SEARCH · Search NASA

Results for “Safety Design Approach”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 775 records · Page 43

All sources NASA NTRS DOE OSTI

NASA NTRS2019

Orion Heat Shield Manufacturing Producibility Improvements for the EM-1 Flight Test Program

This paper describes how the Orion program is incorporating improvements in the heat shield design and manufacturing processes reducing programmatic risk and ensuring crew safety in support of NASA’s Exploration Missions. The Orion program successfully completed the EFT-1 flight test in 2014 and is currently developing the EM-1 spacecraft to meet the test objectives of an orbital mission to the moon and return to earth in 2019. Lessons learned from the EFT-1 manufacturing and flight test experience are being incorporated into a wide variety of vehicle systems and manufacturing processes to reduce risk to the Orion missions and flight crew. A critical contributor to crew safety is the heat shield that protects the crew capsule during re-entry through the earth’s atmosphere for return from deep space. The first flight test vehicle, EFT-1, was manufactured and tested in the Neil Armstrong Operations and Checkout (O&C) facility at KSC to demonstrate early risk reduction including the functionality of the Thermal Protection Systems (TPS) for capsule safe return to earth. The approach for the EFT-1 heat shield utilized a low risk approach using Apollo heritage design and manufacturing processes using an Avcoat TPS ablator with a honeycomb substrate to provide a one piece heat shield to meet the mission re-entry heating environments. The manufacturing processes used honeycomb cell injection guns which were redeveloped from the Apollo Lunar Program processes to build the EFT-1 heat shield. The completed heat shield was transported across the country by aircraft to the O&C at KSC for installation onto the capsule. The EFT-1 heat shield successfully performed its mission and experienced ~80% of the re-entry velocity (50% heating rate) for a lunar return for an Exploration Mission. The second flight test vehicle is the EM-1 mission which will have additional flight systems installed to fly to the moon and return. Heat shield design and producibility improvements have been incorporated in the EM-1 vehicle to meet deep space mission and programmatic requirements. The design continues to use the Avcoat material, but in a “block” configuration to enable improvements in the application processes as well as additional improvements in the carrier structure design and manufacturing operations. Incorporating flight test results and producibility improvements from EFT-1 for the heat shield system design and processes have improved the thermal protection capability, improved the producibility, and cost for EM-1 flight test.

Producibility↗

DOE OSTI2019

Retrieval, Disposal, and Disposition of Legacy 252 Cf Sealed Sources

In this article, we describe work performed on behalf of the US Department of Energy (DOE) to disposition 467 government-owned, sealed californium-252 ( 252 Cf) sources located at 52 academic and government research sites. These sources are the legacy of the DOE 252 Cf Loan/Lease Program, which operated from the late 1960s until 2008, when the loan program closed abruptly. Although the DOE took decades to fabricate and distribute the sources, best safety and nuclear accountability practices demanded retrieval or disposition of all loaned sources as soon as achievable after the loan program was closed. An adaptable disposition approach was developed, and disposition of the sources was pursued. The approach involved a combination of source retrievals, disposal actions, and source ownership transfers. A new shielded shipping container was designed and deployed to aid in source retrievals. In a couple cases, incomplete source fabrication and shipping records prevented shipment, and those sources were left indefinitely with the customer in a safe configuration. Lastly, all the sources in the inventory were safely dispositioned in some way, and lessons learned from this effort are provided.

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

NASA NTRS1972

Development of a category 2 approach system model

An analytical model is presented which provides, as its primary output, the probability of a successful Category II approach. Typical applications are included using several example systems (manual and automatic) which are subjected to random gusts and deterministic wind shear. The primary purpose of the approach system model is to establish a structure containing the system elements, command inputs, disturbances, and their interactions in an analytical framework so that the relative effects of changes in the various system elements on precision of control and available margins of safety can be estimated. The model is intended to provide insight for the design and integration of suitable autopilot, display, and navigation elements; and to assess the interaction of such elements with the pilot/copilot.

