Search NASA⌕ Search

SEARCH · Search NASA

Results for “System Safety Assessment”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 307 records · Page 17

National plan to enhance aviation safety through human factors improvements

The purpose of this section of the plan is to establish a development and implementation strategy plan for improving safety and efficiency in the Air Traffic Control (ATC) system. These improvements will be achieved through the proper applications of human factors considerations to the present and future systems. The program will have four basic goals: (1) prepare for the future system through proper hiring and training; (2) develop a controller work station team concept (managing human errors); (3) understand and address the human factors implications of negative system results; and (4) define the proper division of responsibilities and interactions between the human and the machine in ATC systems. This plan addresses six program elements which together address the overall purpose. The six program elements are: (1) determine principles of human-centered automation that will enhance aviation safety and the efficiency of the air traffic controller; (2) provide new and/or enhanced methods and techniques to measure, assess, and improve human performance in the ATC environment; (3) determine system needs and methods for information transfer between and within controller teams and between controller teams and the cockpit; (4) determine how new controller work station technology can optimally be applied and integrated to enhance safety and efficiency; (5) assess training needs and develop improved techniques and strategies for selection, training, and evaluation of controllers; and (6) develop standards, methods, and procedures for the certification and validation of human engineering in the design, testing, and implementation of any hardware or software system element which affects information flow to or from the human.

Foushee, Clay↗

Civil uses of remotely piloted aircraft

An overview of an ongoing study of civil applications of Remotely Piloted Vehicles (RPVs) is presented, including a summation of results to date and the status of work yet to be completed. The intent of the study is to examine the total technical, economic, and environmental impact of RPVs in the civil environment in order to identify and assess the technological effort required to bring these vehicles to realization. The paper describes a market survey in which some 35 civil applications of RPVs have been defined and categorized into groups which have similar mission requirements. From this broad analysis of many potential uses, a smaller number of promising and representative applications have been selected for more in-depth analysis. Using one or two of these applications as specific examples, the paper briefly describes system performance requirements and vehicle concepts, and compares the benefits and costs with those of present methods. The paper also reports on the status of other work such as subsystem concepts, assessment of the technology, and the influence of safety and environmental considerations on these future civil RPV systems.

Nelms, W. P., Jr.↗

Comparative Assessment of Radiological Consequences from Sabotage-Induced Releases in Diverse Microreactor Designs

Many microreactor design developers are planning to reduce on-site physical protection measures and emergency planning zones by relying on robust fuel and reactor designs and leveraging passive safety systems. These reductions raise the risk of sabotage at these microreactors. To evaluate these requirements, this study assessed the radiological consequences of sabotage-induced accidents at microreactors. For the assessment, five diverse designs, each producing 30 MWt, were considered. These designs included pressurized water microreactors (PWMs), sodium-cooled fast microreactors (SFMs), high-temperature helium-cooled prismatic microreactors (HTPMs), heat pipe–cooled microreactors (HPMs), and molten salt–cooled microreactors (MSMs). For each design, two postulated sabotage-induced accidents were defined along with the associated release percentages of fission products. Additionally, consequences from the release of activation products were assessed. With regard to evaluating physical protection and emergency planning requirements, the consequences of sabotage-induced accidents for each design type were found to be comparable. The differences were primarily because of the distinct fuel forms (and associated release mechanisms), burnup, and neutron spectra of the different microreactor types. Future effort will further investigate the release percentages of fission products to perform accurate dose consequence assessment.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

On Automating Failure Mode Analysis and Enforcing its Integrity

This paper reports our experience on the development of a design-for-safety (DFS) workbench called Risk Assessment and Management Environment (RAME) for microelectronic avionics systems. Our objective is to transform DFS practice from an ad-hoc, inefficient, error-prone approach to a stringent engineering process such that DFS can keep up with the rapidly growing complexity of avionics systems. In particular, RAME is built upon an information infrastructure that comprises a fault model, a knowledge base, and a failure reporting/tracking system. This infrastructure permits systematic learning from prior projects and enables the automation of failure modes, effects and criticality analysis (FMECA). Among other unique features, the most important advantage of RAME is its capability of directly accepting design source code in hardware description languages (HDLs) for automated failure mode analysis, which enables RAME to be compatible and to evolve with most electronic-computer-aided-design systems. Through an initial experimental evaluation of the RAME prototype, we show that our approach to FMECA automation improves failure mode analysis turn-around-time, completeness, and accuracy.

