Search NASA⌕ Search

SEARCH · Search NASA

Results for “loss of assured safety”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2

Aerospace Communications Security Technologies Demonstrated

In light of the events of September 11, 2001, NASA senior management requested an investigation of technologies and concepts to enhance aviation security. The investigation was to focus on near-term technologies that could be demonstrated within 90 days and implemented in less than 2 years. In response to this request, an internal NASA Glenn Research Center Communications, Navigation, and Surveillance Aviation Security Tiger Team was assembled. The 2-year plan developed by the team included an investigation of multiple aviation security concepts, multiple aircraft platforms, and extensively leveraged datalink communications technologies. It incorporated industry partners from NASA's Graphical Weather-in-the-Cockpit research, which is within NASA's Aviation Safety Program. Two concepts from the plan were selected for demonstration: remote "black box," and cockpit/cabin surveillance. The remote "black box" concept involves real-time downlinking of aircraft parameters for remote monitoring and archiving of aircraft data, which would assure access to the data following the loss or inaccessibility of an aircraft. The cockpit/cabin surveillance concept involves remote audio and/or visual surveillance of cockpit and cabin activity, which would allow immediate response to any security breach and would serve as a possible deterrent to such breaches. The datalink selected for the demonstrations was VDL Mode 2 (VHF digital link), the first digital datalink for air-ground communications designed for aircraft use. VDL Mode 2 is beginning to be implemented through the deployment of ground stations and aircraft avionics installations, with the goal of being operational in 2 years. The first demonstration was performed December 3, 2001, onboard the LearJet 25 at Glenn. NASA worked with Honeywell, Inc., for the broadcast VDL Mode 2 datalink capability and with actual Boeing 757 aircraft data. This demonstration used a cockpitmounted camera for video surveillance and a coupling to the intercom system for audio surveillance. Audio, video, and "black box" data were simultaneously streamed to the ground, where they were displayed to a Glenn audience of senior management and aviation security team members.

Griner, James H.↗

Suppression of Low Strain Rate Nonpremixed Flames by an Agent

The agent concentration required to achieve the suppression of low strain rate nonpremixed flames is an important consideration for fire protection in a microgravity environment such as a space platform. Currently, there is a lack of understanding of the structure and extinction of low strain rate (<20 s(exp -1)) nonpremixed flames. The exception to this statement is the study by Maruta et al., who reported measurements of low strain rate suppression of methane-air diffusion flames with N2 added to the fuel stream under microgravity conditions. They found that the nitrogen concentration required to achieve extinction increased as the strain rate decreased until a critical value was obtained. As the strain rate was further decreased, the required N2 concentration decreased. This phenomenon was termed "turning point" behavior and was attributed to radiation-induced nonpremixed flame extinction. In terms of fire safety, a critical agent concentration assuring suppression under all flow conditions represents a fundamental limit for nonpremixed flames. Counterflow flames are a convenient configuration for control of the flame strain rate. In high and moderately strained near-extinction nonpremixed flames, analysis of flame structure typically neglects radiant energy loss because the flames are nonluminous and the hot gas species are confined to a thin reaction zone. In counterflowing CH4-air flames, for example, radiative heat loss fractions ranging from 1 to 6 percent have been predicted and measured. The objective of this study is to investigate the impact of radiative emission, flame strain, agent addition, and buoyancy on the structure and extinction of low strain rate nonpremixed flames through measurements and comparison with flame simulations. The suppression effectiveness of a number of suppressants (N2, CO2, or CF3Br) was considered as they were added to either the fuel or oxidizer streams of low strain rate methane-air diffusion flames.

Hamins, A.↗

In-Time Non-Participant Casualty Risk Assessment to Support Onboard Decision Making for Autonomous Unmanned Aircraft

Numerous operational paradigms, technologies, and missions are emerging as newcomers to the National Airspace System (NAS) develop small Unmanned Aircraft Systems (sUAS), personal air vehicles and other Urban Air Mobility (UAM) concepts. As the list of applications expands, maintaining the safety of the current airspace system remains one of the core concerns preventing widespread commercial implementation of these concepts. Further, the risks associated with unmanned aircraft operations themselves have to be recognized and mitigated in a timely manner. Safety-critical risks include, but are not limited to, flight outside of approved airspace, unsafe proximity to people or property, critical system failures, loss-of control, and cyber-security related risks. Instead of reacting to accidents, a set of predictive and data-driven risk monitoring, assessment, and mitigation capabilities are envisioned to help capture and eliminate hazards as these systems become operational. NASA’s System-wide Safety project is performing R&D on such a safety assurance concept. As part of this concept, this paper describes an architecture that continuously monitors a diverse set of onboard and ground-based sources to estimate and predict non-participant casualty risk during flight. Timely identification of the changing nature of this risk can inform decision making processes to mitigate current and impending situations.