Johnson, W. A.↗

DOE OSTI2017

Development of a utility computer-based training program on setpoint methodology for nuclear power plants - 129

The purpose of this paper is to provide an overview of the development of the Computer- Based Training (CBT) Program for utility engineers on Setpoint Methodology for nuclear power plants. This computer based training module was prepared by the Advanced Engineering Training initiative. The Advanced Engineering Training initiative is a nuclear industry effort to develop technical computer-based training modules for targeted areas of engineering expertise. The target audience is engineers at commercial nuclear power facilities in the U. S. These modules are being developed using the systematic approach to training and are being designed to maintain industry engineering expertise and to facilitate engineering knowledge transfer. The objective of this training effort is to support the development of the next generation of site technical experts for specific topic areas. The training is one part of three key components that would facilitate knowledge transfer to the future site Subject Matter Expert (SME). The following are the major focus areas covered in the Setpoint Methodology CBT: Chapter 1 provides an overview of the role instrument setpoints perform in the defense-in-depth safety analysis for the plant as well introducing key definitions related to setpoints. Chapter 2 provides the history and current regulatory requirements related to setpoint control including the laws and guidance provided by the U.S. NRC. Chapter 3 provides describes the setpoint methodology including terms, formulae, methods of combination, graded approach and methods for drift analysis. This is a major part of the training module in covering the incremental uncertainty terms that need to be considered and how they are combined. Chapter 4 provides and overview of the role of setpoints in Technical Specifications and associated documents. Chapter 5 describes how the regulatory process, related to setpoint control, has been implemented in NRC inspections and how the major elements of the 10 CFR 50.59 reviews apply to the performance of a new or revised setpoint calculation. (authors)

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

DOE OSTI2026

GridCoPilot for Thermal Events: An LLM-Based Platform for Power Grid Reliability Analysis

Large Language Models show promise for translating natural language into database queries, but deploying such systems in safety-critical domains requires high reliability. We present an application of GridCoPilot to thermal event analysis (heatwaves and coldwaves) that affect power grid reliability. Our approach uses a LangChain SQL Agent to translate natural language queries into auditable SQL statements, with deterministic visualization routines that parse the structured query results. We introduce structural framing as a design principle, we integrate a NERC-region-level event library with county-level meteorology and decompose the combined data into three relational tables (event metadata, county-level event details, and a county-to-NERC subregion mapping), using prompt-guided joins to direct the model toward correct multi-table queries. For two core analytical patterns (identifying worst events by region and by region-year), the system achieved 100% SQL accuracy across all 16 NERC subregions and both event types (64 queries total). These results validate the approach for target use cases, though performance on diverse natural language formulations requires further investigation. We discuss design trade-offs, failure modes including JSON output truncation, and pathways for extending this approach to other hazard domains.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2024

Adaptive Framework for Maintenance Scheduling Based on Dynamic Preventive Intervals and Remaining Useful Life Estimation

Data-based prognostic methods exploit sensor data to forecast the remaining useful life (RUL) of industrial settings to optimize the scheduling of maintenance actions. However, implementing sensors may not be cost-effective or practical for all components. Traditional preventive approaches are not based on sensor data; however, they schedule maintenance at equally spaced intervals, which is not a cost-effective approach since the distribution of the time between failures changes with the degradation state of other parts or changes in working conditions. This study introduces a novel framework comprising two maintenance scheduling strategies. In the absence of sensor data, we propose a novel dynamic preventive policy that adjusts intervention intervals based on the most recent failure data. When sensor data are available, a method for RUL prediction, designated k-LSTM-GFT, is enhanced to dynamically account for RUL prediction uncertainty. The results demonstrate that dynamic preventive maintenance can yield cost reductions of up to 51.8% compared to conventional approaches. The predictive approach optimizes the exploitation of RUL, achieving costs that are only 3–5% higher than the minimum cost achievable while ensuring the safety of critical systems since all of the failures are avoided.

Nunes, Pedro (ORCID:0000000180012172)↗

NASA NTRS1976

Technology and politics: The regional airport experience

The findings of a comparative study of the following six regional airports were presented: Dallas/Fort Worth, Kansas City, Washington, D.C., Montreal, Tampa, and St. Louis. Each case was approached as a unique historical entity, in order to investigate common elements such as: the use of predictive models in planning, the role of symbolism to heighten dramatic effects, the roles of community and professional elites, and design flexibility. Some of the factors considered were: site selection, consolidation of airline service, accessibility, land availability and cost, safety, nuisance, and pollution constraints, economic growth, expectation of regional growth, the demand forecasting conundrum, and design decisions. The hypotheses developed include the following: the effect of political, social, and economic conflicts, the stress on large capacity and dramatic, high-technology design, projections of rapid growth to explain the need for large capital outlays.

