SEARCH · Search NASA

Results for “ACCIDENT PREVENTION”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 253 records · Page 14

All sources NASA NTRS DOE OSTI

DOE OSTI2021

Flow boiling transient critical heat flux tests with stainless steel and FeCrAl: Transient correlation implementation, model calibration, and sensitivity analysis

In this study, steady-state and transient internal-flow critical heat flux (CHF) experiments were carried out under two flow conditions, at atmospheric pressure, on 316 stainless steel (316-SS) and iron-chromium-aluminum (FeCrAl) tubes. Slow power transients at a low mass flow (300 kg/m 2 - s) with very low subcooling (X e =-0.0054) generated premature CHFs, which were prevented by faster power transients and high mass flow (1000 kg/m 2 - s). The measured transient CHFs increased linearly with increasing power transients, compared with the steady-state CHF. Yet, the wall superheat at the CHFs decreased with faster power transients. Transient CHF correlations highlighting heterogeneous spontaneous nucleation were calibrated to the measured CHFs and compared with other existing correlations. Transient CHF multipliers were acquired from pool and flow boiling empirical CHF correlations that were generated. The multipliers were applied to the RELAP5-3D nuclear system code to analyze the discrepancies between the measured data and the predicted CHF and post-CHF behavior, which improved peak cladding temperature predictions by 24.6%. A variance-based global sensitivity study perturbing the experimental uncertainties and cladding material thermal properties showed the diminishing influence of flow boiling heat transfer with increasing power transients, highlighting the significance of the volumetric heat capacity for the cladding integrity during transients. Transient CHF correlations were applied to the most limiting design basis accident: a hot-zero-power reactivity-initiated accident on a generic pressurized water reactor RELAP5-3D model.

36 MATERIALS SCIENCE↗

NASA NTRS2006

A Silent Safety Program

NASA's Columbia Accident Investigation Board (CAIB) referred 8 times to the NASA "Silent Safety Program." This term, "Silent Safety Program" was not an original observation but first appeared in the Rogers Commission's Investigation of the Challenger Mishap. The CAIB on page 183 of its report in the paragraph titled 'Encouraging Minority Opinion,' stated "The Naval Reactor Program encourages minority opinions and "bad news." Leaders continually emphasize that when no minority opinions are present, the responsibility for a thorough and critical examination falls to management. . . Board interviews revealed that it is difficult for minority and dissenting opinions to percolate up through the agency's hierarchy. . ." The first question and perhaps the only question is - what is a silent safety program? Well, a silent safety program may be the same as the dog that didn't bark in Sherlock Holmes' "Adventure of the Silver Blaze" because system safety should behave as a devil's advocate for the program barking on every occasion to insure a critical review inclusion. This paper evaluates the NASA safety program and provides suggestions to prevent the recurrence of the silent safety program alluded to in the Challenger Mishap Investigation. Specifically targeted in the CAM report, "The checks and balances the safety system was meant to provide were not working." A silent system safety program is not unique to NASA but could emerge in any and every organization. Principles developed by Irving Janis in his book, Groupthink, listed criteria used to evaluate an organization's cultural attributes that allows a silent safety program to evolve. If evidence validates Jams's criteria, then Jams's recommendations for preventing groupthink can also be used to improve a critical evaluation and thus prevent the development of a silent safety program.

Goodin, James Ronald↗

NASA NTRS2017

Verification Testing: Meet User Needs Figure of Merit

Verification is the process through which Modeling and Simulation(M&S) software goes to ensure that it has been rigorously tested and debugged for its intended use. Validation confirms that said software accurately models and represents the real world system. Credibility gives an assessment of the development and testing effort that the software has gone through as well as how accurate and reliable test results are. Together, these three components form Verification, Validation, and Credibility(VV&C), the process by which all NASA modeling software is to be tested to ensure that it is ready for implementation. NASA created this process following the CAIB (Columbia Accident Investigation Board) report seeking to understand the reasons the Columbia space shuttle failed during reentry. The reports conclusion was that the accident was fully avoidable, however, among other issues, the necessary data to make an informed decision was not there and the result was complete loss of the shuttle and crew. In an effort to mitigate this problem, NASA put out their Standard for Models and Simulations, currently in version NASA-STD-7009A, in which they detailed their recommendations, requirements and rationale for the different components of VV&C. They did this with the intention that it would allow for people receiving MS software to clearly understand and have data from the past development effort. This in turn would allow the people who had not worked with the MS software before to move forward with greater confidence and efficiency in their work. This particular project looks to perform Verification on several MATLAB (Registered Trademark)(The MathWorks, Inc.) scripts that will be later implemented in a website interface. It seeks to take note and define the limits of operation, the units and significance, and the expected datatype and format of the inputs and outputs of each of the scripts. This is intended to prevent the code from attempting to make incorrect or impossible calculations. Additionally, this project will look at the coding generally and note inconsistencies, redundancies, and other aspects that may become problematic or slow down the codes run time. Certain scripts lacking in documentation also will be commented and cataloged.