design for safety↗

NASA Human System Risk Assessment Process

NASA utilizes an evidence based system to perform risk assessments for the human system for spaceflight missions. The center of this process is the multi-disciplinary Human System Risk Board (HSRB). The HSRB is chartered from the Chief Health and Medical Officer (OCHMO) at NASA Headquarters. The HSRB reviews all human system risks via an established comprehensive risk and configuration management plan based on a project management approach. The HSRB facilitates the integration of human research (terrestrial and spaceflight), medical operations, occupational surveillance, systems engineering and many other disciplines in a comprehensive review of human system risks. The HSRB considers all factors that influence human risk. These factors include pre-mission considerations such as screening criteria, training, age, sex, and physiological condition. In mission factors such as available countermeasures, mission duration and location and post mission factors such as time to return to baseline (reconditioning), post mission health screening, and available treatments. All of the factors influence the total risk assessment for each human risk. The HSRB performed a comprehensive review of all potential inflight medical conditions and events and over the course of several reviews consolidated the number of human system risks to 30, where the greatest emphasis is placed for investing program dollars for risk mitigation. The HSRB considers all available evidence from human research and, medical operations and occupational surveillance in assessing the risks for appropriate mitigation and future work. All applicable DRMs (low earth orbit for 6 and 12 months, deep space for 30 days and 1 year, a lunar mission for 1 year, and a planetary mission for 3 years) are considered as human system risks are modified by the hazards associated with space flight such as microgravity, exposure to radiation, distance from the earth, isolation and a closed environment. Each risk has a summary two-page assessment representing the state of knowledge/evidence of that risk, available risk mitigations, traceability to the Space Flight Human System Standards (SFHSS) and program requirements, and future work required. These data then can drive coordinated budgets across the Human Research Program, the International Space Station, Crew Health and Safety and Advanced Exploration System budgets to provide the most economical and timely mitigations. The risk assessments were completed for the 6 DRMs and serve as the baseline for which subsequent research and technology development and crew health care portfolios can be assessed. The HSRB reviews each risk at least annually or when new evidence/information is available that adds to the body of evidence. The current status of each risk can be reported to program management for operations, budget reviews and general oversight of the human system risk management program.

Francisco, D.↗

Flying Qualities Analysis and Piloted Simulation Testing of a Lift+Cruise Vehicle with Propulsion Failures in Hover and Low-Speed Conditions

The recent emergence of electric-Vertical Take-Off and Landing (eVTOL) vehicles for Urban Air Mobility (UAM) applications has resulted in a wide variety of configurations with unique stability and control characteristics. NASA is currently conducting research to develop conceptual design tools to accelerate public acceptance of these vehicles which includes requirements for safety during failure scenarios. This paper summarizes progress toward a toolbox for predicting flying qualities of eVTOL vehicles during critical propulsion failures that could impact the allowable design of the vehicle geometry or control system. Key topics include unique vulnerabilities of eVTOL/multirotor vehicles to propulsion failures, relevant flying qualities design metrics, and simulation modeling requirements for assessing flying qualities degradation due to failures. Results of a piloted simulation study conducted in the NASA Ames Vertical Motion Simulator (VMS) are presented. The VMS experiment was designed to assess and validate key handling qualities and safety design metrics for propulsion failures. These results show the correlation between control system design requirements and the degradation in handling qualities for various propulsion failures.

George Altamirano↗

Human Error Assessment and Reduction Technique (HEART) and Human Factor Analysis and Classification System (HFACS)

Research results have shown that more than half of aviation, aerospace and aeronautics mishaps/incidents are attributed to human error. As a part of Safety within space exploration ground processing operations, the identification and/or classification of underlying contributors and causes of human error must be identified, in order to manage human error. This research provides a framework and methodology using the Human Error Assessment and Reduction Technique (HEART) and Human Factor Analysis and Classification System (HFACS), as an analysis tool to identify contributing factors, their impact on human error events, and predict the Human Error probabilities (HEPs) of future occurrences. This research methodology was applied (retrospectively) to six (6) NASA ground processing operations scenarios and thirty (30) years of Launch Vehicle related mishap data. This modifiable framework can be used and followed by other space and similar complex operations.