Starling, J. D.↗

NASA NTRS1983

Fabrication division ultrasonic inspection specification for critically stressed components

An ultrasonic inspection specification which incorporates existing industry practices for straight beam modes with a new approach to the angle beam reference standard was developed. The method employs a commercially available letter "I" die stamp to impress a controlled shape ultrasonic reflector using common hand tools. The specification is designed to produce very stringent inspections and is primarily intended for utilization in the grading of material used in high load-low safety factor applications, such as cryogenic wind tunnel models and support hardware.

Berry, R. F., Jr.↗

NASA NTRS1990

NASA aerospace flight battery systems program

The major objective of the NASA Aerospace Flight Battery Systems Program is to provide NASA with the policy and posture to increase and ensure the safety, performance and reliability of batteries for space power systems. The program plan has been modified in the past year to reflect changes in the agency's approach to battery related problems that are affecting flight programs. Primary attention in the Battery Program is being devoted to the development of an advanced nickel-cadmium cell design and the qualification of vendors to produce cells for flight programs. As part of a unified Battery Program, the development of a nickel-hydrogen standard and primary cell issues are also being pursued to provide high performance NASA Standards and space qualified state-of-the-art primary cells. The resolution of issues is being addressed with the full participation of the aerospace battery community.

Manzo, Michelle A.↗

NASA NTRS1990

NASA Aerospace Flight Battery Systems Program

The major objective of the NASA Aerospace Flight Battery Systems Program is to provide NASA with the policy and posture to increase and ensure the safety, performance and reliability of batteries for space power systems. The program plan has been modified in the past year to reflect changes in the agency's approach to battery related problems that are affecting flight programs. Primary attention in the Battery Program is being devoted to the development of an advanced nickel-cadmium cell design and the qualification of vendors to produce cells for flight programs. As part of a unified Battery Program, the development of a nickel-hydrogen standard and primary cell issues are also being pursued to provide high-performance NASA Standards and space qualified state-of-the-art primary cells. The resolution of issues is being addressed with the full participation of the aerospace battery community.

Manzo, Michelle A.↗

NASA NTRS2001

Enabling Advanced Automation in Spacecraft Operations with the Spacecraft Emergency Response System

True autonomy is the Holy Grail of spacecraft mission operations. The goal of launching a satellite and letting it manage itself throughout its useful life is a worthy one. With true autonomy, the cost of mission operations would be reduced to a negligible amount. Under full autonomy, any problems (no matter the severity or type) that may arise with the spacecraft would be handled without any human intervention via some combination of smart sensors, on-board intelligence, and/or smart automated ground system. Until the day that complete autonomy is practical and affordable to deploy, incremental steps of deploying ever-increasing levels of automation (computerization of once manual tasks) on the ground and on the spacecraft are gradually decreasing the cost of mission operations. For example, NASA's Goddard Space Flight Center (NASA-GSFC) has been flying spacecraft with low cost operations for several years. NASA-GSFC's SMEX (Small Explorer) and MIDEX (Middle Explorer) missions have effectively deployed significant amounts of automation to enable the missions to fly predominately in 'light-out' mode. Under light-out operations the ground system is run without human intervention. Various tools perform many of the tasks previously performed by the human operators. One of the major issues in reducing human staff in favor of automation is the perceived increased in risk of losing data, or even losing a spacecraft, because of anomalous conditions that may occur when there is no one in the control center. When things go wrong, missions deploying advanced automation need to be sure that anomalous conditions are detected and that key personal are notified in a timely manner so that on-call team members can react to those conditions. To ensure the health and safety of its lights-out missions, NASA-GSFC's Advanced Automation and Autonomy branch (Code 588) developed the Spacecraft Emergency Response System (SERS). The SERS is a Web-based collaborative environment that enables secure distributed fault and resource management. The SERS incorporates the use of intelligent agents, threaded discussions, workflow, database connectivity, and links to a variety of communications devices (e.g., two-way paging, PDA's, and Internet phones) via commercial gateways. When the SERS detects a problem, it notifies on-call team members, who then can remotely take any necessary actions to resolve the anomalies.The SERS goes well beyond a simple '911' system that sends out an error code to everyone with a pager. Instead, SERS' software agents send detailed data (i.e., notifications) to the most appropriate team members based on the type and severity of the anomaly and the skills of the on-call team members. The SERS also allows the team members to respond to the notifications from their wireless devices. This unique capability ensures rapid response since the team members no longer have to go to a PC or the control center for every anomalous event. Most importantly, the SERS enables safe experimentation with various techniques for increasing levels of automation, leading to robust autonomy. For the MIDEX missions at NASA GSFC, the SERS is used to provide 'human-in-the-loop' automation. During lights-out operations, as greater control is given to the MIDEX automated systems, the SERS can be configured to page remote personnel and keep them informed regarding actions taking place in the control center. Remote off-duty operators can even be given the option of enabling or inhibiting a specific automated response in near real time via their two-way pagers. The SERS facilitates insertion of new technology to increase automation, while maintaining the safety and security of mission resources. This paper will focus on SERS' overall functionality and how SERS has been designed to handle the monitoring and emergency response for missions with varying levels of automation. The paper will also convey some of the key lessons learned from SERS' deployment across of variety of missions, highlighting this incremental approach to achieving 'robust autonomy'.

