Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Criticality Safety”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 163 records · Page 9
All sourcesNASA NTRSDOE OSTI
NASA NTRS2021

Separation at Crossing Waypoints Under Wind Uncertainty in Urban Air Mobility

To enable high-density operations in major metropolitan areas, urban air mobility networks are anticipated to have air traffic management with higher levels of autonomy. To ensure that this type of autonomy is feasible, one of the critical steps from a safety and efficiency perspective is understanding various factors that affect the spatial separation between airborne flights and ensure that these factors can be managed. In terms of separation assurance and scheduling, an important real-world concern is that future states of aircraft cannot be perfectly predicted. The focus of this research paper is to understand how these prediction errors affect separation and scheduling services and to explore mitigation strategies to handle these errors. In this research, we have simulated these types of uncertainty by adding wind-prediction errors to trajectory predictions for separation. With these wind-prediction errors, we decompose the problem into two separate questions. First, using both simulation and analytical methods, we look at conflict-detection-only scenarios to understand how the wind errors affect required minimum temporal separation between crossing flights to ensure a specific spatial separation. Next, we study how trajectory errors effect conflict resolution, and we explore different combinations of scheduling and separation assurance to mitigate the effects of uncertainty between crossing flights. The conflict resolution algorithm aims to minimize necessary temporal separation between crossing flights under uncertainty, still ensuring safety-critical spatial separation. In summary, this research suggests that the required minimum temporal separation at a crossing waypoint is dependent on factors such as inbound crossing angle, the relative angle between wind direction and bearing of each route, wind magnitude, wind magnitude uncertainty, nominal cruise airspeed of aircraft, and look-ahead time of the conflict detection algorithm. This research also suggests that different combinations of scheduling and separation have different qualitative results. Using a combination of strategic, flow-based scheduling, tactical scheduling at crossings, speed control near crossing points, and separation management leads to a system that is insensitive to trajectory prediction errors with high throughput and flexibility for aircraft away from shared resources.

urban air mobility↗
NASA NTRS2021

Separation at Crossing Waypoints Under Wind Uncertainty in Urban Air Mobility

To enable high-density operations in major metropolitan areas, urban air mobility networks are anticipated to have air traffic management with higher levels of autonomy. To ensure that this type of autonomy is feasible, one of the critical steps from a safety and efficiency perspective is understanding various factors that affect the spatial separation between airborne flights and ensure that these factors can be managed. In terms of separation assurance and scheduling, an important real-world concern is that future states of aircraft cannot be perfectly predicted. The focus of this research paper is to understand how these prediction errors affect separation and scheduling services and to explore mitigation strategies to handle these errors. In this research, we have simulated these types of uncertainty by adding wind-prediction errors to trajectory predictions for separation. With these wind-prediction errors, we decompose the problem into two separate questions. First, using both simulation and analytical methods, we look at conflict-detection-only scenarios to understand how the wind errors affect required minimum temporal separation between crossing flights to ensure a specific spatial separation. Next, we study how trajectory errors effect conflict resolution, and we explore different combinations of scheduling and separation assurance to mitigate the effects of uncertainty between crossing flights. The conflict resolution algorithm aims to minimize necessary temporal separation between crossing flights under uncertainty, still ensuring safety-critical spatial separation. In summary, this research suggests that the required minimum temporal separation at a crossing waypoint is dependent on factors such as inbound crossing angle, the relative angle between wind direction and bearing of each route, wind magnitude, wind magnitude uncertainty, nominal cruise airspeed of aircraft, and look-ahead time of the conflict detection algorithm. This research also suggests that different combinations of scheduling and separation have different qualitative results. Using a combination of strategic, flow-based scheduling, tactical scheduling at crossings, speed control near crossing points, and separation management leads to a system that is insensitive to trajectory prediction errors with high throughput and flexibility for aircraft away from shared resources.

urban air mobility↗
NASA NTRSDate not supplied

NASA’s Identified Risks of Adverse Outcomes Due to Inadequate Human Systems Integration Architecture in Human Spaceflight