Ancel, Ersin↗

Tracking Radioactive Isotopes in HVAC and Application for Hot Cell Analyses - 20155

In recent years, the surge in the number of isotope production facilities under design has increased the need to analyze isotope migration in facility Heating, Ventilation, and Air Conditioning (HVAC) during normal operations and accident scenarios. These facilities are used to produce isotopes for medical, security, and industrial applications and as such are subject to license and regulatory requirements 10CFR20, 10CFR30, 10CFR50, and 10CFR70. GOTHIC, a general-purpose thermal-hydraulics software package, includes the ability to model isotopic tracers, radioactive decay and isotope migration as well as HEPA and charcoal filters for isotope retention. A GOTHIC model was developed by Zachry Nuclear Engineering (ZNE) to examine the effect of negative room pressure, HEPA filtration, and HVAC fluctuations on radiation areas, hot cells and gloveboxes. Radioactive tracers were used to simulate the concentration of spills within contaminated areas, track the migration of isotopes of interest, and determine the isotopic retention and buildup on facility HEPA filters. A variety of isotopes with concern to dose (e.g., Kr-85, Sr-90, I-131, etc.), including their decay and progeny, are included in the analysis. Negative pressures are maintained in the regions of interest by a representative central HVAC system equipped with a volumetric fan that exhausts to the environment after a series of isolation valves and HEPA filters. GOTHIC is an industry trusted tool for providing engineering solutions for a variety of applications, including fission product tracking, aerosol and particulate transport and ventilation assessments. The software provides an integrated analysis environment that includes a graphical user interface (GUI) for constructing analysis models, a numerical solver that includes parallel processing capabilities and a post-processor for evaluating simulation results. It solves the conservation equations for mass, momentum and energy for multicomponent, multi-phase flow in lumped parameter and multi-dimensional geometries (1, 2, or full 3D), including the effects of turbulence, diffusion and buoyancy. It has been developed and maintained under a Quality Assurance program in compliance with the requirements of 10CFR50 Appendix B and applicable portions of ASME NQA-1 since 1995. GOTHIC has been used for assessing both forced and natural convection conditions for a wide range of applications, including: - Tracking concentration of hazardous gases and chemicals for habitability and safety assessments - Determining ventilation and filtration requirements and optimizing location and arrangement of these systems - Room heat-up, including diverse and Flexible coping strategies for Extended Loss of AC Power (FLEX/ELAP) - Equipment Qualification (EQ) A distinctive feature of GOTHIC is the ability to track many different fields/substances in a simulation, including user defined tracer elements, in the liquid, vapor and droplet fields as well as surfaces and filters. This capability allows GOTHIC to model fission product transport and release or the removal of particulates or harmful toxins from exhaust gases using a spray scrubber or other types of filtration systems. GOTHIC also includes models for engineered equipment, such as fans, filters, charcoal filters, dryers/demisters, dampers, etc. The aerosols and other filtered material are removed or accumulated in these components. The range of aerosol and radiological applications that GOTHIC has been used for includes: - Source Term: Primary Coolant (Equilibrium) Activity; Non-Water Coolant Source/Leakage. - Conditions for Iodine Re-evolution: Sump/Suppression Pool Conditions and pH; - RWST Conditions and pH. - Isotope Removal Mechanisms: Containment Sprayed and Unsprayed Region Mixing; Charcoal Filter Heating due to Iodine decay. - Radionuclide Transport and Decay: Post-LOCA Release in containment; Transport between connected Compartments and vent systems; Groundwater transport of radionuclides. - Non-Newtonian Fluid modeling for sludge, waste tanks, etc. ADAMS ML071581053 (titled 'Best Practice Guidelines for the use of CFD in Nuclear Reactor Safety Applications') poses guidelines for applying single phase CFD codes in nuclear reactor safety problems and GOTHIC is listed as a 'tool for 3D flows' and 'dispersal and deposition of radionuclides.' The Nuclear Quality Assurance (NQA) pedigree of GOTHIC is an important aspect for applications in the nuclear industry. The fundamental tracer models (convective transport, molecular and turbulent diffusion, removal mechanisms, etc.) have been verified using analytical solutions and validated against applicable separate effects tests. Also, GOTHIC has been benchmarked to many integrated effects tests, including Phebus FP (Fission Product). GOTHIC gives good agreement for the buildup and decay of fission products in Phebus Test 3. The model developed by ZNE demonstrates GOTHIC's applicability and acceptability for use in analyzing the migration and retention of radioactive isotopes and their progeny in normal operation and accident scenario analyses for isotope production facilities, hot cells, and gloveboxes. The tracer activities calculated by GOTHIC can then be used in downstream radiation transport and shielding codes like RADTRAD-NAI{sup C}, MCNP{sup R}, and MicroShield{sup R} to determine on-site and of-site doses. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

Testing of Advanced Capabilities to Enable In-time Safety Management and Assurance for Future Flight Operations