Breed, Julie↗

DOE OSTI2017

Analyses Supporting Design Review of TREAT Multi-SERTTA Experiment Test Vehicle

The Transient Test Reactor (TREAT) Facility was designed to evaluate nuclear fuels and structural materials under simulated nuclear excursion and transient power/cooling mismatch situations that could be encountered in nuclear reactors [1]. It was historically operated from 1959 through 1994; ongoing activities at Idaho National Laboratory (INL) include resumption of transient testing capabilities to generate experimental data suitable to validate advanced modeling and simulation of these transient conditions, supporting current and next generation power reactor design and nuclear safety [2]. The resumption of transient testing requires new experiment vehicle designs to satisfy testing needs. The most developed experiment test vehicle candidate in TREAT’s arsenal will be the Multi-SERTTA (Static Environment Rodlet Transient Test Apparatuses) [3], which accommodates up to four concurrent rodlets under separate environmental conditions. An overview of the Multi-SERTTA, which would be placed at the center of the TREAT core during use, is shown in Figure 1. In the current design, all four rodlet test vessels are identical except for flux shaping collar material content to meet design needs. As the date rapidly approaches for TREAT restart, there is a need to have the Multi-SERTTA design approved and tested. Test experiments are an integral component of TREAT operations, and will be integrated among initial restart testing and supporting core reactor physics measurements. An integral step in finalization of any test vehicle design for TREAT is the hosting and resolution of a formal design review.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗

DOE OSTI2016

An Approach for Assessing Consequences of Potential Supply Chain and Insider Contributed Cyber Attacks on Nuclear Power Plants

The Stuxnet attack at the Natanz facility is an example of a targeted and successful cyber attack on a nuclear facility. Snowden's release of National Security Agency documents demonstrated the consequences of the insider threat. More recently, the United States tried to attack North Korea but failed, South Korea was attempting to attack North Korea, and both applied Stuxnet-like approaches. These sophisticated targeted attacks differ from web-site hacking events that are reported almost daily in the news mainly because targeted attacks require detailed design and operation information of the systems attacked and/or are often carried out by insiders. For instance, in order to minimize disruption of facilities around the world, Stuxnet remained idle until it recognized the specific configuration of the Natanz facility, demonstrating that the attackers possessed extremely detailed information about the facility. Such targeted cyber attacks could become a national-level military weapon and be used in coercion of hostile countries. While U.S. nuclear power plants (NPPs) are well designed and protected and not easily attacked through internet hacking, there have been a few digital-system-related incidents. For example, in 2003, the Slammer worm breached the private network of the Davis Besse plant and disabled a safety monitoring system for almost five hours. The breach did not pose a safety hazard because the plant was offline, but it demonstrates the vulnerability of NPP systems. The worm did not enter the plant systems directly; it began by entering the systems of a Davis Besse contractor, and entered through the T1 line bridging the contractor's computer and Davis Besse's corporate networks. The T1 line was not protected by the plant's firewall. The success of the Stuxnet-Natanz case demonstrates that supply-chain level attack (i.e., physically tampering with digital systems to install undetectable malware for the purpose of bringing harm to a player further down the supply chain network) plays a crucial role in a successful attack. Although attacking an NPP naturally requires more complex strategies and tactics than internet hacking, NPP's have a variety of sophisticated and possibly sensitive systems that may be attacked. Previous studies, for example, Baylon, have identified and confirmed that such attack strategies and tactics can be designed and could produce severe damage to an NPP. Current NPPs were designed according to design basis accidents that predate use of the internet by the general public and did not take into consideration potential cyber attacks that could be carried out by state-sponsored attackers and malicious insiders. To date, no detailed engineering analysis has been performed to realistically examine the consequences these attacks may have on the plants. In this paper, we discuss an approach for assessing the potential consequences of Stuxnet type of attacks. We will examine the engineering criteria used in designing the plants, develop possible attack scenarios in terms of the structures, components, and systems (SSCs) being controlled by digital systems at the NPPs, perform engineering analysis to determine if the attacks would impose conditions that are beyond design bases, and categorize the consequences of the potential accidents. (authors)

