Search NASA⌕ Search

SEARCH · Search NASA

Results for “Safety Controls”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 379 records · Page 21

A Low-Cost and Low-Risk Testbed for Control Design of Launch Vehicles and Landing Systems

This research seeks to bridge the gap between the simulation/theory and the flight-testing phases of control algorithmdesign for launch vehicles (LVs) and landing systems (LSs). Thispaper reviews contemporary testbeds for LV and LS control sys-tem design with an emphasis on reducing costs and risks. Also, anew low-cost and low-risk testbed utilizing a quadcopter, flexibleinverted pendulum, and a hanging pendulum is proposed. It is shown that the planar dynamic response of this proposed testbedcan match the planar dynamic response of an LV. As mission objectives for frequent cislunar and interplanetary travel become more complex, the algorithms that control LVs and LSs need to become more advanced to ensure mission safety and success. These control systems are slow to mature because it is difficult to perform experiments in an environment relevant to the mission in a safe and cost-effective manner. A solution to this problem frequently leveraged in the aviation andsatellite industries involves mimicking the dynamic response ofthe vehicle with a test platform that is low-cost and low-risk.

William J Elke III↗

NASA’s Lunar Communications and Navigation Architecture: Human Lunar Return

NASA’s Artemis missions will return humanity to the Moon, establishing a long-term presence there and opening more of the lunar surface to exploration than ever before. This rapid growth of lunar activity requires robust and resilient communications, navigation, and networking capabilities for crew safety, command and control of spacecraft, return of science data, and precise maneuvering of assets in space and on the lunar surface.

Michael J Zemba↗

Design of the DUNE APATF cryogenic system

Fermi National Accelerator Laboratory (FNAL) is developing the international Long- Baseline Neutrino Facility (LBNF) and Deep Underground Neutrino Experiment (DUNE) to advance neutrino science. The flagship of the DUNE project consists of a large particle detector constructed one-mile (1.6 km) beneath the surface at the Sanford Underground Research Facility (SURF) in Lead, SD. The SURF detector is the largest of its type ever built and is comprised of four cryostats totaling 70,000 tons of liquid argon (LAr) to record neutrino interactions with unprecedented precision. Each cryostat houses a detector, the first includes 150 Anode Panel Assemblies (APA) submersed within 17,500 tons of LAr. Before installing 150 APA within the SURF detector they will be cryogenically cooled to nominally 90 K at the APA Test Facility (APATF) utilizing nitrogen flows. The APATF cryogenic system is entirely located one-mile underground at the SURF facility and includes nominally 13 kW of refrigeration at 80 K, cryogenic transfer lines, APA test cryostats, a cryogenic control system, and various control and pressure safety elements to ensure performance and safety requirements are achieved. The APATF preliminary design is in progress and major considerations include an efficient, costeffective mechanism to deliver the required refrigeration to the APATF underground, support of rigid testing intervals to support the DUNE operating schedule, temperature stability of the APA and electronics within cryostats, efficient cryogenic system operation to minimize heat leak and/or liquid nitrogen consumption, thermo-mechanical stability and flexibility of components, and pressure safety of the APATF cryogenic system. Installation and integration of the APATF cryogenic system within the footprint and to adjacent sub-systems is also discussed.

43 PARTICLE ACCELERATORS↗

Skewering the silos: using Brick to enable portable analytics, modeling and controls in buildings

Nearly all large commercial buildings have heating, ventilation and air conditioning (HVAC) systems, lighting systems, safety and other systems controlled by a computer—a dedicated server with a building energy management system (BMS). However, these BMSs are proprietary with each building’s assets (that is, fans, valves, pumps, and their setpoints) named and coded uniquely by the BMS vendor or engineer; building analytics and control algorithms are written specific to the assets and the building. Thus, any control updates or analytics to improve building performance—especially critical to reduce greenhouse emissions or improve load flexibility—are labor intensive and costly. The Brick schema was developed so the same analysis or control algorithms can work on a variety of buildings if each is digitally represented in a Brick data model. The goal of this project was to further the development of Brick to extend it beyond an academic project with demonstrated success in a small field study, to a practical choice for industrial and commercial stakeholders seeking to realize value from building data. To do this, we executed four objectives: (1) expand the Brick schema including its modeling capabilities and vocabulary, (2) develop tools for integrating Brick with existing digital technologies and representations in buildings, (3) develop an open-source analytics platform to facilitate use of Brick in delivering data value, and (4) demonstrate Brick-driven analytics and controls in real settings.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗

Qualification of the flight-critical AFTI/F-16 digital flight control system

Qualification considerations for assuring the safety of a life-critical digital flight control system include four major areas: systems interactions, verification, validation, and configuration control. The AFTI/F-16 design, development, and qualification illustrate these considerations. In this paper, qualification concepts, procedures, and methodologies are discussed and illustrated through specific examples.

Mackall, D. A.↗

Validation of Safety-Critical Systems for Aircraft Loss-of-Control Prevention and Recovery

Validation of technologies developed for loss of control (LOC) prevention and recovery poses significant challenges. Aircraft LOC can result from a wide spectrum of hazards, often occurring in combination, which cannot be fully replicated during evaluation. Technologies developed for LOC prevention and recovery must therefore be effective under a wide variety of hazardous and uncertain conditions, and the validation framework must provide some measure of assurance that the new vehicle safety technologies do no harm (i.e., that they themselves do not introduce new safety risks). This paper summarizes a proposed validation framework for safety-critical systems, provides an overview of validation methods and tools developed by NASA to date within the Vehicle Systems Safety Project, and develops a preliminary set of test scenarios for the validation of technologies for LOC prevention and recovery

Belcastro, Christine M.↗

Diagnostics: Chapter 8 of the special issue: on the path to tokamak burning plasma operation