validation↗

NASA NTRS2005

SAFER Inspection of Space Shuttle Thermal Protection System

In the aftermath of the space shuttle Columbia accident, it quickly became clear that new methods would need to be developed that would provide the capability to inspect and repair the shuttle's thermal protection system (TPS). A boom extension to the Remote Manipulator System (RMS) with a laser topography sensor package was identified as the primary means for measuring the damage depth in acreage tile as well as scanning Reinforced Carbon- Carbon (RCC) surfaces. However, concern over the system's fault tolerance made it prudent to investigate alternate means of acquiring close range photographs and contour depth measurements in the event of a failure. One method that was identified early was to use the Simplified Aid For EVA Rescue (SAFER) propulsion system to allow EVA access to damaged areas of concern. Several issues were identified as potential hazards to SAFER use for this operation. First, the ability of an astronaut to maintain controlled flight depends upon efficient technique and hardware reliability. If either of these is insufficient during flight operations, a safety tether must be used to rescue the crewmember. This operation can jeopardize the integrity of the Extra-vehicular Mobility Unit (EMU) or delicate TPS materials. Controls were developed to prevent the likelihood of requiring a tether rescue, and procedures were written to maximize the chances for success if it cannot be avoided. Crewmember ability to manage tether cable tension during nominal flight also had to be evaluated to ensure it would not negatively affect propellant consumption. Second, although propellant consumption, flight control, orbital dynamics, and flight complexity can all be accurately evaluated in Virtual Reality (VR) Laboratory at Johnson Space Center, there are some shortcomings. As a crewmember's hand is extended to simulate measurement of tile damage, it will pass through the vehicle without resistance. In reality, this force will push the crewmember away from the vehicle, and could induce a moment which, if strong enough, could saturate the attitude control system in SAFER. This raises the concern that additional propellant will be consumed to maintain controlled flight. To account for this, the fidelity of the Virtual Reality simulation was improved to include the effect of crewmember contact with the vehicle during SAFER flight. In addition, while participating in VR simulations, the subject is in shirt sleeves and sits in a chair. This does not provide a flight-like representation of body position awareness. To prevent inadvertent contact with tile or RCC, other facilities were utilized to establish crew preferences for body attitude and tool configuration. Finally, a study was performed to determine if attitude constraints are needed for the Space shuttle and International Space Station to reduce SAFER flight difficulty.

Scoville, Zebulon C.↗

NASA NTRS2009

Software Health Management: A Short Review of Challenges and Existing Techniques

Modern spacecraft (as well as most other complex mechanisms like aircraft, automobiles, and chemical plants) rely more and more on software, to a point where software failures have caused severe accidents and loss of missions. Software failures during a manned mission can cause loss of life, so there are severe requirements to make the software as safe and reliable as possible. Typically, verification and validation (V&V) has the task of making sure that all software errors are found before the software is deployed and that it always conforms to the requirements. Experience, however, shows that this gold standard of error-free software cannot be reached in practice. Even if the software alone is free of glitches, its interoperation with the hardware (e.g., with sensors or actuators) can cause problems. Unexpected operational conditions or changes in the environment may ultimately cause a software system to fail. Is there a way to surmount this problem? In most modern aircraft and many automobiles, hardware such as central electrical, mechanical, and hydraulic components are monitored by IVHM (Integrated Vehicle Health Management) systems. These systems can recognize, isolate, and identify faults and failures, both those that already occurred as well as imminent ones. With the help of diagnostics and prognostics, appropriate mitigation strategies can be selected (replacement or repair, switch to redundant systems, etc.). In this short paper, we discuss some challenges and promising techniques for software health management (SWHM). In particular, we identify unique challenges for preventing software failure in systems which involve both software and hardware components. We then present our classifications of techniques related to SWHM. These classifications are performed based on dimensions of interest to both developers and users of the techniques, and hopefully provide a map for dealing with software faults and failures.

Pipatsrisawat, Knot↗

DOE OSTI2022

Wettability and CHF limits of Accident-Tolerant nuclear fuel cladding materials in light water reactor conditions

Here, we present the results of experimental investigations aimed at evaluating the thermal–hydraulic performance of chromium-coated zircaloy, i.e., one of the most promising accident tolerant fuel (ATF) cladding material for light water nuclear reactors. Precisely, we investigate the wettability and critical heat flux (CHF) limits of chromium-coated and conventional zircaloy surfaces in prototypical reactor conditions. For both surface types, we measure the contact angle in a vapor-saturated atmosphere from ambient pressure to the operating pressure of pressurized water reactors (PWRs), i.e., ~15 MPa. We measure the ambient-pressure steady-state flow boiling CHF with a spatially uniform heat flux. We measure the high-pressure steady-state flow boiling CHF with a cosine shape heat flux (up to 20 MPa) and with a uniform heat flux (up to 15 MPa), also exploring the effect of CRUD deposits on the chromium-coated surface. Our results reveal that the chromium surface and the bare zircaloy surface have similar wettability and both become super-hydrophilic in PWR conditions, and that there is practically no difference in the steady-state CHF limits, both at low-pressure and high-pressure conditions, also when the chromium-coated surface is covered by a CRUD deposit. However, while the chromium-coating does not improve the CHF compared to the bare zircaloy surface, it improves the post-CHF behavior. The chromium coating prevents the reaction between zircaloy and steam, which results in the formation of a brittle zirconium oxide through the surface of the cladding. We also measure the transient CHF under exponentially escalating heat flux inputs of a nano-smooth and a rough surface mimicking a chromium-coated zircaloy cladding. Interestingly, the results of the transient heat flux tests suggest that the CHF limit for very short periods (i.e., fast transients) is independent of the surface finish, being the same for a rough chromium surface or a nano-smooth surface.