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

DOE OSTI2017

Operational performance risk assessment in support of a supervisory control system - 251

A supervisory control system is being developed for multiunit advanced small modular reactors to minimize human interventions during normal and abnormal operations. In the supervisory control system, control action decisions are made based on a probabilistic risk assessment that employs event trees and fault trees. Although traditional probabilistic risk assessment tools are implemented, their scope is extended to normal operations, and the application is reversed to assess the success of non-safety related systems and to enable continued operation of the plant. This extended probabilistic risk assessment approach is called operational performance risk assessment (OPRA). OPRA helps to identify available paths, combine control actions for maintaining plant conditions within operational limits, and to quantify the likelihood of success of these operational trajectories to optimize the selection of alternative actions without activating reactor protection system. In this paper, a case study of OPRA in a supervisory control system is demonstrated for the Advanced Liquid Metal Reactor (ALMR) Power Reactor Inherently Safe Module (PRISM) design, specifically the power conversion system. The scenario investigated involved a condition in which the feedwater control valve that was observed to be drifting to the closed position. Alternative plant configurations that would allow the plant to continue to operate at full or reduced power were identified using OPRA. Dynamic analyses were performed with a thermal-hydraulic model of the ALMR PRISM system using Modelica to evaluate the magnitude of safety margins. Successful recovery paths for the selected scenario were identified and quantified using the supervisory control system. (authors)

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗

DOE OSTI2022

Computational Tools and Workflows for Quantitative Risk Assessment and Decision Support for Geologic Carbon Storage Sites: Progress and Insights from the U.S. DOE’s National Risk Assessment Partnership

The 2005 Intergovernmental Panel on Climate Change (IPCC) Special Report on CCS raised the profile of CO2 capture and storage (CCS) as an important technology for reducing greenhouse gas (GHG) emissions. CCS is now recognized as a key component of most climate change mitigation scenarios. Since publication of that report the international research, development, and deployment (RD&D) community has advanced key technical aspects, clarified regulatory requirements, explored value chain and infrastructure solutions, and developed incentive paradigms to enable and promote large-scale deployment of CCS. These efforts have included research to better characterize geologic storage resources, to improve injection performance and storage efficiency, to assess and manage subsurface environmental risks, and to advance monitoring technologies to assure system conformance. These efforts have helped to build confidence in the viability of geologic carbon storage (GCS), but stakeholder concerns about long-term risks and liability associated with GCS remain a hurdle to broad acceptance and large-scale deployment of CCS. Since 2010, the U.S. DOE’s National Risk Assessment Partnership (NRAP) – a research collaboration between five contributing national laboratories – has worked to establish and demonstrate methods and tools to quantify and manage the subsurface environmental risks associated with GCS, amidst uncertainty. This work supports the Office of Fossil Energy and Carbon Management Carbon Transport and Storage Program’s goal of advancing safe and secure commercial-scale GCS deployment. To address the technical challenge of simulating the physical response of the GCS site to large-scale CO2 injection, NRAP has adopted an approach that relies on coupling computationally efficient reduced-order and/or data-driven proxy models of important system components (i.e., storage reservoir, sealing caprock, leakage pathways, intermediate formations, overlying groundwater aquifers, and the atmosphere) in integrated assessment framework. That integrated model of the physical system is complemented with fit-for purpose functionality to support site characterization and risk-related decisions. The recently released NRAP Phase II toolset includes the Open-Source Integrated Assessment Model (NRAP-Open-IAM) for evaluation of trends in leakage risk and potential impact, tools to support monitoring design optimization (Designs for Risk Evaluation and Management – DREAM v3.0 and Passive Seismic Monitoring Tool - PSMT), and tools for state of stress evaluation (State-of-Stress Analysis Tool - SOSAT) and forecasting induced seismicity risk. The NRAP team has also released a pair of reports describing conceptual workflows to incorporate physics-based, quantitative risk assessment into many of the design, planning, operation, and closure decisions for GCS projects. An online catalogue highlights published studies where these tools and methods are demonstrated. In this presentation, the utility of these products to assess risks and address key stakeholder questions will be highlighted through examples, and related insights about the safety and security of geologic carbon storage in qualified storage sites will be discussed. The prospect of rapid, large-scale deployment of GCS technology to aggressively reduce anthropogenic CO2 emissions requires careful consideration of interference between multiple commercial-scale storage projects within a basin. Going forward, NRAP is expanding and adapting site-scale risk quantification tools and methods to enable assessment of risks and inform management decisions for basin-scale deployment. Increasingly, this work will leverage next-generation approaches for surrogate modelling, fast prediction, and advanced visualization enabled by machine learning and artificial intelligence to promote virtual learning, scenario evaluation, and augment risk-based decision making.

