such as subjective measures.

Hayashi, Miwa↗
NASA NTRS2016

Cardiac-Activity Measures for Assessing Airport Ramp-Tower Controller's Workload

Heart rate (HR) and heart rate variability (HRV) potentially offer objective, continuous, and non-intrusive measures of human-operators mental workload. Such measurement capability is attractive for workload assessment in complex laboratory simulations or safety-critical field testing. The present study compares mean HR and HRV data with self-reported subjective workload ratings collected during a high-fidelity human-in-the-loop simulation of airport ramp traffic control operations, which involve complex cognitive and coordination tasks. Mean HR was found to be weakly sensitive to the workload ratings, while HRV was not sensitive or even contradictory to the assumptions. Until more knowledge on stress response mechanisms of the autonomic nervous system is obtained, it is recommended that these cardiac-activity measures be used with other workload assessment tools, such as subjective measures.

Hayashi, Miwa↗
NASA NTRS2016

Challenges in High-Assurance Runtime Verification

Safety-critical systems are growing more complex and becoming increasingly autonomous. Runtime Verification (RV) has the potential to provide protections when a system cannot be assured by conventional means, but only if the RV itself can be trusted. In this paper, we proffer a number of challenges to realizing high-assurance RV and illustrate how we have addressed them in our research. We argue that high-assurance RV provides a rich target for automated verification tools in hope of fostering closer collaboration among the communities.

Goodloe, Alwyn E.↗
NASA NTRS2017

Fuzzy Logic Controller Stability Analysis Using a Satisfiability Modulo Theories Approach

While many widely accepted methods and techniques exist for validation and verification of traditional controllers, at this time no solutions have been accepted for Fuzzy Logic Controllers (FLCs). Due to the highly nonlinear nature of such systems, and the fact that developing a valid FLC does not require a mathematical model of the system, it is quite difficult to use conventional techniques to prove controller stability. Since safety-critical systems must be tested and verified to work as expected for all possible circumstances, the fact that FLC controllers cannot be tested to achieve such requirements poses limitations on the applications for such technology. Therefore, alternative methods for verification and validation of FLCs needs to be explored. In this study, a novel approach using formal verification methods to ensure the stability of a FLC is proposed. Main research challenges include specification of requirements for a complex system, conversion of a traditional FLC to a piecewise polynomial representation, and using a formal verification tool in a nonlinear solution space. Using the proposed architecture, the Fuzzy Logic Controller was found to always generate negative feedback, but inconclusive for Lyapunov stability.

Fuzzy Logic Controller↗
NASA NTRS2017

Formal Methods Tool Qualification

Formal methods tools have been shown to be effective at finding defects in safety-critical digital systems including avionics systems. The publication of DO-178C and the accompanying formal methods supplement DO-333 allows applicants to obtain certification credit for the use of formal methods without providing justification for them as an alternative method. This project conducted an extensive study of existing formal methods tools, identifying obstacles to their qualification and proposing mitigations for those obstacles. Further, it interprets the qualification guidance for existing formal methods tools and provides case study examples for open source tools. This project also investigates the feasibility of verifying formal methods tools by generating proof certificates which capture proof of the formal methods tool's claim, which can be checked by an independent, proof certificate checking tool. Finally, the project investigates the feasibility of qualifying this proof certificate checker, in the DO-330 framework, in lieu of qualifying the model checker itself.

Wagner, Lucas G.↗
NASA NTRS2017

The MINERVA Software Development Process

This paper presents a software development process for safety-critical software components of cyber-physical systems. The process is called MINERVA, which stands for Mirrored Implementation Numerically Evaluated against Rigorously Verified Algorithms. The process relies on formal methods for rigorously validating code against its requirements. The software development process uses: (1) a formal specification language for describing the algorithms and their functional requirements, (2) an interactive theorem prover for formally verifying the correctness of the algorithms, (3) test cases that stress the code, and (4) numerical evaluation on these test cases of both the algorithm specifications and their implementations in code. The MINERVA process is illustrated in this paper with an application to geo-containment algorithms for unmanned aircraft systems. These algorithms ensure that the position of an aircraft never leaves a predetermined polygon region and provide recovery maneuvers when the region is inadvertently exited.