In order to refine an initial Concept of Operations, explore Concepts of Use, and expose/validate requirements for future In-Time Aviation Safety Management Systems (IASMS), testing architectures were created, along with a set of capabilities and underlying information exchange protocols. These systems were conceived and developed based on hazards associated with two envisioned urban area flight domains: (1) highly autonomous small uncrewed aerial systems (sUAS) operating at low altitudes, and (2) highly autonomous air taxis. The initial scope of this development is described in [1]; this report provides an update, focusing on the subsequent developments and test activities. As stated in [1], it is important to note that there are many capabilities already in use by the industry (or soon to be in use) that will play critical roles in future IASMS designs. Those reported here were developed to address a gap in the current state-of-the-art regarding specific hazards/risks, and/or to allow for investigation of the interplay between and across hazard types — particularly regarding how overall safety risk can be reduced or managed effectively. Results of testing and development activities are organized by the operational phase wherein a particular capability would be employed (i.e., preflight, in-flight, and post-flight/off-line). Pre-flight: A set of capabilities were developed to help mitigate safety risk prior to flight (e.g., during flight and mission planning). Results of testing summarize (1) validation activities to raise the Technology Readiness Level (TRL) and (2) evaluation activities where the capabilities were applied to flight/mission planning procedures and used by operators/pilots. For the latter, flight plans were automatically assessed, and operators/pilots were notified of hazardous flight segments so as to enable adjustment of the flight plan and re-evaluation, and/or to better inform go/no-go decisions. Capabilities addressed hazards associated with power consumption, third-party risk, wind, navigation system performance, radiofrequency interference, and proximity to geo-spatial threats (e.g., buildings, trees, and no-fly zones). In-flight: Flight experiments tested capabilities that detect and respond to hazards encountered during flight. In the first series, safety hazards were monitored and assessed onboard, and system-generated mitigation maneuvers were recorded (but not acted upon by the vehicle). In the second series, mitigation maneuver commands directed the aircraft in response to safety hazards (i.e., auto-mitigation). The sUAS used for testing is described in full, as is the test architecture, which included commercial avionics, research avionics, and onboard software designed to detect, assess, and respond to hazards. The onboard system was designed as a run-time assurance framework, consistent with [2] and supportive of both supervisory and automated modes. The primary functions included: real-time risk assessment (RTRA), auto-pilot monitoring, constraint monitoring, and contingency select/triggering. RTRA performs integrated risk assessment considering data from several hazard-related monitors (e.g., battery, motors, navigation, communications, population density, and loss-of-control). Post-flight/off-line: Data monitored and recorded during flights can enable IASMS capabilities that execute after flights have completed (or “off-line”). These include: (1) the ability to identify anomalies and trends that may only be observable when comparing data spanning a number of similar flights; (2) the ability to update and validate pre-flight and in-flight capabilities and any underlying models to improve their performance; (3) the ability to report anomalies/off-nominals that may indicate design changes or maintenance actions are needed; and (4) the ability for humans involved in operations to report safety-relevant observations to help in understanding the flight data and/or the operational context of a flight. Progress on three such capabilities is summarized; the first investigates anomaly detection given a limited set of flight logs and applies an approach previously used for space operations. The second explores what could be identified using a larger set of flight logs, including from web-based forums where flight logs are posted by sUAS autopilot users. The third creates a new means of collecting information on UAS incidents and accidents via the Aviation Safety Reporting System (ASRS).

sUAS↗

Post-Challenger evaluation of space shuttle risk assessment and management

As the shock of the Space Shuttle Challenger accident began to subside, NASA initiated a wide range of actions designed to ensure greater safety in various aspects of the Shuttle system and an improved focus on safety throughout the National Space Transportation System (NSTS) Program. Certain specific features of the NASA safety process are examined: the Critical Items List (CIL) and the NASA review of the Shuttle primary and backup units whose failure might result in the loss of life, the Shuttle vehicle, or the mission; the failure modes and effects analyses (FMEA); and the hazard analysis and their review. The conception of modern risk management, including the essential element of objective risk assessment is described and it is contrasted with NASA's safety process in general terms. The discussion, findings, and recommendations regarding particular aspects of the NASA STS safety assurance process are reported. The 11 subsections each deal with a different aspect of the process. The main lessons learned by SCRHAAC in the course of the audit are summarized.

Source record↗

Varying Levels of Automation on UAS Operator Responses to Traffic Resolution Advisories in Civil Airspace

Continuing demand for the use of Unmanned Aircraft Systems (UAS) has put increasing pressure on operations in civil airspace. The need to fly UAS in the National Airspace System (NAS) in order to perform missions vital to national security and defense, emergency management, and science is increasing at a rapid pace. In order to ensure safe operations in the NAS, operators of unmanned aircraft, like those of manned aircraft, may be required to maintain separation assurance and avoid loss of separation with other aircraft while performing their mission tasks. This experiment investigated the effects of varying levels of automation on UAS operator performance and workload while responding to conflict resolution instructions provided by the Tactical Collision Avoidance System II (TCAS II) during a UAS mission in high-density airspace. The purpose of this study was not to investigate the safety of using TCAS II on UAS, but rather to examine the effect of automation on the ability of operators to respond to traffic collision alerts. Six licensed pilots were recruited to act as UAS operators for this study. Operators were instructed to follow a specified mission flight path, while maintaining radio contact with Air Traffic Control and responding to TCAS II resolution advisories. Operators flew four, 45 minute, experimental missions with four different levels of automation: Manual, Knobs, Management by Exception, and Fully Automated. All missions included TCAS II Resolution Advisories (RAs) that required operator attention and rerouting. Operator compliance and reaction time to RAs was measured, and post-run NASA-TLX ratings were collected to measure workload. Results showed significantly higher compliance rates, faster responses to TCAS II alerts, as well as less preemptive operator actions when higher levels of automation are implemented. Physical and Temporal ratings of workload were significantly higher in the Manual condition than in the Management by Exception and Fully Automated conditions.

