Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Criticality Safety”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 1,081 records · Page 60

Predicting the Operational Acceptability of Route Advisories

NASA envisions a future Air Traffic Management system that allows safe, efficient growth in global operations, enabled by increasing levels of automation and autonomy. In a safety-critical system, the introduction of increasing automation and autonomy has to be done in stages, making human-system integrated concepts critical in the foreseeable future. One example where this is relevant is for tools that generate more efficient flight routings or reroute advisories. If these routes are not operationally acceptable, they will be rejected by human operators, and the associated benefits will not be realized. Operational acceptance is therefore required to enable the increased efficiency and reduced workload benefits associated with these tools. In this paper, the authors develop a predictor of operational acceptability for reroute advisories. Such a capability has applications in tools that identify more efficient routings around weather and congestion and that better meet airline preferences. The capability is based on applying data mining techniques to flight plan amendment data reported by the Federal Aviation Administration and data on requested reroutes collected from a field trial of the NASA developed Dynamic Weather Routes tool, which advised efficient route changes to American Airlines dispatchers in 2014. 10-Fold cross validation was used for feature, model and parameter selection, while nested cross validation was used to validate the model. The model performed well in predicting controller acceptance or rejection of a route change as indicated by chosen performance metrics. Features identified as relevant to controller acceptance included the historical usage of the advised route, the location of the maneuver start point relative to the boundaries of the airspace sector containing the maneuver start (the maneuver start sector), the reroute deviation from the original flight plan, and the demand level in the maneuver start sector. A random forest with forty trees was the best performing of the five models evaluated in this paper.

operational acceptability↗

Integrated Systems Health Management for Sustainable Habitats (Using Sustainability Base as a Testbed)

Habitation systems provide a safe place for astronauts to live and work in space and on planetary surfaces. They enable crews to live and work safely in deep space, and include integrated life support systems, radiation protection, fire safety, and systems to reduce logistics and the need for resupply missions. Innovative health management technologies are needed in order to increase the safety and mission-effectiveness for future space habitats on other planets, asteroids, or lunar surfaces. For example, off-nominal or failure conditions occurring in safety-critical life support systems may need to be addressed quickly by the habitat crew without extensive technical support from Earth due to communication delays. If the crew in the habitat must manage, plan and operate much of the mission themselves, operations support must be migrated from Earth to the habitat. Enabling monitoring, tracking, and management capabilities on-board the habitat and related EVA platforms for a small crew to use will require significant automation and decision support software.Traditional caution and warning systems are typically triggered by out-of-bounds sensor values, but can be enhanced by including machine learning and data mining techniques. These methods aim to reveal latent, unknown conditions while still retaining and improving the ability to provide highly accurate alerts for known issues. A few of these techniques will briefly described, along with performance targets for known faults and failures. Specific system health management capabilities required for habitat system elements (environmental control and life support systems, etc.) may include relevant subsystems such as water recycling systems, photovoltaic systems, electrical power systems, and environmental monitoring systems. Sustainability Base, the agency's flagship LEED-platinum certified green building acts as a living laboratory for testing advanced information and sustainable technologies that provides an opportunity to test novel machine learning and controls capabilities. In this talk, key features of Sustainability Base that make it relevant to deep space habitat technology and its use of these kinds of subsystems previously listed will be presented. The fact that all such systems require less power to support human occupancy can be used as a focal point to serve as a testbed for deep space habitats that will need to operate within finite energy budgets.

