Search NASA⌕ Search

SEARCH · Search NASA

Results for “Safety Design Approach”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 901 records · Page 50

Next Generation Batteries for Electric Aviation and Space

Energy storage plays a critical part in the success of future NASA missions that desire batteries with higher energy density, higher power, and most critically improved safety. These performance requirements stretch beyond that of electric automobile markets and are required for enabling widespread adoption of electric aviation. One approach to improve the safety and energy is the transition to non-volatile solid-state electrolytes (SSE) which promise many advantages over traditional flammable liquid electrolytes and may also be an enabling technology for next generation chemistries such as lithium-sulfur (Li-S). However, significant manufacturing challenges must be overcome before the adoption of such technology. This study will discuss the development of solid electrolytes specifically designed to meet future NASA electric aviation targets with densified thicknesses between 20-30 microns derived using solvent processing techniques. Films were produced 10-15 times thinner than comparable bulk cold pressed powder electrolytes and achieved thicknesses comparable to commercial polyolefin separators (25 micron) used in commercial liquid containing lithium-ion cells. Furthermore, design and development of novel cathode composites through integration of experiment and a particle dynamics model will be discussed. Beyond aeronautics, unique challenges and requirements exist for energy storage for space applications, which can cover extreme temperatures and material scarcity for in-situ derived materials. Additionally, this talk will briefly cover the need and development of lunar and Martian derived electrode materials for in-situ manufacturing of energy storage devices.

Batteries↗

Human Performance Contributions to Safety in Commercial Aviation

Every day in aviation, pilots, air traffic controllers, and other front-line personnel perform countless correct judgments and actions in a variety of operational environments. These judgments and actions are often the difference between an accident and a non-event. Ironically, data on these behaviors are rarely collected or analyzed. Data-driven decisions about safety management and design of safety-critical systems are limited by the available data, which influence how decision makers characterize problems and identify solutions. Large volumes of data are collected on the failures and errors that result in infrequent incidents and accidents, but in the absence of data on behaviors that result in routine successful outcomes, safety management and system design decisions are based on a small sample of nonrepresentative safety data. This assessment aimed to find and document “safety successes” made possible by human operators. With many Aeronautics Research Mission Directorate (ARMD) Programs and Projects focusing on increased automation and autonomy and decreased human involvement, failure to fully consider the human contributions to successful system performance in civil aviation represents a significant risk — a risk that has not been recognized to date. Without understanding how humans contribute to safety, any estimate of predicted safety of autonomous capabilities is incomplete and inherently suspect. Furthermore, understanding the ways in which humans contribute to safety can promote strategic interactions among safety technologies, functions, procedures and the people using them. Without this understanding, the full benefits of an integrated, optimized human/technology or autonomous system will not be realized. Historically, safety has been consistently defined in terms of the occurrence of accidents or recognized risks (i.e., in terms of things that go wrong). These adverse outcomes are explained by identifying their causes, and safety is restored by eliminating or mitigating these causes. An alternative to this approach is to focus on what goes right and identify how to replicate that process. Focusing on the rare cases of failures attributed to “human error” provides little information about why human performance routinely prevents adverse events. Hollnagel has proposed that things go right because people continuously adjust their work to match their operating conditions. These adjustments become increasingly important as systems continue to grow in complexity. Thus, the definition of safety should reflect not only “avoiding things that go wrong” but “ensuring that things go right.” The basis for safety management requires developing an understanding of everyday activities. However, few mechanisms to monitor everyday work exist in the aviation domain, which limits opportunities to learn how designs function in reality. This concept of safety thinking and safety management is reflected in the emerging field of resilience engineering. According to Hollnagel, a system is resilient if it can sustain required operations under expected and unexpected conditions by adjusting its functioning prior to, during, or following changes, disturbances, and opportunities. To explore “positive” behaviors that contribute to resilient performance in commercial aviation, the assessment team examined a range of existing sources of data about pilot and air traffic control (ATC) tower controller performance, including subjective interviews with domain experts and objective aircraft flight data records. These data were used to identify strategies that support resilient performance, methods for exploring and refining those strategies in existing data, and proposed methods for capturing and analyzing new data.

