SEARCH · Engineering Papers
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Software Engineering Initiative: Reduces risk of software failure -Increases mission safety. More predictable software cost estimates and delivery schedules. Smarter buyer of contracted out software. More defects found and removed earlier. Reduces duplication of efforts between projects. Increases ability to meet the challenges of evolving software technology.
More than two decades ago, Butler and Finelli examined the problem of experimentally demonstrating the reliability of safety critical software and concluded that it was impractical. We revisit this conclusion in the light of recent advances in computer system virtualization technology and the capability to link virtualization tools to simulation models of physical environments. A specific demonstration of testing for reliability is offered using software that is part of a building control system. Extrapolating the results of this demonstration, we conclude that experimental demonstrations of high reliability may now be feasible for some applications.
Modern aircraft rely heavily on dependable operation of many safety-critical software components. Despite careful design, verification and validation (V&V), on-board software can fail with disastrous consequences if it encounters problematic software/hardware interaction or must operate in an unexpected environment. We are using a Bayesian approach to monitor the software and its behavior during operation and provide up-to-date information about the health of the software and its components. The powerful reasoning mechanism provided by our model-based Bayesian approach makes reliable diagnosis of the root causes possible and minimizes the number of false alarms. Compilation of the Bayesian model into compact arithmetic circuits makes SWHM feasible even on platforms with limited CPU power. We show initial results of SWHM on a small simulator of an embedded aircraft software system, where software and sensor faults can be injected.
The high cost of software production is driving development organizations to adopt more automated design and analysis methods such as rapid prototyping, computer-aided software engineering (CASE) tools, and high-level code generators. Even developers of safety-critical software system have adopted many of these new methods while striving to achieve high levels Of quality and reliability. While these new methods may enhance productivity and quality in many cases, we examine some of the risks involved in the use of new methods in safety-critical contexts. We examine a case study involving the use of a CASE tool that automatically generates code from high-level system designs. We show that while high-level testing on the system structure is highly desirable, significant risks exist in the automatically generated code and in re-validating releases of the generated code after subsequent design changes. We identify these risks and suggest process improvements that retain the advantages of rapid, automated development methods within the quality and reliability contexts of safety-critical projects.
Purpose: Delivery of sufficient amounts of therapeutic drugs into the eye for treatment of various ocular diseases is often a challenging task. Ultrasound was shown to be effective in enhancing ocular drug delivery in the authors’ previous in vitro and in vivo studies. Methods: The study reported here was designed to investigate the safety of ultrasound application and its potential thermal effects in the eye using PZFlex modeling software. The safety limit in this study was set as a temperature increase of no more than 1.5 °C based on regulatory recommendations and previous experimental safety studies. Acoustic and thermal specifications of different human eye tissues were obtained from the published literature. The tissues of particular interest in this modeling safety study were cornea, lens, and the location of optic nerve in the posterior eye. Ultrasound application was modeled at frequencies of 400 kHz–1 MHz, intensities of 0.3–1 W/cm{sup 2}, and exposure duration of 5 min, which were the parameters used in the authors’ previous drug delivery experiments. The baseline eye temperature was 37 °C. Results: The authors’ results showed that the maximal tissue temperatures after 5 min of ultrasound application were 38, 39, 39.5, and 40 °C in the cornea, 39.5, 40, 42, and 43 °C in the center of the lens, and 37.5, 38.5, and 39 °C in the back of the eye (at the optic nerve location) at frequencies of 400, 600, 800 kHz, and 1 MHz, respectively. Conclusions: The ocular temperatures reached at higher frequencies were considered unsafe based on current recommendations. At a frequency of 400 kHz and intensity of 0.8 W/cm{sup 2} (parameters shown in the authors’ previous in vivo studies to be optimal for ocular drug delivery), the temperature increase was small enough to be considered safe inside different ocular tissues. However, the impact of orbital bone and tissue perfusion should be included in future modeling efforts to determine the safety of this method in the whole orbit especially regarding potential adverse optic nerve heating at the location of the bone.
NASA and its industry and international partners are embarking on a bold and inspiring development effort to design and build an exploration class space system. The space system is made up of the Orion system, the Space Launch System (SLS) and the Ground Systems Development and Operations (GSDO) system. All are highly coupled together and dependent on each other for the combined safety of the space system. A key area of system safety focus needs to be in the ground and flight application software system (GFAS). In the development, certification and operations of GFAS, there are a series of safety characteristics that define the approach to ensure mission success. This paper will explore and examine the safety characteristics of the GFAS development.