Systems Health Management↗

The Relationship Between Workload and Performance in Air Traffic Control: Exploring the Influence of Levels of Automation and Variation in Task Demand

In an air traffic environment, task demand is dynamic. However, previous research has largely considered the association of task demand and controller performance using conditions of stable task demand. Further, there is a comparatively restricted understanding of the influence of task demand transitions on workload and performance in association with different types and levels of automation that are available to controllers. This study used an air traffic control simulation to investigate the influence of task demand transitions, and two conditions of automation, on workload and efficiency-related performance. Findings showed that both the direction of the task demand variation and the amount of automation influenced the relationship between workload and performance. Findings are discussed in relation to capacity and arousal theories. Further research is needed to enhance understanding of demand transition and workload history effects on operator experience and performance, in both air traffic control and other safety-critical domains.

function allocation↗

Dynamics and Control of Quadcopter in Uncertain Environment

We consider problem of dynamics, control, and uncertainty quantification for quadcopter. We use the 6DOF model of quadcopter dynamics, linear quadratic regulator and linear quadratic Gaussian control of quadcopter in the presence of dynamical disturbances, measurement noise, hidden dynamical variables, dashing GPS signal, and wind gusts to predict quadcopter trajectory. We identify key sources of uncertainties and report on progress in development of a system that estimates the probability of safety-critical events using a set of algorithms based on the trajectory predictions.

uncertainty quantification↗

Fuzzy Logic Controller Stability Analysis Using a Satisfiability Modulo Theories Approach

While many widely accepted methods and techniques exist for validation and verification of traditional controllers, at this time no solutions have been accepted for Fuzzy Logic Controllers (FLCs). Due to the highly nonlinear nature of such systems, and the fact that developing a valid FLC does not require a mathematical model of the system, it is quite difficult to use conventional techniques to prove controller stability. Since safety-critical systems must be tested and verified to work as expected for all possible circumstances, the fact that FLC controllers cannot be tested to achieve such requirements poses limitations on the applications for such technology. Therefore, alternative methods for verification and validation of FLCs needs to be explored. In this study, a novel approach using formal verification methods to ensure the stability of a FLC is proposed. Main research challenges include specification of requirements for a complex system, conversion of a traditional FLC to a piecewise polynomial representation, and using a formal verification tool in a nonlinear solution space. Using the proposed architecture, the Fuzzy Logic Controller was found to always generate negative feedback, but inconclusive for Lyapunov stability.

Fuzzy Logic Controller↗

Task Demand Variation in Air Traffic Control: Implications for Workload, Fatigue, and Performance

In air traffic control, task demand and workload have important implications for the safety and efficiency of air traffic, and remain dominant considerations. Within air traffic control, task demand is dynamic. However, research on demand transitions and subsequent controller perception and performance is limited. This research uses an air traffic control simulation to investigate the effect of task demand transitions, and the direction of those transitions, on workload and fatigue and one efficiency performance measure. Results indicate that a change in task demand appears to affect both workload and fatigue ratings, although not necessarily performance. In addition, participants' workload and fatigue ratings in equivalent task demand periods appear to change depending on the demand period preceding the time of the current ratings. Further research is needed to enhance understanding of demand transition and workload history effects on operator experience and performance, in both air traffic control and other safety-critical domains.

workload history↗

Task Demand Variation in Air Traffic Control: Implications for Controller Workload, Fatigue, and Performance

In air traffic control, task demand and workload have important implications for the safety and efficiency of air traffic, and remain dominant considerations. Within air traffic control, task demand is dynamic. However, research on demand transitions and subsequent controller perception and performance is limited. This research uses an air traffic control simulation to investigate the effect of task demand transitions, and the direction of those transitions, on workload and fatigue and one efficiency performance measure. Results indicate that a change in task demand appears to affect both workload and fatigue ratings, although not necessarily performance. In addition, participants workload and fatigue ratings in equivalent task demand periods appear to change depending on the demand period preceding the time of the current ratings. Further research is needed to enhance understanding of demand transition and workload history effects on operator experience and performance, in both air traffic control and other safety-critical domains.

workload history↗

Are We There Yet? Determining the Adequacy of Formalized Requirements and Test Suites

Structural coverage metrics have traditionally categorized code as either covered or uncovered. Recent work presents a stronger notion of coverage, checked coverage, which counts only statements whose execution contributes to an outcome checked by an oracle. While this notion of coverage addresses the adequacy of the oracle, for Model-Based Development of safety critical systems, it is still not enough; we are also interested in how much of the oracle is covered, and whether the values of program variables are masked when the oracle is evaluated. Such information can help system engineers identify missing requirements as well as missing test cases. In this work, we add to the idea of checked coverage an analysis of requirements coverage to help provide insight to engineers as to whether the requirements or the test suite need to be improved. We implement our approach based on a dynamic backward slicing technique and evaluate it on several systems developed in Simulink. The results of our preliminary study show that even for systems with comprehensive test suites and good sets of requirements, our approach can identify cases where more tests or more requirements are needed to improve coverage numbers.

