SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
The CloudSat Project has developed a simplified approach for fault tree analysis and probabilistic risk assessment. A system-level fault tree has been constructed to identify credible fault scenarios and failure modes leading up to a potential failure to meet the nominal mission success criteria.
Understanding and accounting for uncertainty in risk analysis is a critical step in the management and communication of risk in engineered systems. The component and system-level analysis to determine the probability of a negative outcome and its consequence is often quantified by a point estimate. Many Program and Enterprise decisions involving technical concerns and issues rely on reliability engineering activities to produce quantified risk analysis to inform the decision making process. At NASA, it is common to use a Probabilistic Risk Analysis (PRA) to inform the overall risk to Loss of Mission or Loss of Crew that involves integration across all spacecraft subsystem fault trees to produce an overall probability of mission failure. The point estimate is an estimate of this overall probability and is an immediate result of a fault tree model. It is the result of a model where the probability of each event is taken to be equal to its mean. The value provides an approximation of the overall mean without running any uncertainty calculations (e.g., no sampling). Using only the point estimate can lead to a false sense of precision and the point estimate may not match the resulting mean when uncertainty is taken into consideration. This paper will explore five conditions that can cause the PRA model mean to diverge from the point estimate and will provide engineers and managers insight into the importance of understanding uncertainty in the elements of PRA models.
This paper presents the false positive (FP) and false negative (FN) risk assessment process currently being conducted for the Space Launch System (SLS) Artemis II Fault Management (FM) detection functions. The analysis scope, general assumptions and guide rules, and key modeling concepts were discussed to establish the basis of the risk assessments conducted. Initial analyses indicated a dominance in the total risk by software and firmware failures. This paper presents efforts applied to refine the software risks and the overall impact of implementing those modifications. Current analyses conducted on the detection functions implemented for the SLS Artemis II mission indicate primary risk drivers for the individual FM detection functions are flight software failures, firmware design failures, and hardware Common Cause Failures (CCFs). There still remains issues of how to account for time and redundancy in the software risk estimations.
This presentation describes the false positive (FP) and false negative (FN) risk assessment process currently being conducted for the Space Launch System (SLS) Artemis II Fault Management (FM) detection functions. The analysis scope, general assumptions and guide rules, and key modeling concepts were discussed to establish the basis of the risk assessments conducted. Initial analyses indicated a dominance in the total risk by software and firmware failures. This paper presents efforts applied to refine the software risks and the overall impact of implementing those modifications. Current analyses conducted on the detection functions implemented for the SLS Artemis II mission indicate primary risk drivers for the individual FM detection functions are flight software failures, firmware design failures, and hardware Common Cause Failures (CCFs). There still remains issues of how to account for time and redundancy in the software risk estimations.
The crew health and performance (CHP) system represents the span of technological interventions and tested processes and procedures that in combination address the human risk to space flight. The Human Research Program (HRP) mental model of the CHP system breaks the capabilities needed to meet NASA human flight systems standards into specific categories (i.e., countermeasures, behavioral health, medical intervention). These categories are further broken down into specific sub-groups generally associated with the human system risks that these capabilities seek to mitigate. Like the approach used to develop the Integrated Medical Model (IMM) and the Medical Extensible Dynamic Probabilistic Risk Analysis Tool (MEDPRAT), HRP tasked NASA GRC’s Cross-Cutting Computational Modeling Project with developing a CHP probabilistic risk assessment tool, the CHP-PRA. The CHP-PRA model seeks to quantify and relatively assess the human risk state within the crew health and performance domain, using a combination of knowledge about human system risks and technology and practices likely to be applied during space flight missions. This modeling system will incorporate customer and stakeholder feedback and be flexible enough to address multiple different questions about important low-level mission-specific parameters. This presentation will introduce the initial concept and development timeline for this tool and demonstrate proof-of-concept through an application addressing a specific human risk question posed within the Artemis program.
