Search NASA⌕ Search

SEARCH · Search NASA

Results for “safety assessment”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 325 records · Page 18

Impact of Pilot Delay and Non-Responsiveness on the Safety Performance of Airborne Separation

Assessing the safety effects of prediction errors and uncertainty on automationsupported functions in the Next Generation Air Transportation System concept of operations is of foremost importance, particularly safety critical functions such as separation that involve human decision-making. Both ground-based and airborne, the automation of separation functions must be designed to account for, and mitigate the impact of, information uncertainty and varying human response. This paper describes an experiment that addresses the potential impact of operator delay when interacting with separation support systems. In this study, we evaluated an airborne separation capability operated by a simulated pilot. The experimental runs are part of the Safety Performance of Airborne Separation (SPAS) experiment suite that examines the safety implications of prediction errors and system uncertainties on airborne separation assistance systems. Pilot actions required by the airborne separation automation to resolve traffic conflicts were delayed within a wide range, varying from five to 240 seconds while a percentage of randomly selected pilots were programmed to completely miss the conflict alerts and therefore take no action. Results indicate that the strategicAirborne Separation Assistance System (ASAS) functions exercised in the experiment can sustain pilot response delays of up to 90 seconds and more, depending on the traffic density. However, when pilots or operators fail to respond to conflict alerts the safety effects are substantial, particularly at higher traffic densities.

Consiglio, Maria↗

An Improved Model For Determining Salinity Recharge Time for Deep Borehole Disposal - 20405

In a previous publication (K. P. Travis, D. Burley and F. G. F. Gibb, WM2017 Conference, Phoenix Arizona paper no. 17480) we introduced a numerical model to estimate the time it would take for a pressure perturbation to subside following its creation from the construction of a deep geological borehole in water-saturated rock. The model was based on the notion of a point source of momentum - a solution of the time-dependent pressure-diffusion equation. Using the model, we estimated that it would take on the order of 10 k years for physical equilibrium to become re-established following the sinking of a 5 km borehole in granite. The significance of such a model is that it places an upper bound on the lifetime required of a borehole sealing system - a necessary input to a borehole post-closure safety case assessment. No engineered sealing system has ever been devised which is capable of retaining its sealing properties for 10 half-lives of long-lived radioisotopes in spent fuel or high-level waste. One of the key advantages of disposing of nuclear waste via Deep Borehole Disposal (DBD) is the natural sealing provided by density stratified groundwater. Upon sinking of a borehole, and subsequent filling with fresh water, brine or drilling mud, this natural barrier may be temporarily damaged. Over time, fresh brine from the far-field will flow towards or away from the hole (driven by a pressure gradient) and will eventually re-establish the original salinity gradient. It follows that the engineered seals need last only as long as the time required for this salinity gradient to reset itself. One of the limitations of our previous model was the use of a static boundary condition on the borehole wall. The model used a boundary pressure which varied quadratically with depth (arising from differences between the pressure of a column of fresh water in the borehole and that of a column of brine in the host rock). However as brine replaces fresh water in the borehole (driven by a pressure gradient), the boundary function must change with time. We now introduce an improved model which takes this time dependent boundary condition into account. The model also takes into account the time taken for a mixture of brine and fresh water to re-establish chemical equilibrium through the process of diffusion. The paper contains the mathematical details of our new iterative model as well as results showing the time taken to reach steady state, and concentration profiles for the components of the brine-filled borehole as a function of time together with a discussion on the implications of the results for developing a post-closure safety assessment for DBD. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

Software Safety Risk in Legacy Safety-Critical Computer Systems

Safety-critical computer systems must be engineered to meet system and software safety requirements. For legacy safety-critical computer systems, software safety requirements may not have been formally specified during development. When process-oriented software safety requirements are levied on a legacy system after the fact, where software development artifacts don't exist or are incomplete, the question becomes 'how can this be done?' The risks associated with only meeting certain software safety requirements in a legacy safety-critical computer system must be addressed should such systems be selected as candidates for reuse. This paper proposes a method for ascertaining formally, a software safety risk assessment, that provides measurements for software safety for legacy systems which may or may not have a suite of software engineering documentation that is now normally required. It relies upon the NASA Software Safety Standard, risk assessment methods based upon the Taxonomy-Based Questionnaire, and the application of reverse engineering CASE tools to produce original design documents for legacy systems.

