SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
This paper provides a Safety Checklist for use during the analysis of software requirements for spacecraft and other safety-critical, embedded systems.
This slide presentation reviews the development of technical requirements for Unmanned Aircraft Systems (UAS) utilization of the Iridium Satellite Constellation to provide flight safety. The Federal Aviation Authority (FAA) required an over-the-horizon communication standard to guarantee flight safety before permitting widespread UAS flights in the National Air Space (NAS). This is important to ensure reliable control of UASs during loss-link and over-the-horizon scenarios. The core requirement was to utilize a satellite system to send GPS tracking data and other telemetry from a flight vehicle down to the ground. Iridium was chosen as the system because it is one of the only true satellite systems that has world wide coverage, and the service has a highly reliable link margin. The Iridium system, the flight modems, and the test flight are described.
An overview is presented of the specific system safety activities required to support the ground support technology program associated with the design of an aerospace plane. Safe zones must be assessed to ensure that explosive safety requirements are attained to protect the vehicle, personnel, and support and operational facilities. Attention is given to the specific and unique design requirements connected with the utilization of cryogenic fuels as they apply to the design and development of an aerospace plane.
This report describes the interim progress for research supporting the design and optimization of information automation systems for nuclear power plants. Much of the domestic nuclear fleet is currently focused on modernizing technologies and processes, including transitioning toward digitalization in the control room and elsewhere throughout the plant, along with a greater use of automation, artificial intelligence, robotics, and other emerging technologies. While there are significant opportunities to apply these technologies toward greater plant safety, efficiency, and overall cost-effectiveness, optimizing their design and avoiding potential safety and performance risks depends on ensuring that human-performance-related organizational and technical design issues are identified and addressed. This report describes modeling tools and techniques, based on sociotechnical system theory, to support these design goals and their application in the current research effort. The report is intended for senior nuclear energy stakeholders, including regulators, corporate management, and senior plant management. We have developed and employed a method to design an optimized information automation ecosystem (IAE) based on the systems-theoretic constructs underlying sociotechnical systems theory in general and the Systems-Theoretic Accident Modeling and Processes (STAMP) approach in particular. We argue that an IAE can be modeled as an interactive information control system whose behavior can be understood in terms of dynamic control and feedback relationships amongst the system’s technical and organizational components. Up to this point, we have employed a Causal Analysis based on STAMP (CAST) technique to examine a performance- and safety-related incident at an industry partner’s plant that involved the unintentional activation of an emergency diesel generator. This analysis provided insight into the behavior of the plant’s current information control structure within the context of a specific, significant event. Our ongoing analysis is focused on identifying near-term process improvements and longer-term design requirements for an optimized IAE system. The latter analyses will employ a second STAMP-derived technique, System-Theoretic Process Analysis (STPA). STPA is a useful modeling tool for generating and analyzing actual or potential information control structures. Finally, we have begun modeling plantwide organizational relationships and processes. Organizational system modeling will supplement our CAST and STPA findings and provide a basis for mapping out a plantwide information control architecture. CAST analysis findings indicate an important underlying contributor to the incident under investigation, and a significant risk to information automation system performance, was perceived schedule pressure, which exposed weaknesses in interdepartmental coordination between and within responsible plant organizations and challenged the resilience of established plant processes, until a human caused the initiating event. These findings are discussed in terms of their risk to overall system performance and their implications for information automation system resilience and brittleness. We present two preliminary information automation models. The proactive issue resolution model is a test case of an information automation concept with significant near-term potential for application and subsequent reduction in significant plant events. The IAE model is a more general representation of a broader, plantwide information automation system. From our results, we have generated a set of preliminary system-level requirements and safety constraints. These requirements will be further developed over the remainder of our project in collaboration with nuclear industry subject matter experts and specialists in the technical systems under consideration. Additionally, we will continue to pursue the system analyses initiated in the first part of our effort, with a particular emphasis on STPA as the main tool to identify weak or weakening control structures that affect the resilience of organizations and programs. Our intent is to broaden the scope of the analysis from an individual use case to a related set of use cases (e.g., maintenance tasks, compliance tasks) with similar human-system performance challenges. This will enable more generalized findings to refine the Proactive Issue Resolution and IAE models, as well as their system-level requirements and safety constraints. We will use organizational system modeling analyses to supplement STPA findings and model development. We conclude the report with a set of summary recommendations and an initial draft list of system-level requirements and safety constraints for optimized information automation systems.