human error↗

Biological toxicity and environmental hazards associated with PLGA nanoparticles

There have been tremendous advances in nanotechnology. More recently, the use of nanoparticles has expanded to applications including materials, packaging, energy, and medical uses such as drug delivery, diagnostics, and therapeutics. The American Society for Testing and Materials (ASTM) and the International Organization for Standardization (ISO) define nanoparticles as particles with at least one dimension measuring between 1 and 100 nm (2), but this view is generally too limited, and recommendations have been made to consider all materials with a dimension measuring under 1,000 nm as nanoparticles. The biomedical uses of nanoparticles are particularly promising because of their ability to reach and target various sites and organs. However, some nanoparticles can be composed of toxic materials or are limited by issues of biodistribution and bioaccumulation, which have hampered their use in biomedicine. The copolymer poly lactic-co-glycolic acid (PLGA) has gained use in biomedical applications as a delivery system because it is considered biocompatible and can be formulated with controlled degradation in physiological environments. PLGA has a history in biomedicine that dates to the 1970s when biodegradable sutures were developed using PLGA. In addition, the United States (US) Food and Drug Administration (FDA) and the European Medicine Agency (EMA) have approved various PLGA particle formulations as therapeutic delivery vehicles. Interest in biocompatible materials to deliver a range of therapeutic drugs, proteins, nucleic acids, and other molecules has risen recently. In addition to drug delivery, sustained drug release can be achieved by tuning the physical properties of PLGA, such as the molecular weight, ratio of lactic to glycolic acid, drug concentration, stabilizing molecules, and particle size. Given the rise of nanoparticles, human and environmental exposure to them is inevitable as more applications use free, unbound, and highly mobile particles. Although PLGA is generally considered safe, a detailed understanding of how PLGA and the other components used to help formulate this copolymer into a nanoparticle delivery vehicle is useful for assessing potential harmful effects. Despite recent advances in PLGA nanoparticle formulations, residual stabilizing molecules, inconsistent preparations, and batch-to-batch variations can lead to toxicity. Poor preparations of PLGA can lead to common mechanisms of toxicity observed with nanoparticles, such as inflammation and oxidative stress. Consistency in PLGA formulations and accurate methods to evaluate nanoparticle toxicity are needed to ensure safety. In order to better assess PLGA nanoparticles as non-toxic delivery systems, it is critical to understand their physical and chemical properties and the formulation protocols that may introduce toxic components into particles.

Biology, nanoparticle, toxicity↗

A Comparison of RESRAD and GoldSim Models for Assessing Radiological Dose for a RCRA Landfill - 20418

US Ecology Idaho (USEI) operates a Resource Conservation and Recovery Act (RCRA) Subtitle C, Hazardous Waste Treatment, Storage, and Disposal (TSD) Facility on a 640-acre property in Owyhee County, Idaho. USEI accepts a wide variety of RCRA-exempt low activity radioactive wastes, including naturally occurring radioactive material (NORM) and technologically enhanced NORM (TENORM) (USEI 2009). The performance of the landfill with regard to radiological operating permit requirements was previously assessed using a model constructed with the residual radioactivity (RESRAD) computer program, developed by Argonne National Laboratory for the U.S. Department of Energy (DOE). RESRAD supports the evaluation of several environmental transport pathways related to a radionuclide-contaminated soil source term, but it was not conceived as a model for the evaluation of landfill radiological performance. A more comprehensive and realistic model is desired in order to better support submissions to both the State of Idaho's Department of Environmental Quality as well as the U.S. Nuclear Regulatory Commission. A Performance Assessment (PA) computer model was developed using GoldSim software for the USEI RCRA Subtitle C landfill. The RESRAD computer model was specifically developed for calculating soil cleanup criteria and radiological dose and cancer risk from residual radioactive material in soil. To evaluate site-specific conditions, users may select from among a number of available environmental transport and exposure pathways and modify 'default' parameter values. In GoldSim, a user must construct the model 'from scratch.' However, this modeling is facilitated by a number of specialized elements available in GoldSim to support a radiological mass transport model. These include elements for defining radiological decay and ingrowth, container failure and radiological release, advective and diffusive transport, and other processes. Advantages afforded by the use of RESRAD for modeling radiological dose for a RCRA Subtitle C landfill include ease of use and reasonable flexibility in specifying site-specific conditions. GoldSim allows for considerably more flexibility and site-specificity than RESRAD, including evaluation of potentially relevant environmental transport processes not supported in RESRAD. The probabilistic modeling capabilities of GoldSim also far exceed those of RESRAD. The pros and cons of RESRAD and GoldSim for this modeling problem are explored with a focus on identifying approaches and critical factors in identifying the appropriate platform. The capabilities of RESRAD and GoldSim for mathematically modeling the disposal system will be contrasted and compared. For example, the existing RESRAD radiological safety assessment evaluated potentially complete exposure pathways related to infiltration to groundwater and upwards diffusion of radon. Additional transport pathways identified in the USEI Idaho facility Conceptual Site Model include deposition of radon decay products in cover material, root uptake of radionuclides in disposed wastes by native plants, and mixing of cover material by burrowing animals. Results of the two models and how the different transport and dose pathways affect results will be discussed. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