Modeling and implementing fire safety for nuclear power plants is a costly activity. Because of the complexity of fire phenomena and multiple operational procedures, it is difficult to computationally provide assurance that mitigation methods are adequate for critical areas using current analysis methods in a cost-effective manner. The nuclear industry needs efficient methods to provide more accurate modeling and optimize mitigation methods to improve nuclear power plant understanding for fire scenarios. This report describes the work done over the last two year on the Fire Risk Investigation in 3D (FRI3D) software. This software simplifies the modeling process by importing existing plant models and data, incorporating a 3D modeling environment and coupling with the fire simulation software CFAST. This eliminates the manual labor and errors associated with much of the fire modeling process. The report lays out the status and path of FRID software for the Risk Informed Safety Analysis pathway of the Light Water Reactor Sustainability project at Idaho National Laboratory and industry collaborators to best help reduce costs and improve realism in fire probabilistic risk analysis.
Employing integrated energy systems (IESs) with nuclear power plants (NPPs) can improve NPP utilization by leveraging dedicated thermal and electric power delivery, but it may also increase operational safety risks. This paper presents a framework to identify and quantify hazards and risks for such IESs. The framework combines accidentology to review past industrial accidents with failure modes and effects analysis (FMEA) to identify potential future incidents. Hydrogen explosion and toxic chemical release hazards are of particular concern. Explosion consequences are quantified using the Bauwens-Dorofeev (Bauwens) and trinitrotoluene equivalent mass (TNT-EM) methods, while chemical release consequences are computed using the Gaussian atmospheric dispersion method. Operational disturbances from direct electrical and thermal integration that may affect NPP safety are modeled using probabilistic risk analysis (PRA). Hazards and risks are then evaluated for regulatory compliance. The framework is applied to IESs comprising pressurized or boiling water reactors supplying three levels of thermal and electrical power to industrial customers. Case studies include high-temperature steam electrolysis hydrogen plants of varying capacities and a synthetic fuel production plant. Sensitivity analysis examines piping component failures in the PRA model as a precursor to cost estimation for thermal extraction line design. Additionally, Fussel-Vessely (FV) and risk increase importance (RII) measures identify risk-informed design improvements for the thermal extraction system. FMEA highlights hazards such as loss of offsite power, prompt loss of electrical load, loss of thermal output, and immediate steam diversion, in addition to hydrogen explosions and toxic chemical releases. Both Bauwens and TNT-EM methods suggest maintaining several hundred meters of separation between the NPP and hydrogen facility to mitigate explosion risks. PRA results show a maximum initiating event frequency increase of 1.15% and an overall risk increase of 0.28%. Importance measure analysis identifies upstream pipe leak isolation components as critical. Evaluating the results against safety regulations, it is concluded that hazards and risks can be managed to comply with regulations through risk-informed thermal and electrical connection designs, component selection, maintenance programs, and safe separation distances between NPPs and integrated industrial facilities.
Accident Tolerant Fuels (ATF) are being tested by different nuclear vendors and research organizations and their introduction in the US light water reactors fleet is planned for the second half of the 2020`s. In the framework of the US-DOE Light-Water Reactor Sustainability program, Risk-Informed Systems Analysis pathway, researches are being conducted at the Idaho National Laboratory for developing tools and methods that can help the industry quantifying the benefits from the adoption of ATF technology. In this paper we describe the developed risk-informed methodology including the safety analysis codes improvements, and we present some results for selected accident scenarios. The developed methodology combines INL state-of-the-art deterministic Best Estimate code RELAP5-3D, and Probabilistic Risk Analysis tools RAVEN and SAPHIRE. The analyses are performed on a three-loops pressurized water reactor, simulating Station Blackout and LB-LOCA accidents and considering near-term ATFs, or FeCrAl and Chromium-coated clads. Finally, we show how, applying our methodology, the new Core Damage Frequency can be assessed. The results indicated that the main benefits in introducing near-term ATFs concern a significant reduction in the hydrogen production during accident conditions. No significant Core Damage Frequency reduction was found.
Probabilistic risk analysis is an integration of failure modes and effects analysis (FMEA), fault tree analysis and other techniques to assess the potential for failure and to find ways to reduce risk. This bibliography references 160 documents in the NASA STI Database that contain the major concepts, probabilistic risk assessment, risk and probability theory, in the basic index or major subject terms, An abstract is included with most citations, followed by the applicable subject terms.