This chapter presents the activity conducted by the ITPA topical group (TG) on Diagnostics over about the last 15 years. Following a general introduction of the ITER Diagnostics led by their measurement roles, the document is organized in several subchapters detailing the design support, research and development activity conducted by each of the specialist working groups (WGs) of the TG. Please note that the magnetic diagnostics were supported at the TG without a specific WG. Their status is included in the general introduction. In the following some highlights of the subchapter’s contents are provided. Recent advances in ITER first wall (FW) diagnostics for the measurements of plasma-metallic wall interaction in support of the ITER research plan are reported. An InfraRed imaging Video Bolometer for ITER has been developed and tested on several tokamaks to measure the radiated power loss. A laser-induced breakdown spectroscopy (LIBS) technique which utilizes a pulsed laser beam to ablate locally by forming a crater, will measure local tritium inventory in the FW material. Real-time Residual Gas Analyzers will measure the neutral gas composition in a divertor port and an equatorial port during plasma operation. Due to the full metallic FW environment, the plasma-wall interaction in ITER will face several challenges such as the compromised radiated power and divertor heat flux measurements by reflection. Ray tracing and analysis codes have been developed to eliminate and correct the effects of reflection in the measurements. The characteristics of the reflecting surfaces depending on the roughness and angle of the incidence have been measured by dedicated experiments, and the results were applied to the reflection elimination. For the measurement of the metallic impurity radiation induced by eroded metallic atoms, a vacuum ultraviolet spectrometer has been developed and tested. An extensive thermonuclear diagnostic suite will be required to support the operation of ITER and the planned experimental program for future burning plasma experiments. Due to the harsh environmental conditions, the implementation of diagnostic systems in ITER is a major challenge. These conditions include high levels of neutron and gamma fluxes, neutron heating, particle bombardment. Therefore, the selection and design of diagnostic systems must take into account a number of phenomena previously unseen in diagnostic design. For this reason, the measurement of neutrons and confined or lost fast ions, with particular emphasis on alpha particles, is critical to ITER. The diagnostics associated with these measurements will be important for future plasma-burning experiments at ITER. The high neutron emission and very large plasma size in ITER make neutron diagnostics the main diagnostic method used to measure plasma parameters such as fusion power, fusion power density, ion temperature, energy of fast ions and their spatial distributions in the plasma core. Active spectroscopy techniques are methods where a neutral particle beam is injected into the plasma and information on plasma parameters is extracted from the measurement of line emission resulting from the beam-plasma interaction, either by plasma ions or by beam atoms. Spatial localization is achieved by crossing the beamline and multiple observation lines. The ITER plasma will be a high temperature, moderately dense, fully ionized collisional plasma. The plasma facing surfaces are principally metallic being fashioned from beryllium or tungsten but many other elements, arising from either structural or from operational needs, may enter this plasma. The energy range of the emitted photons range from meV (infra-red) to multi keV (x-rays) and originate from all areas of the plasma volume. The primary role of passive emission diagnostics is to identify what is in the plasma from spectral signatures. Extracting quantitative information from these measurements such as impurity content, ion temperature, rotation, degree of detachment and radiated power depends on calibrated instruments, a physics model of the atomic and molecular processes and plasma transport and an analysis workflow that takes into account environmental effects such as reflections. The particular needs for ITER have prompted a multi-machine, many-year effort to address all these aspects and this chapter reviews the work on diagnostic design, experiments and new analysis techniques. An overview of the laser diagnostics to be implemented on ITER is also provided in this paper. This includes descriptions of the Thomson scattering in the core, edge and divertor regions, polarimetry and interferometry diagnostics used for measuring plasma density and also measurements of helium density in the divertor using Laser Induced Flourescence. Techniques which can allow improvements on current measurements are also addressed in particular expanding poloidal polarimetry measurements to measure field fluctuations and proposed use of dispersion interferometery which has a number of advantages over existing methods. This paper identifies particular areas where further research and testing on existing tokamaks is useful even at this advanced stage to inform the design of diagnostics for ITER. Outstanding areas of concern for the implementation of laser diagnostics, in particular with a view to reliable operation are identified. An overview of the latest developments of microwave diagnostic systems and techniques is given. The primary focus is the contributions for ITER—the next step burning plasma experiment—which is supplemented by describing recent progress of techniques applicable for fusion experiments beyond ITER. The contributions are intentionally kept concise, and are being supplemented by a rich list of references for further studies. Radiation induced effects are receiving continuous and well-deserved attention of the ITER diagnostic community and they are in many cases one of the primary design drivers of the ITER diagnostic systems. The paper summarizes recent progress in this area focusing primarily on the ITER diagnostics but in some cases provides also outlook