SEARCH · Engineering Papers
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Training manuals containing the fundamentals of nondestructive testing using magnetic particle as detection media are used by metal parts inspectors and quality assurance specialists. Magnetic particle testing involves magnetization of the test specimen, application of the magnetic particle and interpretation of the patterns formed.
CLASS is a novel approach to the enhancement of system safety in which the system safety case becomes the focus of safety engineering throughout the system lifecycle. CLASS also expands the role of the safety case across all phases of the system's lifetime, from concept formation to decommissioning. As CLASS has been developed, the concept has been generalized to a more comprehensive notion of assurance becoming the driving goal, where safety is an important special case. This report summarizes major aspects of CLASS and contains a bibliography of papers that provide additional details.
The briefing contains the preliminary findings and suggestions for improvement of methods used in development and evaluation of a multi monitor runtime assurance architecture for autonomous flight vehicles. Initial system design, implementation, verification, and flight testing has been conducted. As of yet detailed data review is incomplete, and flight testing has been limited to initial monitor force fights. Detailed monitor flight evaluations have yet to be performed.
This document includes the information pertaining to the practices of the Emergency Response Software Development Team (ERSDT) for the RASCAL software project. The content includes information regarding: 1) Software Quality Assurance. 2) Project Management. 3) Configuration Management. 4) Development Standards. 5) Third-Party Software. 6) Verification and Validation. The information contained in this report is considered living documentation. The information contained in this report was assembled from multiple documents and content management systems.
Model-based design and automated code generation are being used increasingly at NASA. Many NASA projects now use MathWorks Simulink and Real-Time Workshop for at least some of their modeling and code development. However, there are substantial obstacles to more widespread adoption of code generators in safety-critical domains. Since code generators are typically not qualified, there is no guarantee that their output is correct, and consequently the generated code still needs to be fully tested and certified. Moreover, the regeneration of code can require complete recertification, which offsets many of the advantages of using a generator. Indeed, manual review of autocode can be more challenging than for hand-written code. Since the direct V&V of code generators is too laborious and complicated due to their complex (and often proprietary) nature, we have developed a generator plug-in to support the certification of the auto-generated code. Specifically, the AutoCert tool supports certification by formally verifying that the generated code is free of different safety violations, by constructing an independently verifiable certificate, and by explaining its analysis in a textual form suitable for code reviews. The generated documentation also contains substantial tracing information, allowing users to trace between model, code, documentation, and V&V artifacts. This enables missions to obtain assurance about the safety and reliability of the code without excessive manual V&V effort and, as a consequence, eases the acceptance of code generators in safety-critical contexts. The generation of explicit certificates and textual reports is particularly well-suited to supporting independent V&V. The primary contribution of this approach is the combination of human-friendly documentation with formal analysis. The key technical idea is to exploit the idiomatic nature of auto-generated code in order to automatically infer logical annotations. The annotation inference algorithm itself is generic, and parametrized with respect to a library of coding patterns that depend on the safety policies and the code generator. The patterns characterize the notions of definitions and uses that are specific to the given safety property. For example, for initialization safety, definitions correspond to variable initializations while uses are statements which read a variable, whereas for array bounds safety, definitions are the array declarations, while uses are statements which access an array variable. The inferred annotations are thus highly dependent on the actual program and the properties being proven. The annotations, themselves, need not be trusted, but are crucial to obtain the automatic formal verification of the safety properties without requiring access to the internals of the code generator. The approach has been applied to both in-house and commercial code generators, but is independent of the particular generator used. It is currently being adapted to flight code generated using MathWorks Real-Time Workshop, an automatic code generator that translates from Simulink/Stateflow models into embedded C code.