This viewgraph presentation reviews Structural Health Monitoring Analysis for the Orbiter Wing Leading Edge. The Wing Leading Edge Impact Detection System (WLE IDS) and the Impact Analysis Process are also described to monitor WLE debris threats. The contents include: 1) Risk Management via SHM; 2) Hardware Overview; 3) Instrumentation; 4) Sensor Configuration; 5) Debris Hazard Monitoring; 6) Ascent Response Summary; 7) Response Signal; 8) Distribution of Flight Indications; 9) Probabilistic Risk Analysis (PRA); 10) Model Correlation; 11) Impact Tests; 12) Wing Leading Edge Modeling; 13) Ascent Debris PRA Results; and 14) MM/OD PRA Results.
MELCOR-TMAP is a combined thermal-hydraulics and tritium tracking code developed to simulate severe accident scenarios in fission and fusion power plants. Here, we demonstrate the results of MELCOR-TMAP analyses on historical ARIES program reference designs. By coupling MELCOR-TMAP with the open source RAVEN probabilistic risk analysis framework’s Bayesian UQ capabilities, we also demonstrate key uncertainties in material properties with the highest impact on tritium inventory and plant risk.
Create an improved method to calculate reliability of a conceptual launch vehicle system prior to fabrication by using historic data of actual root causes of failures. While failures have unique "proximate causes", there are typically a finite amount of common "root causes". Heretofore launch vehicle reliability evaluation typically hardware-centric statistical analyses, while most root causes of failures are been shown to be human-centric. A method based on human-centric root causes can be used to quantify reliability assessments and focus proposed actions to mitigate problems. Existing methods have been optimistic in their projections of launch vehicle reliability compared to actuals. Hypothesis: reliability of a conceptual launch vehicle can be more accurately evaluated based on a rational, probabilistic approach using past failure assessment teams' findings predicated on human-centric causes."Human Reliability Analysis Methods Selection Guidance for NASA"Chandler F.T., et al., NASA HQ/OSMA study group, July 2006. Outside HRA experts from academia, other federal labs, and the private sector. 50 system reliability methods considered, fourteen selected for further study, four finally selected as best suited for human spaceflight. Probabilistic Risk Analysis (PRA) + Human Reliability Analysis (HRA) enabled incorporating effects and probabilities of human errors. While four down-selected methods deemed appropriate for failure assessment, it did not appear that these methods could be concisely applied to perform major system-wide assessment of probability of failure of a conceptual design without becoming unwieldy."Engineering a Safer World", Detailed, comprehensive study external to NASA Leveson N. G., MIT, 2011.Systems-Theoretic Accident Model and Processes (STAMP). All-encompassing accident model based on systems theory analyzed accidents after they occurred and created approaches to prevent occurrence in developing systems not focused on failure prevention per se, but rather reducing hazards by influencing human behavior through use of constraints, hierarchical control structures, and process models to improve system safetySystem Theoretic Process Analysis (STPA) addresses predictive part of problem (a "hazard analysis"). Includes all causal factors identified in STAMP: "...design errors, software flaws, component interaction accidents, cognitively complex human decision-making errors, and social organizational and management factors contributing to accidents" can guide design process rather than require it to exist before-hand did not appear capable of concise application for system-wide assessment of probability of failure of a conceptual design without becoming unwieldy.
Background: Following the success of Artemis I, NASA is preparing for human extended duration missions. Ongoing efforts are focused on mitigating mission-related risks, including those affecting crew health and performance. Communication latency, logistics of resupply and time frame of medical evacuation are barriers to provision of healthcare for these missions, especially with respect to constraints in mass, volume, and crew training. An in-depth assessment of medical risks, capabilities and resources for a specific mission design is necessary to determine an optimal balance that maximizes likelihood of mission success. Overview: IMPACT (Informed Mission Planning via Analysis of Complex Tradespaces) is a dynamic tool designed to estimate medical risk and outcomes for a specific mission design. In its current iteration, a list of medical conditions selected based on likelihood of occurrence and/or consequence was linked to a set of clinical capabilities and resources necessary for diagnosis and management. A probabilistic risk analysis tool was then used to identify and estimate the likelihood and consequence of risks through the following outcome metrics: loss of crew life (inflight mortality due to medical conditions), need for medical evacuation (return to definitive care), and crew disability (task time affected based on how medical conditions influence the ability to perform specific exploration mission crew tasks). Finally, the model’s optimization algorithm provides recommendations for medical capabilities that maximize risk mitigation relative to mass and volume constraints. In the Spring of 2023, IMPACT was utilized to estimate outcome metrics for a design reference mission that would be representative of an extended duration Artemis mission. Notional data generated were then used to determine a recommended set of medical capabilities and resources relative to user-defined mass and volume constraints. A multidisciplinary team has also been updating IMPACT to strengthen the model’s fidelity. Figure 1 shows how updates to outcome metric inputs for the conditions resulted in different capability and resource allocation recommendations. Discussion: This presentation will discuss the IMPACT tool and share the latest data generated for a representative extended duration Artemis mission. Efforts to improve the fidelity of data generated by the model’s algorithm will also be discussed.