for the possible solutions for even more demanding radiation environment of fusion reactors beyond ITER. Despite advancements in the area of modeling and simulation of various radiation induced effects, experimental testing in a nuclear environment as close as possible to the target one is still seen as unavoidable for proper qualification of particular diagnostic functional elements. Recent advancement within three diagnostic areas: optical diagnostics, magnetics and bolometers is covered. Encouraging results on qualification of silica glass vacuum window assemblies are presented. In the area of magnetic sensors, progress of irradiation tests performed on ITER in-vessel LTCC inductive sensors is presented with outlook for novel technological approaches to inductive sensors utilizing thick printing and photolithography technologies being highlighted. Summary of advancements in the area of steady state magnetic field sensors based on Hall effect is given. New results of neutron irradiation test of the ITER borosilicate glass inserts for vacuum electrical feedthroughs are summarized finding negligible swelling at target level of neutron fluence. Off-line irradiation tests of fiber optic current sensors for plasma current measurement demonstrated that both for gamma doses up to 5 MGy and a total neutron fluence up to 10 15 cm −2 , radiation induced changes are still compatible with required measurement accuracy on ITER. The ITER bolometers are given as an example how considering radiation effects may influence the diagnostic design. Finally, outlook for future main R&D directions is outlined. All optical and laser-based diagnostics in ITER will be using mirrors to guide plasma radiation toward detectors, cameras and sensors. In the hostile plasma, radiation and particle environment the optical characteristics of diagnostic mirrors will degrade directly affecting the entire performance of involved diagnostic systems. An assessment of factors affecting mirror performance is provided. Among the prime adverse factors are deposition of plasma impurities, sputtering of mirror surface and steam ingress in the vicinity of mirrors. Within the International Tokamak Physics Activity with active support by ITER central team and domestic agencies, the structured research and development (R&D) program on mitigation of risks for diagnostic mirrors is underway. Within this program the mirror material development, the passive mitigation of mirror degradation by using diagnostic ducts and shutters along with an active mirror recovery program comprising the in-situ mirror cleaning and calibration is underway. Recent developments in diagnostic mirror R&D are described in this Chapter along with an example of their implementation of R&D solutions in ITER Infrared Thermography diagnostic. An assessment of still open engineering and physics questions, considerations on mirror risks during an early phase of ITER operation are given along with an overview of diagnostic mirror evolution in the late ITER operation stage toward the demonstration fusion power plant. Several crucial areas of diagnostic R&D outlined in ITER Research Plan are addressed. The basic control groups in a fusion reactor can be broken-down in five categories: (1) plasma position, magnetic configuration, and plasma current control, (2) profile control and confinement optimization, (3) MHD control and suppression, (4) edge dissipation control, radiation and plasma exhaust control and (5) break-down optimization. These categories are coupled via the physics (a control action in one domain will affect the other domains) and via shared actuators (e.g. ECRH for impurity accumulation avoidance, current density distribution control and MHD suppression). Consequently, a supervisory control system should determine the priority of the various control tasks, their couplings, and the interfaces with the safety and interlock system. For the systematic development of the various controllers taking the complexity of the plasma and the control system into account, a model-based approach is required. A short historical overview is given of the developments in systems and control theory and control engineering with special emphasis on those developments that are most relevant for Nuclear Fusion research and operation. An overview is given of the state of the field of fusion plasma control for the control categories. It will be shown how synthetic diagnostics are being developed in ITER and how they are used in diagnostic design and design validation and how they can be in model-based controller synthesis using relatively simple models. In modern control methods, multiple diagnostics are used to constrain relatively simple models. The constrained models provide an estimate for the state. This opens the route to state controllers, such as model predictive control. A major challenge in nuclear fusion research is the coherent combination of data from heterogeneous diagnostics and modeling codes for machine control and safety as well as physics studies. Measured data from different diagnostics often provide information about the same subset of physical parameters. Additionally, information provided by some diagnostics might be needed for the analysis of other diagnostics. A joint analysis of complementary and redundant data allows, e.g. to improve the reliability of parameter estimation, to increase the spatial and temporal resolution of profiles, to obtain synergistic effects, to consider diagnostics interdependencies and to find and resolve data inconsistencies. Physics-based modeling and parameter relationships provide additional information improving the treatment of ill-posed inversion problems. A coherent combination of all kind of available information within a probabilistic framework allows for improved data analysis results. The concept of integrated data analysis (IDA) in the framework of Bayesian probability theory is outlined and contrasted with conventional data analysis. Components of the probabilistic approach are summarized and specific ingredients beneficial for data analysis at fusion devices are discussed.