This document establishes the structural requirements for human-rated spaceflight hardware including launch vehicles, spacecraft and payloads. These requirements are applicable to Government Furnished Equipment activities as well as all related contractor, subcontractor and commercial efforts. These requirements are not imposed on systems other than human-rated spacecraft, such as ground test articles, but may be tailored for use in specific cases where it is prudent to do so such as for personnel safety or when assets are at risk. The requirements in this document are focused on design rather than verification. Implementation of the requirements is expected to be described in a Structural Verification Plan (SVP), which should describe the verification of each structural item for the applicable requirements. The SVP may also document unique verifications that meet or exceed these requirements with NASA Technical Authority approval.
System safety assessment is defined in NPR 8715.3C, NASA General Safety Program Requirements as a disciplined, systematic approach to the analysis of risks resulting from hazards that can affect humans, the environment, and mission assets. Achievement of the highest practicable degree of system safety is one of NASA's highest priorities. Traditionally, system safety assessment at NASA and elsewhere has focused on the application of a set of safety analysis tools to identify safety risks and formulate effective controls.1 Familiar tools used for this purpose include various forms of hazard analyses, failure modes and effects analyses, and probabilistic safety assessment (commonly also referred to as probabilistic risk assessment (PRA)). In the past, it has been assumed that to show that a system is safe, it is sufficient to provide assurance that the process for identifying the hazards has been as comprehensive as possible and that each identified hazard has one or more associated controls. The NASA Aerospace Safety Advisory Panel (ASAP) has made several statements in its annual reports supporting a more holistic approach. In 2006, it recommended that "... a comprehensive risk assessment, communication and acceptance process be implemented to ensure that overall launch risk is considered in an integrated and consistent manner." In 2009, it advocated for "... a process for using a risk-informed design approach to produce a design that is optimally and sufficiently safe." As a rationale for the latter advocacy, it stated that "... the ASAP applauds switching to a performance-based approach because it emphasizes early risk identification to guide designs, thus enabling creative design approaches that might be more efficient, safer, or both." For purposes of this preface, it is worth mentioning three areas where the handbook emphasizes a more holistic type of thinking. First, the handbook takes the position that it is important to not just focus on risk on an individual basis but to consider measures of aggregate safety risk and to ensure wherever possible that there be quantitative measures for evaluating how effective the controls are in reducing these aggregate risks. The term aggregate risk, when used in this handbook, refers to the accumulation of risks from individual scenarios that lead to a shortfall in safety performance at a high level: e.g., an excessively high probability of loss of crew, loss of mission, planetary contamination, etc. Without aggregated quantitative measures such as these, it is not reasonable to expect that safety has been optimized with respect to other technical and programmatic objectives. At the same time, it is fully recognized that not all sources of risk are amenable to precise quantitative analysis and that the use of qualitative approaches and bounding estimates may be appropriate for those risk sources. Second, the handbook stresses the necessity of developing confidence that the controls derived for the purpose of achieving system safety not only handle risks that have been identified and properly characterized but also provide a general, more holistic means for protecting against unidentified or uncharacterized risks. For example, while it is not possible to be assured that all credible causes of risk have been identified, there are defenses that can provide protection against broad categories of risks and thereby increase the chances that individual causes are contained. Third, the handbook strives at all times to treat uncertainties as an integral aspect of risk and as a part of making decisions. The term "uncertainty" here does not refer to an actuarial type of data analysis, but rather to a characterization of our state of knowledge regarding results from logical and physical models that approximate reality. Uncertainty analysis finds how the output parameters of the models are related to plausible variations in the input parameters and in the modeling assumptions. The evaluation of unrtainties represents a method of probabilistic thinking wherein the analyst and decision makers recognize possible outcomes other than the outcome perceived to be "most likely." Without this type of analysis, it is not possible to determine the worth of an analysis product as a basis for making decisions related to safety and mission success. In line with these considerations the handbook does not take a hazard-analysis-centric approach to system safety. Hazard analysis remains a useful tool to facilitate brainstorming but does not substitute for a more holistic approach geared to a comprehensive identification and understanding of individual risk issues and their contributions to aggregate safety risks. The handbook strives to emphasize the importance of identifying the most critical scenarios that contribute to the risk of not meeting the agreed-upon safety