Search NASA⌕ Search

SEARCH · Search NASA

Results for “Safety Controls”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 109 records · Page 6
All sourcesNASA NTRSDOE OSTI
NASA NTRS1990

Grounding, bonding and shielding for safety and signal interference control

Aircraft models and other aerodynamic tests are conducted at the NASA Ames Research Center National Full Scale Aerodynamics Complex (NFAC). The models, tested in NFAC's wind tunnels, are sometimes heavily instrumented and are connected to a data acquisition system. Besides recording data for evaluation, certain critical information must be monitored to be sure the model is within operational limits. The signals for these parameters are for the most part low-level signals that require good instrumentation amplification. These amplifiers need to be grounded and shielded for common mode rejection and noise reduction. The instrumentation also needs to be grounded to prevent electrical shock hazards. The purpose of this paper is to present an understanding of the principles and purpose of grounding, bonding, and shielding.

Forsyth, T. J.↗
NASA NTRS2008

Advanced Control System Increases Helicopter Safety

With support and funding from a Phase II NASA SBIR project from Ames Research Center, Hoh Aeronautics Inc. (HAI), of Lomita, California, produced HeliSAS, a low-cost, lightweight, attitude-command-attitude-hold stability augmentation system (SAS) for civil helicopters and unmanned aerial vehicles. HeliSAS proved itself in over 160 hours of flight testing and demonstrations in a Robinson R44 Raven helicopter, a commercial helicopter popular with news broadcasting and police operations. Chelton Flight Systems, of Boise, Idaho, negotiated with HAI to develop, market, and manufacture HeliSAS, now available as the Chelton HeliSAS Digital Helicopter Autopilot.

Source record↗
NASA NTRS1967

Operational range safety.

Hazards in sounding rocket assembly and launch operations and safety techniques at NASA Wallops station noting storage, explosive control, ground safety, etc

ROCKET FIRING↗
NASA NTRS1971

Split-core heat-pipe reactors for out-of-pile thermionic power systems.

Description of the concept of splitting a heat-pipe reactor for out-of-core thermionics into two identical halves and using the resulting center gap for reactivity control. Short Li-W reactor heat pipes penetrate the axial reflectors and form a heat exchanger with long heat pipes which wind through the shield to the thermionic diodes. With one reactor half anchored to the shield, the other is attached to a long arm with a pivot behind the shield and swings through a small arc for reactivity control. A safety shim prevents large reactivity inputs, and a fueled control arm drive shaft acts as a power stabilizer. Reactors fueled with U-235C and with U-233C have been studied.-

Niederauer, G.↗
NASA NTRS2009

Modular Battery Charge Controller

A new approach to masterless, distributed, digital-charge control for batteries requiring charge control has been developed and implemented. This approach is required in battery chemistries that need cell-level charge control for safety and is characterized by the use of one controller per cell, resulting in redundant sensors for critical components, such as voltage, temperature, and current. The charge controllers in a given battery interact in a masterless fashion for the purpose of cell balancing, charge control, and state-of-charge estimation. This makes the battery system invariably fault-tolerant. The solution to the single-fault failure, due to the use of a single charge controller (CC), was solved by implementing one CC per cell and linking them via an isolated communication bus [e.g., controller area network (CAN)] in a masterless fashion so that the failure of one or more CCs will not impact the remaining functional CCs. Each micro-controller-based CC digitizes the cell voltage (V(sub cell)), two cell temperatures, and the voltage across the switch (V); the latter variable is used in conjunction with V(sub cell) to estimate the bypass current for a given bypass resistor. Furthermore, CC1 digitizes the battery current (I1) and battery voltage (V(sub batt) and CC5 digitizes a second battery current (I2). As a result, redundant readings are taken for temperature, battery current, and battery voltage through the summation of the individual cell voltages given that each CC knows the voltage of the other cells. For the purpose of cell balancing, each CC periodically and independently transmits its cell voltage and stores the received cell voltage of the other cells in an array. The position in the array depends on the identifier (ID) of the transmitting CC. After eight cell voltage receptions, the array is checked to see if one or more cells did not transmit. If one or more transmissions are missing, the missing cell(s) is (are) eliminated from cell-balancing calculations. The cell-balancing algorithm is based on the error between the cell s voltage and the other cells and is categorized into four zones of operation. The algorithm is executed every second and, if cell balancing is activated, the error variable is set to a negative low value. The largest error between the cell and the other cells is found and the zone of operation determined. If the error is zero or negative, then the cell is at the lowest voltage and no balancing action is needed. If the error is less than a predetermined negative value, a Cell Bad Flag is set. If the error is positive, then cell balancing is needed, but a hysteretic zone is added to prevent the bypass circuit from triggering repeatedly near zero error. This approach keeps the cells within a predetermined voltage range.