Tracking Radioactive Isotopes in HVAC and Application for Hot Cell Analyses - 20155

In recent years, the surge in the number of isotope production facilities under design has increased the need to analyze isotope migration in facility Heating, Ventilation, and Air Conditioning (HVAC) during normal operations and accident scenarios. These facilities are used to produce isotopes for medical, security, and industrial applications and as such are subject to license and regulatory requirements 10CFR20, 10CFR30, 10CFR50, and 10CFR70. GOTHIC, a general-purpose thermal-hydraulics software package, includes the ability to model isotopic tracers, radioactive decay and isotope migration as well as HEPA and charcoal filters for isotope retention. A GOTHIC model was developed by Zachry Nuclear Engineering (ZNE) to examine the effect of negative room pressure, HEPA filtration, and HVAC fluctuations on radiation areas, hot cells and gloveboxes. Radioactive tracers were used to simulate the concentration of spills within contaminated areas, track the migration of isotopes of interest, and determine the isotopic retention and buildup on facility HEPA filters. A variety of isotopes with concern to dose (e.g., Kr-85, Sr-90, I-131, etc.), including their decay and progeny, are included in the analysis. Negative pressures are maintained in the regions of interest by a representative central HVAC system equipped with a volumetric fan that exhausts to the environment after a series of isolation valves and HEPA filters. GOTHIC is an industry trusted tool for providing engineering solutions for a variety of applications, including fission product tracking, aerosol and particulate transport and ventilation assessments. The software provides an integrated analysis environment that includes a graphical user interface (GUI) for constructing analysis models, a numerical solver that includes parallel processing capabilities and a post-processor for evaluating simulation results. It solves the conservation equations for mass, momentum and energy for multicomponent, multi-phase flow in lumped parameter and multi-dimensional geometries (1, 2, or full 3D), including the effects of turbulence, diffusion and buoyancy. It has been developed and maintained under a Quality Assurance program in compliance with the requirements of 10CFR50 Appendix B and applicable portions of ASME NQA-1 since 1995. GOTHIC has been used for assessing both forced and natural convection conditions for a wide range of applications, including: - Tracking concentration of hazardous gases and chemicals for habitability and safety assessments - Determining ventilation and filtration requirements and optimizing location and arrangement of these systems - Room heat-up, including diverse and Flexible coping strategies for Extended Loss of AC Power (FLEX/ELAP) - Equipment Qualification (EQ) A distinctive feature of GOTHIC is the ability to track many different fields/substances in a simulation, including user defined tracer elements, in the liquid, vapor and droplet fields as well as surfaces and filters. This capability allows GOTHIC to model fission product transport and release or the removal of particulates or harmful toxins from exhaust gases using a spray scrubber or other types of filtration systems. GOTHIC also includes models for engineered equipment, such as fans, filters, charcoal filters, dryers/demisters, dampers, etc. The aerosols and other filtered material are removed or accumulated in these components. The range of aerosol and radiological applications that GOTHIC has been used for includes: - Source Term: Primary Coolant (Equilibrium) Activity; Non-Water Coolant Source/Leakage. - Conditions for Iodine Re-evolution: Sump/Suppression Pool Conditions and pH; - RWST Conditions and pH. - Isotope Removal Mechanisms: Containment Sprayed and Unsprayed Region Mixing; Charcoal Filter Heating due to Iodine decay. - Radionuclide Transport and Decay: Post-LOCA Release in containment; Transport between connected Compartments and vent systems; Groundwater transport of radionuclides. - Non-Newtonian Fluid modeling for sludge, waste tanks, etc. ADAMS ML071581053 (titled 'Best Practice Guidelines for the use of CFD in Nuclear Reactor Safety Applications') poses guidelines for applying single phase CFD codes in nuclear reactor safety problems and GOTHIC is listed as a 'tool for 3D flows' and 'dispersal and deposition of radionuclides.' The Nuclear Quality Assurance (NQA) pedigree of GOTHIC is an important aspect for applications in the nuclear industry. The fundamental tracer models (convective transport, molecular and turbulent diffusion, removal mechanisms, etc.) have been verified using analytical solutions and validated against applicable separate effects tests. Also, GOTHIC has been benchmarked to many integrated effects tests, including Phebus FP (Fission Product). GOTHIC gives good agreement for the buildup and decay of fission products in Phebus Test 3. The model developed by ZNE demonstrates GOTHIC's applicability and acceptability for use in analyzing the migration and retention of radioactive isotopes and their progeny in normal operation and accident scenario analyses for isotope production facilities, hot cells, and gloveboxes. The tracer activities calculated by GOTHIC can then be used in downstream radiation transport and shielding codes like RADTRAD-NAI{sup C}, MCNP{sup R}, and MicroShield{sup R} to determine on-site and of-site doses. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