Kenny, Caitlin↗

Analysis of Launch Vehicle Liftoff Debris: Historical Perspective from Space Shuttle and Application to Artemis I

Human exploration-class launch vehicles are inherently prone to debris due to the extreme environments generated during pre-launch operations, liftoff, and flight. The use of cryogenic propellants often requires thermal protection system (TPS) coatings, typically foam, to maintain the propellant conditions in the tank and prevent an accumulation ice on the external surface of the vehicle. Some ice growth is to be expected at umbilical interfaces, vents, flanges, or brackets where it is difficult to apply TPS. This ice may come loose at any time due to wind on the launch pad, structural vibration and acoustics after rocket ignition, or aerodynamic forces during flight. This phenomena is especially apparent on vehicles with no TPS, such as the Saturn V rockets used in the Apollo Program, see Figure 1. During propellant tanking, the thermal contraction of the underlying substrate may generate cracks in the TPS (Figure 1). Chunks of TPS can release due to the expansion of ingested gas from cryopumping or from aerodynamic forces if the crack creates an offset surface. Most foams will also have a certain amount of “popcorning” where small pieces of foam will pop off during flight because of the differential between the static surface pressure and the pressure of the gas trapped in the foam cell structure. There are a number of other coating or closeout materials that may be shed from the vehicle and become debris. During pre-launch operations and liftoff, the vehicle may also be exposed to debris originating from the launch pad or ground support equipment. This debris is separate from foreign object debris, or FOD, which is not intended to be present and is strictly controlled through operations and maintenance procedures. In this case, debris is generated from hardware and materials that are necessary for launch and are subject to the intense vibration, acoustics, and direct plume impingement of the launch environment. Examples include ice from umbilicals, tape and tie wraps that protect cables, and rust or corrosion from the launch platform. While NASA has historically been aware of debris as a potential issue that could cause a failure resulting in loss of mission, loss of vehicle, or loss of crew, the likelihood and severity of that risk was not always well understood or given sufficient weight in program and flight decisions. After the Space Shuttle Columbia accident (STS-107), the investigation found that foam TPS debris shed from the external tank was the proximate cause of the damage to the orbiter wing. Six previous observations of debris released from the foam ramp that covered the bipod connecting the forward end of the orbiter to the external tank resulted in minor changes or were determined to be accepted flight risks. Two occurrences of bipod ramp foam loss were not identified until the STS-107 investigation. Despite the damage inflicted by these debris strikes, the Shuttle Program Requirements Control Board deemed the vehicle safe to fly. During the Return to Flight effort following the Columbia disaster, NASA Engineering developed a process for the assessment of debris transport, impact, and damage tolerance to support independent assessments of risk by NASA Safety and Mission Assurance (S&MA). Under this system, each element (vehicle or ground system) defines a catalog of all expected debris based on launch history, component testing, or analysis. Debris transport analysis (DTA) is conducted using the debris catalog characteristics and potential flow transport mechanisms (e.g., vehicle aerodynamics, gravity, wind, plume-driven). The predicted debris impact locations and velocities are provided to the hardware owners, who use available test data and analysis to determine whether each component can withstand the impacts. In cases where the element hardware may be severely damaged or fail, the options are to mitigate the debris source through some change in design or operation, or to work with S&MA to try to characterize the probability of the impact and damage for program risk acceptance. Because of the differences in debris characteristics and transport, the DTA has been divided between the Liftoff and Ascent regimes. The development and application of Liftoff DTA methodology from the Shuttle Program to the current Artemis Program is the subject of this paper. Liftoff DTA covers the time from the start of pre-launch operations at the launch pad, up until the vehicle clears the launch tower and there is no longer any interaction with ground systems. Debris transport during this period is broadly classified as either gravity, wind, and plume-entrained (GWPE) or plume driven (PD). GWPE debris is generally lower speed, travelling in a forward-to-aft direction. PD transport includes flow features from the rocket ignition transient, as well as plume impingement and recirculation that occur as the vehicle lifts off the launch platform. In these cases, the debris typically moves in an aft-to-forward direction at higher speeds. The applicable transport mechanisms must be considered for each piece of debris depending on the material, and release location and time. For example, rust or metallic debris from the tower could fall (GWPE) and impact the vehicle before landing on the launch platform deck where it could be also be transported by plume impingement (PD). However, falling ice (GWPE) from an umbilical is unlikely to survive impact with the vehicle or launch platform and be available for PD transport. Modeling of debris transport is accomplished using a set of DTA tools which simulate debris trajectories subject to a reference frame acceleration (i.e., gravity) and aerodynamic drag. Where the trajectory encounters a solid surface, the debris is allowed to rebound with a specified coefficient of restitution. The drag is calculated by interpolating the fluid state at each point in the debris trajectory from high-fidelity computational fluid dynamics (CFD) simulations of the launch vehicle and pad. The CFD data may either be static (steady state or time averaged), typically for GWPE transport, or dynamic (time-accurate) for PD flow features like the ignition transient. Examples of the CFD flow field solutions for the Space Launch System (SLS) rocket and launch pad are shown in Figure 2. Typical SLS debris trajectory predictions from DTA are illustrated in Figure 3. The final version of this paper will include a more detailed examination of the Liftoff DTA process developed during the Shuttle Program, and how it has been augmented and applied to the SLS rocket under the Artemis Program. Comparisons with debris observations from the Artemis I launch will demonstrate validation of the tools and methodology.