objectives and requirements using all appropriate tools (including but not limited to hazard analysis). Thereafter, emphasis shifts to identifying the risk drivers that cause these scenarios to be critical and ensuring that there are controls directed toward preventing or mitigating the risk drivers. To address these and other areas, the handbook advocates a proactive, analytic-deliberative, risk-informed approach to system safety, enabling the integration of system safety activities with systems engineering and risk management processes. It emphasizes how one can systematically provide the necessary evidence to substantiate the claim that a system is safe to within an acceptable risk tolerance, and that safety has been achieved in a cost-effective manner. The methodology discussed in this handbook is part of a systems engineering process and is intended to be integral to the system safety practices being conducted by the NASA safety and mission assurance and systems engineering organizations. The handbook posits that to conclude that a system is adequately safe, it is necessary to consider a set of safety claims that derive from the safety objectives of the organization. The safety claims are developed from a hierarchy of safety objectives and are therefore hierarchical themselves. Assurance that all the claims are true within acceptable risk tolerance limits implies that all of the safety objectives have been satisfied, and therefore that the system is safe. The acceptable risk tolerance limits are provided by the authority who must make the decision whether or not to proceed to the next step in the life cycle. These tolerances are therefore referred to as the decision maker's risk tolerances. In general, the safety claims address two fundamental facets of safety: 1) whether required safety thresholds or goals have been achieved, and 2) whether the safety risk is as low as possible within reasonable impacts on cost, schedule, and performance. The latter facet includes consideration of controls that are collective in nature (i.e., apply generically to broad categories of risks) and thereby provide protection against unidentified or uncharacterized risks.
The renewed emphasis within NASA on the incorporation of firmly established safety design requirements and evolving new safety analysis techniques, including quantitative safety risk assessment methods, is discussed with particular reference to the Space Station Freedom Safety Program. The program provides for integration of the partial safety analysis performed by numerous NASA Centers and International Partners into a Programmatic Safety Assessment for each of the launch increments and the complete Space Station Freedom on orbit. Communication in the safety program will utilize state-of-the-art software and computers, which will provide broad accessibility to safety information among the NASA and International Partners.
In a half century of human spaceflight, NASA has continuously refined agency safety and reliability requirements in response to mission demands, critical failures, and technology development. Early spacecraft, including Mercury, Gemini and Apollo vehicles, were highly reliant on dissimilar redundancy and demonstrated test margins. Later programs, such as the reusable Space Transportation System (STS) and International Space Station (ISS), introduced probabilistic studies and isolated two-failure tolerance to improve robustness at the expense of added complexity. More recently, the Orion Multi-Program Crew Vehicle (MPCV) program adopted universal single-failure tolerance with two categorical exceptions; Zero-Failure Tolerant (0FT) and Design for Minimum Risk (DFMR) hardware. Failure tolerance variances are defined and managed in accordance with agency human-rating requirements, and require concurrence from program Technical Authorities (TA) as well as the MPCV Safety and Mission Assurance Safety and Engineering Review Panel (MSERP). To understand and reaffirm standards applied to Apollo, Space Shuttle and Orion vehicles, Orion and Deep Space Gateway Safety and Mission Assurance (S&MA) representatives conducted accelerated research to compare unique safety and reliability criteria against ground and flight anomalies, based on information contained in post-mission reports and the Problem Reporting and Corrective Action (PRACA) database. In some cases, high-profile failures and narrow escapes have reinforced decisions to maintain or adapt safety requirements. In others, empirical trends have highlighted the need for vigilance and innovative safety guidelines. Given the inability to achieve absolute compliance with evolving safety and reliability requirements, the team conducted a targeted review of DFMR and 0FT propulsion elements within the framework of changing system design, inspection, materials and process developments to formulate conclusions on technological maturity, failure density, and net changes in safety risk. Based on the aggregate performance of high-reliability and failure-tolerant systems, the authors have attempted to establish best practices and guidelines to inform future program decisions. On a somewhat cautionary note, this study is not intended to direct a universal set of requirements for future missions based on prior lessons learned. Spacecraft safety is a multi-variable problem, and attempts to mitigate past failures will not guarantee future success. However, this assessment offers a retrospective review of policy changes, implementation and effectiveness. In the future, NASA, European Space Agency (ESA) and industry partners may benefit from a more robust correlation between requirements and performance, as space-faring nations work toward more challenging, complex and long-duration commercial and deep-space ventures.