High reliability of mission- and safety-critical software systems has been identified by NASA as a high-priority technology challenge. We present an approach for the performance analysis of a neural network (NN) in an advanced adaptive control system. This problem is important in the context of safety-critical applications that require certification, such as flight software in aircraft. We have developed a tool to measure the performance of the NN during operation by calculating a confidence interval (error bar) around the NN's output. Our tool can be used during pre-deployment verification as well as monitoring the network performance during operation. The tool has been implemented in Simulink and simulation results on a F-15 aircraft are presented.
This program was developed to fill a need within the Wallops Flight Facility workflow for automation of the development of vertical plan limit lines used by flight safety officers during the conduct of expendable launch vehicle missions. Vertical plane present-position-based destruct lines have been used by range safety organizations at numerous launch ranges to mitigate launch vehicle risks during the early phase of flight. Various ranges have implemented data submittal and processing workflows to develop these destruct lines. As such, there is significant prior art in this field. The ElLimits program was developed at NASA's Wallops Flight Facility to automate the process for developing vertical plane limit lines using current computing technologies. The ElLimits program is used to configure launch-phase range safety flight control lines for guided missiles. The name of the program derives itself from the fundamental quantity that is computed - flight elevation limits. The user specifies the extent and resolution of a grid in the vertical plane oriented along the launch azimuth. At each grid point, the program computes the maximum velocity vector flight elevation that can be permitted without endangering a specified back-range location. Vertical plane x-y limit lines that can be utilized on a present position display are derived from the flight elevation limit data by numerically propagating 'streamlines' through the grid. The failure turn and debris propagation simulation technique used by the application is common to all of its analysis options. A simulation is initialized at a vertical plane grid point chosen by the program. A powered flight failure turn is then propagated in the plane for the duration of the so-called RSO reaction time. At the end of the turn, a delta-velocity is imparted, and a ballistic trajectory is propagated to impact. While the program possesses capability for powered flight failure turn modeling, it does not require extensive user inputs of vehicle characteristics (e.g., thrust and aerodynamic data), nor does it require reams of turn data after the traditional fashion of the Air Force ranges. The program requires a nominal trajectory table (time, altitude, range, velocity, and flight elevation) and makes heavy use of it to initialize and model a failure turn.
This paper intends to present the design and the production of a software for the Occupational Health and Safety Integrated Management System with the view to a rapid drawing up of the system documents in the field of occupational health and safety.
Modern aircraft, both piloted fly-by-wire commercial aircraft as well as UAVs, more and more depend on highly complex safety critical software systems with many sensors and computer-controlled actuators. Despite careful design and V&V of the software, severe incidents have happened due to malfunctioning software. In this paper, we discuss the use of Bayesian networks (BNs) to monitor the health of the on-board software and sensor system, and to perform advanced on-board diagnostic reasoning. We will focus on the approach to develop reliable and robust health models for the combined software and sensor systems.
With the current transition from analog to digital instrumentation and control systems in nuclear power plants, the number and variety of software-based systems has significantly increased. Due to the sophisticated nature and the increasing complexity of software, a significant challenge faced by the nuclear industry is the trust one can place in software-based systems once they have been developed. The trust placed in software is typically termed software dependability, a qualifier which encompasses different attributes such as software reliability, safety, security, availability and maintainability. It is recognized that these attributes relate to each other in different ways under various scenarios. The detailed dependencies between software dependability attributes can be found in a previous study. With limited time and budget resources, which dependability attribute should be given the highest priority when certifying software-based systems in the nuclear industry is a fundamental question that needs to be answered. This paper addresses this problem using stakeholders' opinion elicitation. A comprehensive questionnaire was designed to elicit the goals that should be fulfilled by the nuclear industry and to collect the relative importance of the various dependability attributes for each goal. We then used the Analytical Hierarchy Process (AHP) to analyze the data and obtained the relative importance ranking of software dependability attributes in the context of a reactor protection system. The results will provide guidance to resource allocation for the certification of software dependability in the nuclear industry. (authors)
The SAS4A/SASSYS-1 safety analysis software is used to perform deterministic analysis of anticipated events as well as design-basis and beyond-design-basis accidents for advanced fast reactors. It plays a central role in the analysis of U.S. DOE conceptual designs, proposed test and demonstration reactors, and in domestic and international collaborations. This report summarizes the code development activities that have taken place during FY2017. Extensions to the void and cladding reactivity feedback models have been implemented, and Control System capabilities have been improved through a new virtual data acquisition system for plant state variables and an additional Block Signal for a variable lag compensator to represent reactivity feedback for novel shutdown devices. Current code development and maintenance needs are also summarized in three key areas: software quality assurance, modeling improvements, and maintenance of related tools. With ongoing support, SAS4A/SASSYS-1 can continue to fulfill its growing role in fast reactor safety analysis and help solidify DOE’s leadership role in fast reactor safety both domestically and in international collaborations.