ITER↗

Tactical Separation and Safety Alerting System for Terminal Airspace

Provision of tactical alerts to aid air traffic controllers in providing separation assurance in terminal airspace is hindered by the complexity of the airspace, its operations, and flight procedures. A prototype automation system is studied that provides controllers with both separation and safety alerts based on or derived from the separation standard for terminal airspace. The system models flight trajectories heuristically, with use of merged intent information from readily available sources: area navigation departure procedures, flight-plan routes, and arrival nominal interior routes used in terminal automation systems. Flight vertical intent is modeled according to standard procedural restrictions except when superseded by controller-issued altitude clearances. Importantly, flight trajectories are modeled for all aircraft, including those conducting visual approaches. New safety-alert thresholds for aircraft conducting visual approaches are studied. Performance of the system is evaluated through fast-time playback of recorded air traffic data from high-fidelity Human-In-The-Loop simulations and real-world operations in two Terminal Radar Approach Control facilities. The prototype system is found to produce a false-alert rate of 8% for separation alerts. The number and validity of safety alerts are studied by comparing with the current Conflict Alert system, showing that the false alerts of Conflict Alert are at 85% and they are avoided in the prototype system.

Air Traffic Management↗

NASA's Software Safety Standard

NASA (National Aeronautics and Space Administration) relies more and more on software to control, monitor, and verify its safety critical systems, facilities and operations. Since the 1960's there has hardly been a spacecraft (manned or unmanned) launched that did not have a computer on board that provided vital command and control services. Despite this growing dependence on software control and monitoring, there has been no consistent application of software safety practices and methodology to NASA's projects with safety critical software. Led by the NASA Headquarters Office of Safety and Mission Assurance, the NASA Software Safety Standard (STD-18l9.13B) has recently undergone a significant update in an attempt to provide that consistency. This paper will discuss the key features of the new NASA Software Safety Standard. It will start with a brief history of the use and development of software in safety critical applications at NASA. It will then give a brief overview of the NASA Software Working Group and the approach it took to revise the software engineering process across the Agency.

Ramsay, Christopher M.↗

Automation of closed environments in space for human comfort and safety

The development of Environmental Control and Life Support Systems (ECLSS) for Space Station Freedom, future colonization of the Moon, and Mars missions presents new challenges for present technologies. ECLSS that operate during long-duration missions must be semi-autonomous to allow crew members environmental control without constant supervision. A control system for the ECLSS must address these issues as well as being reliable. The Kansas State University Advanced Design Team is in the process of researching and designing controls for the automation of the ECLSS for Space Station Freedom and beyond. The ECLSS for Freedom is composed of six subsystems. The temperature and humidity control (THC) subsystem maintains the cabin temperature and humidity at a comfortable level. The atmosphere control and supply (ACS) subsystem insures proper cabin pressure and partial pressures of oxygen and nitrogen. To protect the space station from fire damage, the fire detection and suppression (FDS) subsystem provides fire-sensing alarms and extinguishers. The waste management (WM) subsystem compacts solid wastes for return to Earth, and collects urine for water recovery. The atmosphere revitalization (AR) subsystem removes CO2 and other dangerous contaminants from the air. The water recovery and management (WRM) subsystem collects and filters condensate from the cabin to replenish potable water supplies, and processes urine and other waste waters to replenish hygiene water supplies. These subsystems are not fully automated at this time. Furthermore, the control of these subsystems is not presently integrated; they are largely independent of one another. A fully integrated and automated ECLSS would increase astronauts' productivity and contribute to their safety and comfort.

Source record↗

An Independent Evaluation of the FMEA/CIL Hazard Analysis Alternative Study

The present instruments of safety and reliability risk control for a majority of the National Aeronautics and Space Administration (NASA) programs/projects consist of Failure Mode and Effects Analysis (FMEA), Hazard Analysis (HA), Critical Items List (CIL), and Hazard Report (HR). This extensive analytical approach was introduced in the early 1970's and was implemented for the Space Shuttle Program by NHB 5300.4 (1D-2. Since the Challenger accident in 1986, the process has been expanded considerably and resulted in introduction of similar and/or duplicated activities in the safety/reliability risk analysis. A study initiated in 1995, to search for an alternative to the current FMEA/CIL Hazard Analysis methodology generated a proposed method on April 30, 1996. The objective of this Summer Faculty Study was to participate in and conduct an independent evaluation of the proposed alternative to simplify the present safety and reliability risk control procedure.

Ray, Paul S.↗

MARVEL Instrumentation, Control, and Software Considerations

This paper details the various I&C considerations and design decisions made throughout the MARVEL (Micro-reactor Applications Research Validation and Evaluation) project, including sensor and actuator selection, safety-related functionality, digital control hardware and software, and testing methodologies. Key challenges such as managing radiation, temperature, and space constraints are discussed, along with the trade-offs between using standard equipment and custom solutions. The successful integration of off-the-shelf components, the emphasis on minimizing safety-related instrumentation, and the lessons learned from prototyping and testing are highlighted. The authors aim to provide insights that can benefit future micro-reactor designs and emphasize the importance of real-world testing in advancing reactor technology.