Software requirements, design, implementation, verification and validation, and especially management are affected by the need to produce safe software. This paper discusses the changes in the software life cycle that are necessary to ensure that software will execute without resulting in unacceptable risk. Software is being used increasingly to monitor and control safety-critical processes in which a run-time failure or error could result in unacceptable losses such as death, injury, loss of property, or environmental harm. Examples of such processes maybe found in transportation, energy, aerospace, basic industry, medicine, and defense systems.
User requirements for lithium sulfur batteries are presented. They include careful analysis of design and quality control, along with certain equipment specifications. Some of the specifications include: hermetically sealed cells; lithium limited cells with stoichiometry of lithium to sulfur dioxide as a ratio of one; low moisture content in the cells; and battery capacity.
This paper analyzes the root causes of safety-related software errors in safety-critical, embedded systems. The results show that software errors identified as potentially hazardous to the system tend to be produced by different error mechanisms than non- safety-related software errors. Safety-related software errors are shown to arise most commonly from (1) discrepancies between the documented requirements specifications and the requirements needed for correct functioning of the system and (2) misunderstandings of the software's interface with the rest of the system. The paper uses these results to identify methods by which requirements errors can be prevented. The goal is to reduce safety-related software errors and to enhance the safety of complex, embedded systems.
U.S. DOE contractor CH2M Hill Plateau Remediation Company (CHPRC) has safely and efficiently managed the removal of highly radioactive sludge from the 105-K West Reactor fuel storage basin (105- KW Basin) near the Columbia River. In mid-September 2019, sludge retrieval was completed after 21 storage containers were safely loaded with highly radioactive sludge and transported approximately 13 miles from the 105-KW Basin to T Plant, located in the 200 West Area on the Central Plateau of the Hanford Site. Sludge removal represents the last major source term reduction necessary before the K West Reactor and fuel storage basin can transition to closure activities in preparation for final deactivation and demolition. The technical complexity of the sludge retrieval process, coupled with the challenging physical and radiological characteristics of the waste, necessitated a methodical and deliberate approach using unique design and operational solutions to safely conduct the work. This challenge was further complicated by the need to plan and conduct the work in two separate facilities, each subject to the controls and requirements of its own nuclear facility safety basis. The project overcame these challenges through creating an integrated team that actively engaged, communicated and coordinated each phase of the project to ensure successful completion. This paper will cover how these key elements of the Sludge Removal Project led to its success: - Integrating project planning and management; - Lessons learned from design and construction; - Preparing for a successful campaign (lessons learned from testing and start-up); - Lessons learned from operating in two separate facilities, transporting sludge containers on the Hanford Site and ensuring compliance with a range of regulatory and safety basis requirements. The establishment of an integrated group spanning two facilities and multiple organizations created a team capable of overcoming the challenges necessary to successfully plan and execute the sludge retrieval mission. Sharing lessons learned from this successful project can enhance the ability of teams across the DOE complex to successfully plan and execute complex projects. (authors)
The International Space Station (ISS) represents the culmination of over two decades of unprecedented global human endeavors to conceive, design, build and operate a research laboratory in space. Uninterrupted human presence in space since the inception of the ISS has been made possible by an international fleet of space vehicles facilitating crew rotation, delivery of science experiments and replenishment of propellants and supplies. On-orbit propulsion systems on both ISS and Visiting Vehicles are essential to the continuous operation of the ISS. This paper compares the ISS visiting vehicle propulsion systems by providing an overview of key design drivers, operational considerations and performance characteristics. Despite their differences in design, functionality, and purpose, all visiting vehicles must adhere to a common set of interface requirements along with safety and operational requirements. This paper addresses a wide variety of methods for satisfying these requirements and mitigating credible hazards anticipated during the on-orbit life of propulsion systems, as well as the seamless integration necessary for the continued operation of the ISS.