Null, Cynthia H.↗

Development of an Alternative Approach to Demonstrating Environmental Performance in the UK - 19354

European basic safety standards require that exposure of humans to the potentially harmful effects of ionising radiation are optimised so that they are as low as reasonably achievable, taking account of economic and societal factors. In the United Kingdom the responsibility for ensuring that exposures to humans are optimised is split between two regulatory functions. The Office of Nuclear Regulation regulates exposures to workers in all scenarios and to members of the public in the event of an accident. Environmental regulators in each of the four nations comprising the United Kingdom regulate exposures to members of the public from normal operations. Since the early 1990's, all permissions granted to nuclear sites in the UK for the discharge/disposal of radioactive waste to the environment have contained conditions requiring holders to demonstrate that they minimise the generation of radioactive waste, apply appropriate abatement and discharge/dispose of it in a way that minimises impacts on members of the public and the environment. For many years, the industry standard for providing this demonstration, which was heavily influenced by regulatory expectations and feedback, was to undertake one or a series of multi-attribute decision assessments (MADA). Wood's team of environmental specialists has been involved in undertaking such MADA studies for many years. Since the mid-2000's, our team has become increasingly aware of some of the limitations of undertaking MADA to demonstrate environmental performance for large scale new nuclear build projects and, in particular, the next generation of new nuclear power stations that are being planned and implemented in the UK. We have collaborated with the vendors of reactor technologies, the prospective/owner operators of new nuclear power stations and the developers of new facilities on existing sites to develop an alternative approach to demonstrating environmental performance. Our alternative approach comprises three main pillars which are summarised as: - Evolution - benefit from progressive improvements, operational experience and recent permitting activities. Our alternative approach uses the claim, argument, evidence approach which is commonly used for nuclear safety cases and which allows us to 'tell the story' of how environmental performance has been achieved. We have successfully deployed this approach for all new nuclear power stations proposed in the UK. - Integration - ensure that optimisation is integrated into the project programme and forms part of the 'big picture'. Our alternative approach allows environmental performance to be managed better throughout the life cycle of the project and ensures that our outputs are 'living' documents and do not 'sit on the shelf'. We have successfully demonstrated how this can be applied during rationalisation of major schemes and significant design changes on nuclear new build projects. - Opportunity - identify the best time to deliver elements of the programme. Our alternative approach aims to minimise the overall time, trouble and costs associated with demonstrating environmental performance by ensuring that decisions are made at the time when they offer greatest benefit and by minimising unnecessary rework. Our advice has helped to reduce the project costs and minimise delays associated with regulatory queries and interventions. This paper describes the journey that we have taken with our clients in developing our alternative approach to demonstrating environmental performance. We explain the UK regulatory context and explore the need for change. We present a number of case studies related to new nuclear power stations and other new facilities on existing nuclear sites that demonstrate the successful application of our alternative approach. We provide examples of how we have successfully implemented the outputs of our alternative approach into project and corporate management arrangements. Finally, we examine feedback from clients, regulators and other interested parties to propose future refinements. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

Quantitative Risk Assessment for Fuel Cell Electric Bus Hydrogen Storage and Refueling Facility

It is necessary to understand the safety implications and risk mitigation options for fuel cell electric bus fleet deployment, especially for related facilities responsible for operations such as production, storage, compression, and dispensing of hydrogen for use by the buses. In this report, we present a quantitative risk assessment for a potential fuel cell electric bus fleet that was motivated by efforts to improve resilience at the Portland International Airport but can be applicable to a range of hydrogen case studies and use cases. We estimated risk for a facility that produces, stores, compresses, and dispenses hydrogen for the fleet of buses, with a focus on individual risk to people in terms of annual frequency of fatality. We considered the frequency of hydrogen leaks that could result in harmful physical outcomes like jet fires or explosions, and the consequences of those outcomes for people. We created customized fault trees to calculate the frequencies of different sizes of leaks and event sequence diagrams to calculate ignition probabilities for the various leak sizes. We also leveraged the HyRAM+ toolkit to use these inputs to calculate overall risk for the facility, which we separated into one section responsible for producing, storing, and compressing hydrogen, and one section responsible for dispensing the hydrogen to the buses. We found that the dispensing area seemed to have a higher risk than the production/storage/compression area of the facility, largely because of the inclusion of a component with a high leak frequency (the heat exchanger used to cool the hydrogen before entering the vehicle, to prevent overheating and expansion of hydrogen in the onboard tank). For the example production and refueling facility we evaluated and the data we used for the analysis, the leak frequency had a larger impact on the risk differences between the two sections on the facility, compared to the physical outcome consequence, which was slightly different due to the varying fuel conditions, but not substantially different. Actions can be taken to prevent these hazards (e.g., lowering leak frequencies in system components) or to mitigate the consequences if they do occur (e.g., installing barriers to protect people if ignition events occur). The choice of which actions to take depends not only on safety considerations but also on space, time, staffing, feasibility, and financial constraints. Therefore, the quantitative risk assessment approach can help understand relative risk contributions from different components, leak sizes, consequences, and human actions, to prioritize risk reduction strategies and balance these parameters. The outcomes of this report may be useful for a variety of stakeholders working in the hydrogen, transportation, vehicle, and aviation sector, including those responsible for aspects like facility design, operations, and regulations. There is not a single value of risk that determines whether a hypothetical system is “safe” or not. The insights about risk mitigations may be leveraged, and the quantitative risk assessment approach can be applied to other case studies to understand risk priorities and contributions specific to different FCEB and hydrogen facility uses.