The NASA Human System Risk Board (HSRB) has the overall responsibility for tracking the evolution of the top ~30 human system risks that it has identified to be associated with human spaceflight. As part of this process, the Board is charged with maintaining a consistent, integrated process to mitigate those risks, and developing evidence-based risk posture recommendations. One of the identified risks is due to inadequate human systems integration architecture (HSIA) and a driving factor of this risk is that given decreasing real-time ground support for execution of complex operations during future exploration missions, there is a possibility of adverse performance outcomes including that crew are unable to adequately respond to unanticipated critical malfunctions or detect safety critical procedural errors. The HSRB uses Directed Acyclic Graphs (DAGs) as a communication tool for describing how astronaut exposure to spaceflight hazards leads to meaningful mission-level health and performance outcomes and as the basis for understanding intermediate causal relationships between risk contributing factors and countermeasures that link hazards to outcomes. The HSIA risk DAG will be presented and described. Historically, critical malfunctions requiring Crew/MCC management occurred at a rate of 1.7 times per year for ISS averaged over the lifetime and 3-4 times per year in the burn in phase for the vehicle. These averages do not include EVA data, which greatly increases the incident rate. Prior experience from the Apollo program showed 10/11 crewed missions experienced significant anomalies where crew relied heavily on MCC expertise in real-time. These failure patterns are in line with those observed in other complex engineered systems (e.g., oil rigs, launch systems, commercial aviation, etc.) It is likely that general malfunction and error rates are > 10% for short duration missions (<30 days), based on past and current spaceflight operations data. Likelihood of adverse outcomes has the potential to increase as crew conduct work with new, complex systems and with less ground support. For Low Earth Orbit missions and Lunar missions less than 30 days, assuming minimal comm delays, disruptions and bandwidth limitations, malfunctions and errors can affect mission objectives and crew health but may be mitigated by ground support. For Lunar missions greater than 30 days and any potential Mars mission malfunctions and errors can have Loss of Crew and Loss of Mission consequences due to reduced ground support (communication delays, constraints and blackouts) for more complex operations, as well as reduced resupply and evacuation options.

Daniel M Buckland↗
NASA NTRS2004

Monitoring the Performance of a Neuro-Adaptive Controller

Traditional control has proven to be ineffective to deal with catastrophic changes or slow degradation of complex, highly nonlinear systems like aircraft or spacecraft, robotics, or flexible manufacturing systems. Control systems which can adapt toward changes in the plant have been proposed as they offer many advantages (e.g., better performance, controllability of aircraft despite of a damaged wing). In the last few years, use of neural networks in adaptive controllers (neuro-adaptive control) has been studied actively. Neural networks of various architectures have been used successfully for online learning adaptive controllers. In such a typical control architecture, the neural network receives as an input the current deviation between desired and actual plant behavior and, by on-line training, tries to minimize this discrepancy (e.g.; by producing a control augmentation signal). Even though neuro-adaptive controllers offer many advantages, they have not been used in mission- or safety-critical applications, because performance and safety guarantees cannot b e provided at development time-a major prerequisite for safety certification (e.g., by the FAA or NASA). Verification and Validation (V&V) of an adaptive controller requires the development of new analysis techniques which can demonstrate that the control system behaves safely under all operating conditions. Because of the requirement to adapt toward unforeseen changes during operation, i.e., in real time, design-time V&V is not sufficient.

Schumann, Johann↗
NASA NTRS2009

Apollo Spacecraft and Saturn V Launch Vehicle Pyrotechnics/Explosive Devices

The Apollo Mission employs more than 210 pyrotechnic devices per mission.These devices are either automatic of commanded from the Apollo spacecraft systems. All devices require high reliability and safety and most are classified as either crew safety critical or mission critical. Pyrotechnic devices have a wide variety of applications including: launch escape tower separation, separation rocket ignition, parachute deployment and release and electrical circuit opening and closing. This viewgraph presentation identifies critical performance, design requirements and safety measures used to ensure quality, reliability and performance of Apollo pyrotechnic/explosive devices. The major components and functions of a typical Apollo pyrotechnic/explosive device are listed and described (initiators, cartridge assemblies, detonators, core charges). The presentation also identifies the major locations and uses for the devices on: the Command and Service Module, Lunar Module and all stages of the launch vehicle.