The CERES SYN1deg product provides climate quality 3-hourly globally gridded and temporally complete maps of top of atmosphere, in atmosphere, and surface fluxes. This product requires efficient release to the public and validation to maintain quality assurance. The CERES team developed web-tools for the distribution of both the global gridded products and grid boxes that contain long term validation sites that maintain high quality flux observations at the Earth's surface. These are found at: http://ceres.larc.nasa.gov/order_data.php. In this poster we explore the various tools available to users to sub-set, download, and validate using surface observations the SYN1Deg and Surface-EBAF products. We also analyze differences found in long-term records from well-maintained land surface sites such as the ARM central facility and high quality buoy radiometers, which due to their isolated nature cannot be maintained in a similar manner to their land based counterparts.
In a half century of human spaceflight, NASA has continuously refined agency safety and reliability requirements in response to mission demands, critical failures, and technology development. Early spacecraft, including Mercury, Gemini and Apollo vehicles, were highly reliant on dissimilar redundancy and demonstrated test margins. Later programs, such as the reusable Space Transportation System (STS) and International Space Station (ISS), introduced probabilistic studies and isolated two-failure tolerance to improve robustness at the expense of added complexity. More recently, the Orion Multi-Program Crew Vehicle (MPCV) program adopted universal single-failure tolerance with two categorical exceptions; Zero-Failure Tolerant (0FT) and Design for Minimum Risk (DFMR) hardware. Failure tolerance variances are defined and managed in accordance with agency human-rating requirements, and require concurrence from program Technical Authorities (TA) as well as the MPCV Safety and Mission Assurance Safety and Engineering Review Panel (MSERP). To understand and reaffirm standards applied to Apollo, Space Shuttle and Orion vehicles, Orion and Deep Space Gateway Safety and Mission Assurance (S&MA) representatives conducted accelerated research to compare unique safety and reliability criteria against ground and flight anomalies, based on information contained in post-mission reports and the Problem Reporting and Corrective Action (PRACA) database. In some cases, high-profile failures and narrow escapes have reinforced decisions to maintain or adapt safety requirements. In others, empirical trends have highlighted the need for vigilance and innovative safety guidelines. Given the inability to achieve absolute compliance with evolving safety and reliability requirements, the team conducted a targeted review of DFMR and 0FT propulsion elements within the framework of changing system design, inspection, materials and process developments to formulate conclusions on technological maturity, failure density, and net changes in safety risk. Based on the aggregate performance of high-reliability and failure-tolerant systems, the authors have attempted to establish best practices and guidelines to inform future program decisions. On a somewhat cautionary note, this study is not intended to direct a universal set of requirements for future missions based on prior lessons learned. Spacecraft safety is a multi-variable problem, and attempts to mitigate past failures will not guarantee future success. However, this assessment offers a retrospective review of policy changes, implementation and effectiveness. In the future, NASA, European Space Agency (ESA) and industry partners may benefit from a more robust correlation between requirements and performance, as space-faring nations work toward more challenging, complex and long-duration commercial and deep-space ventures.
Optical lighting detection from space has been ongoing since 1995 from the Optical Transient detector (1995-2000), then later by the Lightning Imaging Sensors (LIS) on the Tropical Rainfall Measuring Mission (TRMM) satellite (1997-2015) and the International Space Station (ISS) (ISS 2017-present). A rapid readout (2 ms) 128x128 pixel CCD (Charge-coupled Device) array detects optical transients from lightning (events) and transmits the observations to ground. Ground processing determines whether individual events are likely due to lightning or noise. Likely lightning events are then grouped into groups, flashes, and areas and their location on the earth are determined. The lightning data are saved in orbit files; each file containing the time, location, and intensity of the lightning events, groups, flashes, and areas detected during one orbit. Even after this processing anomalies may exist in some of the orbits. A manual quality assurance (QA) procedure is performed monthly to assess the data and omit orbits with obvious anomalies from the dataset. These files are not included in the final dataset that has undergone QA. The manual QA was developed during the OTD mission to identify artifacts that made it through ground processing algorithms. The manual QA process was continued for the TRMM and ISS LIS missions. Many anomalies have been identified and software updates now address many of them. However, some anomalies still occur in the processed datasets. The manual QA process examines the data for obvious issues in the lightning files that passed through the processing algorithms. These files are considered anomalous and are not included in the final QA dataset. Some issues that may cause an orbit to be considered anomalous include: obvious noise (excess events that make it through the processing), suspect geolocation, and excessive missing data packets. As an example, one way noise manifests is as “streaks” in lightning climatology plots. These streaks are especially apparent in low lightning rate regions (eg., over oceans). Since there is no method at present to extract these anomalies during processing, orbit files with significant anomalies are identified and removed from the final QA ISS LIS dataset. The final QA dataset can be obtained files from the Global Hydrometeorological Resource Center (GHRC). This presentation will provide examples of the various anomalies and examine how often the various anomalies occur and how much data is lost due to the omission of the anomalous orbits. Comparisons with OTD and TRMM LIS will also be examined.