Integrated Systems Health Management (ISHM) is a system engineering discipline that addresses the design, development, operation, and lifecycle management of components, subsystems, vehicles, and other operational systems with the purpose of maintaining nominal system behavior and function and assuring mission safety and effectiveness under off-nominal conditions. NASA missions are often conducted in extreme, unfamiliar environments of space, using unique experimental spacecraft. In these environments, off-nominal conditions can develop with the potential to rapidly escalate into mission- or life-threatening situations. Further, the high visibility of NASA missions means they are always characterized by extraordinary attention to safety. ISHM is a critical element of risk mitigation, mission safety, and mission assurance for exploration. ISHM enables: In-space maintenance and repair; a) Autonomous (and automated) launch abort and crew escape capability; b) Efficient testing and checkout of ground and flight systems; c) Monitoring and trending of ground and flight system operations and performance; d) Enhanced situational awareness and control for ground personnel and crew; e) Vehicle autonomy (self-sufficiency) in responding to off-nominal conditions during long-duration and distant exploration missions; f) In-space maintenance and repair; and g) Efficient ground processing of reusable systems. ISHM concepts and technologies may be applied to any complex engineered system such as transportation systems, orbital or planetary habitats, observatories, command and control systems, life support systems, safety-critical software, and even the health of flight crews. As an overarching design and operational principle implemented at the system-of-systems level, ISHM holds substantial promise in terms of affordability, safety, reliability, and effectiveness of space exploration missions.
SAND2025-01917O Elucidator is a software tool that allows for the storage and interpretation of arbitrary metadata for use in an HPC context. It provides a flexible specification of data members uses facilities to convert buffers of information into the appropriate data types to ensure type safety. The software supports multithreading and database support. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.
Enhanced AutoNav (ENav), the baseline surface navigation software for NASA’s Perseverance rover, sorts a list of candidate paths for the rover to traverse, then uses the Approximate Clearance Evaluation (ACE) algorithm to evaluate whether the most highly ranked paths are safe. ACE is crucial for maintaining the safety of the rover, but is computationally expensive. If the most promising candidates in the list of paths are all found to be infeasible, ENav must continue to search the list and run time-consuming ACE evaluations until a feasible path is found. In this paper, we present two heuristics that, given a terrain heightmap around the rover, produce cost estimates that more effectively rank the candidate paths before ACE evaluation. The first heuristic uses Sobel operators and convolution to incorporate the cost of traversing high-gradient terrain. The second heuristic uses a machine learning (ML) model to predict areas that will be deemed untraversable by ACE. We used physics simulations to collect training data for the ML model and to run Monte Carlo trials to quantify navigation performance across a variety of terrains with various slopes and rock distributions. Compared to ENav's baseline performance, integrating the heuristics can lead to a significant reduction in ACE evaluations and average computation time per planning cycle, increase path efficiency, and maintain or improve the rate of successful traverses. This strategy of targeting specific bottlenecks with ML while maintaining the original ACE safety checks provides an example of how ML can be infused into planetary science missions and other safety-critical software.