08 HYDROGEN↗

Sensitivity analysis of numerical modeling input parameters on floating offshore wind turbine loads

Abstract. Floating wind turbines must withstand a unique and challenging set of loads from the wind and ocean environment. To de-risk development, accurate predictions of these loads are necessary. Uncertainty in modeling predictions leads to larger required safety factors, increasing project costs and the levelized cost of energy. Complex aero-hydro-elastic modeling tools use many input parameters to represent the wind, waves, current, aerodynamic loads, hydrodynamic loads, and structural properties. It is helpful to understand which of these parameters ultimately drives a design. In this work, an ultimate and fatigue-proxy load sensitivity analysis was performed with 35 different input parameters, using an elementary effects approach to identify the most influential parameters for a case study involving the National Renewable Energy Laboratory (NREL) 5 MW baseline wind turbine atop the OC4-DeepCwind semisubmersible during normal operation. The importance of each parameter was evaluated using 14 response quantities of interest across three operational wind speed conditions. The study concludes that turbulent wind velocity standard deviation is the parameter with the strongest sensitivity; this value is important not just for turbine loads, but also for the global system response. The system center of mass in the wind direction is found to have the highest impact on the system rotation and tower loads. The current velocity is found to be the most dominating parameter for the system global motion and consequently the mooring loads. All tested wind turbulence parameters in addition to the standard deviation are also found to be influential. Wave characteristics are influential for some fatigue-proxy loading but do not significantly impact the extreme ultimate loads in these operational load cases. The required number of random seeds for stochastic environmental conditions is considered to ensure that the sensitivities are due to the input parameters and not due to the seed. The required number of analysis points in the parameter space is identified so that the conclusions represent a global sensitivity. The results are specific to the platform, turbine, and choice of parameter ranges, but the demonstrated approach can be applied widely to guide focus in parameter uncertainty.

17 WIND ENERGY↗

Faster Aerodynamic Simulation With Cart3D

A NASA-developed aerodynamic simulation tool is ensuring the safety of future space operations while providing designers and engineers with an automated, highly accurate computer simulation suite. Cart3D, co-winner of NASA's 2002 Software of the Year award, is the result of over 10 years of research and software development conducted by Michael Aftosmis and Dr. John Melton of Ames Research Center and Professor Marsha Berger of the Courant Institute at New York University. Cart3D offers a revolutionary approach to computational fluid dynamics (CFD), the computer simulation of how fluids and gases flow around an object of a particular design. By fusing technological advancements in diverse fields such as mineralogy, computer graphics, computational geometry, and fluid dynamics, the software provides a new industrial geometry processing and fluid analysis capability with unsurpassed automation and efficiency.

Source record↗

Materials, Processes and Manufacturing in Ares 1 Upper Stage: Integration with Systems Design and Development

Ares I Crew Launch Vehicle Upper Stage is designed and developed based on sound systems engineering principles. Systems Engineering starts with Concept of Operations and Mission requirements, which in turn determine the launch system architecture and its performance requirements. The Ares I-Upper Stage is designed and developed to meet these requirements. Designers depend on the support from materials, processes and manufacturing during the design, development and verification of subsystems and components. The requirements relative to reliability, safety, operability and availability are also dependent on materials availability, characterization, process maturation and vendor support. This paper discusses the roles and responsibilities of materials and manufacturing engineering during the various phases of Ares IUS development, including design and analysis, hardware development, test and verification. Emphasis is placed how materials, processes and manufacturing support is integrated over the Upper Stage Project, both horizontally and vertically. In addition, the paper describes the approach used to ensure compliance with materials, processes, and manufacturing requirements during the project cycle, with focus on hardware systems design and development.