46 - INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AN↗

Physical and thermal property changes under uniform oxidation in nuclear graphite

Material property changes of fine- and medium-grain nuclear graphite grades were measured after subjection to uniform oxidation. The cores of high temperature reactors are composed of large nuclear graphite block components. Here, these large core components are designed to provide neutron moderation and reflection, create a large thermal sink to assist in operational control, and form the solid core structure containing the nuclear fuel, coolant channels, and the safety critical channels for control rod insertion. Oxidation is a principle degradation mechanism affecting all aspects of the nuclear graphite component functions. This study addresses the underlying physical property changes of nuclear-graphite components for oxidized mass loss ranges beyond the current recommended ASME code rule limits to ensure structural integrity within the graphite components (a maximum mass loss = 10%).

11 - NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗

Facility safety study

The safety of NASA's in house microelectronics facility is addressed. Industrial health standards, facility emission control requirements, operation and safety checklists, and the disposal of epitaxial vent gas are considered.

Source record↗

NASA System Safety Handbook: System Safety Framework and Concepts for Implementation - Volume 1

System safety assessment is defined in NPR 8715.3C, NASA General Safety Program Requirements as a disciplined, systematic approach to the analysis of risks resulting from hazards that can affect humans, the environment, and mission assets. Achievement of the highest practicable degree of system safety is one of NASA's highest priorities. Traditionally, system safety assessment at NASA and elsewhere has focused on the application of a set of safety analysis tools to identify safety risks and formulate effective controls.1 Familiar tools used for this purpose include various forms of hazard analyses, failure modes and effects analyses, and probabilistic safety assessment (commonly also referred to as probabilistic risk assessment (PRA)). In the past, it has been assumed that to show that a system is safe, it is sufficient to provide assurance that the process for identifying the hazards has been as comprehensive as possible and that each identified hazard has one or more associated controls. The NASA Aerospace Safety Advisory Panel (ASAP) has made several statements in its annual reports supporting a more holistic approach. In 2006, it recommended that "... a comprehensive risk assessment, communication and acceptance process be implemented to ensure that overall launch risk is considered in an integrated and consistent manner." In 2009, it advocated for "... a process for using a risk-informed design approach to produce a design that is optimally and sufficiently safe." As a rationale for the latter advocacy, it stated that "... the ASAP applauds switching to a performance-based approach because it emphasizes early risk identification to guide designs, thus enabling creative design approaches that might be more efficient, safer, or both." For purposes of this preface, it is worth mentioning three areas where the handbook emphasizes a more holistic type of thinking. First, the handbook takes the position that it is important to not just focus on risk on an individual basis but to consider measures of aggregate safety risk and to ensure wherever possible that there be quantitative measures for evaluating how effective the controls are in reducing these aggregate risks. The term aggregate risk, when used in this handbook, refers to the accumulation of risks from individual scenarios that lead to a shortfall in safety performance at a high level: e.g., an excessively high probability of loss of crew, loss of mission, planetary contamination, etc. Without aggregated quantitative measures such as these, it is not reasonable to expect that safety has been optimized with respect to other technical and programmatic objectives. At the same time, it is fully recognized that not all sources of risk are amenable to precise quantitative analysis and that the use of qualitative approaches and bounding estimates may be appropriate for those risk sources. Second, the handbook stresses the necessity of developing confidence that the controls derived for the purpose of achieving system safety not only handle risks that have been identified and properly characterized but also provide a general, more holistic means for protecting against unidentified or uncharacterized risks. For example, while it is not possible to be assured that all credible causes of risk have been identified, there are defenses that can provide protection against broad categories of risks and thereby increase the chances that individual causes are contained. Third, the handbook strives at all times to treat uncertainties as an integral aspect of risk and as a part of making decisions. The term "uncertainty" here does not refer to an actuarial type of data analysis, but rather to a characterization of our state of knowledge regarding results from logical and physical models that approximate reality. Uncertainty analysis finds how the output parameters of the models are related to plausible variations in the input parameters and in the modeling assumptions. The evaluation of unrtainties represents a method of probabilistic thinking wherein the analyst and decision makers recognize possible outcomes other than the outcome perceived to be "most likely." Without this type of analysis, it is not possible to determine the worth of an analysis product as a basis for making decisions related to safety and mission success. In line with these considerations the handbook does not take a hazard-analysis-centric approach to system safety. Hazard analysis remains a useful tool to facilitate brainstorming but does not substitute for a more holistic approach geared to a comprehensive identification and understanding of individual risk issues and their contributions to aggregate safety risks. The handbook strives to emphasize the importance of identifying the most critical scenarios that contribute to the risk of not meeting the agreed-upon safety objectives and requirements using all appropriate tools (including but not limited to hazard analysis). Thereafter, emphasis shifts to identifying the risk drivers that cause these scenarios to be critical and ensuring that there are controls directed toward preventing or mitigating the risk drivers. To address these and other areas, the handbook advocates a proactive, analytic-deliberative, risk-informed approach to system safety, enabling the integration of system safety activities with systems engineering and risk management processes. It emphasizes how one can systematically provide the necessary evidence to substantiate the claim that a system is safe to within an acceptable risk tolerance, and that safety has been achieved in a cost-effective manner. The methodology discussed in this handbook is part of a systems engineering process and is intended to be integral to the system safety practices being conducted by the NASA safety and mission assurance and systems engineering organizations. The handbook posits that to conclude that a system is adequately safe, it is necessary to consider a set of safety claims that derive from the safety objectives of the organization. The safety claims are developed from a hierarchy of safety objectives and are therefore hierarchical themselves. Assurance that all the claims are true within acceptable risk tolerance limits implies that all of the safety objectives have been satisfied, and therefore that the system is safe. The acceptable risk tolerance limits are provided by the authority who must make the decision whether or not to proceed to the next step in the life cycle. These tolerances are therefore referred to as the decision maker's risk tolerances. In general, the safety claims address two fundamental facets of safety: 1) whether required safety thresholds or goals have been achieved, and 2) whether the safety risk is as low as possible within reasonable impacts on cost, schedule, and performance. The latter facet includes consideration of controls that are collective in nature (i.e., apply generically to broad categories of risks) and thereby provide protection against unidentified or uncharacterized risks.