Hill, Janice↗

Modeling FLEX Human Actions Using the EMRALD Dynamic Risk Assessment Tool

Most current efforts have modified and applied existing human reliability analysis (HRA) methods to treat human actions related to beyond-design-basis external events in which diverse and flexible coping strategies (FLEX) equipment would be deployed. However, many questions remain regarding the suitability of legacy HRA methods to address FLEX human actions, sparking the need for a new method of reasonably evaluating them. In this context, Idaho National Laboratory (INL) researched a relatively new approach to treating FLEX human actions via Event Modeling Risk Assessment Using Linked Diagrams (EMRALD) software. EMRALD was developed to support the increasing need for dynamic probabilistic risk assessment (PRA) models that can respond to evolving plant conditions during simulations. A couple benefits were identified when analyzing FLEX human actions through this software. In general, it is especially useful for evaluating a strategy’s feasibility, including FLEX human actions that require a relatively long time to perform. In this paper, we suggest how FLEX human actions can be modeled using the EMRALD software. Two different HRA modeling approaches using EMRALD are introduced: (1) procedure-based modeling and (2) PRA/HRA-based modeling. The former approach was introduced in the authors’ previous paper, whereas this paper mainly discusses how the latter approach works for an extended loss of AC power (ELAP) scenario with relevant procedures and PRA models. A hybrid method combining the two modeling approaches is introduced at the paper’s conclusion.

99 GENERAL AND MISCELLANEOUS↗

Integrated techno-economic framework for nuclear hydrogen production: assessing the role of high temperature steam electrolysis and safety considerations

This manuscript presents a comprehensive techno-economic assessment of nuclear integrated hydrogen production through high-temperature steam electrolysis (HTSE) in the U.S. Gulf Coast region. Given the significant role of hydrogen as an energy carrier and chemical feedstock, the research evaluates the feasibility of co-locating HTSE facilities with existing nuclear power plants (NPPs) to enhance hydrogen production efficiency and cost-effectiveness. Here, the study highlights the advantages of HTSE over traditional low-temperature electrolysis, particularly in leveraging thermal and electrical energy from NPPs. A novel framework for hydrogen deployment is introduced, integrating hydrogen market analysis, techno-economic evaluation (TEA), and safety assessments. The findings underscore the economic viability of hydrogen production in light of current market conditions, including fluctuating natural gas prices and the impact of production tax credits under the Inflation Reduction Act. A case study in the Gulf Coast region demonstrates the potential for strategic hydrogen production to meet growing industrial demand while ensuring safety and regulatory compliance. Overall, this research contributes to the advancement of nuclear integrated hydrogen production as a sustainable energy solution.

08 - HYDROGEN↗

New Mobility Technology Assessment - Benefits, Risks, and Safety

The age of vehicle automation is upon us. The fundamental perception and control technology is maturing as we speak (and write) with robo-taxis proliferating in select US cities. The news cycle is no longer filled with technological skepticism, but rather societal commentary on our collective response and use of the technology. This maturing of the technology is also accompanied by a renaissance in new types of urban movement technology to more effectively link people with goods, services, and employment, particularly in dense development areas where vehicle congestion (even automated vehicles) prevents high quality mobility. The National Renewable Energy Laboratory, through the DOE Clean Energy to Communities (C2C) program has worked with two jurisdictions to assess the benefits, risks, and safety concerns for a new product offering based on suspended cable technology which is fully automated and proposes an aerial network of self-propelled gondolas. The recognized need, independent of the technology, is to fairly assess the benefits of the proposed transportation system, assess its technical maturity, as well as risks and safety concerns. Using this new technology as an example, a technology represented by Swyft Cities, NREL developed a succession of mini-studies that characterized the technical maturity level, assessed the proposed benefits for Greenville, SC, examined the risks involved in moving forward with an emerging mobility technology, and determined the governing safety protocols and standards that are applicable to the space. These mini-case studies, though centered on Swyft Cities aerial automated gondola technology, are highly transferable to any type of new mobility technology and lays out a repeatable process for assessing new technology within an city or community context.