Interbartolo, Michael↗
NASA NTRSDate not supplied

Adaptive Stress Testing of Collision Avoidance Systems for Small UASs with Deep Reinforcement Learning

The next-generation Airborne Collision Avoidance System for smaller UASs (ACAS sXu) is currently being developed and tested by the Federal Aviation Administration (FAA) to provide detect-and-avoid capability for small unmanned aircraft operating beyond line-of-sight. Due to the complexity and safety-critical nature of the system, safety validation is important not only for the certification of the final system, but also for informing changes during the iterative development process. In this paper, we analyze a prototype of ACAS sXu in simulated aircraft encounters to discover scenarios of small near mid-air collisions (sNMACs), an important safety event in which two aircraft come closer than 50 feet horizontally and 15 feet vertically. Due to the size and complexity of the system as well as rarity of sNMAC events, traditional methods such as Monte Carlo testing often require informed setup and targeting to elicit failures. However, such a dependence on domain knowledge can be incompatible with the independent verification and validation (IV&V) process, the aim of which is to discover unforeseen issues. To address these challenges, we apply an accelerated validation method called adaptive stress testing (AST) to find the most likely sNMAC scenarios without reliance on system introspection. AST uses reinforcement learning to adapt the search towards the most promising areas of the search space as it progresses. We use a state-of-the-art deep reinforcement learning algorithm, proximate policy optimization, to more efficiently search the large and continuous state space. We find that this approach significantly improves the performance of AST compared to a prior approach based on Monte Carlo tree search. We perform experiments using AST to find sNMAC events under various encounter configurations, varying parameters pertaining to dynamics and coordination. Our experiments show AST to be very effective at finding sNMAC scenarios. We summarize our findings, presenting high-level categories of discovered sNMACs and specific examples of encounters in each category.

aircraft collision avoidance↗
NASA NTRSDate not supplied

NASA's Identified Risk of Adverse Outcomes due to Inadequate Human Systems Integration Architecture

The NASA Human System Risk Board (HSRB) is responsible for tracking the evolution of the top ~30 human system risks identified to be associated with human spaceflight. As part of this process, the Board is charged with maintaining a consistent, integrated process to evaluate those risks and developing evidence-based risk posture recommendations. Risks are ranked by likelihood and consequence. Intermediate causal relationships between risk contributing factors and countermeasures that link hazards to outcomes are described using Directed Acyclic Graphs (DAGs). The DAGs are also useful for identifying common factors and countermeasures across the top 30 risks as well as communicating how astronaut exposure to spaceflight hazards leads to meaningful mission-level health and performance outcomes. One of the top risks tracked by the HSRB is The Risk of Adverse Outcomes Due to Inadequate Human-Systems Integration Architecture (HSIA). This risk captures the possibility that due to decreasing real-time ground support during missions beyond LEO, crew will be unable to adequately respond to unanticipated critical malfunctions or detect safety-critical procedural errors. The HSIA risk is ranked red (high) for Lunar surface and Mars missions due to the probability of Loss of Crew and Loss of Mission consequences. This paper describes the evidence that supports the HSIA risk ranking and presents the central narrative of the HSIA risk DAG-- i.e., anomaly detection, diagnosis, intervention, and task performance. Characterizations of the current state of practice for each of the DAG’s central nodes and the future tools needed for successful anomaly response are provided.

human-systems integration architecture↗
NASA NTRS2021

Architectural Modeling and Analysis for Safety Engineering

Model-based development tools are increasingly being used for system-level development of safety-critical systems. Architectural and behavioral models provide important information that can be leveraged to improve the system safety analysis process. Model-based design artifacts produced in early stage development activities can be used to perform system safety analysis, reducing costs and providing accurate results throughout the system life-cycle. In this report we describe an extension to the Architecture Analysis and Design Language (AADL) that supports modeling of system behavior under failure conditions. This Safety Annex enables the independent modeling of component failures and allows safety engineers to weave various types of fault behavior into the nominal system model. The accompanying tool support uses model checking to propagate errors from their source to their effect on safety properties without the need to add separate propagation specifications. The tool also captures all minimal set of fault combinations that can cause violation of the safety properties, that can be compared to qualitative and quantitative objectives as part of the safety assessment process. We describe the Safety Annex, illustrate its use with a representative example, and discuss and demonstrate the tool support enabling an analyst to investigate the system behavior under failure conditions.