Debris↗

NASA Accident Precursor Analysis Handbook, Version 1.0

Catastrophic accidents are usually preceded by precursory events that, although observable, are not recognized as harbingers of a tragedy until after the fact. In the nuclear industry, the Three Mile Island accident was preceded by at least two events portending the potential for severe consequences from an underappreciated causal mechanism. Anomalies whose failure mechanisms were integral to the losses of Space Transportation Systems (STS) Challenger and Columbia had been occurring within the STS fleet prior to those accidents. Both the Rogers Commission Report and the Columbia Accident Investigation Board report found that processes in place at the time did not respond to the prior anomalies in a way that shed light on their true risk implications. This includes the concern that, in the words of the NASA Aerospace Safety Advisory Panel (ASAP), "no process addresses the need to update a hazard analysis when anomalies occur" At a broader level, the ASAP noted in 2007 that NASA "could better gauge the likelihood of losses by developing leading indicators, rather than continue to depend on lagging indicators". These observations suggest a need to revalidate prior assumptions and conclusions of existing safety (and reliability) analyses, as well as to consider the potential for previously unrecognized accident scenarios, when unexpected or otherwise undesired behaviors of the system are observed. This need is also discussed in NASA's system safety handbook, which advocates a view of safety assurance as driving a program to take steps that are necessary to establish and maintain a valid and credible argument for the safety of its missions. It is the premise of this handbook that making cases for safety more experience-based allows NASA to be better informed about the safety performance of its systems, and will ultimately help it to manage safety in a more effective manner. The APA process described in this handbook provides a systematic means of analyzing candidate accident precursors by evaluating anomaly occurrences for their system safety implications and, through both analytical and deliberative methods used to project to other circumstances, identifying those that portend more serious consequences to come if effective corrective action is not taken. APA builds upon existing safety analysis processes currently in practice within NASA, leveraging their results to provide an improved understanding of overall system risk. As such, APA represents an important dimension of safety evaluation; as operational experience is acquired, precursor information is generated such that it can be fed back into system safety analyses to risk-inform safety improvements. Importantly, APA utilizes anomaly data to predict risk whereas standard reliability and PRA approaches utilize failure data which often is limited and rare.

Groen, Frank↗

Antimicrobial Medication Stability During Space Flight

The current vision for manned space flight involves lunar and Martian exploration within the next two decades. In order for NASA to achieve these goals, a significant amount of preparation is necessary to assure crew health and safety. A mission critical component of this vision centers around the stability of pharmaceutical preparations contained in the space medicine kits. Evidence suggests that even brief periods of space flight have significant detrimental effects for some pharmaceutical formulations. The effects observed include decreases in physical stability of drug formulations of sufficient magnitude to effect bioavailability. Other formulations exhibit decreases in chemical stability resulting in a loss of potency. Physical or-chemical instability of pharmaceutical formulations i n space medicine kits could render the products ineffective. Of additional concern is the potential for formation of toxic degradation products as a result of the observed product instability. This proposal addresses Question number 11 of Clinical Capabilities in the Critical Path Roadmap. In addition, this proposal will reduce the risks and/or enhance the capabilities of humans exposed to the environments of space flight or an extraterrestrial destination by identifying drugs that may be unstable during spaceflight.

Putcha, Lakshmi↗

Verification and Validation of Safety-Critical Aircraft Systems Operating under Off-Nominal, Contingency, and Emergency Conditions

Verification and validation (V&V) of safety-critical technologies developed for loss of control (LOC) prevention and recovery and other aviation safety concerns pose significant challenges. Aircraft LOC can result from a wide spectrum of hazards, often occurring in combination, which cannot be fully replicated during evaluation. Technologies developed for LOC prevention and recovery must therefore be effective under a wide variety of hazardous and uncertain conditions, and the verification and validation of these technologies must provide some measure of assurance that the new vehicle safety technologies do no harm (i.e., that they themselves do not introduce new safety risks). V&V technologies must also enable the identification of system limitations and constraints, as well as enable the identification of safe and unsafe operating conditions (and their boundaries). Additionally, the V&V of complex, increasingly autonomous systems is a fundamental concern. Scalable, reproducible and cost-effective techniques for the assurance of safety critical systems during their design and operation is a key barrier to fielding new systems or updating current systems. Moreover, these techniques need to provide artifacts that enable a comprehensive evidence-based approach to certification. This briefing summarizes research performed under NASA’s Aviation Safety Program and follow-on research for the V&V of safety-critical aircraft system technologies developed for LOC prevention and recovery and increasingly autonomous systems, and for a broad assurance capability in both current and emerging aviation applications. Note that, in this briefing, the term “validation” refers to a confirmation that the system implementation (e.g., algorithms etc.) is performing the intended function(s), as well as an affirmation of effectiveness in these functions. “Verification” refers to a confirmation that the system implementation in the software and hardware meets its (hopefully validated) specifications (e.g., correctly executes algorithms as designed).