Bhat, Biliyar N.↗

Optimization of Second Fault Detection Thresholds to Maximize Mission Probability of Success

In order to support manned spaceflight safety requirements, the Space Launch System (SLS) has defined program-level requirements for key systems to ensure successful operation under single fault conditions. The SLS program has also levied requirements relating to the capability of the Inertial Navigation System to detect a second fault. This detection functionality is required in order to feed abort analysis and ensure crew safety. Increases in navigation state error due to sensor faults in a purely inertial system can drive the vehicle outside of its operational as-designed environmental and performance envelope. As this performance outside of first fault detections is defined and controlled at the vehicle level, it allows for the use of system level margins to increase probability of mission success on the operational edges of the design. A top-down approach is utilized to assess vehicle sensitivity to second sensor faults. A wide range of failure scenarios in terms of both fault magnitude and time is used for assessment. The approach also utilizes a schedule to change fault detection thresholds autonomously. These individual values are optimized along a nominal trajectory in order to maximize probability of mission success in terms of system-level insertion requirements while minimizing the probability of false positives. This paper will describe an approach integrating Genetic Algorithms and Monte Carlo analysis to tune the threshold parameters to maximize vehicle resilience to second fault events over an ascent mission profile. The analysis approach and performance assessment and verification will be presented to demonstrate the applicability of this approach to second fault detection optimization to maximize mission probability of success through taking advantage of existing margin.

Anzalone, Evan J.↗

Aerosol-Jet Printed Sensors for Environmental, Safety, and Health Monitoring: A Review

An emergent direct-write approach, aerosol-jet printing (AJP), is gaining attention for the deployment of rapid and affordable microadditively manufactured energy-efficient sensors and printed electronics. AJP enables a broad range of ink viscosities (0.001–1 Pa s) for printing diverse materials ranging from ceramics and metals to polymers and biological matter. Reproducible, high-spatial-resolution features (≈10 µm), and wide standoff distances (1–11 mm) between the nozzle and the substrate facilitate conformal printing of complex geometrical designs on nonplanar—e.g., stepped or curved—surfaces. Here this paper aims to provide a comprehensive overview of state-of-the-art AJP-based sensors (e.g., strain and temperature gauges, biosensors, photosensors, humidity and surface acoustic wave sensors, dielectric elastomer actuators, and motion, smoke, and hazardous gas detectors) and to discuss prospective applications. The drive toward cost-effective devices that are smaller, lighter, and better-performing remains a frontier challenge in the field of printed electronics. Consequently, as AJP becomes increasingly utilized in the high-volume manufacturing of miniaturized active and passive sensors, it opens a pathway for facile large-scale fabrication of devices for a wide range of consumer and industrial applications, including transportation, agriculture, infrastructure, aerospace, national defense, and healthcare.

3-dimensional↗

A matrix safety frame approach to robot safety for space applications

The planned use of autonomous robots in space applications has generated many new safety problems. This thesis assesses safety of autonomous robot systems through the structure of a proposed three-dimensional matrix safety frame. By identifying the common points of accidents and fatalities involving terrestrial robots, reviewing terrestrial robot safety standards, and modifying and extending these results to space applications, hazards are identified and their associated risks assessed. Three components of the safeguarding dimension of the matrix safety frame, safeguarding through design and operation for intrinsic safety, and incorporation of add-on safety systems are explained through examples for both terrestrial and space robots. A space robot hazard identification checklist, a qualitative tool for robot systems designers, is developed using the structure imparted by the matrix safety frame. The development of an expert system from the contents of the checklist is discussed.