Button, Robert↗
NASA NTRS2007

Safety Verification of a Fault Tolerant Reconfigurable Autonomous Goal-Based Robotic Control System

Fault tolerance and safety verification of control systems are essential for the success of autonomous robotic systems. A control architecture called Mission Data System (MDS), developed at the Jet Propulsion Laboratory, takes a goal-based control approach. In this paper, a method for converting goal network control programs into linear hybrid systems is developed. The linear hybrid system can then be verified for safety in the presence of failures using existing symbolic model checkers. An example task is simulated in MDS and successfully verified using HyTech, a symbolic model checking software for linear hybrid systems.

goal network↗
DOE OSTI2021

A Risk-Informed Performance-Based Methodology to Manage Fire Protection Systems in Nuclear Facilities

Fire protection systems (FPSs) and features are installed in U.S. Department of Energy (DOE) Hazard Category 1, 2, or 3 nuclear facilities to protect property (maximum possible fire loss thresholds), life, and nuclear safety (i.e., structures, systems, and components). These FPSs and features are designed and maintained in accordance with the prescriptive guidance provided in applicable building codes and National Fire Protection Association codes and standards. Management, operations, and maintenance activities of FPSs involve significant effort. A DOE facility’s documented safety analysis or other safety basis document could also rely on FPSs to provide either a safety significant or safety class function to mitigate fire hazards and minimize radiological consequences. In some cases, the designation of safety significant or safety class may be determined to provide a layer of defense-in-depth to minimize nuclear safety risks independent of the fire risk. DOE standards allow the use of performance-based design alternatives developed by the fire industry but do not consider the defense-in-depth layers of protection provided in DOE facilities to prevent or mitigate the risks associated with unintended release of radioactive materials into the environment. Pacific Northwest National Laboratory developed a decision-making methodology tailored for DOE non-reactor nuclear facilities to manage FPSs and features by integrating nuclear safety risk insights into a performance-based analysis. This risk-informed, performance-based (RIPB) methodology can be used to provide the technical basis for classifying an FPS as safety class and safety significant, tailoring administrative controls (e.g., technical safety requirements), and ranking the importance of FPSs to prioritize maintenance, upgrades, and replacement activities. The RIPB methodology is a graded approach to inform DOE facility owners and Fire Protection Program managers of the most risk-significant FPSs and equipment, and those systems would be cost-beneficial to relax rigor if there is a need to re-design the FPS coverage or deviate from DOE and National Fire Protection Association standards for those systems that would be less significant. This paper describes the framework used to develop the RIPB methodology and the outcome of implementing this methodology in a use-case nuclear facility. This paper also discusses the impact to DOE policies and standards and the safety margins and defense-in-depth measures credited in nuclear safety assessments in a facility’s documented safety analysis and the benefits of implementing an RIPB methodology in lieu of a prescriptive method to comply with fire protection requirements.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
DOE OSTI2022

Benchmark Exercise for the Control Rod Swelling Evaluation

The VTR core has six reactivity control assemblies and three safety assemblies. The control assemblies or primary control rods are adjusted during the normal operation to balance the core reactivity and to control the reactor power. A typical control assembly radial layout is presented in Figure 1. The figure shows the swelled absorber (B 4 C) rod. Initially, helium gas fills the gap between the pin and the cladding before irradiation swelling takes place. For VTR, HT9 steel was selected as the cladding and duct material. The main neutron absorbing material used in the VTR is B 4 C. When residing in the core, the neutronics, thermophysical, and mechanical properties of the materials used in a control assembly will degrade due to accumulated neutron damage. Material degradation limits how long a control assembly can reside in the core. Many phenomena affect the control assembly lifetime, such as the loss of reactivity worth due to B 4 C depletion, the mechanical interaction of the absorber rod and the cladding due to B 4 C swelling, the helium gas buildup in the pin due to B-10 capture, etc. B 4 C swelling, which causes closure of the gap between the absorber rod and the cladding, is usually considered as the main limiting factor from past experience. An initial study was conducted at PNNL to evaluate the irradiation behavior of a VTR control assembly. The evaluation was performed using the CNRD2 code that was initially developed for the FFTF. The study also included an assessment of the VTR control assembly and focused on a 61-pin control assembly design, which is different from that used (37-pin design) in the core design study. The study conducted by PNNL was reviewed independently by ANL. A Python script referred to as the Control Assembly Evaluation Script (CAES) was developed for the independent review and additional assessment of 37-pin control assembly design. The script has focused on the assessment of the absorber rod swelling for its importance in determining the control assembly lifetime. CAES uses geometry, neutronics, materials data as input to predict the swelling of the absorber rod during its residence in the reactor core. The results from CAES showed some non-negligible differences against the PNNL results. Some of the differences can be attributed to the different interpretation of the control rod assembly dimensions. To resolve this issue, a benchmark exercise was proposed. The benchmark specification was developed by PNNL. The benchmark exercise was performed independently at PNNL and ANL using different codes/scripts (CRND2 and CAES). This memo documents the results calculated using the different codes. However, this report is limited to presenting the results obtained. Further investigation of the cause of the observed difference will be performed as part of future activities, pending continuation of the VTR program.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
NASA NTRS1989