33 ADVANCED PROPULSION SYSTEMS↗

CONUS-wide Projected Flood Frequency and Uncertainty Estimates, Version 1.0

This dataset presents a large-ensemble of CONUS-wide projected flood frequency and uncertainty estimates across ~2.7 million NHDPlusV2 river reaches over the CONUS. The framework producing this dataset leverages a multi-model, uncertainty-aware modeling framework that allows evaluating shifts in flood frequences at the stream reach level across the CONUS. CONUS-wide ensemble streamflow projections generated from hydrologic simulations driven by downscaled and bias-corrected Coupled Model Intercomparison Project Phase 6 (CMIP6) outputs are used to derive these flood frequency and uncertainty estimates over the period 1980 - 2099. A spatially consistent regional L-moment algorithm is applied across clusters defined by the US Hydrologic Unit Code Subregions (HUC4s and HUC8s) and NHDPlusV2 stream orders to estimate flood frequencies. The dataset also includes at-site based flood estimates that allow for the comparison between local and regional approach-based estimates, assess projected changes, and characterize their uncertainties. For more reliable estimation of rare flood frequencies such as 500 and 1000-year return periods, super-ensemble based estimates are also included in the dataset. This dataset is derived to support the "Impact-Informed Dam Safety Risk Assessment for Securing Hydropower Assests" project for the US Department of Energy (DOE) Hydropower and Hydrokinetic Office (H2O). For further details, refer to Kao et al. (2022), Ghimire et al. (2023), Ghimire et al. (2025), and Hosking and Wallis (1997).

Ghimire, Ganesh [ORNL] (ORCID:0000000242843941)↗

VEG-04 Pick-and-Eat Crop Production and Human Research on the International Space Station

Growing fresh, nutritious, palatable produce for crew consumption during spaceflight may provide health-promoting, bioavailable nutrients and enhance the astronaut dietary experience as we move toward longer-duration missions. Tending plants may also serve as a countermeasure for crew psychological stresses associated with spaceflight. However, requirements to support consistent growth of a variety of nutritious crops under spaceflight environmental conditions remain unclear. This study explores the potential to grow crops for consumption on the International Space Station (ISS) using the Veggie vegetable-production system. VEG-04A and B were two flight tests conducted in 2019 with the leafy green crop Mizuna mustard. Mizuna was grown in two Veggie chambers simultaneously, with the chambers set to different red-to-blue light formulations; one Veggie was programmed as “red-rich” and the second as “blue-rich.” Light quality is known to impact plant growth, nutrition, microbiology, and organoleptic characteristics on Earth, and the Veggie flight tests examined how these impacts might differ in microgravity. VEG-04A was a 35-day growth test with a single harvest. VEG-04B, a 58-day test with harvests at four, six, and eight weeks from the same plants, assessed sustained productivity. Challenges with the watering program occurred early during VEG-04A, and several plants failed to survive in both the flight and ground control operations. Thus, prior to VEG-04B, an extra test was conducted to tailor water timing and volumes. This test allowed a fine tuning of methods for VEG-04B, and generally plant survival was better in that experiment. At each harvest, the astronauts froze half of the edible plant tissue to return to Earth and weighed the remaining half using the ISS Mass Measurement Device (MMD). Weighed samples were then cleaned with produce-sanitizing wipes, and consenting crew members participated in organoleptic evaluation of the fresh produce. Organoleptic evaluations were conducted on the Mizuna crops grown in both light treatments, and data from these tests are compared to ground data collected at JSC. The remaining sanitized produce was available for crew consumption as desired. Frozen flight samples were returned for microbial and chemical analyses to assess food safety and nutritional quality. Microbial assessments included culturing and identifying aerobic bacteria, yeasts, and molds, and screening for specific human pathogens. Chemical nutrient analyses included assessing elements, antioxidants, and phenolics in plant tissues. Crew members involved in plant operations completed behavioral health surveys pre-flight, in-flight associated with plant growth and harvest activities, and post-flight. Surveys captured the amount of time spent on different plant-related operations, enjoyment of the different activities, engagement with Veggie, experience interacting with Veggie, and sensory stimulation associated with growing plants in Veggie.