Validation↗

Advanced Modeling and Uncertainty Quantification for Flight Dynamics; Interim Results and Challenges

As part of the NASA Vehicle Systems Safety Technologies (VSST), Assuring Safe and Effective Aircraft Control Under Hazardous Conditions (Technical Challenge #3), an effort is underway within Boeing Research and Technology (BR&T) to address Advanced Modeling and Uncertainty Quantification for Flight Dynamics (VSST1-7). The scope of the effort is to develop and evaluate advanced multidisciplinary flight dynamics modeling techniques, including integrated uncertainties, to facilitate higher fidelity response characterization of current and future aircraft configurations approaching and during loss-of-control conditions. This approach is to incorporate multiple flight dynamics modeling methods for aerodynamics, structures, and propulsion, including experimental, computational, and analytical. Also to be included are techniques for data integration and uncertainty characterization and quantification. This research shall introduce new and updated multidisciplinary modeling and simulation technologies designed to improve the ability to characterize airplane response in off-nominal flight conditions. The research shall also introduce new techniques for uncertainty modeling that will provide a unified database model comprised of multiple sources, as well as an uncertainty bounds database for each data source such that a full vehicle uncertainty analysis is possible even when approaching or beyond Loss of Control boundaries. Methodologies developed as part of this research shall be instrumental in predicting and mitigating loss of control precursors and events directly linked to causal and contributing factors, such as stall, failures, damage, or icing. The tasks will include utilizing the BR&T Water Tunnel to collect static and dynamic data to be compared to the GTM extended WT database, characterizing flight dynamics in off-nominal conditions, developing tools for structural load estimation under dynamic conditions, devising methods for integrating various modeling elements into a real-time simulation capability, generating techniques for uncertainty modeling that draw data from multiple modeling sources, and providing a unified database model that includes nominal plus increments for each flight condition. This paper presents status of testing in the BR&T water tunnel and analysis of the resulting data and efforts to characterize these data using alternative modeling methods. Program challenges and issues are also presented.

Hyde, David C.↗

Evaluation of Risk and Possible Mitigation Schemes for Previously Unidentified Hazards

In April 2004, the NASA Engineering and Safety Center (NESC) was commissioned by NASA's Chief Safety and Mission Assurance (S&MA) Officer to review and render a technical opinion on the probability of a catastrophic failure related to this scenario: The Space Shuttle Program (SSP) recognized a zero-fault-tolerant design related to an inadvertent firing of the primary reaction control system (RCS) jets on the Orbiter during mated operations with the International Space Station (ISS). It was determined that an un-commanded firing of an RCS jet could cause serious damage or loss of both the SSP Orbiter and the ISS. Several scenarios were suggested in which an un-commanded firing of the RCS jet is possible. These scenarios include an arc track event in the 28-volt heater circuits that could result in a wire-to-wire short to the adjacent reaction control jet wire. In this worst-case scenario, enough current and power could be applied to activate the reaction control jet valves and fire a thruster. The following report summarizes the work that was sponsored by the NESC as part of their assessment of the Orbiter inadvertent firing of a RCS thruster while attached to the ISS.

Linzey, William↗

NASA System Safety Handbook: System Safety Framework and Concepts for Implementation - Volume 1