36 MATERIALS SCIENCE↗

DOE OSTI2025

Success Path Method: Conformance with Safety Management Systems

All industrial facilities deal with safety hazards such as equipment failures, chemical and toxic releases, and fires and explosions just to name a few. A disciplined framework for managing the integrity of operating systems and processes that handle hazardous substances by applying good design principles, engineering, and operating practices is called process safety. The goal of such framewoks is to prevent the release of energy or material that could cause harm to people or damage to equipment and/or environment. Process safety covers all aspects of facility operation also including design, maintenance, and human and organizational factors that could possibly have effect on process safety. As it will be seen from the discussion below, process safety is just one of the pieces of the much bigger matter, a safety culture. Many industries have long recognized the importance of safety culture in their day-to-day operation. Although the definition of safety culture can slightly differ from organization to organization, in general, a safety culture is how things are done to demonstrate a commitment to safety by everyone involved. An organization acquires safety culture over time as the product of individual and group values, actions, and behaviors toward overall safety. It is important to note that safety culture should not be viewed as some static state that an organization wants to reach. It is more like a constantly evolving level of “how things are done when nobody is watching.” Safety culture is an inherent characteristic of an organization, it is always present, but the level can range on a continuum from undesirable to desirable or more commonly used, from negative to positive. An example for an undesirable, negative safety culture would be a company in which accidents resulting in harm (physical and/or emotional) of its employees, equipment or surrounding environment and community occur frequently. At the other end of the spectrum would be a company in which such accidents are rare or do not occur at all (desired or positive safety culture). Every company/industry exists somewhere within this spectrum.

42 ENGINEERING↗

NASA NTRS2010

Control of Risks Through the Use of Procedures: A Method for Evaluating the Change in Risk

This paper considers how procedures can be used to control risks faced by an organization and proposes a means of recognizing if a particular procedure reduces risk or contributes to the organization's exposure. The proposed method was developed out of the review of work documents and the governing procedures performed in the wake of the Columbia accident by NASA and the Space Shuttle prime contractor, United Space Alliance, LLC. A technique was needed to understand the rules, or procedural controls, in place at the time in the context of how important the role of each rule was. The proposed method assesses procedural risks, the residual risk associated with a hazard after a procedure's influence is accounted for, by considering each clause of a procedure as a unique procedural control that may be beneficial or harmful. For procedural risks with consequences severe enough to threaten the survival of the organization, the method measures the characteristics of each risk on a scale that is an alternative to the traditional consequence/likelihood couple. The dual benefits of the substitute scales are that they eliminate both the need to quantify a relationship between different consequence types and the need for the extensive history a probabilistic risk assessment would require. Control Value is used as an analog for the consequence, where the value of a rule is based on how well the control reduces the severity of the consequence when operating successfully. This value is composed of two parts: the inevitability of the consequence in the absence of the control, and the opportunity to intervene before the consequence is realized. High value controls will be ones where there is minimal need for intervention but maximum opportunity to actively prevent the outcome. Failure Likelihood is used as the substitute for the conventional likelihood of the outcome. For procedural controls, a failure is considered to be any non-malicious violation of the rule, whether intended or not. The model used for describing the Failure Likelihood considers how well a task was established by evaluating that task on five components. The components selected to define a well established task are: that it be defined, assigned to someone capable, that they be trained appropriately, that the actions be organized to enable proper completion and that some form of independent monitoring be performed. Validation of the method was based on the information provided by a group of experts in Space Shuttle ground processing when they were presented with 5 scenarios that identified a clause from a procedure. For each scenario, they recorded their perception of how important the associated rule was and how likely it was to fail. They then rated the components of Control Value and Failure Likelihood for all the scenarios. The order in which each reviewer ranked the scenarios Control Value and Failure Likelihood was compared to the order in which they ranked the scenarios for each of the associated components; inevitability and opportunity for Control Value and definition, assignment, training, organization and monitoring for Failure Likelihood. This order comparison showed how the components contributed to a relative relationship to the substitute risk element. With the relationship established for Space Shuttle ground processing, this method can be used to gauge if the introduction or removal of a particular rule will increase or decrease the .risk associated with the hazard it is intended to control.

Praino, Gregory T.↗

DOE OSTI2023

Semi-Annual Report for Horizontal Compact High Temperature Gas Reactor (HC-HTGR) Development during Performance Period April 2023 – September 2023

Horizontal Compact High Temperature Gas Reactor (HC-HTGR) is being designed by a multi-disciplinary team of nuclear, mechanical, and structural engineers under the support of a DOE-NE Advanced Reactor Demonstration Program’s Advanced Reactor Concepts-20 (ARC-20) award. The objective of this ARC-20 project is to deliver a conceptual design for the proposed HC-HTGR in 3 years and support its commercialization as a safe, low-cost HTGR. Argonne National Laboratory (Argonne) is responsible for the design and analysis of the reactor cavity cooling system (RCCS) as a safety system for passive decay heat removal of the reactor concept. Additionally, Argonne is providing analysis of the primary coolant system to ensure temperatures within the core remain below safety margins during steady-state and potential accident scenarios. This fourth semi-annual report summarized the progress made at Argonne on the two tasks during the second half of FY23. As a part of the RCCS design task, recent efforts have been made to complete a conceptual design of the RCCS for the HC-HTGR, including the design update of the water panel and system configuration favorable in point of view of fabrication and system operation. Design calculations were conducted under various heat load conditions to validate the system design. Transient simulations using RELAP5-3D were conducted to investigate system dynamics under transients of interest and to evaluate the system performance in the design condition. The results demonstrated the overall system feasibility that the RCCS design maintains structures temperatures lower than maximum allowable temperature with sufficient system inventory without any active heat sink. In the primary system thermal hydraulics task, the preliminary analysis was performed for a long term pressurized conduction cooldown (PCC) transient. This analysis used a combination of a fully resolved and coarse homogenized mesh to predict the temperature distribution for the steady-state initial condition and the PCC transient. The steady-state initial condition was determined using a fully resolved full core model with 3D solid to 1D fluid coupling. The fully resolved mesh was also used to model the first 20 seconds of the PCC. The temperature difference between fuel pins and the graphite matrix becomes minimal and the dominant heat transfer shifts to a larger scale radially towards the RCCS. After 20 seconds, a homogenized coarse mesh is used, greatly reducing the computational costs of the model. These results demonstrate that the core is designed to passively remove enough decay heat in a protected loss of primary coolant flow to prevent an unsafe rise of core temperatures.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗

NASA NTRS2006

A Comparison of Functional Models for Use in the Function-Failure Design Method

When failure analysis and prevention, guided by historical design knowledge, are coupled with product design at its conception, shorter design cycles are possible. By decreasing the design time of a product in this manner, design costs are reduced and the product will better suit the customer s needs. Prior work indicates that similar failure modes occur with products (or components) with similar functionality. To capitalize on this finding, a knowledge base of historical failure information linked to functionality is assembled for use by designers. One possible use for this knowledge base is within the Elemental Function-Failure Design Method (EFDM). This design methodology and failure analysis tool begins at conceptual design and keeps the designer cognizant of failures that are likely to occur based on the product s functionality. The EFDM offers potential improvement over current failure analysis methods, such as FMEA, FMECA, and Fault Tree Analysis, because it can be implemented hand in hand with other conceptual design steps and carried throughout a product s design cycle. These other failure analysis methods can only truly be effective after a physical design has been completed. The EFDM however is only as good as the knowledge base that it draws from, and therefore it is of utmost importance to develop a knowledge base that will be suitable for use across a wide spectrum of products. One fundamental question that arises in using the EFDM is: At what level of detail should functional descriptions of components be encoded? This paper explores two approaches to populating a knowledge base with actual failure occurrence information from Bell 206 helicopters. Functional models expressed at various levels of detail are investigated to determine the necessary detail for an applicable knowledge base that can be used by designers in both new designs as well as redesigns. High level and more detailed functional descriptions are derived for each failed component based on NTSB accident reports. To best record this data, standardized functional and failure mode vocabularies are used. Two separate function-failure knowledge bases are then created aid compared. Results indicate that encoding failure data using more detailed functional models allows for a more robust knowledge base. Interestingly however, when applying the EFDM, high level descriptions continue to produce useful results when using the knowledge base generated from the detailed functional models.

Stock, Michael E.↗

DOE OSTI2025

Stabilization of Preternatural Barium Oxidation States as an Unexpected Byproduct of β-Decay: Discovery of a New Halide Semiconductor Alloy

137 Cs has a wide range of roles in the nuclear industry. The solid material, safely encapsulated in CsCl as 137 CsCl, is stored as fission product waste from nuclear power production and legacy waste from nuclear weapons production; it has also served as a radiation source in food and sewage irradiators as well as medical devices. However, because of the solubility of the chloride salt and the relatively high specific activity of 137 Cs, damaged or broken capsules can lead to severe radiological accidents. Safe capsule design and material recycling are complicated by the unclear structural evolution during β-decay, which remains ambiguous due to the differing oxidation states of Cs (1+) and Ba (2+). Here, in this study, we use first-principles calculations to investigate the evolving structure–property relationships of Cs 1–x Ba x Cl during β-decay. Despite the well-established 2+ formal oxidation state of alkali-earth metals, we find that Ba 1+ can be stabilized in the form of a mixed-valence alloy at low concentrations. Specifically, we identify three regimes for the β-decay of 137 Cs into CsCl: Ba-doped CsCl (Ba ≤ 14%), wherein Ba has the expected 2+ oxidation state; Cs–Ba–Cl alloys, where Ba has a mix of the usual Ba 2+ and highly unusual Ba 1+ oxidation state in the form of a quasi-disordered mixed-valence alloy (Ba = 25%); and phase separation into a CsCl + BaCl 2 + Ba (m) mechanical mixture, where Ba reverts to its expected 2+ oxidation state (Ba > 25%). Surprisingly, the Cs 0.75 Ba 0.25 Cl mixed-valence alloy is a narrow indirect band gap semiconductor (1.05 eV) despite the insulating nature of both CsCl and BaCl 2 . It also exhibits strongly excitonic polarized optical properties, has glass-like ultralow thermal conductivity (directional average of 0.21 W/mK at 300 K), and shows greater resistance to deformation under both tensile and volumetric strengths compared with the original CsCl structure (e.g., shear and Young’s modulus of 9.04 and 31.62 GPa, respectively). These findings imply that transmutation of 137 Cs leads to highly unusual chemical bonding that stabilizes Ba 1+ in local regions of the quasi-disordered Cs 0.25 Ba 0.75 Cl, resulting in anomalous physical properties. Moreover, this discovery provides valuable insight for safe nuclear waste capsule design, which can aid in preventing environmental or human exposure to radioactive materials.