The High-Luminosity LHC (HL-LHC) is expected to deliver an integrated luminosity of 3000–4000 fb −1 over 10 years of operation with the peak instantaneous luminosity reaching about 5–7.5 × 1 0 34 cm −2 s −1 . During Long Shutdown 3, several components of the CMS detector will undergo major improvements, called Phase-2 upgrades, to be able to operate in the challenging environment of the HL-LHC. The current CMS tracker will be replaced. The Phase-2 Outer Tracker (OT) will have increased radiation tolerance, higher granularity, and the capability to handle higher data rates. Moreover, the OT will provide tracking information to the Level-1 trigger for the first time at a hadron collider, allowing trigger rates to be kept at a sustainable level without sacrificing physics potential. For this, the OT will be made of modules with two closely-spaced silicon sensors read out by front-end ASICs that can correlate hits in the two sensors to create short track segments, used in the Level-1 track finder. The modules come in two flavors: strip-strip and pixel-strip, containing different sensor configurations and multiple ASICs. This contribution presents the Phase-2 OT, the finalization of the OT module design, and the quality assurance and control procedures used to ensure that the modules fulfill both the specifications from the assembly steps as well as the proper communication among the ASICs.
he High Luminosity LHC (HL-LHC) is expected to deliver an integrated luminosity of $3000-4000$~fb$^{-1}$ after 10 years of operation with peak instantaneous luminosity reaching about $5-7.5\times10^{34}$cm$^{-2}$s$^{-1}$. During Long Shutdown 3, several components of the CMS detector will undergo major changes, called Phase-2 upgrade, to be able to operate in the challenging environment of the HL-LHC. The current CMS silicon strip tracker has to be replaced with a new detector. The Phase-2 Outer Tracker (OT) will have higher radiation tolerance, higher granularity, and the capability to handle higher data rates compared to the current system. Another key feature of the OT will be to provide tracking information to the Level-1 (L1) trigger, allowing trigger rates to be kept at a sustainable level without sacrificing physics potential. For this, the OT will be made out of modules with two closely spaced sensors read out by front-end ASICs, which can correlate hits in the two sensors creating short track segments called stubs. The stubs will be used for tracking in the L1 track finder. The modules come in two flavors: strip-strip (2S) and pixel-strip (PS), which contain different sensor configurations and multiple ASICs. In this contribution, the design of the CMS Phase-2 OT, the technological choices, and the quality assurance (QA) procedures used to ensure the functionality of the modules will be reported. The contribution will cover the first results with pre-production devices and the different aspects taken into account during the QA: from fulfilling the precision specification of the module assembly procedure to ensuring the proper communication between the different ASICs on the module. The module noise performance is also checked and the full module functionality is verified at different temperatures.
The purpose of this document is to provide the user information about the installation of Fuel Analysis for Steady state and Transient (FAST)-1.2 on their computers or servers. General information about the code and supported operating systems is described in Section 1.0. Self-service oriented FAST-1.2 software licensing steps are described in Section 2.0. An installation verification test suite is provided with FAST-1.2 and described in Section 3.0. A convenience script for converting Fuel Rod Analysis Program – Constant (FRAPCON) to FAST inputs is discussed in Section 4.0. FAST-1.2 was developed and released under a software quality assurance program based upon NQA-1-2017 at Pacific Northwest National Laboratory (PNNL). FAST-1.2 is the latest baseline code. The installation verification test suite contains both steady state and transient Anticipated Operation Occurrences (AOOs), accident conditions, such as Reactivity Initiated Accidents (RIAs) and Loss of Coolant Accidents (LOCAs).