System safety assessment is defined in NPR 8715.3C, NASA General Safety Program Requirements as a disciplined, systematic approach to the analysis of risks resulting from hazards that can affect humans, the environment, and mission assets. Achievement of the highest practicable degree of system safety is one of NASA's highest priorities. Traditionally, system safety assessment at NASA and elsewhere has focused on the application of a set of safety analysis tools to identify safety risks and formulate effective controls.1 Familiar tools used for this purpose include various forms of hazard analyses, failure modes and effects analyses, and probabilistic safety assessment (commonly also referred to as probabilistic risk assessment (PRA)). In the past, it has been assumed that to show that a system is safe, it is sufficient to provide assurance that the process for identifying the hazards has been as comprehensive as possible and that each identified hazard has one or more associated controls. The NASA Aerospace Safety Advisory Panel (ASAP) has made several statements in its annual reports supporting a more holistic approach. In 2006, it recommended that "... a comprehensive risk assessment, communication and acceptance process be implemented to ensure that overall launch risk is considered in an integrated and consistent manner." In 2009, it advocated for "... a process for using a risk-informed design approach to produce a design that is optimally and sufficiently safe." As a rationale for the latter advocacy, it stated that "... the ASAP applauds switching to a performance-based approach because it emphasizes early risk identification to guide designs, thus enabling creative design approaches that might be more efficient, safer, or both." For purposes of this preface, it is worth mentioning three areas where the handbook emphasizes a more holistic type of thinking. First, the handbook takes the position that it is important to not just focus on risk on an individual basis but to consider measures of aggregate safety risk and to ensure wherever possible that there be quantitative measures for evaluating how effective the controls are in reducing these aggregate risks. The term aggregate risk, when used in this handbook, refers to the accumulation of risks from individual scenarios that lead to a shortfall in safety performance at a high level: e.g., an excessively high probability of loss of crew, loss of mission, planetary contamination, etc. Without aggregated quantitative measures such as these, it is not reasonable to expect that safety has been optimized with respect to other technical and programmatic objectives. At the same time, it is fully recognized that not all sources of risk are amenable to precise quantitative analysis and that the use of qualitative approaches and bounding estimates may be appropriate for those risk sources. Second, the handbook stresses the necessity of developing confidence that the controls derived for the purpose of achieving system safety not only handle risks that have been identified and properly characterized but also provide a general, more holistic means for protecting against unidentified or uncharacterized risks. For example, while it is not possible to be assured that all credible causes of risk have been identified, there are defenses that can provide protection against broad categories of risks and thereby increase the chances that individual causes are contained. Third, the handbook strives at all times to treat uncertainties as an integral aspect of risk and as a part of making decisions. The term "uncertainty" here does not refer to an actuarial type of data analysis, but rather to a characterization of our state of knowledge regarding results from logical and physical models that approximate reality. Uncertainty analysis finds how the output parameters of the models are related to plausible variations in the input parameters and in the modeling assumptions. The evaluation of unrtainties represents a method of probabilistic thinking wherein the analyst and decision makers recognize possible outcomes other than the outcome perceived to be "most likely." Without this type of analysis, it is not possible to determine the worth of an analysis product as a basis for making decisions related to safety and mission success. In line with these considerations the handbook does not take a hazard-analysis-centric approach to system safety. Hazard analysis remains a useful tool to facilitate brainstorming but does not substitute for a more holistic approach geared to a comprehensive identification and understanding of individual risk issues and their contributions to aggregate safety risks. The handbook strives to emphasize the importance of identifying the most critical scenarios that contribute to the risk of not meeting the agreed-upon safety objectives and requirements using all appropriate tools (including but not limited to hazard analysis). Thereafter, emphasis shifts to identifying the risk drivers that cause these scenarios to be critical and ensuring that there are controls directed toward preventing or mitigating the risk drivers. To address these and other areas, the handbook advocates a proactive, analytic-deliberative, risk-informed approach to system safety, enabling the integration of system safety activities with systems engineering and risk management processes. It emphasizes how one can systematically provide the necessary evidence to substantiate the claim that a system is safe to within an acceptable risk tolerance, and that safety has been achieved in a cost-effective manner. The methodology discussed in this handbook is part of a systems engineering process and is intended to be integral to the system safety practices being conducted by the NASA safety and mission assurance and systems engineering organizations. The handbook posits that to conclude that a system is adequately safe, it is necessary to consider a set of safety claims that derive from the safety objectives of the organization. The safety claims are developed from a hierarchy of safety objectives and are therefore hierarchical themselves. Assurance that all the claims are true within acceptable risk tolerance limits implies that all of the safety objectives have been satisfied, and therefore that the system is safe. The acceptable risk tolerance limits are provided by the authority who must make the decision whether or not to proceed to the next step in the life cycle. These tolerances are therefore referred to as the decision maker's risk tolerances. In general, the safety claims address two fundamental facets of safety: 1) whether required safety thresholds or goals have been achieved, and 2) whether the safety risk is as low as possible within reasonable impacts on cost, schedule, and performance. The latter facet includes consideration of controls that are collective in nature (i.e., apply generically to broad categories of risks) and thereby provide protection against unidentified or uncharacterized risks.

Dezfuli, Homayoon↗

CAST Safety Enhancement Research on Airplane State Awareness and Prediction Technologies

Loss of control in flight (LOC-I) is the leading cause of fatal aircraft accidents. A study of LOC accidents and incidents, commissioned by the Commercial Aviation Safety Team (CAST) identified a growing trend in loss of Airplane State Awareness (ASA) by the flight crew. This has led to recommended safety enhancements that include flight deck technologies for improving current and predicted energy state awareness. In this talk, we discuss recent CAST motivated efforts to develop new information systems for predicting and assessing the future aircraft energy state and auto-flight configuration. The outputs from these systems can serve multiple purposes, including improved pilot alerting for anticipating and recovering from problematic flight conditions, as well as higher level flight safety assurance for autonomous operations.

Schuet, Stefan↗

Application of Constellation's best estimate alternate source term methodology

Safety analyses for a nuclear power plants need to consider postulated accidents that results in a risk of accidental release of radiation. The regulations require plant specific safety analysis reports to include an evaluation of the requirements of 10CFR50.67. Such a safety analysis report mandates limits such that calculated radiological consequences at certain locations do not exceed established limits in 10CFR50.67 following a postulated release of radioactivity. Analyses should demonstrate, with reasonable assurance, that these prescribed limits are complied with. Conventional methodologies utilize conservative approaches to address lack of uncertainty quantification in the utilized approaches, methods, and/or inputs. These built-in excess conservatisms often result in with compounding effects and hence overly conservative results in the estimated radiological consequences, which leads to inaccurate margin evaluation for operation and accident mitigation. Therefore, evaluating accurate dose consequences is needed for both operational and safety reasons. This paper illustrates the use of the best estimate source term (BEAST) methodology to the case of the loss of coolant accident (LOCA) dose analysis.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