Human Error Assessment and Reduction Technique (HEART) and Human Factor Analysis and Classification System (HFACS)

Research results have shown that more than half of aviation, aerospace and aeronautics mishaps incidents are attributed to human error. As a part of Safety within space exploration ground processing operations, the identification and/or classification of underlying contributors and causes of human error must be identified, in order to manage human error. This research provides a framework and methodology using the Human Error Assessment and Reduction Technique (HEART) and Human Factor Analysis and Classification System (HFACS), as an analysis tool to identify contributing factors, their impact on human error events, and predict the Human Error probabilities (HEPs) of future occurrences. This research methodology was applied (retrospectively) to six (6) NASA ground processing operations scenarios and thirty (30) years of Launch Vehicle related mishap data. This modifiable framework can be used and followed by other space and similar complex operations.

mishaps↗

Get-Away tether experiment - Experimental plans

The experimental capabilities of the Get-Away Tether Experiment (GATE) are presented and a series of demonstration mission are proposed. The GATE is a free-flying tether system that will develop or demonstrate technology in the areas of tether dynamics (deployment and stabilization, retrieval, stationkeeping, and severance), tether electrodynamics, micrometeor hazards to tethers, and disturbance rejection. The system consists of two subsatellites connected by 1 km of tether. The free-flying system is ejected from the Orbiter via a Getaway Special (GAS) canister. Two dynamics missions are profiled along with a description of electrodynamic mission capabilities. The dynamic interactions of the end body and tether may be observed from the Orbiter or from an on-board video tracking system. Hence, GATE provides a unique, low cost capability to demonstrate various tether technologies, and address critical design and safety issues associated with future tether applications. An assessment of the significant measurable parameters and associated instrumentation is given. Future work and system development projection schedules are also outlined.

Greene, Michael↗

Workshop on the Role of Design Assurance in System-Wide Safety’s Safety Demonstrator Series