Spaceflight Safety (SFS) engineers at NASA Lewis Research Center (LeRC) are responsible for evaluating the microgravity fluids and combustion experiments, payloads and facilities developed at NASA LeRC which are manifested for spaceflight on the Space Shuttle, the Russian space station Mir, and/or the International Space Station (ISS). An ongoing activity at NASA LeRC is the comprehensive training of its SFS engineers through the creation and use of safety tools and processes. Teams of SFS engineers worked on the development of an Internet website (containing a spaceflight safety knowledge database and electronic templates of safety products) and the establishment of a technical peer review process (known as the Safety Assurance for Lewis Spaceflight Activities (SALSA) review).
The complexity of computer systems currently being designed for critical applications in the scientific, commercial, and military arenas requires the development of new techniques for utilizing models of system behavior in order to assure 'ultra-dependability'. The complexity of these systems, such as Space Station Freedom and the Air Traffic Control System, stems from their highly integrated designs containing both hardware and software as critical components. Reliability graph models, such as fault trees and digraphs, are used frequently to model hardware systems. Their applicability for software systems has also been demonstrated for software safety analysis and the analysis of software fault tolerance. This paper discusses further uses of graph models in the design and implementation of fault management systems for safety critical applications.
Global nuclear energy deployment scenarios suggest favorable economics for smaller, more versatile, and self-contained reactor technologies. Recognizing their key features as integrated, autonomous and either semi-remotely operated or fully remotely operated systems, microreactors are expected to be deployed in large numbers servicing off/micro-grids, many in geographically remote locations. Integrated nature of these systems as well as ease of their transportation as complete units, simplified installation and relocation/decommissioning challenge traditional continuity-of-knowledge practices used for conventional light water reactors where refueling is done onsite at designated times only replacing portions of their cores and only after their full commissioning for operations including completion of their containment building with security and safeguards measures in place. This effort is exploring AI (artificial intelligence)-enabled monitoring options that would be design agnostic and would assure secure unit deployment and operations. The principle is to maintain situational awareness via real-time evaluations of simultaneous and remotely transmitted monitoring data capturing key safeguards attributes including such characteristics as temperature, radiation, vibrational signals (inter alia), and others. The key principle is to provide reliable and resilient security options while maintaining simplified and economical deployment. The paper will review feasible options for AI-enabled solutions for such evaluations.
The Savannah River National Laboratory Glass Composition-Properties (ComPro) database is an extensive database containing pertinent composition and durability data to support the accelerated clean-up mission at the Defense Waste Processing Facility. The activities described in this data qualification report were performed to support the information contained in the database. There were two objectives of the original data qualification process. The first objective was to review supporting documentation to determine if DOE/RW-0333P Quality Assurance Requirements and Description had been implemented during the original work. If the DOE/RW-0333P Quality Assurance Requirements and Description had not been directly implemented during the original work, the second objective was to determine if the controls that were used were adequate to meet the intent of the DOE/RW-0333P Quality Assurance Requirements and Description. The results of these two objectives and the activities performed to support these decisions are described in this document. An assessment of each dataset was made to determine if the data were RW-0333P Compliant, RW-0333P Equivalent or Non-RW-0333P Compliant. The original data qualification was performed in accordance with E7, Conduct of Engineering Manual, Procedure 3.70, Revision 4, Qualification of Data. The specific method that was used was Equivalent Controls as described in E7, 3.70. Revision 2 of this document adds supporting information for the RW-0333P Compliant datasets added to Revision 3 of the database.