Space Mission Human Reliability Analysis (HRA) Project

The purpose of the Space Mission Human Reliability Analysis (HRA) Project is to extend current ground-based HRA risk prediction techniques to a long-duration, space-based tool. Ground-based HRA methodology has been shown to be a reasonable tool for short-duration space missions, such as Space Shuttle and lunar fly-bys. However, longer-duration deep-space missions, such as asteroid and Mars missions, will require the crew to be in space for as long as 400 to 900 day missions with periods of extended autonomy and self-sufficiency. Current indications show higher risk due to fatigue, physiological effects due to extended low gravity environments, and others, may impact HRA predictions. For this project, Safety & Mission Assurance (S&MA) will work with Human Health & Performance (HH&P) to establish what is currently used to assess human reliabiilty for human space programs, identify human performance factors that may be sensitive to long duration space flight, collect available historical data, and update current tools to account for performance shaping factors believed to be important to such missions. This effort will also contribute data to the Human Performance Data Repository and influence the Space Human Factors Engineering research risks and gaps (part of the HRP Program). An accurate risk predictor mitigates Loss of Crew (LOC) and Loss of Mission (LOM).The end result will be an updated HRA model that can effectively predict risk on long-duration missions.

Boyer, Roger↗

Hydrogen Detection Strategies to Support H2@SCALE - The NREL Sensor Laboratory

Hydrogen represents a major pathway to decarbonize and stabilize the national and international energy industry and select manufacturing markets. To facilitate the development of hydrogen markets, the US Department of Energy initiated H2@Scale to bring together stakeholders to advance affordable hydrogen production, transport, storage, and utilization to increase revenue opportunities in multiple energy sectors. One major impediment to hydrogen implementation is cost. To expedite the use of hydrogen in energy and other markets, the United States announced in 2021 the Hydrogen Shot, which seeks to reduce the cost of clean hydrogen by 80% to $1 per 1 kilogram in 1 decade ("1 1 1"). As the cost of hydrogen drops, new applications will emerge that will require unique configurations of existing equipment and infrastructure, and eventually lead to advances in the generation and utilization of hydrogen. As the hydrogen economy expands, sensors and detection methods will need to adapt to changing infrastructure demands to address the primary targets of health & safety, emissions monitoring, and process control. The NREL Sensor Laboratory is playing a pivotal role in advancing the use of hydrogen sensors and detection methodologies in each of these categories to support DOE's mission for safe and efficient utilization in emerging markets. Health & safety monitors are required to ensure that operators and facilities can react to unintended hydrogen releases, either as GH2, LH2, or as a constituent of blends (e.g., natural gas or ammonia). Current detection methodologies focus on safety applications to detect near its lower flammable limit (4 vol %), and typically include point sensors in applications such as fixed or mobile detectors (e.g., personal gas monitors). Methodologies amenable for area detection include acoustic, emerging optical imaging methods, and flame detectors. Comparable detection strategies can be utilized for emissions monitoring and quantization, however few methods can simultaneously cover both low (emissions) and high (health & safety) levels. Deployment of emission level detectors will be required to 1) reduce product loss through small but potentially significant leaks from an environmental or cost perspective, 2) reduce downtime of high demand systems by early identification of eminent system failures (leaks through pump or compressor seals indicative of impending failure), and 3) address potential emission monitoring requirements that may be set by regulating bodies. The first two points should be adopted by industry to reduce the cost-of-goods-sold. The third main category for hydrogen detection relates to process control and may be advantageous for many existing applications. Two main applications are emerging. For example, the purity requirements for hydrogen that is dispensed from refueling systems for hydrogen fuel cell electric vehicles (FCEV) is rigorously regulated by the Standard SAE J2719, which prescribes maximum allowable levels of multiple impurities in the hydrogen fuel and must be verified by a regulatory body. Hydrogen contaminant detectors (HCD) integrated to the fueling station can assure this compliance. HCDs must be able operate in 100% H2 backgrounds and be able to distinguish between multiple contaminants at low ppm to low ppb levels. Secondly, as a strategy to decarbonize the natural gas grid, there are proposals to blend hydrogen with natural gas. This blending will affect transport applications (pipeline infrastructure), stationary combustion systems (turbines), and consumer and commercial appliances. In the short-term, hydrogen levels up to 20% are proposed. Variations in the hydrogen level can have dramatic impact on the combustion process and on the potential response of safety sensors. These mixtures may be regulated so that the concentration at a delivery point must be monitored with high precision. However, routine maintenance may introduce background gases such as ambient air (with water) or maintenance gases (introduced with welding processes or adhesive outgassing.) Therefore, the detection methodology must be robust enough to recover or respond to various contaminants. Several reviews can be found in literature addressing sensing and detection technologies, including their limitations and applications. However, for most applications, limitations can be alleviated by combining various detection techniques either through system integration or implementation of machine learning methods (artificial intelligence). In this presentation, we will discuss several applications, highlight their current approach for hydrogen detection, and suggest detection strategies to supplement their limitations.

ENERGY STORAGE,HYDROGEN↗