Dynamic Slicing↗

Memo on Speech Alarms: Replication and Validation of Results

Caution and warning (C&W) alarms help people to quickly and efficiently identify situations that are of immediate danger or would escalate to a safety critical level. Tones are highly salient and have been traditionally used for caution and warning alarms. However, research shows that tone alarms can have an unwanted startle effect that hinders operator decision making. Speech alarms are good alternatives to tone alarms because they require less training and are less startling. They have been in use for decades for caution and warning systems in commercial airplanes and in buildings. Speech alarms have been considered for space flight use by the National Aeronautics and Space Administration’s (NASA) Astronaut Office and by its Orion Program. To investigate whether performance with various types of speech alarms was similar to performance with the currently used tone alarms, a study was conducted in 2010. The results showed faster identification times of speech alarms as well as higher acceptance rates from participants. However, the presentation of the alarms had a variable onset time due to software. The current research project was funded to address this issue by collecting new data with alarms having nonvariable onset time and to validate the alarms in the Human Exploration Research Analog (HERA). This report describes the two studies: a laboratory experiment comparing tone and speech alarms, and an evaluation in the HERA facility.

warning signals↗

Analysis of San Francisco Bar Pilot Dispatch Records: Preliminary Report

Maritime pilots licensed by the San Francisco Board of Pilot Commissioners perform safety-critical tasks in a demanding environment, working in all weather and at all times of day and night. Since 1850, San Francisco maritime pilots have been known as Bar Pilots because their duties include guiding ships safely across the large sand bar that lies west of the Golden Gate. Schedules and Work Hours Records for San Francisco Bay Bar Pilots were analyzed to determine the minimum and maximum work periods, the frequency of extended work hours, the frequency of night work and the rotation of work hours. A mathematical model is being applied to predict fatigue in order to identify schedules that may have a high likelihood of fatigue. This presentation provides a progress report on the research thus far.

marine pilots↗

R2U2: Tool Overview

R2U2 (Realizable, Responsive, Unobtrusive Unit) is an extensible framework for runtime System HealthManagement (SHM) of cyber-physical systems. R2U2 can be run in hardware (e.g., FPGAs), or software; can monitorhardware, software, or a combination of the two; and can analyze a range of different types of system requirementsduring runtime. An R2U2 requirement is specified utilizing a hierarchical combination of building blocks: temporal formula runtime observers (in LTL or MTL), Bayesian networks, sensor filters, and Boolean testers. Importantly, the framework is extensible; it is designed to enable definitions of new building blocks in combination with the core structure. Originally deployed on Unmanned Aerial Systems (UAS), R2U2 is designed to run on a wide range of embedded platforms, from autonomous systems like rovers, satellites, and robots, to human-assistive ground systems and cockpits. R2U2 is named after the requirements it satisfies; while the exact requirements vary by platform and mission, the ability to formally reason about realizability, responsiveness, and unobtrusiveness is necessary for flight certifiability, safety-critical system assurance, and achievement of technology readiness levels for target systems. Realizability ensures that R2U2 is suficiently expressive to encapsulate meaningful runtime requirements while maintaining adaptability to run on different platforms, transition between different mission stages, and update quickly between missions. Responsiveness entails continuously monitoring the system under test, real-time reasoning, reporting intermediate status, and as-early-as-possible requirements evaluations. Unobtrusiveness ensures compliance with the crucial properties of the target architecture: functionality, certifiability, timing, tolerances, cost, or other constraints.