Veggie↗

VEG-04 PICK-AND-EAT CROP PRODUCTION AND HUMAN RESEARCH ON THE INTERNATIONAL SPACE STATION

Growing fresh, nutritious, palatable produce for crew consumption during spaceflight may provide health-promoting, bioavailable nutrients and enhance the astronaut dietary experience as we move toward longer-duration missions. Tending plants may also serve as a countermeasure for crew psychological stresses associated with spaceflight. However, requirements to support consistent growth of a variety of nutritious crops under spaceflight environmental conditions remain unclear. This study explores the potential to grow crops for consumption on the International Space Station (ISS) using the Veggie vegetable-production system. VEG-04A and B were two flight tests conducted in 2019 with the leafy green crop Mizuna mustard. Mizuna was grown in two Veggie chambers simultaneously, with the chambers set to different red-to-blue light formulations; one Veggie was programmed as “red-rich” and the second as “blue-rich.” Light quality is known to impact plant growth, nutrition, microbiology, and organoleptic characteristics on Earth, and the Veggie flight tests examined how these impacts might differ in microgravity. VEG-04A was a 35-day growth test with a single harvest. VEG-04B, a 58-day test with harvests at four, six, and eight weeks from the same plants, assessed sustained productivity. Challenges with the watering program occurred early during VEG-04A, and several plants failed to survive in both the flight and ground control operations. Thus, prior to VEG-04B, an extra test was conducted to tailor water timing and volumes. This test allowed a fine tuning of methods for VEG-04B, and generally plant survival was better in that experiment. At each harvest, the astronauts froze half of the edible plant tissue to return to Earth and weighed the remaining half using the ISS Mass Measurement Device (MMD). Weighed samples were then cleaned with produce-sanitizing wipes, and consenting crew members participated in organoleptic evaluation of the fresh produce. Organoleptic evaluations were conducted on the Mizuna crops grown in both light treatments, and data from these tests are compared to ground data collected at JSC. The remaining sanitized produce was available for crew consumption as desired. Frozen flight samples were returned for microbial and chemical analyses to assess food safety and nutritional quality. Microbial assessments included culturing and identifying aerobic bacteria, yeasts, and molds, and screening for specific human pathogens. Chemical nutrient analyses included assessing elements, antioxidants, and phenolics in plant tissues. Crew members involved in plant operations completed behavioral health surveys pre-flight, in-flight associated with plant growth and harvest activities, and post-flight. Surveys captured the amount of time spent on different plant-related operations, enjoyment of the different activities, engagement with Veggie, experience interacting with Veggie, and sensory stimulation associated with growing plants in Veggie. Within each study, plant growth did not differ across light treatment or location (flight versus ground). In general, more biomass was produced in most treatments during the longer study, but growth of this crop declined over time with the repeated harvests. On average, bacterial and fungal counts were significantly lower on ground control samples than flight samples, and microbial counts increased with repeated harvests. Light treatment did not influence any elements in tissues tested; however, the growth duration did impact levels of several elements. Organoleptic scores were generally higher in flight, and ground tasters considered samples more bitter. Amount of interaction and responses to Veggie varied widely by individual. Enjoyable tasks had higher impact than non-enjoyable tasks and interacting with Veggie was generally viewed as positive. These tests on ISS are helping to mitigate the risk of an inadequate food supply for long-duration missions by adding fresh vegetables and key nutrients to the crew diet, and indicating which plant care activities are providing behavioral health benefits for the crew. This research was co-funded by the Human Research Program and Space Biology (MTL#1075) in the ILSRA 2015 NRA call. Videos due Jan. 25th.

Veggie↗

Validating a Dynamic PWR Safety and Security Model?