FTA↗
NASA NTRS1996

V&V Within Reuse-Based Software Engineering

Verification and Validation (V&V) is used to increase the level of assurance of critical software, particularly that of safety-critical and mission-critical software. V&V is a systems engineering discipline that evaluates the software in a systems context, and is currently applied during the development of a specific application system. In order to bring the effectiveness of V&V to bear within reuse-based software engineering, V&V must be incorporated within the domain engineering process.

Addy, Edward A.↗
NASA NTRS1996

V & V Within Reuse-Based Software Engineering

Verification and validation (V&V) is used to increase the level of assurance of critical software, particularly that of safety-critical and mission critical software. This paper describes the working group's success in identifying V&V tasks that could be performed in the domain engineering and transition levels of reuse-based software engineering. The primary motivation for V&V at the domain level is to provide assurance that the domain requirements are correct and that the domain artifacts correctly implement the domain requirements. A secondary motivation is the possible elimination of redundant V&V activities at the application level. The group also considered the criteria and motivation for performing V&V in domain engineering.

Addy, Edward A.↗
NASA NTRSDate not supplied

Defining Collaborative Control Interactions Using Systems Theory

Human teams collaborate by establishing roles, changing functional authorities, maintaining team cognition, coordinating, and mutually helping one another close control loops. These complex inter-actions are inspiring novel concepts to improve human-machine and multi-machine collaboration. However, these new systems face engineering gaps in modeling, analysis, design, and assurance. As such, few have been fielded in safety-critical domains like aerospace. To analyze safety, this paper introduces a system-theoretic framework to describe interactions that are—or are planned to be—used in multi-controller systems. It outlines a taxonomy of seven structural dimensions that influence controller interactions and nine dynamics observed in collaborative control that are defined using Systems Theory. An analyzed set of 101 controller interactions in aerospace systems demonstrates how to apply the framework and that designers are trying to create more sophisticated systems. This framework provides the foundation to extend system-theoretic hazard analysis techniques to systematically find collabora-tive-control causal factors.

Human machine teaming↗
NASA NTRS2020

Adaptive Stress Testing: Finding Likely Failure Events with Reinforcement Learning

Finding the most likely path to a set of failure states is important to the analysis of safety-critical systems that operate over a sequence of time steps, such as aircraft collision avoidance systems and autonomous cars. In many applications such as autonomous driving, failures cannot be completely eliminated due to the complex stochastic environment in which the system operates.As a result, safety validation is not only concerned about whether a failure can occur, but also discovering which failures are most likely to occur. This article presents adaptive stress testing (AST), a framework for finding the most likely path to a failure event in simulation. We consider a general black box setting for partially observable and continuous-valued systems operating in an environment with stochastic disturbances. We formulate the problem as a Markov decision process and use reinforcement learning to optimize it. The approach is simulation-based and does not require internal knowledge of the system, making it suitable for black-box testing of large systems. We present different formulations depending on whether the state is fully observable or partially observable. In the latter case, we present a modified Monte Carlo tree search algorithm that only requires access to the pseudorandom number generator of the simulator to overcome partial observability. We also present an extension of the framework, called differential adaptive stress testing (DAST), that can find failures that occur in one system but not in another. This type of differential analysis is useful in applications such as regression testing, where we are concerned with finding areas of relative weakness compared to a baseline. We demonstrate the effectiveness of the approach on an aircraft collision avoidance application, where a prototype aircraft collision avoidance system is stress tested to find the most likely scenarios of near mid-air collision.

Verification and Validation↗
NASA NTRS2023

Considerations for Software Fault Prevention and Tolerance

Mission or safety-critical spaceflight systems should be developed to both reduce the likelihood of software faults pre-flight and to detect/mitigate the effects of software errors should they occur in-flight. New data is available that categorizes software errors from significant historic spaceflight software incidents with implications and considerations to better develop and design software to both minimize and tolerate these most likely software failures.