quantitative risk assessment, geologic carbon stor↗

NASA NTRS1994

On the use of the systems approach to certify advanced aviation technologies

The field of human factors is as varied and diverse as the human subject itself. But one of its most important applications is the facilitation of safety and efficiency in a particular working environment through the implementation of paradigms known about humans and their working relationship with machines and systems. During the period since World War II (which is often viewed as the birth of Human Factors) no area has been the subject of more human factors research than aviation. And in no time during that epoch is the influence of human factors more important, nor more imperative than it is today. As technology driven designs have been finding their way into the national airspace system (NAS), there has been growing concern within the aviation industry itself, the Federal Aviation Administration (FAA), and the general public for a means by which to certify complex systems and the advanced aviation technologies that will be responsible for transporting, directing, and maintaining our airborne travel. While it is widely agreed human factors certification is desirable, the philosophy that will underlie the approach is debatable. There are, in general, two different approaches to certification: (1) the top-down or systems approach; and, (2) the bottom-up or monadical approach. The top-down approach is characterized by the underlying assumption that certification can be best achieved by looking at the system as a whole, understanding its objectives and operating environment, then examining the constituent parts. In an aircraft cockpit, this would be accomplished by first examining what the aircraft is supposed to be (e.g., fighter, general aviation, passenger), identifying its operating environment (IFR, VMC, combat, etc.) and looking at the entire working system which includes the hardware, software, liveware and their interactions; then, evaluative measures can be applied to the subsystems (e.g., individual instruments, CRT displays, controls). The bottom-up approach is founded on the philosophy that the whole can be best served by first examining it constituent elements. This approach would perform the above certification completely antithetically, by looking at the individual parts and certifying good human factors applications to those parts under the basic assumption that the whole is equal to the sum of its parts.

Wise, Mark A.↗

NASA NTRS1980

AMTV headway sensor and safety design

A headway sensing system for an automated mixed traffic vehicle (AMTV) employing an array of optical proximity sensor elements is described, and its performance is presented in terms of object detection profiles. The problem of sensing in turns is explored experimentally and requirements for future turn sensors are discussed. A recommended headway sensor configuration, employing multiple source elements in the focal plane of one lens operating together with a similar detector unit, is described. Alternative concepts including laser radar, ultrasonic sensing, imaging techniques, and radar are compared to the present proximity sensor approach. Design concepts for an AMTV body which will minimize the probability of injury to pedestrians or passengers in the event of a collision are presented.

Johnston, A. R.↗

NASA NTRSDate not supplied

Oversimplification of Systems Engineering Goals, Processes, and Criteria in NASA Space Life Support

This paper investigates the oversimplification of the inherently complex systems engineering process in space life support. The standard systems engineering process steps are described. The International Space Station (ISS) life support system is explained with its goals and performance criteria. Although it is not usually emphasized, the essential function of developing a hierarchy of systems and subsystems is to simplify the design process. The System Complexity Metric (SCM) shows how this di-vide-and-conquer approach also reduces the system complexity. The complete systems engineering process has many detailed steps. It is often simplified because of the effort required and the human limitations on working memory and decision span. Systems analysis demands slow, logical, and fo-cused thinking but is often bypassed in favor of quick, intuitive, subconscious “gut feel.” A study of 100 system designs found examples of 12 specific mental mistakes, such as ignoring stakeholder needs, and these mistakes are essentially oversimplifications of the systems engineering process. An analysis of space life support goals, options, criteria, and processes found 11 examples of oversimplifications in systems engineering, such as neglecting safety and cost. All these 11 oversimplifications could be traced to one or more of the 12 previously identified mental mistakes or other well-known ones, such as ig-noring sunk costs. Oversimplification of the systems engineering process is rarely noticed but is a common and harmful problem. A study of failures in 50 different space systems found that problems in systems engineering caused failures and often led to errors in design, development, and test that further contributed to failure. It seems that more diligent systems engineering could prevent many project problems and failures, but projects seem to be more guided by “gut feel” based on tradition, authority, and consensus than on the logical, rational systems engineering approach.

Simplified systems engineering↗