Dezfuli, Homayoon↗

Automatic control of cryogenic wind tunnels

Inadequate Reynolds number similarity in testing of scaled models affects the quality of aerodynamic data from wind tunnels. This is due to scale effects of boundary-layer shock wave interaction which is likely to be severe at transonic speeds. The idea of operation of wind tunnels using test gas cooled to cryogenic temperatures has yielded a quantrum jump in the ability to realize full scale Reynolds number flow similarity in small transonic tunnels. In such tunnels, the basic flow control problem consists of obtaining and maintaining the desired test section flow parameters. Mach number, Reynolds number, and dynamic pressure are the three flow parameters that are usually required to be kept constant during the period of model aerodynamic data acquisition. The series of activity involved in modeling, control law development, mechanization of the control laws on a microcomputer, and the performance of a globally stable automatic control system for the 0.3-m Transonic Cryogenic Tunnel (TCT) are discussed. A lumped multi-variable nonlinear dynamic model of the cryogenic tunnel, generation of a set of linear control laws for small perturbation, and nonlinear control strategy for large set point changes including tunnel trajectory control are described. The details of mechanization of the control laws on a 16 bit microcomputer system, the software features, operator interface, the display and safety are discussed. The controller is shown to provide globally stable and reliable temperature control to + or - 0.2 K, pressure to + or - 0.07 psi and Mach number to + or - 0.002 of the set point value. This performance is obtained both during large set point commands as for a tunnel cooldown, and during aerodynamic data acquisition with intrusive activity like geometrical changes in the test section such as angle of attack changes, drag rake movements, wall adaptation and sidewall boundary-layer removal. Feasibility of the use of an automatic Reynolds number control mode with fixed Mach number control is demonstrated.

Balakrishna, S.↗