Montgomery, T. D.↗

Coupling Shared E-scooters and Public Transit: A Spatial and Temporal Analysis

The integration of shared e-scooters with public transit is a promising solution for urban mobility's first/last-mile challenge. This study explores spatiotemporal factors influencing this integration, using 35-day e-scooter trip data from Chicago. Employing a random-effect negative binomial approach, we modeled the frequency of e-scooter trips to access/egress to/from bus stops and train stations. Results indicate that weather conditions, design features like intersection density, and multimodal network density significantly influence usage. The transit system characteristics such as service frequency have a positive effect on the integration of e-scooters and trains while a similar effect for bus and e-scooter integration was not significant. Furthermore, safety-related variables such as accident and crime rates as well as demographic characteristics were also revealed to be significant factors in our study. These findings offer vital insights to urban planners and policymakers for infrastructure, safety enhancements, and interventions to encourage efficient e-scooter-public transit integration.

Chicago↗

A design and implementation methodology for diagnostic systems

A methodology for design and implementation of diagnostic systems is presented. Also discussed are the advantages of embedding a diagnostic system in a host system environment. The methodology utilizes an architecture for diagnostic system development that is hierarchical and makes use of object-oriented representation techniques. Additionally, qualitative models are used to describe the host system components and their behavior. The methodology architecture includes a diagnostic engine that utilizes a combination of heuristic knowledge to control the sequence of diagnostic reasoning. The methodology provides an integrated approach to development of diagnostic system requirements that is more rigorous than standard systems engineering techniques. The advantages of using this methodology during various life cycle phases of the host systems (e.g., National Aerospace Plane (NASP)) include: the capability to analyze diagnostic instrumentation requirements during the host system design phase, a ready software architecture for implementation of diagnostics in the host system, and the opportunity to analyze instrumentation for failure coverage in safety critical host system operations.

Williams, Linda J. F.↗

NASA's Space Launch System: Momentum Builds Towards First Launch

NASA's Space Launch System (SLS) is gaining momentum programmatically and technically toward the first launch of a new exploration-class heavy lift launch vehicle for international exploration and science initiatives. The SLS comprises an architecture that begins with a vehicle capable of launching 70 metric tons (t) into low Earth orbit. Its first mission will be the launch of the Orion Multi-Purpose Crew Vehicle (MPCV) on its first autonomous flight beyond the Moon and back. SLS will also launch the first Orion crewed flight in 2021. SLS can evolve to a 130-t lift capability and serve as a baseline for numerous robotic and human missions ranging from a Mars sample return to delivering the first astronauts to explore another planet. Managed by NASA's Marshall Space Flight Center, the SLS Program formally transitioned from the formulation phase to implementation with the successful completion of the rigorous Key Decision Point C review in 2014. At KDP-C, the Agency Planning Management Council determines the readiness of a program to go to the next life-cycle phase and makes technical, cost, and schedule commitments to its external stakeholders. As a result, the Agency authorized the Program to move forward to Critical Design Review, scheduled for 2015, and a launch readiness date of November 2018. Every SLS element is currently in testing or test preparations. The Program shipped its first flight hardware in 2014 in preparation for Orion's Exploration Flight Test-1 (EFT-1) launch on a Delta IV Heavy rocket in December, a significant first step toward human journeys into deep space. Accomplishments during 2014 included manufacture of Core Stage test articles and preparations for qualification testing the Solid Rocket Boosters and the RS-25 Core Stage engines. SLS was conceived with the goals of safety, affordability, and sustainability, while also providing unprecedented capability for human exploration and scientific discovery beyond Earth orbit. In an environment of economic challenges, the nationwide SLS team continues to meet ambitious budget and schedule targets through the studied use of hardware, infrastructure, and workforce investments the United States has already made in the last half century, while selectively using new technologies for design, manufacturing, and testing, as well as streamlined management approaches that have increased decision velocity and reduced associated costs. This paper will summarize recent SLS Program technical accomplishments, as well as the challenges and opportunities ahead for the most powerful and capable launch vehicle in history.