This report summarizes a three-hour hybrid in-person/online workshop on June 7, 2024 on the topic of design assurance and the Safety Demonstrator Series (SDS), which was held at NASA Ames Research Center. The SDS provides an operational demonstration of, and recommendations for, requirements and standards necessary to monitor, assess, and mitigate risks to assure safety in disaster-oriented operations. Over sixty NASA personnel participated in the workshop. Four main topics were discussed: (1) assurance needs for the Safety Demonstrator Series, (2) assurance and the In-Time Aviation Safety Management System (IASMS), (3) in-time assurance: existing efforts and future opportunities, and (4) demonstrating assurance tools in the Safety Demonstrators. Key takeaways are as follows: 1. Design assurance tools can be used to assure an In-Time Aviation Safety Management System, the systems that comprise it, and other systems or missions. Assurance must consider both systems and components and include the interactions between elements in both a systems/aircraft context and a systems-of-systems/airspace context. 2. Design-time assurance activities can support the identification of monitors needed for operational assurance activities (i.e., the “monitor” function in the monitor-assess-mitigate paradigm at the heart of the IASMS concept). 3. A major opportunity for design-time assurance tools to contribute to the IASMS concept is to support rapid re-validation of systems. This will be particularly important for (1) supporting novel operations in the IASMS, where operational data may disprove design-time assumptions (motivating re-analysis of system safety) and (2) adapting technologies (e.g., AI/ML for autonomous operations) to new operational domains, where there may be new or different safety considerations not included in the initial scope of operations. 4. There are several design assurance tools under development in the System-Wide Safety project that can support assurance of Services, Functions, and Capabilities (SFCs) in the Safety Demonstrators. Transitioning these tools from one-off research projects into a functioning part of IASMS assurance will require closer integration between these tools. 5. It is not clear whether the role of design assurance tools is primarily as a part of IASMS architecture or as an external check on IASMS. The workshop consisted of four discussion topics initiated via four lightning talks by System-Wide Safety researchers. Discussions utilized Mural to engage both in-person and online participants in the hybrid format. Polls and surveys were also utilized to gather participant input. The workshop closed with a reflection activity for participants, as well as new ideas for collaboration and coordination of ongoing System-Wide Safety research.

design assurance↗

European Workshop Industrical Computer Science Systems approach to design for safety

This paper presents guidelines on designing systems for safety, developed by the Technical Committee 7 on Reliability and Safety of the European Workshop on Industrial Computer Systems. The focus is on complementing the traditional development process by adding the following four steps: (1) overall safety analysis; (2) analysis of the functional specifications; (3) designing for safety; (4) validation of design. Quantitative assessment of safety is possible by means of a modular questionnaire covering various aspects of the major stages of system development.

Zalewski, Janusz↗

Small space reactor power systems for unmanned solar system exploration missions

A preliminary feasibility study of the application of small nuclear reactor space power systems to the Mariner Mark II Cassini spacecraft/mission was conducted. The purpose of the study was to identify and assess the technology and performance issues associated with the reactor power system/spacecraft/mission integration. The Cassini mission was selected because study of the Saturn system was identified as a high priority outer planet exploration objective. Reactor power systems applied to this mission were evaluated for two different uses. First, a very small 1 kWe reactor power system was used as an RTG replacement for the nominal spacecraft mission science payload power requirements while still retaining the spacecraft's usual bipropellant chemical propulsion system. The second use of reactor power involved the additional replacement of the chemical propulsion system with a small reactor power system and an electric propulsion system. The study also provides an examination of potential applications for the additional power available for scientific data collection. The reactor power system characteristics utilized in the study were based on a parametric mass model that was developed specifically for these low power applications. The model was generated following a neutronic safety and operational feasibility assessment of six small reactor concepts solicited from U.S. industry. This assessment provided the validation of reactor safety for all mission phases and generatad the reactor mass and dimensional data needed for the system mass model.

Bloomfield, Harvey S.↗

Analysis of Launch Vehicle Liftoff Debris: Historical Perspective from Space Shuttle and Application to Artemis I