Narkawicz, Anthony↗
NASA NTRS2017

Safeguard: Progress and Test Results for a Reliable Independent On-Board Safety Net for UAS

As demands increase to use unmanned aircraft systems (UAS) for a broad spectrum of commercial applications, regulatory authorities are examining how to safely integrate them without compromising safety or disrupting traditional airspace operations. For small UAS, several operational rules have been established; e.g., do not operate beyond visual line-of-sight, do not fly within five miles of a commercial airport, do not fly above 400 feet above ground level. Enforcing these rules is challenging for UAS, as evidenced by the number of incident reports received by the Federal Aviation Administration (FAA). This paper reviews the development of an onboard system - Safeguard - designed to monitor and enforce conformance to a set of operational rules defined prior to flight (e.g., geospatial stay-out or stay-in regions, speed limits, and altitude constraints). Unlike typical geofencing or geo-limitation functions, Safeguard operates independently of the off-the-shelf UAS autopilot and is designed in a way that can be realized by a small set of verifiable functions to simplify compliance with existing standards for safety-critical systems (e.g. for spacecraft and manned commercial transportation aircraft systems). A framework is described that decouples the system from any other devices on the UAS as well as introduces complementary positioning source(s) for applications that require integrity and availability beyond what can be provided by the Global Positioning System (GPS). This paper summarizes the progress and test results for Safeguard research and development since presentation of the design concept at the 35th Digital Avionics Systems Conference (DASC '16). Significant accomplishments include completion of software verification and validation in accordance with NASA standards for spacecraft systems (to Class B), development of improved hardware prototypes, development of a simulation platform that allows for hardware-in-the-loop testing and fast-time Monte Carlo evaluations, and flight testing on multiple air vehicles. Integration testing with NASA's UAS Traffic Management (UTM) service-oriented architecture was also demonstrated.

Young, Steven D.↗
NASA NTRS2017

Beyond Control Centers

For NASA's Resource Prospector (RP) Lunar Rover Mission, we are moving away from a control center concept, to a fully distributed operation utilizing control nodes, with decision support from anywhere via mobile devices. This operations concept will utilize distributed information systems, notifications, mobile data access, and optimized mobile data display for off-console decision support. We see this concept of operations as a step in the evolution of mission operations from a central control center concept to a mission operations anywhere concept. The RP example is part of a trend, in which mission expertise for design, development and operations is distributed across countries and across the globe. Future spacecraft operations will be most cost efficient and flexible by following this distributed expertise, enabling operations from anywhere. For the RP mission we arrived at the decision to utilize a fully distributed operations team, where everyone operates from their home institution, based on evaluating the following factors: the requirement for physical proximity for near-real time command and control decisions; the cost of distributed control nodes vs. a centralized control center; the impact on training and mission preparation of flying the team to a central location. Physical proximity for operational decisions is seldom required, though certain categories of decisions, such as launch abort, or close coordination for mission or safety-critical near-real-time command and control decisions may benefit from co-location. The cost of facilities and operational infrastructure has not been found to be a driving factor for location in our studies. Mission training and preparation benefit from having all operators train and operate from home institutions.

Operations↗
NASA NTRS2017

Predicting the Operational Acceptability of Route Advisories

NASA envisions a future Air Traffic Management system that allows safe, efficient growth in global operations, enabled by increasing levels of automation and autonomy. In a safety-critical system, the introduction of increasing automation and autonomy has to be done in stages, making human-system integrated concepts critical in the foreseeable future. One example where this is relevant is for tools that generate more efficient flight routings or reroute advisories. If these routes are not operationally acceptable, they will be rejected by human operators, and the associated benefits will not be realized. Operational acceptance is therefore required to enable the increased efficiency and reduced workload benefits associated with these tools. In this paper, the authors develop a predictor of operational acceptability for reroute advisories. Such a capability has applications in tools that identify more efficient routings around weather and congestion and that better meet airline preferences. The capability is based on applying data mining techniques to flight plan amendment data reported by the Federal Aviation Administration and data on requested reroutes collected from a field trial of the NASA developed Dynamic Weather Routes tool, which advised efficient route changes to American Airlines dispatchers in 2014. 10-Fold cross validation was used for feature, model and parameter selection, while nested cross validation was used to validate the model. The model performed well in predicting controller acceptance or rejection of a route change as indicated by chosen performance metrics. Features identified as relevant to controller acceptance included the historical usage of the advised route, the location of the maneuver start point relative to the boundaries of the airspace sector containing the maneuver start (the maneuver start sector), the reroute deviation from the original flight plan, and the demand level in the maneuver start sector. A random forest with forty trees was the best performing of the five models evaluated in this paper.

route advisories↗
NASA NTRS2017

Workload and Performance in Air Traffic Control: Exploring the Influence of Levels of Automation and Variation in Task Demand

In air traffic control, task demand and workload have important implications for the safety and efficiency of air traffic. Task demand is dynamic, however, research on demand transitions and associated controller perception and performance is limited. In addition, there is a comparatively restricted understanding of the influence of task demand transitions on workload and performance, in association with automation. This study used an air traffic control simulation to investigate the influence of task demand transitions and two conditions of varying automation, on workload and efficiency-related performance. Findings showed that a both the direction of the task demand variation, and the amount of automation, influenced the relationship between workload and performance. Further research is needed to enhance understanding of demand transition and workload history effects on operator experience and performance, in both air traffic control and other safety-critical domains.

air traffic control↗