The International Space Station Program at NASA is constantly seeking to improve the processes and systems that support safe space operations. To that end, the ISS Program decided to upgrade their Safety and Hazard data systems with 3 goals: make safety and hazard data more accessible; better support the interconnection of different types of safety data; and increase the efficiency (and compliance) of safety-related processes. These goals are accomplished by moving data into a web-based structured data system that includes strong process support and supports integration with other information systems. Along with the data systems, ISS is evolving its submission requirements and safety process requirements to support the improved model. In contrast to existing operations (where paper processes and electronic file repositories are used for safety data management) the web-based solution provides the program with dramatically faster access to records, the ability to search for and reference specific data within records, reduced workload for hazard updates and approval, and process support including digital signatures and controlled record workflow. In addition, integration with other key data systems provides assistance with assessments of flight readiness, more efficient review and approval of operational controls and better tracking of international safety certifications. This approach will also provide new opportunities to streamline the sharing of data with ISS international partners while maintaining compliance with applicable laws and respecting restrictions on proprietary data. One goal of this paper is to outline the approach taken by the ISS Progrm to determine requirements for the new system and to devise a practical and efficient implementation strategy. From conception through implementation, ISS and NASA partners utilized a user-centered software development approach focused on user research and iterative design methods. The user-centered approach used on the new ISS hazard system utilized focused user research and iterative design methods employed by the Human Computer Interaction Group at NASA Ames Research Center. Particularly, the approach emphasized the reduction of workload associated with document and data management activities so more resources can be allocated to the operational use of data in problem solving, safety analysis, and recurrence control. The methods and techniques used to understand existing processes and systems, to recognize opportunities for improvement, and to design and review improvements are described with the intent that similar techniques can be employed elsewhere in safety operations. A second goal of this paper is to provide and overview of the web-based data system implemented by ISS. The software selected for the ISS hazard systemMission Assurance System (MAS)is a NASA-customized vairant of the open source software project Bugzilla. The origin and history of MAS as a NASA software project and the rationale for (and advantages of) using open-source software are documented elsewhere (Green, et al., 2009).
The DOT classification for transportation, the military classification for quantity distance, and hazard compatibility grouping used to regulate the transportation and storage of explosives are presented along with a discussion of tests used in determining sensitivity of propellants to an impact/shock environment in the absence of a large explosive donor. The safety procedures and requirements of a Scout launch vehicle, Western and Eastern Test Range, and the Minuteman, Delta, and Poseidon programs are reviewed and summarized. Requirements of the space transportation system safety program include safety reviews from the subsystem level to the completed payload. The Scout safety procedures will satisfy a portion of these requirements but additional procedures need to be implemented to comply with the safety requirements for Shuttle operation from the Eastern Test Range.
Small modular reactors (SMR) offer a novel approach to the construction and operation of nuclear power plants. The NuScale VOYGR™ plant uses a simplified SMR design that is based on proven light-water reactor technology with substantial improvements in nuclear safety. It consists of a 250 MWt reactor core housed with other primary system components in an integral reactor pressure vessel surrounded by a steel containment vessel, all of which is immersed in a large pool of water that also serves as the ultimate heat sink. At the core of the NuScale safety case are three primary safety systems: the decay heat removal system, the emergency core cooling system, and the containment. The ability of the NuScale Power Module (NPM) passive safety systems to remove core decay heat for an unlimited duration is demonstrated through analysis of a beyond-design-basis extended loss of AC power with no replenishment of water to the ultimate heat sink or operator actions. The NuScale methodology to evaluate an indefinite loss of AC power uses the proprietary NRELAP5 systems analysis computer code. Analysis results show that the reactor coolant system liquid level above the core is maintained and that containment pressure remains below the vessel design pressure. Once full passive air cooling is established, containment pressure and temperature will decrease over time with decreasing core decay heat. NuScale received standard design approval in September 2020 and design certification in January 2023 for its 50 MWe NPM configured as a 12 module plant. NuScale is currently seeking standard design approval to increase its core power to 250 MWt, nominally 77 MWe per module, in a 6-module plant (VOYGR™-6) configuration. The high-level safety of NuScale’s SMR technology is foundational to a new standard of nuclear power plant resilience.