Human exploration-class launch vehicles are inherently prone to debris due to the extreme environments generated during pre-launch operations, liftoff, and flight. The use of cryogenic propellants often requires thermal protection system (TPS) coatings, typically foam, to maintain the propellant conditions in the tank and prevent an accumulation ice on the external surface of the vehicle. Some ice growth is to be expected at umbilical interfaces, vents, flanges, or brackets where it is difficult to apply TPS. This ice may come loose at any time due to wind on the launch pad, structural vibration and acoustics after rocket ignition, or aerodynamic forces during flight. This phenomena is especially apparent on vehicles with no TPS, such as the Saturn V rockets used in the Apollo Program, see Figure 1. During propellant tanking, the thermal contraction of the underlying substrate may generate cracks in the TPS (Figure 1). Chunks of TPS can release due to the expansion of ingested gas from cryopumping or from aerodynamic forces if the crack creates an offset surface. Most foams will also have a certain amount of “popcorning” where small pieces of foam will pop off during flight because of the differential between the static surface pressure and the pressure of the gas trapped in the foam cell structure. There are a number of other coating or closeout materials that may be shed from the vehicle and become debris. During pre-launch operations and liftoff, the vehicle may also be exposed to debris originating from the launch pad or ground support equipment. This debris is separate from foreign object debris, or FOD, which is not intended to be present and is strictly controlled through operations and maintenance procedures. In this case, debris is generated from hardware and materials that are necessary for launch and are subject to the intense vibration, acoustics, and direct plume impingement of the launch environment. Examples include ice from umbilicals, tape and tie wraps that protect cables, and rust or corrosion from the launch platform. While NASA has historically been aware of debris as a potential issue that could cause a failure resulting in loss of mission, loss of vehicle, or loss of crew, the likelihood and severity of that risk was not always well understood or given sufficient weight in program and flight decisions. After the Space Shuttle Columbia accident (STS-107), the investigation found that foam TPS debris shed from the external tank was the proximate cause of the damage to the orbiter wing. Six previous observations of debris released from the foam ramp that covered the bipod connecting the forward end of the orbiter to the external tank resulted in minor changes or were determined to be accepted flight risks. Two occurrences of bipod ramp foam loss were not identified until the STS-107 investigation. Despite the damage inflicted by these debris strikes, the Shuttle Program Requirements Control Board deemed the vehicle safe to fly. During the Return to Flight effort following the Columbia disaster, NASA Engineering developed a process for the assessment of debris transport, impact, and damage tolerance to support independent assessments of risk by NASA Safety and Mission Assurance (S&MA). Under this system, each element (vehicle or ground system) defines a catalog of all expected debris based on launch history, component testing, or analysis. Debris transport analysis (DTA) is conducted using the debris catalog characteristics and potential flow transport mechanisms (e.g., vehicle aerodynamics, gravity, wind, plume-driven). The predicted debris impact locations and velocities are provided to the hardware owners, who use available test data and analysis to determine whether each component can withstand the impacts. In cases where the element hardware may be severely damaged or fail, the options are to mitigate the debris source through some change in design or operation, or to work with S&MA to try to characterize the probability of the impact and damage for program risk acceptance. Because of the differences in debris characteristics and transport, the DTA has been divided between the Liftoff and Ascent regimes. The development and application of Liftoff DTA methodology from the Shuttle Program to the current Artemis Program is the subject of this paper. Liftoff DTA covers the time from the start of pre-launch operations at the launch pad, up until the vehicle clears the launch tower and there is no longer any interaction with ground systems. Debris transport during this period is broadly classified as either gravity, wind, and plume-entrained (GWPE) or plume driven (PD). GWPE debris is generally lower speed, travelling in a forward-to-aft direction. PD transport includes flow features from the rocket ignition transient, as well as plume impingement and recirculation that occur as the vehicle lifts off the launch platform. In these cases, the debris typically moves in an aft-to-forward direction at higher speeds. The applicable transport mechanisms must be considered for each piece of debris depending on the material, and release location and time. For example, rust or metallic debris from the tower could fall (GWPE) and impact the vehicle before landing on the launch platform deck where it could be also be transported by plume impingement (PD). However, falling ice (GWPE) from an umbilical is unlikely to survive impact with the vehicle or launch platform and be available for PD transport. Modeling of debris transport is accomplished using a set of DTA tools which simulate debris trajectories subject to a reference frame acceleration (i.e., gravity) and aerodynamic drag. Where the trajectory encounters a solid surface, the debris is allowed to rebound with a specified coefficient of restitution. The drag is calculated by interpolating the fluid state at each point in the debris trajectory from high-fidelity computational fluid dynamics (CFD) simulations of the launch vehicle and pad. The CFD data may either be static (steady state or time averaged), typically for GWPE transport, or dynamic (time-accurate) for PD flow features like the ignition transient. Examples of the CFD flow field solutions for the Space Launch System (SLS) rocket and launch pad are shown in Figure 2. Typical SLS debris trajectory predictions from DTA are illustrated in Figure 3. The final version of this paper will include a more detailed examination of the Liftoff DTA process developed during the Shuttle Program, and how it has been augmented and applied to the SLS rocket under the Artemis Program. Comparisons with debris observations from the Artemis I launch will demonstrate validation of the tools and methodology.