Avionics↗
NASA NTRS2017

Interpretable Categorization of Heterogeneous Time Series Data

We analyze data from simulated aircraft encounters to validate and inform the development of a prototype aircraft collision avoidance system. The high-dimensional and heterogeneous time series dataset is analyzed to discover properties of near mid-air collisions (NMACs) and categorize the NMAC encounters. Domain experts use these properties to better organize and understand NMAC occurrences. Existing solutions either are not capable of handling high-dimensional and heterogeneous time series datasets or do not provide explanations that are interpretable by a domain expert. The latter is critical to the acceptance and deployment of safety-critical systems. To address this gap, we propose grammar-based decision trees along with a learning algorithm. Our approach extends decision trees with a grammar framework for classifying heterogeneous time series data. A context-free grammar is used to derive decision expressions that are interpretable, application-specific, and support heterogeneous data types. In addition to classification, we show how grammar-based decision trees can also be used for categorization, which is a combination of clustering and generating interpretable explanations for each cluster. We apply grammar-based decision trees to a simulated aircraft encounter dataset and evaluate the performance of four variants of our learning algorithm. The best algorithm is used to analyze and categorize near mid-air collisions in the aircraft encounter dataset. We describe each discovered category in detail and discuss its relevance to aircraft collision avoidance.

Drones↗
NASA NTRSDate not supplied

A Formal Verification Framework for Runtime Assurance

The simplex architecture is an instance of Runtime Assurance (RTA) where a trusted component takes control of a safety-critical system when an untrusted component violates a safety property. This paper presents a formalization of the simplex RTA framework in the language of hybrid programs. A feature of this formal verification framework is that, for a given system, a specific instantiation can be created and its safety properties are guaranteed by construction. Instantiations may be kept at varying levels of generality, allowing for black box components, such as ML/AI-based controllers, to be modeled. The framework is written in the Prototype Verification System (PVS) using Plaidypvs, an embedding of differential dynamic logic in PVS. As a proof of concept, the framework is illustrated on an automatic vehicle braking system.

Runtime assurance↗
NASA NTRSDate not supplied

A Formal Verification Framework for Runtime Assurance

The simplex architecture is an instance of Runtime Assurance (RTA) where a trusted component takes control of a safety-critical system when an untrusted component violates a safety property. This paper presents a formalization of the simplex RTA framework in the language of hybrid programs. A feature of this formal verification framework is that, for a given system, a specific instantiation can be created and its safety properties are guaranteed by construction. Instantiations may be kept at varying levels of generality, allowing for black box components, such as ML/AI-based controllers, to be modeled. The framework is written in the Prototype Verification System (PVS) using Plaidypvs, an embedding of differential dynamic logic in PVS. As a proof of concept, the framework is illustrated on an automatic vehicle braking system.

Runtime assurance↗
NASA NTRS2011

Reliability and Maintainability Engineering - A Major Driver for Safety and Affordability

The United States National Aeronautics and Space Administration (NASA) is in the midst of an effort to design and build a safe and affordable heavy lift vehicle to go to the moon and beyond. To achieve that, NASA is seeking more innovative and efficient approaches to reduce cost while maintaining an acceptable level of safety and mission success. One area that has the potential to contribute significantly to achieving NASA safety and affordability goals is Reliability and Maintainability (R&M) engineering. Inadequate reliability or failure of critical safety items may directly jeopardize the safety of the user(s) and result in a loss of life. Inadequate reliability of equipment may directly jeopardize mission success. Systems designed to be more reliable (fewer failures) and maintainable (fewer resources needed) can lower the total life cycle cost. The Department of Defense (DOD) and industry experience has shown that optimized and adequate levels of R&M are critical for achieving a high level of safety and mission success, and low sustainment cost. Also, lessons learned from the Space Shuttle program clearly demonstrated the importance of R&M engineering in designing and operating safe and affordable launch systems. The Challenger and Columbia accidents are examples of the severe impact of design unreliability and process induced failures on system safety and mission success. These accidents demonstrated the criticality of reliability engineering in understanding component failure mechanisms and integrated system failures across the system elements interfaces. Experience from the shuttle program also shows that insufficient Reliability, Maintainability, and Supportability (RMS) engineering analyses upfront in the design phase can significantly increase the sustainment cost and, thereby, the total life cycle cost. Emphasis on RMS during the design phase is critical for identifying the design features and characteristics needed for time efficient processing, improved operational availability, and optimized maintenance and logistic support infrastructure. This paper discusses the role of R&M in a program acquisition phase and the potential impact of R&M on safety, mission success, operational availability, and affordability. This includes discussion of the R&M elements that need to be addressed and the R&M analyses that need to be performed in order to support a safe and affordable system design. The paper also provides some lessons learned from the Space Shuttle program on the impact of R&M on safety and affordability.

Safie, Fayssal M.↗