Nuclear power plants (NPPs) are assessed for safety and security using separate models that cannot capture how an attacker's decisions and a plant's response unfold together in real time, leaving regulators and operators without a complete picture of true plant vulnerability. Traditional probabilistic risk assessment (PRA) methods treat adversarial events as fixed initiators with predetermined outcomes, and are structurally incapable of representing the time-dependent interplay between physical security events, safety system response, and operator mitigative actions. At Idaho National Laboratory (INL), I contributed to the development and validation of Modeling and Analysis for Safety and Security using the Dynamic EMRALD Framework (MASS-DEF). Where static PRA relies on event-tree logic that cannot evolve mid-scenario, MASS-DEF couples a time-dependent dynamic PRA tool EMRALD (Event Modeling Risk Assessment using Linked Diagrams) with attack simulation software, allowing attacker behavior, plant system states, and operator actions to interact across time. My work focused on validating a general Pressurized Water Reactor (PWR) model. I traced model logic against PWR plant to identified errors in logic and confirm accuracy. I then built and tested attack scenarios against a general PWR model to verify that the model produced expected outcomes across all logical pathways. I also contributed a section to a related technical paper applying the same EMRALD platform to radiation dose modeling. Results show that MASS-DEF can quantitatively demonstrate that many plants exceed their regulatory security thresholds. This demonstrated margin provides a technically defensible basis for reducing the number of guards without compromising regulatory compliance. Physical security costs represent roughly 10% of annual operating budgets, making such reductions directly meaningful to INL's mission of sustaining existing commercial NPPs. This internship strengthened my understanding of nuclear systems, probabilistic modeling, and technical writing, and has solidified my pursuit of a career at a national laboratory.

98 - NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL↗

Comparing modelling approaches for a generic nuclear waste repository in salt

This paper contains a comparison of five modelling approaches for a simplified nuclear waste repository in a domal salt formation. It is the result of a four-year collaboration between five international teams on Task F of the DECOVALEX-2023 project on performance assessment modelling. The primary objectives of Task F are to build confidence in the models, methods, and software used for performance assessment (PA) of deep geologic nuclear waste repositories, and/or to bring to the fore additional research and development needed to improve PA methodologies. This work demonstrates how these objectives are accomplished through staged development and comparison of the models and methods used by participating teams in their PA frameworks. Participating teams made a wide range of model assumptions, ranging from compartmentalized networks to full 3D models of the salt formation and repository. Despite differences in the modelling strategies, all models indicate that salt compaction and diffusion of radionuclides in brine are key processes in the repository. For the isothermal spent nuclear fuel and vitrified waste scenario with multiple early failures considered, all models indicate little of the disposed radionuclides will migrate beyond the repository seal over the 100,000-year simulations. In general, the model output quantities have the largest differences over the short term and near the waste. Disparities between the models are believed to be due to differing simplifications from the conceptual model.

DECOVALEX↗

Past Approaches for Spent Nuclear Fuel, Transuranic, and High-Level Waste Disposal in the United States—Part 2: Siting Process, Staged Development, and Public Preferences

This report presents pertinent aspects of the ~50-year United States experience in siting a mined geologic disposal repository for spent nuclear fuel (SNF), transuranic (TRU) waste, and high-level radioactive waste (HLW) as related to site selection and the staged process for site investigations as specified in the Nuclear Waste Policy Act of 1982 and generic and site-specific regulations of the US Department of Energy (DOE), US Environmental Protection Agency (EPA), and US Nuclear Regulatory Commission (NRC). The roles of the Environmental Impact Statement and guidance in international consensus standards by the International Atomic Energy Agency are also mentioned. The focus is on siting and developing the Waste Isolation Pilot Plant, an operating repository for TRU waste from atomic energy defense activities, and the proposed Yucca Mountain repository for commercial SNF and HLW. In the social dimension, the role of institutional stakeholders is described. Past national surveys related to waste management options for storage and disposal provide insight on public preferences of other stakeholders. The descriptions are intended to help other countries more fully understand the stages adopted for siting and developing repositories in the United States.