May, Todd↗

A Cable Car Transfer System for the Cigeo Access Ramps - An Original Approach - 17035

Andra is currently implementing the detailed engineering phase of the step-wise design of Cigeo (the French HLW and IL-LLW Deep Geological Repository). Various technical issues are at stake, including the definition and development of a key component: a funicular ('cable-car') system dedicated to the transfer (down the access ramp and leading to the underground infrastructures) of the shielding casks housing the waste disposal containers (packages). The present paper starts with a brief description of the Cigeo architecture (i.e. the surface utilities, the service and nuclear ramps, the various shafts and finally the underground facilities). A focus is then made on the 'nuclear ramp' dedicated to the transfer of the waste containers lodged inside the casks (those latter weighing some 100 to 130 metric tons each) and its main geometrical characteristics (slope, length, diameter, structure). Then a discussion follows to detail the rationale having led to the choice of a somehow 'sophisticated' funicular transfer system, at the expense of what could be called 'more conventional' and more straightforward transport solutions (like a transfer system by trucks or by rack and pinion trains). A systematic comparison is finally made between the various solutions, explaining and rating the pros and cons of each concept, via a multi-criteria analysis. This technical choice (and the related justification approach) was submitted to an Experts review at the end of the Preliminary Design phase of Cigeo and comforted by their strong support before the design freeze of this solution was integrated in Cigeo. The following part of the paper is then focused on a description of the main technical components and the mechanical performance of the cable-car system, its current state of design and the set of qualification tests (of key safety components) to be implemented before its effective construction. This article concludes with a timeline of the qualification tests and developments to come. The positive outcomes of this future technical test campaign will also pave the way for the future instruction of the Cigeo licensing file, scheduled as of mid-2018. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

Application of Objectives-Driven Assurance Cases to System Development in an Evolving Acquisition Model

System properties such as “safety” and “dependability” cannot, in practice, be proven, and must be argued in an “assurance case” aimed at supporting risk-acceptance decisions that have to be made by system acquirers and/or regulatory authorities. The paper is concerned with applications of the “assurance case” idea early in design and development of new systems, when (apart from dedicated testing) the only available operating experience information derives from previous (non-identical) systems. Much of the discussion is based on an evolving acquisition model at the US National Aeronautics and Space Administration; previously, most major systems were developed in-house, but some major systems will now be developed by and acquired from commercial providers. Key points discussed include the following. (1) By promoting a particular kind of focused discussion between acquirers and providers, the use of assurance cases should be particularly valuable under the new acquisition model. (2) In principle, objectives-driven (sometimes called “performance-based”) approaches to assurance of performance have significant advantages in cases where they are applicable. (3) For truly novel systems, completeness of the safety analysis is a significant issue; it is important for the assurance case to include a commitment by the provider (or applicant) to seriously pursue analysis of operating experience, so that previously unrecognized hazards can be identified and addressed. (4) Inquiries into major accidents often point to deficiencies in management oversight in all parts of the life cycle; management processes need to be addressed in the formulation and the implementation of an assurance case. Under the new acquisition model, these considerations imply a serious reconsideration of the way in which the development process is managed by both providers and acquirers.

Objectives-driven↗

APPLICATION OF OBJECTIVES-DRIVEN ASSURANCE CASES TO SYSTEM DEVELOPMENT IN AN EVOLVING ACQUISITION MODEL

System properties such as “safety” and “dependability” cannot, in practice, be proven, and must be argued in an “assurance case” aimed at supporting risk-acceptance decisions that have to be made by system acquirers and/or regulatory authorities. The paper is concerned with applications of the “assurance case” idea early in design and development of new systems, when (apart from dedicated testing) the only available operating experience information derives from previous (non-identical) systems. Much of the discussion is based on an evolving acquisition model at the US National Aeronautics and Space Administration; previously, most major systems were developed in-house, but some major systems will now be developed by and acquired from commercial providers. Key points discussed include the following. (1) By promoting a particular kind of focused discussion between acquirers and providers, the use of assurance cases should be particularly valuable under the new acquisition model. (2) In principle, objectives-driven (sometimes called “performance-based”) approaches to assurance of performance have significant advantages in cases where they are applicable. (3) For truly novel systems, completeness of the safety analysis is a significant issue; it is important for the assurance case to include a commitment by the provider (or applicant) to seriously pursue analysis of operating experience, so that previously unrecognized hazards can be identified and addressed. (4) Inquiries into major accidents often point to deficiencies in management oversight in all parts of the life cycle; management processes need to be addressed in the formulation and the implementation of an assurance case. Under the new acquisition model, these considerations imply a serious reconsideration of the way in which the development process is managed by both providers and acquirers.