Fuhr, Addis S. [Oak Ridge National Laboratory (ORN↗

NASA NTRSDate not supplied

Safety Culture at the World’s Premier Multi-User Spaceport

NASA’s Agency-wide Safety Culture is implemented at the Kennedy Space Center (KSC) using a unique strategy due an unparalleled approach in making human spaceflight history. Kennedy Space Center, the world’s premier multi-user spaceport, enables U.S. government and commercial space access, while providing the world a resource to allow the exploration of and the ability to work in space. A consistently healthy safety culture at KSC is imperative for mission success: desired achievements, protection of space flight hardware, and ultimately, the preservation of human life requires the support of a healthy safety culture. Emphasis on the NASA Agency-wide development of Safety Culture began with the conception of the NASA Agency Safety Culture Working Group. After the devastating loss of life and mission of the Space Shuttle Colombia, a broken safety culture was identified as an organizational cause by the Columbia Accident Investigation Board Report. Thus, the Agency Safety Culture Working Group was developed in 2009 to assess the status of the Agency’s Safety Culture, while addressing safety culture concerns at the NASA Center-level. A Five-factor model was developed to serve as the guiding principles for Safety Culture: 1) Reporting Culture, 2) Just Culture, 3) Flexible Culture, 4) Learning Culture, and 5) Engaged Culture. These five factors are included in the NASA Safety Culture logo, which was intentionally designed as a DNA double helix to prompt the permeation of safety into day-to-day work. KSC specifically implements the NASA Agency-wide Safety Culture principles in a tailored approach that is relevant to the diversity of work being performed. An emphasis is placed on the implementation to include safety at home, not exclusively at work. This emphasis is a KSC-specific element that has been intentionally added to promote a closed loop Safety Culture. To advertise the safety culture, various safety and health events are held throughout the calendar year, providing innovative speakers and engaging activities, while also promoting a wide range of curated safety initiatives. Development and continuous improvement of the KSC safety tracking database, allows for advanced tracking-to-closure, along with providing data sets used to identify areas of emphasis. Other safety initiatives rely solely on employee participation, such as the photo challenges; participants are encouraged to identify and capture themselves, coworkers, or family members participating in safe or healthy activities to share with others within the Center and at Agency levels. Fabrication of exclusive videos and graphics are utilized to advertise and inform employee of safety initiatives, upcoming safety events, and general dispersion of safety information. In addition, an anonymous Agency-wide Safety Culture Survey is advertised, administered, and analyzed at Kennedy Space Center, with the purpose of receiving basic feedback on Safety Culture perceptions to help prevent future incidents from occurring. Through these briefly identified means, and many other forms of employee engagement, Kennedy Space Center aims to maintain safety in the forefront, while creating an environment where everyone trusts that safety is a priority.

Larrin E. Moody↗

DOE OSTI2023

Risk Analysis of Various Design Architectures for High Safety-significant Safety-related Digital Instrumentation and Control Systems of Nuclear Power Plants during Accident Scenarios

This report documents the plus-up activities performed by Idaho National Laboratory (INL) during Fiscal Year (FY) 2022 for the U.S. Department of Energy (DOE) Light Water Reactor Sustainability (LWRS) Program, Risk Informed Systems Analysis (RISA) Pathway, digital instrumentation and control (DI&C) risk assessment project. In FY 2019, the RISA Pathway initiated a project to develop a risk assessment strategy for delivering a strong technical basis to support effective, licensable, and secure DI&C technologies for digital upgrades/designs. An integrated risk assessment technology for the DI&C systems was proposed for this strategy, which aims to (1) provide a best-estimate, risk-informed capability to quantitatively and accurately estimate the safety margin obtained from plant modernization, especially for the high safety-significant safety-related (HSSSR) DI&C systems, (2) support and supplement existing advanced risk-informed DI&C design guides by providing quantitative risk information and evidence, (3) offer a capability of design architecture evaluation of various DI&C systems to support system design decisions and diversity and redundancy applications, (4) assure the long-term safety and reliability of HSSSR DI&C systems, and (5) reduce uncertainty in costs and support integration of DI&C systems in the plant. To achieve these technical goals and deal with the expensive licensing justifications from regulatory insights, the LWRS-developed framework instructs nuclear vendors and utilities on how to effectively lower the costs associated with digital compliance and speed industry advances by: (1) defining an integrated risk-informed analysis process for DI&C upgrade, including hazard analysis, reliability analysis, and consequence analysis, (2) applying systematic and risk-informed tools to address common cause failures (CCFs) and quantify corresponding failure probabilities for DI&C technologies, particularly software CCFs, (3) evaluating the impact of digital failures at the component level, system level, and plant level, and (4) providing insights and suggestions on designs to manage the risks, thus to support the development, licensing, and deployment of advanced DI&C technologies on nuclear power plant (NPPs). Adding diversity within system or components is the main means to eliminate and mitigate CCFs, but diversity also increases plant complexity and errors and may not address all sources of systematic failures. How to optimize the diversity and redundancy applications for the safety-critical DI&C systems remains a challenge. To deal with the technical issues in addressing potential software CCFs in HSSSR DI&C systems of NPPs and supporting relevant design optimization, the framework provides: ? An integrated best-estimate, risk-informed capability to address new technical digital issues quantitatively, accurately, and efficiently in plan modernization progress, such as software CCFs in HSSSR DI&C systems of NPPs ? A common and a modularized platform for DI&C designers, software developers, cybersecurity analysts, and plant engineers to efficiently predict and prevent risk in the early design stage of DI&C systems ? Technical bases and risk-informed insights to assist U.S. Nuclear Regulatory Commission (NRC) and industry to address and fulfill the risk-informed alternatives for evaluation of CCFs in HSSSR DI&C systems of NPPs ? An integrated risk-informed tool that offers a capability of design architecture evaluation of various DI&C systems to support system design decisions in diversity and redundancy applications. The plus-up research and development efforts of this project in FY 2022 are focused on methodology improvement of software CCF modeling and estimation, prevention analysis, importance analysis and risk analysis of various design architectures of HSSSR DI&C systems. This work greatly enhances the capability of the LWRS-developed framework for the risk assessment and design optimization of safety-critical DI&C systems. It should be noted that all the analyses are performed for the demonstration of the LWRS-developed framework, not for the evaluation of relevant systems. Results are obtained based on very limited design information and testing data.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

NASA NTRSDate not supplied

Analysis of Launch Vehicle Liftoff Debris: Historical Perspective from Space Shuttle and Application to Artemis I