Space Nuclear Systems (SNS) technology development offers a wide range of capabilities to support NASA’s current and future missions. Executive Order (EO) 13972, “Promoting Small Modular Reactors for National Defense and Space Exploration” [1], issued 5 January 2021, directs NASA to define requirements for NASA utilization of nuclear energy systems for human and robotic exploration missions through 2040 and analyze the costs and benefits of such requirements.” Although it is premature to define requirements and cost for future exploration missions that have not yet been formulated, this report describes planned objectives and missions by 2040 that are enabled or enhanced by nuclear systems while taking into account a number of unique considerations for nuclear energy in the space environment. Nuclear energy systems are enabling for space missions and critical capabilities where conventional forms of energy production are impractical or impossible due to mass constraints, mission duration, or distance from the Sun. Space nuclear technologies available or in development for use by 2040 utilize radioisotope decay or nuclear fission and fall into three categories: heat, power, and propulsion. Current applications utilize radioisotope power systems that provide consistent and reliable performance in the sub-kilowatt power range. More advanced SNS can enable new mission objectives where high energy density solutions are critical, or where access to solar solutions is prohibitive. Higher power radioisotope and fission systems are under development within NASA for a wide variety of human exploration and science mission applications. Planned missions designed to use radioisotope systems include Dragonfly, a rotorcraft that will explore the surface of Titan, and Persephone, a mission concept for a Pluto orbiter. Nuclear fission systems have the key advantage of providing significantly higher power, lower mass solutions from tens to even thousands of kilowatts. Fission power is enabling to a sustained human presence on the Moon and developing a robust lunar economy. Fission propulsion is enabling for missions within and beyond cis-lunar space. This report examines NASA-envisioned mission applications and associated performance needs for SNS over the next twenty years leading to 2040 along with the unique technical considerations posed by space nuclear technology development. This includes engineering and operational logistics for ground handling, thermal management, survival of the space environment, operational safety, power requirements, and service longevity. Safety to the public, the NASA work force, and agency assets remains a top priority for NASA and particular attention is given to this aspect in the design, hardware assembly, ground operation, launch, and mission operation of an SNS. NASA relies on the Department of Energy as nuclear authority and its legacy of rigorous safety procedures as standards for ground development, test, transportation, and launch site operation. The principal concern is preventing unintended radiological release to the public or environment. Radioisotope system experience has established processes, including ground operation, transportation, and launch, that are considered directly applicable to emerging fission systems; however, fission systems have unique design needs that impact the safety and performance requirements. High efficiency power conversion from both fission and radioisotope systems requires high operating temperatures necessitating both passive and active thermal management to maintain safe and nominal operating conditions. Effective cooling and waste heat rejection have special considerations for space applications, whether in zero-g or reduced gravity. Fluid and heat transfer within the reactor system is not anticipated to be impacted by reduced or zero-g environments. Cryogenic working fluids and propellant supplies utilized in some space nuclear applications will need low mass, high capacity cryocoolers to meet the long-term storage and near zero-boiloff needs. Integrated, high power density SNS capable of being packaged in a single vehicle is a key consideration for NASA. Due to concerns for complexity and reliability, in space reactor assembly and reactor refueling are not current design considerations. Expanding into a new era for space exploration depends on mass-efficient, high-energy solutions to power deep-space vehicles, operate in harsh environments, and increase mission flexibility. NASA nuclear technology investments are targeting power for surface operations and propulsion for fast-transit, deep-space missions, all with the ability to reliably operate without the need for repair or refueling. NASA’s goals, enabled by nuclear technologies, provide for exciting advances in scientific objectives and human exploration, ushering in a new space age that enables a human presence on bodies beyond our Earth.
Sounding rocket programs are becoming larger and more complex, thus range safety personnel are required to be central to vehicle and mission design and operations planning. In response to this, the Wallops Flight Facility (VA), is upgrading range facilities, tracking systems, mobile systems and real-time safety systems. These enhancements will improve safety and reliability while augmenting mission success. Flight safety requirements and responsibilities are summarized, and the range safety's future upgrades for wind weighting, real-time analysis and displays, and the mobile safety systems for rocket programs, are considered.