99 GENERAL AND MISCELLANEOUS↗

Application of Objectives-Driven Assurance Cases to System Development in an Evolving Acquisition Model

System properties such as “safety” and “dependability” cannot, in practice, be proven, and must be argued in an “assurance case” aimed at supporting risk-acceptance decisions that have to be made by system acquirers and/or regulatory authorities. The paper is concerned with applications of the “assurance case” idea early in design and development of new systems, when (apart from dedicated testing) the only available operating experience information derives from previous (non-identical) systems. Much of the discussion is based on an evolving acquisition model at the US National Aeronautics and Space Administration; previously, most major systems were developed in-house, but some major systems will now be developed by and acquired from commercial providers. Key points discussed include the following. (1) By promoting a particular kind of focused discussion between acquirers and providers, the use of assurance cases should be particularly valuable under the new acquisition model. (2) In principle, objectives-driven (sometimes called “performance-based”) approaches to assurance of performance have significant advantages in cases where they are applicable. (3) For truly novel systems, completeness of the safety analysis is a significant issue; it is important for the assurance case to include a commitment by the provider (or applicant) to seriously pursue analysis of operating experience, so that previously unrecognized hazards can be identified and addressed. (4) Inquiries into major accidents often point to deficiencies in management oversight in all parts of the life cycle; management processes need to be addressed in the formulation and the implementation of an assurance case. Under the new acquisition model, these considerations imply a serious reconsideration of the way in which the development process is managed by both providers and acquirers.

99 GENERAL AND MISCELLANEOUS↗

Radiation Beamline Testbeds for the Simulation of Planetary and Spacecraft Environments for Human and Robotic Mission Risk Assessment

The Center for Radiation Engineering and Science for Space Exploration (CRESSE) at Prairie View A&M University, Prairie View, Texas, USA, is establishing an integrated, multi-disciplinary research program on the scientific and engineering challenges faced by NASA and the international space community caused by space radiation. CRESSE focuses on space radiation research directly applicable to astronaut health and safety during future long term, deep space missions, including Martian, lunar, and other planetary body missions beyond low earth orbit. The research approach will consist of experimental and theoretical radiation modeling studies utilizing particle accelerator facilities including: 1. NASA Space Radiation Laboratory (NSRL) at Brookhaven National Laboratory; 2. Proton Synchrotron at Loma Linda University Medical Center; and 3. Los Alamos Neutron Science Center (LANSCE) at Los Alamos National Laboratory. Specifically, CRESSE investigators are designing, developing, and building experimental test beds that simulate the lunar and Martian radiation environments for experiments focused on risk assessment for astronauts and instrumentation. The testbeds have been designated the Bioastronautics Experimental Research Testbeds for Environmental Radiation Nostrum Investigations and Education (BERT and ERNIE). The designs of BERT and ERNIE will allow for a high degree of flexibility and adaptability to modify experimental configurations to simulate planetary surface environments, planetary habitats, and spacecraft interiors. In the nominal configuration, BERT and ERIE will consist of a set of experimental zones that will simulate the planetary atmosphere (Solid CO2 in the case of the Martian surface.), the planetary surface, and sub-surface regions. These experimental zones can be used for dosimetry, shielding, biological, and electronic effects radiation studies in support of space exploration missions. BERT and ERNIE are designed to be compatible with the experimental areas associated with the above facilities. CRESSE has broad expertise in space radiation in the areas of space radiation environment modeling, Monte-Carlo radiation transport modeling, space radiation instrumentation and dosimetry, radiation effects on electronics, and multi-functional composite shielding materials. The BERT and ERNIE testbeds will be utilized in individual and collaborative research incorporating this expertise. The research goal is to maximize the technical readiness level (TRL) of radiation instrumentation for human and robotic missions, optimizing the return value of CRESSE for NASA exploration and international co-operative missions. Outcomes and knowledge from research utilizing BERT and ERNIE will be applied to a variety of scientific and engineering disciplines vital for safe and reliable execution of future space exploration missions, which can be negatively impacted by the space radiation environment. The testbeds will be central to a variety of university educational activities and educational goals of NASA. Specifically, BERT and ERNIE will enhance educational opportunities in science, technology, engineering and mathematics (STEM) disciplines for engineering and science students at PVAMU, a historically black college/university. Preliminary data on prototype testbed configurations, including simulated lunar regolith (JSC-1A stimulant based on Apollo 11 samples), regolith/polyethylene composites, and dry ice, will be presented to demonstrate the usefulness of BERT and ERNIE in radiation beam line experiments.

Wilkins, Richard↗