Human exploration-class launch vehicles are inherently prone to debris due to the extreme environments generated during pre-launch operations, liftoff, and flight. The use of cryogenic propellants often requires thermal protection system (TPS) coatings, typically foam, to maintain the propellant conditions in the tank and prevent an accumulation ice on the external surface of the vehicle. Some ice growth is to be expected at umbilical interfaces, vents, flanges, or brackets where it is difficult to apply TPS. This ice may come loose at any time due to wind on the launch pad, structural vibration and acoustics after rocket ignition, or aerodynamic forces during flight. This phenomena is especially apparent on vehicles with no TPS, such as the Saturn V rockets used in the Apollo Program, see Figure 1. During propellant tanking, the thermal contraction of the underlying substrate may generate cracks in the TPS (Figure 1). Chunks of TPS can release due to the expansion of ingested gas from cryopumping or from aerodynamic forces if the crack creates an offset surface. Most foams will also have a certain amount of “popcorning” where small pieces of foam will pop off during flight because of the differential between the static surface pressure and the pressure of the gas trapped in the foam cell structure. There are a number of other coating or closeout materials that may be shed from the vehicle and become debris. During pre-launch operations and liftoff, the vehicle may also be exposed to debris originating from the launch pad or ground support equipment. This debris is separate from foreign object debris, or FOD, which is not intended to be present and is strictly controlled through operations and maintenance procedures. In this case, debris is generated from hardware and materials that are necessary for launch and are subject to the intense vibration, acoustics, and direct plume impingement of the launch environment. Examples include ice from umbilicals, tape and tie wraps that protect cables, and rust or corrosion from the launch platform. While NASA has historically been aware of debris as a potential issue that could cause a failure resulting in loss of mission, loss of vehicle, or loss of crew, the likelihood and severity of that risk was not always well understood or given sufficient weight in program and flight decisions. After the Space Shuttle Columbia accident (STS-107), the investigation found that foam TPS debris shed from the external tank was the proximate cause of the damage to the orbiter wing. Six previous observations of debris released from the foam ramp that covered the bipod connecting the forward end of the orbiter to the external tank resulted in minor changes or were determined to be accepted flight risks. Two occurrences of bipod ramp foam loss were not identified until the STS-107 investigation. Despite the damage inflicted by these debris strikes, the Shuttle Program Requirements Control Board deemed the vehicle safe to fly. During the Return to Flight effort following the Columbia disaster, NASA Engineering developed a process for the assessment of debris transport, impact, and damage tolerance to support independent assessments of risk by NASA Safety and Mission Assurance (S&MA). Under this system, each element (vehicle or ground system) defines a catalog of all expected debris based on launch history, component testing, or analysis. Debris transport analysis (DTA) is conducted using the debris catalog characteristics and potential flow transport mechanisms (e.g., vehicle aerodynamics, gravity, wind, plume-driven). The predicted debris impact locations and velocities are provided to the hardware owners, who use available test data and analysis to determine whether each component can withstand the impacts. In cases where the element hardware may be severely damaged or fail, the options are to mitigate the debris source through some change in design or operation, or to work with S&MA to try to characterize the probability of the impact and damage for program risk acceptance. Because of the differences in debris characteristics and transport, the DTA has been divided between the Liftoff and Ascent regimes. The development and application of Liftoff DTA methodology from the Shuttle Program to the current Artemis Program is the subject of this paper. Liftoff DTA covers the time from the start of pre-launch operations at the launch pad, up until the vehicle clears the launch tower and there is no longer any interaction with ground systems. Debris transport during this period is broadly classified as either gravity, wind, and plume-entrained (GWPE) or plume driven (PD). GWPE debris is generally lower speed, travelling in a forward-to-aft direction. PD transport includes flow features from the rocket ignition transient, as well as plume impingement and recirculation that occur as the vehicle lifts off the launch platform. In these cases, the debris typically moves in an aft-to-forward direction at higher speeds. The applicable transport mechanisms must be considered for each piece of debris depending on the material, and release location and time. For example, rust or metallic debris from the tower could fall (GWPE) and impact the vehicle before landing on the launch platform deck where it could be also be transported by plume impingement (PD). However, falling ice (GWPE) from an umbilical is unlikely to survive impact with the vehicle or launch platform and be available for PD transport. Modeling of debris transport is accomplished using a set of DTA tools which simulate debris trajectories subject to a reference frame acceleration (i.e., gravity) and aerodynamic drag. Where the trajectory encounters a solid surface, the debris is allowed to rebound with a specified coefficient of restitution. The drag is calculated by interpolating the fluid state at each point in the debris trajectory from high-fidelity computational fluid dynamics (CFD) simulations of the launch vehicle and pad. The CFD data may either be static (steady state or time averaged), typically for GWPE transport, or dynamic (time-accurate) for PD flow features like the ignition transient. Examples of the CFD flow field solutions for the Space Launch System (SLS) rocket and launch pad are shown in Figure 2. Typical SLS debris trajectory predictions from DTA are illustrated in Figure 3. The final version of this paper will include a more detailed examination of the Liftoff DTA process developed during the Shuttle Program, and how it has been augmented and applied to the SLS rocket under the Artemis Program. Comparisons with debris observations from the Artemis I launch will demonstrate validation of the tools and methodology.