Impacts among asteroidal objects would have altered or destroyed pre-existing organic matter in both targets and projectiles to a greater or lesser degree depending upon impact velocities. To begin filling a knowledge gap on the shock metamorphism of organic compounds, we are studying the effects of shock impacts on selected classes of organic compounds utilizing laboratory shock facilities. Our approach is to subject mixtures of organic compounds, embedded in the matrix of the Murchison meteorite, to simulated hypervelocity impacts by firing them into targets at various pressures. The mixtures are then analyzed to determine the amount of each compound that survives as well as to determine if new compounds are being synthesized. The initial compounds added to the matrix (with the exception of thiosulfate). The sulfonic acids were chosen in part because they are relatively abundant in Murchison, relatively stable, and because they and the phosphonic acids are the first well-characterized homologous series of organic sulfur and phosphorus compounds identified in an extraterrestrial material. Experimental procedures were more fully described in the original proposal. A 20 mm gun, with its barrel extending into a vacuum chamber (10(exp -2) torr), was used to launch the projectile containing the sample at approx. 1.6 km/sec (3,600 mi/hr) into the target material. Maximum pressure of impact depend on target/projectile materials. The target was sufficiently thin to assure minimum pressure decay over the total sample thickness.
System safety assessment is defined in NPR 8715.3C, NASA General Safety Program Requirements as a disciplined, systematic approach to the analysis of risks resulting from hazards that can affect humans, the environment, and mission assets. Achievement of the highest practicable degree of system safety is one of NASA's highest priorities. Traditionally, system safety assessment at NASA and elsewhere has focused on the application of a set of safety analysis tools to identify safety risks and formulate effective controls.1 Familiar tools used for this purpose include various forms of hazard analyses, failure modes and effects analyses, and probabilistic safety assessment (commonly also referred to as probabilistic risk assessment (PRA)). In the past, it has been assumed that to show that a system is safe, it is sufficient to provide assurance that the process for identifying the hazards has been as comprehensive as possible and that each identified hazard has one or more associated controls. The NASA Aerospace Safety Advisory Panel (ASAP) has made several statements in its annual reports supporting a more holistic approach. In 2006, it recommended that "... a comprehensive risk assessment, communication and acceptance process be implemented to ensure that overall launch risk is considered in an integrated and consistent manner." In 2009, it advocated for "... a process for using a risk-informed design approach to produce a design that is optimally and sufficiently safe." As a rationale for the latter advocacy, it stated that "... the ASAP applauds switching to a performance-based approach because it emphasizes early risk identification to guide designs, thus enabling creative design approaches that might be more efficient, safer, or both." For purposes of this preface, it is worth mentioning three areas where the handbook emphasizes a more holistic type of thinking. First, the handbook takes the position that it is important to not just focus on risk on an individual basis but to consider measures of aggregate safety risk and to ensure wherever possible that there be quantitative measures for evaluating how effective the controls are in reducing these aggregate risks. The term aggregate risk, when used in this handbook, refers to the accumulation of risks from individual scenarios that lead to a shortfall in safety performance at a high level: e.g., an excessively high probability of loss of crew, loss of mission, planetary contamination, etc. Without aggregated quantitative measures such as these, it is not reasonable to expect that safety has been optimized with respect to other technical and programmatic objectives. At the same time, it is fully recognized that not all sources of risk are amenable to precise quantitative analysis and that the use of qualitative approaches and bounding estimates may be appropriate for those risk sources. Second, the handbook stresses the necessity of developing confidence that the controls derived for the purpose of achieving system safety not only handle risks that have been identified and properly characterized but also provide a general, more holistic means for protecting against unidentified or uncharacterized risks. For example, while it is not possible to be assured that all credible causes of risk have been identified, there are defenses that can provide protection against broad categories of risks and thereby increase the chances that individual causes are contained. Third, the handbook strives at all times to treat uncertainties as an integral aspect of risk and as a part of making decisions. The term "uncertainty" here does not refer to an actuarial type of data analysis, but rather to a characterization of our state of knowledge regarding results from logical and physical