Distributed neural control of a hexapod walking vehicle

There has been a long standing interest in the design of controllers for multilegged vehicles. The approach is to apply distributed control to this problem, rather than using parallel computing of a centralized algorithm. Researchers describe a distributed neural network controller for hexapod locomotion which is based on the neural control of locomotion in insects. The model considers the simplified kinematics with two degrees of freedom per leg, but the model includes the static stability constraint. Through simulation, it is demonstrated that this controller can generate a continuous range of statically stable gaits at different speeds by varying a single control parameter. In addition, the controller is extremely robust, and can continue the function even after several of its elements have been disabled. Researchers are building a small hexapod robot whose locomotion will be controlled by this network. Researchers intend to extend their model to the dynamic control of legs with more than two degrees of freedom by using data on the control of multisegmented insect legs. Another immediate application of this neural control approach is also exhibited in biology: the escape reflex. Advanced robots are being equipped with tactile sensing and machine vision so that the sensory inputs to the robot controller are vast and complex. Neural networks are ideal for a lower level safety reflex controller because of their extremely fast response time. The combination of robotics, computer modeling, and neurobiology has been remarkably fruitful, and is likely to lead to deeper insights into the problems of real time sensorimotor control.

Beer, R. D.↗
DOE OSTI2020

HAZARD ANALYSIS OF DIGITAL ENGINEERED SAFETY FEATURES ACTUATION SYSTEM IN ADVANCED NUCLEAR POWER PLANTS USING A REDUNDANCY-GUIDED APPROACH

Replacing the existing aging analog instrumentation and control (I&C) systems with modern safety control and protection digital technology offers one of the foremost means of performance improvements and cost reductions for the existing nuclear power plants (NPPs). However, the qualification of digital I&C systems remains a challenge, especially considering the issue of software common-cause failures (CCFs), which are difficult to address. With the application and upgrades of advanced digital I&C systems, software CCFs have become a potential threat to plant safety because most redundant designs use similar digital platforms or software in the operating and application systems. With complex designs of multilayer redundancy to meet the single-failure criterion, digital I&C safety systems (e.g., engineered safety-features actuation system [ESFAS]) are of a particular concern in the U.S. Nuclear Regulatory Commission (NRC) licensing procedures. This paper applies a modularized approach to conduct redundancy-guided systems-theoretic hazard analysis for an advanced digital ESFAS with multilevel redundancy designs. Systematic methods and risk-informed tools are incorporated to address both hardware and software CCFs, which provide guidance to eliminate the triggers of potential single points of failure in the design of digital safety systems in advanced plant designs.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
DOE OSTI2020

Transient Safety Filter Design for Grid-Forming Inverters

Unlike conventional generators, inverter-based generation are fundamentally incapable of providing rotational inertia. While grid-forming inverters alleviate some of that problem by synthesizing small inertia via feedback control, additional control mechanisms are needed to ensure safety and security during transients. In this paper, we propose novel real-time safety-constrained feedback controllers (``safety filters'') for droop-based (grid-forming) inverters to ensure transient security of the grid. The safety filter acts as a buffer between the network operational layer and the inverter-control layer, and only lets those dispatch control signals pass to the inverter droop-controller, which are guaranteed to not violate the safety specifications (frequency, voltage, current limits). Using a distributed barrier certificates method, we construct sector-like conditions on the control policies, which guarantee the satisfaction of transient safety specifications. Sum-of-square programming is used to synthesize the safety filters. Numerical simulation results are provided to illustrate the performance of the proposed filter on inverter-based microgrids.

Kundu, Soumya↗
DOE OSTI2024

An Integrated Framework for Risk Assessment of Safety-related Digital Instrumentation and Control Systems in Nuclear Power Plants: Methodology Advancement and Application