Rozier, Kristin Y.↗

In-Flight Evaluation of the Traffic Aware Planner on the NASA HU-25A Guardian Aircraft

NASA’s Traffic Aware Planner (TAP) software is a research-prototype decision support tool that provides pilots with time- and fuel-saving route recommendations that optimize their current trajectory. The software runs on a first-of-a-kind system architecture onboard three aircraft in revenue service conducting operational evaluations with a major domestic airline. Therefore, significant NASA-internal testing is required prior to releasing the software to the partner airline. This paper describes a flight test plan that exercises the functionality of the TAP software in a representative operational environment, describes the system architecture developed and implemented for the NASA Langley HU-25A Guardian aircraft to support the test objectives, presents outcomes of the flight test campaign, and discusses use cases that demonstrate the value of flight testing for this activity.Research into flight path optimization of transport aircraft conducted by the National Aeronautics and SpaceAdministration (NASA) has produced an operational concept known as Traffic Aware Strategic Aircrew Requests(TASAR) [1, 2]. This near-term concept [3] provides the aircrew with a flight deck decision support tool known asthe Traffic Aware Planner (TAP). The TAP software leverages a growing number of information sources on the flightdeck to make time- and fuel-saving route optimization recommendations to the aircrew while en route. The aircrewcan then use the suggestions provided by the tool to make route change requests with a greater likelihood of acceptanceby air traffic control (ATC). Since TASAR is a concept intended for the current operational environment, it isintentionally designed to have no safety-critical impact or require any changes to current Federal AviationAdministration (FAA) rules and procedures [4, 5].The research prototype TAP system [6–8], explained further in Section III.C, continually incorporates up-to-dateaircraft state data from onboard avionics, as well as the latest position of surrounding traffic, the most recent windforecast, and the most recent convective weather forecast, in order to calculate candidate trajectory modifications thatimprove upon the current active route. These trajectories account for user-selectable objective functions [3] of reducedfuel burn, reduced flight time, or an airline-derived combination of factors known as trip cost. Previous analyses andsimulations have estimated substantial savings for airlines employing this technique within the U.S. National AirspaceSystem (NAS) [9–11]. Operational evaluations with Alaska Airlines seek to validate these projected benefits usingmeasured data while simultaneously providing benefits to the airline [12, 13].The TAP software has undergone a number of human-in-the-loop simulations [14] and flight test activities[15–17] in order to validate the operational concept, evaluate human factors considerations (e.g., workload, usability,distraction, etc.), and to assess the ability of the software to function in a representative operational environment (e.g.,connected to live avionics data, using in-flight internet connectivity, etc.). However, these simulations and flight testcampaigns did not account for the hardware architecture implemented on the three aircraft for Alaska Airlines’operational evaluations of the TAP software. Therefore, a need was identified to thoroughly test the functionality ofthe software in a similar hardware architecture to that of the partner airline’s aircraft. Information regarding testapparatus and environments used to evaluate TAP prior to testing on the HU-25A can be found in reference [18].A campaign of flight trials on a NASA aircraft, the HU-25A Guardian, was conducted to ensure that the researchprototype TAP system functions well in a configuration similar to the Alaska Airlines aircraft prior to deployment.This airborne, networked environment enables an assessment of the operational factors unique to the flight environment. Additionally, this activity evaluated the effectiveness and benefit of new TAP functionality andoperation in a relevant flight environment while allowing the rapid prototyping of new concepts and features.This paper is organized as follows: Section II discusses the details of the flight test plan, flight profiles, and theduties of personnel involved with conducting flight operations. Section III describes the test platform, avionicsequipage, and system architecture. Section IV presents a discussion of results, and Section V contains concludingremarks.