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

European Workshop Industrical Computer Science Systems approach to design for safety

This paper presents guidelines on designing systems for safety, developed by the Technical Committee 7 on Reliability and Safety of the European Workshop on Industrial Computer Systems. The focus is on complementing the traditional development process by adding the following four steps: (1) overall safety analysis; (2) analysis of the functional specifications; (3) designing for safety; (4) validation of design. Quantitative assessment of safety is possible by means of a modular questionnaire covering various aspects of the major stages of system development.

Zalewski, Janusz↗

An Integrated Risk Assessment Process of Safety-Related Digital I&C Systems in Nuclear Power Plants

Upgrading the existing analog instrumentation and control (I&C) systems to state-of-the-art digital I&C (DI&C) systems will greatly benefit existing light water reactors. However, the issue of software common cause failure (CCF) remains an obstacle in terms of qualification for digital technologies. Existing analyses of CCFs in I&C systems mainly focus on hardware failures. With the application and upgrading of new DI&C systems, design flaws could cause software CCFs to become a potential threat to plant safety, considering that most redundancy designs use similar digital platforms or software in their operating and application systems. With complex multilayer redundancy designs to meet the single failure criterion, these I&C safety systems are of particular concern in U.S. Nuclear Regulatory Commission licensing procedures. In Fiscal Year 2019, the Risk-Informed Systems Analysis (RISA) Pathway of the U.S. Department of Energy’s Light Water Reactor Sustainability Program initiated a project to develop a risk assessment strategy for delivering a strong technical basis to support effective, licensable, and secure DI&C technologies for digital upgrades and designs. An integrated risk assessment for the DI&C process was proposed for this strategy to identify potential key digital-induced failures, implement reliability analyses of related digital safety I&C systems, and evaluate the unanalyzed sequences introduced by these failures (particularly software CCFs) at the plant level. Here this paper summarizes these RISA efforts in the risk analysis of safety-related DI&C systems at Idaho National Laboratory.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

Work Practice Simulation of Complex Human-Automation Systems in Safety Critical Situations: The Brahms Generalized berlingen Model

The transition from the current air traffic system to the next generation air traffic system will require the introduction of new automated systems, including transferring some functions from air traffic controllers to on­-board automation. This report describes a new design verification and validation (V&V) methodology for assessing aviation safety. The approach involves a detailed computer simulation of work practices that includes people interacting with flight-critical systems. The research is part of an effort to develop new modeling and verification methodologies that can assess the safety of flight-critical systems, system configurations, and operational concepts. The 2002 Ueberlingen mid-air collision was chosen for analysis and modeling because one of the main causes of the accident was one crew's response to a conflict between the instructions of the air traffic controller and the instructions of TCAS, an automated Traffic Alert and Collision Avoidance System on-board warning system. It thus furnishes an example of the problem of authority versus autonomy. It provides a starting point for exploring authority/autonomy conflict in the larger system of organization, tools, and practices in which the participants' moment-by-moment actions take place. We have developed a general air traffic system model (not a specific simulation of Überlingen events), called the Brahms Generalized Ueberlingen Model (Brahms-GUeM). Brahms is a multi-agent simulation system that models people, tools, facilities/vehicles, and geography to simulate the current air transportation system as a collection of distributed, interactive subsystems (e.g., airports, air-traffic control towers and personnel, aircraft, automated flight systems and air-traffic tools, instruments, crew). Brahms-GUeM can be configured in different ways, called scenarios, such that anomalous events that contributed to the Überlingen accident can be modeled as functioning according to requirements or in an anomalous condition, as occurred during the accident. Brahms-GUeM thus implicitly defines a class of scenarios, which include as an instance what occurred at Überlingen. Brahms-GUeM is a modeling framework enabling "what if" analysis of alternative work system configurations and thus facilitating design of alternative operations concepts. It enables subsequent adaption (reusing simulation components) for modeling and simulating NextGen scenarios. This project demonstrates that BRAHMS provides the capacity to model the complexity of air transportation systems, going beyond idealized and simple flights to include for example the interaction of pilots and ATCOs. The research shows clearly that verification and validation must include the entire work system, on the one hand to check that mechanisms exist to handle failures of communication and alerting subsystems and/or failures of people to notice, comprehend, or communicate problematic (unsafe) situations; but also to understand how people must use their own judgment in relating fallible systems like TCAS to other sources of information and thus to evaluate how the unreliability of automation affects system safety. The simulation shows in particular that distributed agents (people and automated systems) acting without knowledge of each others' actions can create a complex, dynamic system whose interactive behavior is unexpected and is changing too quickly to comprehend and control.