Debris↗

DOE OSTI2025

Development and Evaluation of Embrittlement Resistant Alloys for Advanced LWR Cladding

The primary challenge preventing the deployment of reactor designs that leverage wrought FeCrAl as an advanced light-water reactor (LWR) cladding is irradiation hardening and embrittlement. Wrought FeCrAl alloys experience a loss of post-irradiation ductility and fracture toughness under low-temperature neutron irradiation (< 350°C) resulting from the combined effects of dislocation loop formation and the irradiation-enhanced precipitation of Cr-rich alpha-prime precipitates throughout the microstructure. Over the past decade, significant improvements in our understanding regarding the effect of Cr and Al content have been enabled through neutron irradiations, but even optimized wrought alloys such as C26M remain vulnerable to brittle failure during storage, transportation, and handling following irradiation. This report summarizes multiple irradiation campaigns initiated over the past 7 years and provides recent insights into the effect of (1) minor alloying composition, (2) alloy processing strategy, (3) crystal structure, and (4) the use of advanced oxide dispersion strengthened (ODS) alloys. The first irradiation campaign irradiated body-centered cubic FeCrAl alloy C26M with and without elements such as Mo and Y. It also included face-centered cubic alumina-forming austenitic (AFA) alloys that have a steeper neutronic penalty but that have far superior high-temperature strength than wrought FeCrAl. Finally, this campaign compared conventional wrought C26M with the same material produced using modern powder metallurgical hotisostatic pressing (PM-HIP). The second irradiation campaign, initiated in 2018, irradiated wrought and FeCrAl-ODS materials up to 50 dpa to assess their irradiation resistance to high-doses. The results of this work indicate that wrought C26M suffers significant degradation following neutron irradiation at LWR-relevant temperatures regardless of Mo and Y content. The PM-HIP variant appears to be more resilient to irradiation-induced ductility loss in comparison with wrought variants but still loses almost all ductility by 8 dpa. Notably, the AFAs retained at least 5% total elongation after irradiation at the same dose and temperature condition, although additional deterioration may be expected at higher fluence levels. FeCrAl-ODS materials show the greatest promise as a transformative longer-term accident-tolerant fuel (LT-ATF) cladding material. The extruded 106ZY10C alloy retained 10% total elongation after 16 dpa irradiation and retained 8% total elongation after 50 dpa. Additional challenges with FeCrAl-ODS alloys also remain, including optimization of end cap joining methodologies, enhancement of fracture toughness, scaling production to prove economic viability, and optimizing post-pilger heat treatments to maximize ductility and irradiation resistance. This series of irradiations demonstrates the efficacy of the LWR testbed available within the United States for the rapid irradiation and down-selection of LT-ATF candidates. As the country rapidly accelerates its timeline for the deployment of advanced reactor concepts, the effective utilization of the High Flux Isotope Reactor for separate-effects style irradiations should continue to be prioritized to answer the final questions pertaining to LT-ATF candidates necessary for the deployment of advanced boiling water reactors and small modular reactors.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗

NASA NTRSDate not supplied

Overlapping Conditions in IMPACT

Introduction The IMPACT 1.0 model assumes independence of 119 different medical conditions. That is, it is assumed that one medical event maps to a single medical condition. However, it is often the case that a single medical event may lead to several different concurrent conditions (e.g., a single accident resulting in multiple fractures, chest/abdominal trauma, and sepsis). There is a significant overlap between many of the conditions in ICL 1.0. For example, depression and anxiety are two separate conditions but often co-exist. This overlap may lead to an overestimation in the incidence calculation. In future iterations of the model, we plan to address progression of medical conditions. Methods There are two possible methods to approach progression of a medical condition. The first is to take any medical condition in ICL, calculate its incidence and determine its outcomes no matter what sequelae occur. For example, calculate the incidence of prostatitis and determine its metrics (e.g., loss of crew life, risk of medical evacuation or task time affected) no matter what the sequelae might be (sepsis, hydronephrosis, renal failure, etc.). The second approach is to take any medical condition in the ICL and calculate the outcomes based on transitions to any other condition. For example, calculate the incidence of nephrolithiasis and determine the incidence of each possible transition (e.g., hydronephrosis, renal failure, UTI, pyelonephritis, sepsis) and then determine its metrics. With perfectly informative evidence, the answers should be the same using either method. The question is which approach best reduces the opportunity for overlapping. Results The team identified 31 conditions that were the most likely to transition to a secondary condition such as sepsis and respiratory failure. It was felt that the first approach, as described above, would be the easiest to implement and would have the greatest reduction in overlapping conditions. The identified conditions were primarily infectious conditions, like UTI and pneumonia (which could lead to both respiratory failure and sepsis), toxic inhalations, cardiac arrest, seizures, and trauma. Once these conditions were identified, the conditions were divided between the four clinicians on the team to identify those that were not consistent with the others in way they were approached. There were 13 conditions that were found to be problematic. Some condition definitions needed to be changed to eliminate references to transitions or to update them in cases where the definitions were out of date. Some conditions required new evidence to correct the loss of crew life, and one condition was felt to have so much overlap that it was recommended for elimination. A second effort required modification of the sepsis incidence calculation to prevent double counting of the conditions, such as prostatitis, that could progress to sepsis. Conclusion The team made significant progress in clarifying the method for dealing with transitions from one medical condition to another. In addition, errors were found and corrected in definitions, incidence, and loss of crew life as well as a condition in which reference was made to a CLiFF that was no longer included. These modifications will provide greater fidelity in the IMPACT model and reduce overlap.