Underwood, Matthew C.↗

Controller Inhibition of Automated Conflict Resolutions in a Maximum NextGen Condition

With the continued projection of increases in air traffic density, operations in the National Airspace System are expected to exceed human capabilities in the near future. In order to address the bottleneck of human workload capacity, highly automated safety-critical systems are under development to support air traffic controllers. A human-in-the-loop experiment examined controllers transition through four NextGen automation stages: Current-Day, Minimum, Moderate, and Maximum. Maximum NextGen simulated a fully automated environment where the automation was responsible for detecting and resolving conflicts within simulation parameters in high-density airspace. By allocating these tasks to the automation, the controllers task changed. The human moved to primarily a supervisory position- typically only regaining control over separation assurance tasks during conflict situations deferred by the automation. While tasks were allocated a-priori between the controller and automated agent, controllers maintained authority to inhibit the automation from interacting with particular aircraft. Preliminary work is complete, where significant differences were found in inhibition frequency between simulation participants. However, the contexts in which the controllers inhibited the automation, and their reasons for doing so, remain unclear. This analysis attempts to identity factors contributing to human controllers inhibition of the automation in the Maximum NextGen condition.

adaptable automation↗

The Benefits of Napping for Safety & How Quickly Can the Brain Wake-Up from Sleep?

Fatigue is a hazard that must be managed within 24-hour safety-critical operations. Napping is the best known countermeasure to fatigue caused by sleep-loss and circadian misalignment. This presentation will: define fatigue; discuss ways to make the most of a nap opportunity; highlight the benefits of napping, including two case studies from workplace settings; outline the challenges in implementing napping in the workplace; and walk through examples to demonstrate that not all naps are equal when it comes to benefits to alertness and performance. The second half of the presentation will focus on sleep inertia, that is, the brief period of impaired alertness and performance experienced after waking from sleep. The factors contributing to and caused by sleep inertia will be discussed, along with countermeasures to reduce the impact of sleep inertia on alertness and performance.

Hilditch, Cassie J.↗

Model Based Diagnostics and Prognostics Framework for Systems Health Management

In order to tackle and solve the system health prediction problem, it is essential to have awareness of the current state and health of the system, especially since it is necessary to perform condition-based predictions. To be able to accurately predict the future state of any system, it is required to possess knowledge of its current and future operations. Given models of the current and future system behavior, the general approach of model-based prognostics can be employed as a solution to the prior stated prediction problem. In case of electric aircrafts, computing remaining flying time is safety-critical, since an aircraft that runs out of power (battery charge) while in the air will eventually lose control leading to catastrophe. In order to tackle and solve the prediction problem, it is essential to have awareness of the current state and health of the system, especially since it is necessary to perform condition-based predictions. To be able to predict the future state of the system, it is also required to possess knowledge of the current and future operations of the vehicle. This presentation will cover a physics based-modeling approach implemented for case-studies in battery and composite structures for prognostics. Given models of the current and future system behavior, a general approach of model-based prognostics can be employed as a solution to the prediction problem and further for decision making.

Banerjee, Portia↗

TPSAS-NF1676L-14044-DND

The presentation will focus on the application of formal methods to safety-critical systems in aviation and space. Although the talk will mostly focus on work conducted at the NASA Langley Research Center, there will be a brief summary of work conducted at NASA?s Jet Propulsion Laboratory and Ames Research Center.

Alwyn Goodloe↗

TPSAS-NF1676L-15598-DND

The presentation is intended to give an overview of the verification efforts in the Safety-Critical Avionics Systems Branch at the NASA Langley Research Center. Mainly targeted at students that are interested in internships in our group.

Alwyn Goodloe↗

On the Probabilistic Analysis of Neural Networks

Neural networks are powerful tools for automated decision-making,seeing increased application in safety-critical domains, such as autonomous driving. Due to their black-box nature and large scale,reasoning about their behavior is challenging. Statistical analysis is often used to infer probabilistic properties of a network, such as its robustness to noise and inaccurate inputs. While scalable, statistical methods can only provide probabilistic guarantees on the quality of their results and may underestimate the impact of low probability inputs leading to undesired behavior of the network.We investigate here the use of symbolic analysis and constraint solution space quantification to precisely quantify probabilistic properties in neural networks. We demonstrate the potential of the proposed technique in a case study involving the analysis of ACAS-Xu, a collision avoidance system for unmanned aircraft control.

neural nets↗