models that approximate reality. Uncertainty analysis finds how the output parameters of the models are related to plausible variations in the input parameters and in the modeling assumptions. The evaluation of unrtainties represents a method of probabilistic thinking wherein the analyst and decision makers recognize possible outcomes other than the outcome perceived to be "most likely." Without this type of analysis, it is not possible to determine the worth of an analysis product as a basis for making decisions related to safety and mission success. In line with these considerations the handbook does not take a hazard-analysis-centric approach to system safety. Hazard analysis remains a useful tool to facilitate brainstorming but does not substitute for a more holistic approach geared to a comprehensive identification and understanding of individual risk issues and their contributions to aggregate safety risks. The handbook strives to emphasize the importance of identifying the most critical scenarios that contribute to the risk of not meeting the agreed-upon safety objectives and requirements using all appropriate tools (including but not limited to hazard analysis). Thereafter, emphasis shifts to identifying the risk drivers that cause these scenarios to be critical and ensuring that there are controls directed toward preventing or mitigating the risk drivers. To address these and other areas, the handbook advocates a proactive, analytic-deliberative, risk-informed approach to system safety, enabling the integration of system safety activities with systems engineering and risk management processes. It emphasizes how one can systematically provide the necessary evidence to substantiate the claim that a system is safe to within an acceptable risk tolerance, and that safety has been achieved in a cost-effective manner. The methodology discussed in this handbook is part of a systems engineering process and is intended to be integral to the system safety practices being conducted by the NASA safety and mission assurance and systems engineering organizations. The handbook posits that to conclude that a system is adequately safe, it is necessary to consider a set of safety claims that derive from the safety objectives of the organization. The safety claims are developed from a hierarchy of safety objectives and are therefore hierarchical themselves. Assurance that all the claims are true within acceptable risk tolerance limits implies that all of the safety objectives have been satisfied, and therefore that the system is safe. The acceptable risk tolerance limits are provided by the authority who must make the decision whether or not to proceed to the next step in the life cycle. These tolerances are therefore referred to as the decision maker's risk tolerances. In general, the safety claims address two fundamental facets of safety: 1) whether required safety thresholds or goals have been achieved, and 2) whether the safety risk is as low as possible within reasonable impacts on cost, schedule, and performance. The latter facet includes consideration of controls that are collective in nature (i.e., apply generically to broad categories of risks) and thereby provide protection against unidentified or uncharacterized risks.
Efficacious pharmaceuticals with adequate shelf life are essential for successful space medical operations in support of space exploration missions. Physical and environmental factors unique to space missions such as vibration, G forces and ionizing radiation may adversely affect stability of pharmaceuticals intended for standard care of astronauts aboard space missions. Stable pharmaceuticals, therefore, are of paramount importance for assuring health and wellness of astronauts in space. Preliminary examination of stability of formulations from Shuttle and International Space Station (ISS) medical kits revealed that some of these medications showed physical and chemical degradation after flight raising concern of reduced therapeutic effectiveness with these medications in space. A research payload experiment was conducted with a select set of formulations stowed aboard a shuttle flight and on ISS. The payload consisted of four identical pharmaceutical kits containing 31 medications in different dosage forms that were transported to the International Space Station (ISS) aboard the Space Shuttle, STS 121. One of the four kits was stored on the shuttle and the other three were stored on the ISS for return to Earth at six months intervals on a pre-designated Shuttle flight for each kit; the shuttle kit was returned to Earth on the same flight. Standard stability indicating physical and chemical parameters were measured for all pharmaceuticals returned from the shuttle and from the first ISS increment payload along with ground-based matching controls. Results were compared between shuttle, ISS and ground controls. Evaluation of data from the three paradigms indicates that some of the formulations exhibited significant degradation in space compared to respective ground controls; a few formulations were unstable both on the ground and in space. An increase in the number of pharmaceuticals from ISS failing USP standards was noticed compared to those from the shuttle flight. A comprehensive evaluation of results is in progress.