Background: Following the success of Artemis I, NASA is preparing for human extended duration missions. Ongoing efforts are focused on mitigating mission-related risks, including those affecting crew health and performance. Communication latency, logistics of resupply and time frame of medical evacuation are barriers to provision of healthcare for these missions, especially with respect to constraints in mass, volume, and crew training. An in-depth assessment of medical risks, capabilities and resources for a specific mission design is necessary to determine an optimal balance that maximizes likelihood of mission success. Overview: IMPACT (Informed Mission Planning via Analysis of Complex Tradespaces) is a dynamic tool designed to estimate medical risk and outcomes for a specific mission design. In its current iteration, a list of medical conditions selected based on likelihood of occurrence and/or consequence was linked to a set of clinical capabilities and resources necessary for diagnosis and management. A probabilistic risk analysis tool was then used to identify and estimate the likelihood and consequence of risks through the following outcome metrics: loss of crew life (inflight mortality due to medical conditions), need for medical evacuation (return to definitive care), and crew disability (task time affected based on how medical conditions influence the ability to perform specific exploration mission crew tasks). Finally, the model’s optimization algorithm provides recommendations for medical capabilities that maximize risk mitigation relative to mass and volume constraints. In the Spring of 2023, IMPACT was utilized to estimate outcome metrics for a design reference mission that would be representative of an extended duration Artemis mission. Notional data generated were then used to determine a recommended set of medical capabilities and resources relative to user-defined mass and volume constraints. A multidisciplinary team has also been updating IMPACT to strengthen the model’s fidelity. Figure 1 shows how updates to outcome metric inputs for the conditions resulted in different capability and resource allocation recommendations. Discussion: This presentation will discuss the IMPACT tool and share the latest data generated for a representative extended duration Artemis mission. Efforts to improve the fidelity of data generated by the model’s algorithm will also be discussed.
The purpose of the burden versus capability analysis is to analyze the ability of components to withstand the loads that they are subjected to. When designing a launch vehicle, there is always a trade-off for the strength of the components versus the weight of the vehicle. The vehicle needs to have some margin built in to the design, but this added margin should not add a significant amount of weight to the vehicle. When the material properties and limits are known, estimated loads can be used to ensure that the vehicle will survive launch loads. If the variation in the distributions can be quantified, the probability of failure can be estimated more accurately.
NASA’s view of risk changed between early Apollo and the Space Shuttle. Risk was a known serious problem at the beginning of Apollo and the risk estimates were disturbingly high. To avoid public concern, risk analysis was discontinued. Risk analysis was avoided in Shuttle, leading to an unnecessarily risky design. The immediate cause of the Challenger tragedy was the mistaken decision to launch in cold weather. The fundamental cause was the high risk of the Shuttle design. Before Challenger, management thought and testified that the probability of an accident was 1 in 100,000. After Challenger, Probabilistic Risk Analysis (PRA) found a roughly 1 in 100 chance of a Shuttle failure. The recent Orion design uses the safer Apollo approach, with a hardened capsule, launch abort escape, and the crew placed above the rocket tanks and engines. During Apollo it was estimated that, “assuming all elements from propulsion to rendezvous and life support were done as well or better than ever before, that 30 astronauts would be lost before 3 were returned safely to the Earth.” The chance of astronaut survival was only 10%. After the Apollo 1 tragedy, the awareness of risk led to an intense focus on achieving safety. “The only possible explanation for the astonishing success – no losses in space and on time – was that every participant at every level in every area far exceeded the norm of human capabilities.” During Apollo, a NASA PRA found that the chance of success was “less than 5 percent.” The NASA Administrator felt that “the numbers could do irreparable harm,” and discontinued numerical risk assessment.