complex systems↗

The National Aviation Operational Monitoring Service (NAOMS): A Documentation of the Development of a Survey Methodology

The National Aviation Operational Monitoring Service (NAOMS) was a research project under NASA s Aviation Safety Program during the years from 2000 to 2005. The purpose of this project was to develop a methodology for gaining reliable information on changes over time in the rates-of-occurrence of safety-related events as a means of assessing the safety of the national airspace. The approach was a scientifically designed survey of the operators of the aviation system concerning their safety-related experiences. This report presents the results of the methodology developed and a demonstration of the NAOMS concept through a survey of nearly 20,000 randomly selected air-carrier pilots. Results give evidence that the NAOMS methodology can provide a statistically sound basis for evaluating trends of incidents that could compromise safety. The approach and results are summarized in the report and supporting documentation and complete analyses of results are presented in 14 appendices.

Connors, Mary M.↗

Prospective Safety Analysis and the Complex Aviation System

Fatal accident rates in commercial passenger aviation are at historic lows yet have plateaued and are not showing evidence of further safety advances. Modern aircraft accidents reflect both historic causal factors and new unexpected "Black Swan" events. The ever-increasing complexity of the aviation system, along with its associated technology and organizational relationships, provides fertile ground for fresh problems. It is important to take a proactive approach to aviation safety by working to identify novel causation mechanisms for future aviation accidents before they happen. Progress has been made in using of historic data to identify the telltale signals preceding aviation accidents and incidents, using the large repositories of discrete and continuous data on aircraft and air traffic control performance and information reported by front-line personnel. Nevertheless, the aviation community is increasingly embracing predictive approaches to aviation safety. The "prospective workshop" early assessment tool described in this paper represents an approach toward this prospective mindset-one that attempts to identify the future vectors of aviation and asks the question: "What haven't we considered in our current safety assessments?" New causation mechanisms threatening aviation safety will arise in the future because new (or revised) systems and procedures will have to be used under future contextual conditions that have not been properly anticipated. Many simulation models exist for demonstrating the safety cases of new operational concepts and technologies. However the results from such models can only be as valid as the accuracy and completeness of assumptions made about the future context in which the new operational concepts and/or technologies will be immersed. Of course that future has not happened yet. What is needed is a reasonably high-confidence description of the future operational context, capturing critical contextual characteristics that modulate both the likelihood of occurrence of hazards, and the likelihood that those hazards will lead to negative safety events. Heuristics extracted from scenarios, questionnaires, and observed trends from scanning the aviation horizon may be helpful in capturing those future changes in a way conducive to safety assessment. What is also needed is a checklist of potential sources of emerging risk that arise from organizational features that are frequently overlooked. The ultimate goal is to develop a pragmatic, workable method for using descriptions of the future aviation context, to generate valid predictions of safety risks.

prospection↗

Passive Safety System Reliability Analysis: Lessons Learned and Open Items

Passive safety systems have multiple benefits, largely stemming from their high functional reliability due to their simplicity and lack of dependencies. However, accurately assessing the reliability of passive systems can be challenging due in large part to the possibility of functional failures. Argonne National Laboratory (Argonne) has been involved in several recent efforts concerning the reliability assessment of passive safety systems for advanced, non-light water reactors (non-LWRs). These efforts have focused on the development and application of mechanistic methods for the evaluation of passive system reliability, which rely on system modelling and uncertainty analyses to derive reliability values for use in probabilistic safety assessments (PSAs). Further information on these efforts is provided in ref [1]. The current paper reviews key lessons learned through these projects, along with outstanding open items regarding the reliability assessment of passive systems.

Grabaskas, David↗