Arian Anderson↗

NASA NTRS2016

Tailoring a Human Reliability Analysis to Your Industry Needs

Companies at risk of accidents caused by human error that result in catastrophic consequences include: airline industry mishaps, medical malpractice, medication mistakes, aerospace failures, major oil spills, transportation mishaps, power production failures and manufacturing facility incidents. Human Reliability Assessment (HRA) is used to analyze the inherent risk of human behavior or actions introducing errors into the operation of a system or process. These assessments can be used to identify where errors are most likely to arise and the potential risks involved if they do occur. Using the basic concepts of HRA, an evolving group of methodologies are used to meet various industry needs. Determining which methodology or combination of techniques will provide a quality human reliability assessment is a key element to developing effective strategies for understanding and dealing with risks caused by human errors. There are a number of concerns and difficulties in "tailoring" a Human Reliability Assessment (HRA) for different industries. Although a variety of HRA methodologies are available to analyze human error events, determining the most appropriate tools to provide the most useful results can depend on industry specific cultures and requirements. Methodology selection may be based on a variety of factors that include: 1) how people act and react in different industries, 2) expectations based on industry standards, 3) factors that influence how the human errors could occur such as tasks, tools, environment, workplace, support, training and procedure, 4) type and availability of data, 5) how the industry views risk & reliability, and 6) types of emergencies, contingencies and routine tasks. Other considerations for methodology selection should be based on what information is needed from the assessment. If the principal concern is determination of the primary risk factors contributing to the potential human error, a more detailed analysis method may be employed versus a requirement to provide a numerical value as part of a probabilistic risk assessment. Industries involved with humans operating large equipment or transport systems (ex. railroads or airlines) would have more need to address the man machine interface than medical workers administering medications. Human error occurs in every industry; in most cases the consequences are relatively benign and occasionally beneficial. In cases where the results can have disastrous consequences, the use of Human Reliability techniques to identify and classify the risk of human errors allows a company more opportunities to mitigate or eliminate these types of risks and prevent costly tragedies.

DeMott, D. L.↗

NASA NTRSDate not supplied

Meteorite Sample Section Repair at NASA Johnson Space Center

Introduction: Meteorite thin and thick sections are routinely shipped from NASA Johnson Space Center to fulfill sample allocation requests from principle investigators around the world. Sections are also re-turned to JSC when researchers are finished studying them since, in most cases, they can be reused for other studies. The sections are very fragile unfortunately, and sometimes return to us needing repairs. The fol-lowing should give you an idea of how we repair sections here in the very lab where they were created. NOTE: Please do not attempt to repair ANSMET meteorite sections that are in your possession. We will perform the repairs for you at NASA JSC if you send the section back to us. Section Delamination: The majority of the meteorite sections that we produce here are secured to the glass slide using a high quality, two-part epoxy. Occasionally, we are asked to use superglue if the researcher wishes to dismount the section from the slide. Both epoxy and superglue are excellent adhesives, but they both tend to embrittle with time which results in delamination from the slide. Exposure to vacuum can also degrade the adhesion between the sample section and the glass slide. Repeated handling of the slide edges can accelerate delamination and, as a preventive measure, the outer 1-2 mm of epoxy is trimmed from newly created sections at JSC. If conductive tapes (copper, carbon, etc.) are used on the section during analysis, great care must be taken in removing the tape so that the epoxy is not pulled up with it. If in doubt, the tape can be left on the section when it is returned to JSC. Before we perform any repairs to sample sections, carbon, gold, or other coatings are removed. We accomplish this using a slurry of 0.05 micron alumina and 190 proof ethyl alcohol applied to a felt polishing pad fitted to a rotating lap wheel. Coatings are re-moved in this manner from all sections that are re-turned to JSC. The extent of the delamination determines how we proceed with the section repair. If the meteorite sample area of the section is not disturbed, then we carefully remove the delaminated epoxy. This is done using a binocular microscope with a 6X zoom, cut-proof gloves, and a very sharp, single edged razor blade. We cut the delaminated epoxy with the blade angled away from the sample area and using very light pressure. The trimmed section is then cleaned in an ultrasonic bath of 200 proof ethyl alcohol for no more than 10 seconds and carefully dried using a lint-free clean room wipe. The section is then placed into a lab oven at 110o F in preparation for epoxy. We mix the resin and hardener components of the low viscosity epoxy and very small amounts are applied to the cut edges of the section using a needle probe and the binocular microscope. Warming the epoxy helps secure the existing section by filling any voids between the glass slide and the section. After the new epoxy cures, we give the section a light polish on a lap wheel fitted with cotton polishing paper that is charged with 1 micron diamond paste. If the section has delaminated to the point of sample area being lifted from the glass, then it may be irreparable. We employ the above technique along with clamping the section in a Teflon pad arrangement in order to flatten the sample while the epoxy cures. Otherwise, the sample will tend to curl. This works to some degree, but once the sample area curls, it seldom re-turns to the original flatness without cracking or bending. Canada Balsam and Crystalbond: We repair damaged sections that had originally been prepared using Canada Balsam or Crystalbond adhesives through the gradual application of heat. We take great care with these samples since these bonding materials tend to get brittle with age. The section is heated in gradual steps (40-50o F per hour) to the melting point of the adhesive. We repair the sample while the adhesive is fluid and then the section is cooled in the same gradual manner in which it was heated. Slide Cracks and Breaks: Accidents happen. Especially with something as small and fragile as a thin/thick section. We all know someone who has driven a microscope objective into a section. As bad as the damage may look, the section can be repaired in most instances. NOTE: Please do not try to tape or glue section pieces back together prior to returning the dam-aged section. This practice usually renders the section irreparable. If the glass slide is cracked but the section is still in one piece, we repair it by infilling the crack with the low viscosity epoxy mentioned earlier. If the slide is in pieces, we can reassemble it with epoxy on a new backer slide. This is a tricky task as the pieces need to be in the correct plane with respect to each other, especially if the sample area is split among several pieces.

Meteorite↗