This report documents activities performed by Idaho National Laboratory (INL) during fiscal year (FY) 2024 for the U.S. Department of Energy (DOE) Light Water Reactor Sustainability (LWRS) Program, Risk Informed Systems Analysis (RISA) Pathway, Digital Instrumentation and Control (DI&C) Risk Assessment project. The goal of the RISA Pathway is to optimize safety margins and minimize uncertainties to achieve economic efficiencies while maintaining high levels of safety. This is accomplished by providing scientific basis to better represent safety margins and factors that contribute to cost and safety, and by developing new technologies that reduce operating costs. The research efforts for FY 2024 encompass methodology refinement and exploration. The efforts include: (1) The implementation of a natural language processing tool to expedite key aspects of the reliability analysis methods developed by INL; (2) advances to support intersystem CCF analysis by providing guidance for and identification of coupling mechanisms that may contribute to CCF; (3) the investigation of how generative artificial intelligence tools can aid in hazard analysis and diversity and defense in depth (i.e., D3) assessments; (4) Industry collaboration, allowing the demonstration of and INL's risk assessment tools to support risk assessment of DI&C systems at early and late stages of development; (4) a roadmap for the development of a software for each of INL's risk assessment tools; (5) The development of a theory and methodology manual for a risk quantification methodology; (6) the development of a reliability analysis for machine learning (ML)-integrated control systems.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
NASA NTRS2005

Applying Qualitative Hazard Analysis to Support Quantitative Safety Analysis for Proposed Reduced Wake Separation Conops

This paper describes a scenario-driven hazard analysis process to identify, eliminate, and control safety-related risks. Within this process, we develop selective criteria to determine the applicability of applying engineering modeling to hypothesized hazard scenarios. This provides a basis for evaluating and prioritizing the scenarios as candidates for further quantitative analysis. We have applied this methodology to proposed concepts of operations for reduced wake separation for closely spaced parallel runways. For arrivals, the process identified 43 core hazard scenarios. Of these, we classified 12 as appropriate for further quantitative modeling, 24 that should be mitigated through controls, recommendations, and / or procedures (that is, scenarios not appropriate for quantitative modeling), and 7 that have the lowest priority for further analysis.

Shortle, John F.↗
NASA NTRS2005

The Integrated Safety-Critical Advanced Avionics Communication and Control (ISAACC) System Concept: Infrastructure for ISHM

Integrated System Health Management (ISHM) architectures for spacecraft will include hard real-time, critical subsystems and soft real-time monitoring subsystems. Interaction between these subsystems will be necessary and an architecture supporting multiple criticality levels will be required. Demonstration hardware for the Integrated Safety-Critical Advanced Avionics Communication & Control (ISAACC) system has been developed at NASA Marshall Space Flight Center. It is a modular system using a commercially available time-triggered protocol, ?Tp/C, that supports hard real-time distributed control systems independent of the data transmission medium. The protocol is implemented in hardware and provides guaranteed low-latency messaging with inherent fault-tolerance and fault-containment. Interoperability between modules and systems of modules using the TTP/C is guaranteed through definition of messages and the precise message schedule implemented by the master-less Time Division Multiple Access (TDMA) communications protocol. "Plug-and-play" capability for sensors and actuators provides automatically configurable modules supporting sensor recalibration and control algorithm re-tuning without software modification. Modular components of controlled physical system(s) critical to control algorithm tuning, such as pumps or valve components in an engine, can be replaced or upgraded as "plug and play" components without modification to the ISAACC module hardware or software. ISAACC modules can communicate with other vehicle subsystems through time-triggered protocols or other communications protocols implemented over Ethernet, MIL-STD- 1553 and RS-485/422. Other communication bus physical layers and protocols can be included as required. In this way, the ISAACC modules can be part of a system-of-systems in a vehicle with multi-tier subsystems of varying criticality. The goal of the ISAACC architecture development is control and monitoring of safety critical systems of a manned spacecraft. These systems include spacecraft navigation and attitude control, propulsion, automated docking, vehicle health management and life support. ISAACC can integrate local critical subsystem health management with subsystems performing long term health monitoring. The ISAACC system and its relationship to ISHM will be presented.

Gwaltney, David A.↗
NASA NTRS1963

FLIGHT SAFETY ASPECTS OF MANNED SPACE FLIGHT

Flight safety program for mercury manned space vehicle consisting of development engineering and factory rollout inspections, interface control, flight safety reviews, and mission simulation

MANNED SPACECRAFT↗
NASA NTRS2016

Design and Development of a Flight Route Modification, Logging, and Communication Network

There is an overwhelming desire to create and enhance communication mechanisms between entities that operate within the National Airspace System. Furthermore, airlines are always extremely interested in increasing the efficiency of their flights. An innovative system prototype was developed and tested that improves collaborative decision making without modifying existing infrastructure or operational procedures within the current Air Traffic Management System. This system enables collaboration between flight crew and airline dispatchers to share and assess optimized flight routes through an Internet connection. Using a sophisticated medium-fidelity flight simulation environment, a rapid-prototyping development, and a unified modeling language, the software was designed to ensure reliability and scalability for future growth and applications. Ensuring safety and security were primary design goals, therefore the software does not interact or interfere with major flight control or safety systems. The system prototype demonstrated an unprecedented use of in-flight Internet to facilitate effective communication with Airline Operations Centers, which may contribute to increased flight efficiency for airlines.

Merlino, Daniel K.↗