The engineering development of the new Space Launch System (SLS) launch vehicle requires cross discipline teams with extensive knowledge of launch vehicle subsystems, information theory, and autonomous algorithms dealing with all operations from pre-launch through on orbit operations. The characteristics of these spacecraft systems must be matched with the autonomous algorithm monitoring and mitigation capabilities for accurate control and response to abnormal conditions throughout all vehicle mission flight phases, including precipitating safing actions and crew aborts. This presents a large and complex system engineering challenge, which is being addressed in part by focusing on the specific subsystems involved in the handling of off-nominal mission and fault tolerance with response management. Using traditional model based system and software engineering design principles from the Unified Modeling Language (UML) and Systems Modeling Language (SysML), the Mission and Fault Management (M&FM) algorithms for the vehicle are crafted and vetted in specialized Integrated Development Teams (IDTs) composed of multiple development disciplines such as Systems Engineering (SE), Flight Software (FSW), Safety and Mission Assurance (S&MA) and the major subsystems and vehicle elements such as Main Propulsion Systems (MPS), boosters, avionics, Guidance, Navigation, and Control (GNC), Thrust Vector Control (TVC), and liquid engines. These model based algorithms and their development lifecycle from inception through Flight Software certification are an important focus of this development effort to further insure reliable detection and response to off-nominal vehicle states during all phases of vehicle operation from pre-launch through end of flight. NASA formed a dedicated M&FM team for addressing fault management early in the development lifecycle for the SLS initiative. As part of the development of the M&FM capabilities, this team has developed a dedicated testbed that integrates specific M&FM algorithms, specialized nominal and off-nominal test cases, and vendor-supplied physics-based launch vehicle subsystem models. Additionally, the team has developed processes for implementing and validating these algorithms for concept validation and risk reduction for the SLS program. The flexibility of the Vehicle Management End-to-end Testbed (VMET) enables thorough testing of the M&FM algorithms by providing configurable suites of both nominal and off-nominal test cases to validate the developed algorithms utilizing actual subsystem models such as MPS. The intent of VMET is to validate the M&FM algorithms and substantiate them with performance baselines for each of the target vehicle subsystems in an independent platform exterior to the flight software development infrastructure and its related testing entities. In any software development process there is inherent risk in the interpretation and implementation of concepts into software through requirements and test cases into flight software compounded with potential human errors throughout the development lifecycle. Risk reduction is addressed by the M&FM analysis group working with other organizations such as S&MA, Structures and Environments, GNC, Orion, the Crew Office, Flight Operations, and Ground Operations by assessing performance of the M&FM algorithms in terms of their ability to reduce Loss of Mission and Loss of Crew probabilities. In addition, through state machine and diagnostic modeling, analysis efforts investigate a broader suite of failure effects and associated detection and responses that can be tested in VMET to ensure that failures can be detected, and confirm that responses do not create additional risks or cause undesired states through interactive dynamic effects with other algorithms and systems. VMET further contributes to risk reduction by prototyping and exercising the M&FM algorithms early in their implementation and without any inherent hindrances such as meeting FSW processor scheduling constraints due to their target platform - ARINC 653 partitioned OS, resource limitations, and other factors related to integration with other subsystems not directly involved with M&FM such as telemetry packing and processing. The baseline plan for use of VMET encompasses testing the original M&FM algorithms coded in the same C++ language and state machine architectural concepts as that used by Flight Software. This enables the development of performance standards and test cases to characterize the M&FM algorithms and sets a benchmark from which to measure the effectiveness of M&FM algorithms performance in the FSW development and test processes.
The airspace is becoming more and more complicated, and will continue to do so in the future with the integration of Unmanned Aerial Vehicles (UAVs), autonomy, spacecraft, other forms of aviation technology into the airspace. The new technology and complexity increases the importance and difficulty of safety assurance. Additionally, testing new technologies on complex aviation systems & systems of systems can be very difficult, expensive, and sometimes unsafe in real life scenarios. Prognostic methodology provides an estimate of the health and risks of a component, vehicle, or airspace and knowledge of how that will change over time. That measure is especially useful in safety determination, mission planning, and maintenance scheduling. The developed testbed will be used to validate prediction algorithms for the real-time safety monitoring of the National Airspace System (NAS) and the prediction of unsafe events. The framework injects flight related anomalies related to ground systems, routing, airport congestion, etc. to test and verify algorithms for NAS safety. In our research work, we develop a live, distributed, hardware-in-the-loop testbed for aviation and airspace prognostics along with exploring further research possibilities to verify and validate future algorithms for NAS safety. The testbed integrates virtual aircraft using the X-Plane simulator and X-PlaneConnect toolbox, UAVs using onboard sensors and cellular communications, and hardware in the loop components. In addition, the testbed includes an additional research framework to support and simplify future research activities. It enables safe, accurate, and inexpensive experimentation and research into airspace and vehicle prognosis that would not have been possible otherwise. This paper describes the design, development, and testing of this system. Software reliability, safety and latency are some of the critical design considerations in development of the testbed. Integration of HITL elements in the development phases and veri cation/ validation are key elements to this report.
This research and development project leverages generative-AI to assist in the generation of software process documentation based on NASA standards. By utilizing fine-tuned AI models, the proposed system will analyze NASA's software guidelines, helping to translate them into well-structured, compliant process documents. This assistance can reduce the manual effort required to produce such documentation, enhance consistency, and assure alignment with NASA's stringent software development and operational requirements. In addition to assisting in the generation of software process documentation, the project explores how generative-AI can help create audit checklists as well as assess the compliance of NASA provider documentation against applicable NASA standards. This approach would support the compliance auditing process, providing real-time insights and assessments. The intended result will be a streamlined process, potentially including a Python-based tool and database, that improves audit efficiency, reduces human error, lowers manpower costs and required manhours, and assures continuous compliance with NASA and industry evolving standards for safety-critical software development. Future task might be to investigate the software industry approach and standards for potential collaboration.