Debris↗

The ICARE Method

The ICARE method is a flexible, widely applicable method for systems engineers to solve problems and resolve issues in a complete and comprehensive manner. The method can be tailored by diverse users for direct application to their function (e.g. system integrators, design engineers, technical discipline leads, analysts, etc.). The clever acronym, ICARE, instills the attitude of accountability, safety, technical rigor and engagement in the problem resolution: Identify, Communicate, Assess, Report, Execute (ICARE). This method was developed through observation of Space Shuttle Propulsion Systems Engineering and Integration (PSE&I) office personnel approach in an attempt to succinctly describe the actions of an effective systems engineer. Additionally it evolved from an effort to make a broadly-defined checklist for a PSE&I worker to perform their responsibilities in an iterative and recursive manner. The National Aeronautics and Space Administration (NASA) Systems Engineering Handbook states, engineering of NASA systems requires a systematic and disciplined set of processes that are applied recursively and iteratively for the design, development, operation, maintenance, and closeout of systems throughout the life cycle of the programs and projects. ICARE is a method that can be applied within the boundaries and requirements of NASA s systems engineering set of processes to provide an elevated sense of duty and responsibility to crew and vehicle safety. The importance of a disciplined set of processes and a safety-conscious mindset increases with the complexity of the system. Moreover, the larger the system and the larger the workforce, the more important it is to encourage the usage of the ICARE method as widely as possible. According to the NASA Systems Engineering Handbook, elements of a system can include people, hardware, software, facilities, policies and documents; all things required to produce system-level results, qualities, properties, characteristics, functions, behavior and performance. The ICARE method can be used to improve all elements of a system and, consequently, the system-level functional, physical and operational performance. Even though ICARE was specifically designed for a systems engineer, any person whose job is to examine another person, product, or process can use the ICARE method to improve effectiveness, implementation, usefulness, value, capability, efficiency, integration, design, and/or marketability. This paper provides the details of the ICARE method, emphasizing the method s application to systems engineering. In addition, a sample of other, non-systems engineering applications are briefly discussed to demonstrate how ICARE can be tailored to a variety of diverse jobs (from project management to parenting).

Henke, Luke↗

Prospective Safety Analysis and the Complex Aviation System

Fatal accident rates in commercial passenger aviation are at historic lows yet have plateaued and are not showing evidence of further safety advances. Modern aircraft accidents reflect both historic causal factors and new unexpected "Black Swan" events. The ever-increasing complexity of the aviation system, along with its associated technology and organizational relationships, provides fertile ground for fresh problems. It is important to take a proactive approach to aviation safety by working to identify novel causation mechanisms for future aviation accidents before they happen. Progress has been made in using of historic data to identify the telltale signals preceding aviation accidents and incidents, using the large repositories of discrete and continuous data on aircraft and air traffic control performance and information reported by front-line personnel. Nevertheless, the aviation community is increasingly embracing predictive approaches to aviation safety. The "prospective workshop" early assessment tool described in this paper represents an approach toward this prospective mindset-one that attempts to identify the future vectors of aviation and asks the question: "What haven't we considered in our current safety assessments?" New causation mechanisms threatening aviation safety will arise in the future because new (or revised) systems and procedures will have to be used under future contextual conditions that have not been properly anticipated. Many simulation models exist for demonstrating the safety cases of new operational concepts and technologies. However the results from such models can only be as valid as the accuracy and completeness of assumptions made about the future context in which the new operational concepts and/or technologies will be immersed. Of course that future has not happened yet. What is needed is a reasonably high-confidence description of the future operational context, capturing critical contextual characteristics that modulate both the likelihood of occurrence of hazards, and the likelihood that those hazards will lead to negative safety events. Heuristics extracted from scenarios, questionnaires, and observed trends from scanning the aviation horizon may be helpful in capturing those future changes in a way conducive to safety assessment. What is also needed is a checklist of potential sources of emerging risk that arise from organizational features that are frequently overlooked. The ultimate goal is to develop a pragmatic, workable method for using descriptions of the future aviation context, to generate valid predictions of safety risks.

prospection↗