NASA’s view of risk changed between early Apollo and the Space Shuttle. Risk was a known serious problem at the beginning of Apollo and the risk estimates were disturbingly high. To avoid public concern, risk analysis was discontinued. Risk analysis was avoided in Shuttle, leading to an unnecessarily risky design. The immediate cause of the Challenger tragedy was the mistaken decision to launch in cold weather. The fundamental cause was the high risk of the Shuttle design. Before Challenger, management thought and testified that the probability of an accident was 1 in 100,000. After Challenger, Probabilistic Risk Analysis (PRA) found a roughly 1 in 100 chance of a Shuttle failure. The recent Orion design uses the safer Apollo approach, with a hardened capsule, launch abort escape, and the crew placed above the rocket tanks and engines. During Apollo it was estimated that, “assuming all elements from propulsion to rendezvous and life support were done as well or better than ever before, that 30 astronauts would be lost before 3 were returned safely to the Earth.” The chance of astronaut survival was only 10%. After the Apollo 1 tragedy, the awareness of risk led to an intense focus on achieving safety. “The only possible explanation for the astonishing success – no losses in space and on time – was that every participant at every level in every area far exceeded the norm of human capabilities.” During Apollo, a NASA PRA found that the chance of success was “less than 5 percent.” The NASA Administrator felt that “the numbers could do irreparable harm,” and discontinued numerical risk assessment. This led to decreasing understanding of risk. The head of Apollo reliability and safety decided, “Statistics don’t count for anything,” and that risk is reduced by “attention taken in design.” The great and initially unexpected success of Apollo appeared to validate the neglect of PRA. Continuing to neglect the mathematical estimation of risk led Shuttle into a high risk design that produced tragic results. The initial design of the Shuttle emphasized increasing capability and reducing cost without analysis or even mention of risk. A retired NASA official stated, “some NASA people began to confuse desire with reality. … One result was to assess risk in terms of what was thought acceptable without regard for verifying the assessment. … Note that under such circumstances real risk management is shut out.” Not computing risk led to removing launch abort, removing crew escape, selecting less reliable Solid Rocket Boosters, placing the crew compartment next to the rocket boosters, and accepting more stressed shielding tile designs. Accepting these specific risks directly caused the shuttle disasters. The Challenger tragedy is frequently taught as a case of management failure. The focus is on the Challenger launch decision hours before, which is a dramatic example of bad management. However, the true cause of the Challenger disaster occurred decades earlier in the Apollo era. When the easily predictable failures occurred, failure investigations focused on how they might have been avoided. The Shuttle was cancelled after the space station was completed because of its high risk. The ultimate cause of the Shuttle tragedies was the choice by the Apollo-era NASA administrator to avoid a negative public reaction to realistic risk analysis.
Accident Tolerant Fuels (ATF) are being tested by different nuclear vendors and research organization and their introduction in light water reactors fleet is planned for the second half of the 2020`s. In the framework of the US-DOE Light-Water Reactor Sustainability program, Risk-Informed Safety Analysis pathway (LWRS-RISA), research activities are being conducted at the Idaho National Laboratory (INL) for developing tools and methods that can help the industry in quantifying the ATF introduction benefits. In this paper we describe the developed risk-informed methodology, the codes improvements and we present some results for selected accidental conditions. The developed methodology combines INL state-of-the-art deterministic Best Estimate tools like RELAP5-3D code, and Probabilistic Risk Analysis tools like RAVEN and SAPHIRE codes. The analyses are performed on a three-loops pressurized water reactor (PWR) simulating accidental conditions like Station Blackout and LB-LOCA and considering near-term ATF (FeCrAl and Chromium-coated clads). Finally, we show, through our methodologies, how the delta-Core Damage Frequency can be assessed.