A Risk-Based Framework for Power System Modeling to Improve Resilience to Extreme Events
Not Available
24 POWER TRANSMISSION AND DISTRIBUTION↗
SEARCH · Search NASA
Results for “Probabilistic risk analysis”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
ADETS User Manual
ADETS (Automated DEpletion Transport System) calculates coupled neutronic/isotopic results for nuclear systems and produces a large number of criticality and burnup results based on various material feed/removal specifications, power(s), and time intervals. ADETS is a fully automated tool that links the LANL MCNP Monte Carlo transport code with the SCALE system, specifically ORIGEN-ARP (radioactive decay and burnup code). Additionally, ADETS can compute the dose at various distances of the reactor using a point gamma source, whose characteristics are computed by ORIGEN-ARP. In addition, ADETS is fully coupled with the Uncertanty Quantification, Probabilistic Risk Assessment, Parameter Optimization and Data Analysis code RAVEN (developed at the Idaho National Laboratory as well). RAVEN is released with ADETS but MCNP and SCALE (ORIGEN-ARP) are not included.
42 ENGINEERING↗
An Earth Entry Vehicle For Returning Samples From Mars
The driving requirement for design of a Mars Sample return mission is assuring containment of the returned samples. The impact of this requirement on developmental costs, mass allocation, and design approach of the Earth Entry Vehicle is significant. A simple Earth entry vehicle is described which can meet these requirements and safely transport the Mars Sample Return mission's sample through the Earth's atmosphere to a recoverable location on the surface. Detailed analysis and test are combined with probabilistic risk assessment to design this entirely passive concept that circumvents the potential failure modes of a parachute terminal descent system. The design also possesses features that mitigate other risks during the entry, descent, landing and recovery phases. The results of a full-scale drop test are summarized.
Mitcheltree, R.↗
A Probabilistic Approach to Model Update
Finite element models are often developed for load validation, structural certification, response predictions, and to study alternate design concepts. In rare occasions, models developed with a nominal set of parameters agree with experimental data without the need to update parameter values. Today, model updating is generally heuristic and often performed by a skilled analyst with in-depth understanding of the model assumptions. Parameter uncertainties play a key role in understanding the model update problem and therefore probabilistic analysis tools, developed for reliability and risk analysis, may be used to incorporate uncertainty in the analysis. In this work, probability analysis (PA) tools are used to aid the parameter update task using experimental data and some basic knowledge of potential error sources. Discussed here is the first application of PA tools to update parameters of a finite element model for a composite wing structure. Static deflection data at six locations are used to update five parameters. It is shown that while prediction of individual response values may not be matched identically, the system response is significantly improved with moderate changes in parameter values.
Horta, Lucas G.↗
Earth Entry Vehicle for Mars Sample Return
The driving requirement for design of a Mars Sample return mission is assuring containment of the returned samples. The impact of this requirement on developmental costs, mass allocation, and design approach of the Earth Entry Vehicle is significant. A simple Earth entry vehicle is described which can meet these requirements and safely transport the Mars Sample Return mission's sample through the Earth's atmosphere to a recoverable location on the surface. Detailed analysis and test are combined with probabilistic risk assessment to design this entirely passive concept that circumvents the potential failure modes of a parachute terminal descent system. The design also possesses features that mitigate other risks during the entry, descent, landing and recovery phases. The results of a full-scale drop test are summarized.
Mitcheltree, R. A.↗
Risk-Informed Condition Evaluation of Solar-centered Energy Generation and Distribution Networks through Bayesian Learning and Inference
We develop a methodology based on Bayesian inference over Probabilistic Graphical Models (PGMs) to understand and quantify risk in solar-centered grids using targeted measurements and learned system behavior. Being non-prescriptive but, rather, able to infer system behavior and, ultimately, address risk queries from data, our machine learning-type paradigm is tailored for diverse topologies and threat scenarios often associated with distributed energy generation and photovoltaic distributed energy resources (PV-DERs) in particular. We describe algorithmic processes for: (i) learning the structure of PGMs that result from attack-prone PV-DER-proliferated distribution systems, (ii) quantifying cause-effect relationships, and (iii) evaluating risk queries based on diverse evidence. The contributions are illustrated on a residential grid subject to output impairment attacks on its PV-DER infrastructure.
24 POWER TRANSMISSION AND DISTRIBUTION↗
Probability of failure and risk assessment of propulsion structural components
Because of the increasing need to account for the uncertainties in material properties, loading conditions, geometry, etc., a methodology was developed to determine structural reliability and to assess the associated risk. The methodology consists of a probabilistic structural analysis by a probabilistic finite element computer code, numerical evaluation of stochastic structures under stress (NESSUS), and a generic probabilistic material property model. The methodology is versatile and is equally applicable to structures operating at high and cryogenic temperature environments. Results obtained demonstrate that the issues of structural reliability and risk can be formally evaluated by using the methodology developed which is inclusive of the uncertainties in material properties, structural parameters, and loading conditions. The methodology is described in some detail with illustrative examples.
Shiao, Michael C.↗
Derivation of the Most Influential Medical Conditions for An Extended Duration Artemis Mission
BACKGROUND: The risk of loss of mission due to medical conditions may be influenced by loss of crew life (LOCL), need for evacuation (RTDC; return to definitive care), and crew task time lost. Predicting what medical conditions are most likely to lead to crew morbidity and mortality may influence medical system design, clinical capability prioritization, and research strategies. NASA’s Informing Mission Planning via Analysis of Complex Tradespaces tool (IMPACT) applies Probabilistic Risk Assessment (PRA) methodology to assess these risks. OVERVIEW: A team of subject matter experts (SME) from a variety of medical disciplines developed a consensus-based process to determine 120 of the most clinically relevant medical conditions for long-duration exploration missions (LDEMs) . This IMPACT Condition List (ICL) expanded upon previous work done for Integrated Medical Model (IMM). For each condition a best-case and worst-case definition were derived. These definitions were used to identify probability of occurrence, proportion of cases that are best case vs. worst case, clinical phase duration, and risk of outcomes (task time loss [TTL], RTDC, and LOCL) for both treated and untreated states. These data were sources from existing spaceflight databases (e.g. Longitudinal Survey of Astronaut Health), relevant models (e.g. the ISS fire model), and/or terrestrial literature. Each condition was then tied to diagnostic and therapeutic resources and capabilities. IMPACT was then run for the LDLOLS DRM (see Abstract #2 for this panel). DISCUSSION: This abstract will present the process for generating the IMPACT condition list, the relevant data for each clinical condition, and present results for the ten most influential conditions impacting LOCL, RTDC, and TTL for a representative extended duration Artemis mission.
A Nelson↗
Application of Fault Management Theory to the Quantitative Selection of a Launch Vehicle Abort Trigger Suite
The theory of System Health Management (SHM) and of its operational subset Fault Management (FM) states that FM is implemented as a "meta" control loop, known as an FM Control Loop (FMCL). The FMCL detects that all or part of a system is now failed, or in the future will fail (that is, cannot be controlled within acceptable limits to achieve its objectives), and takes a control action (a response) to return the system to a controllable state. In terms of control theory, the effectiveness of each FMCL is estimated based on its ability to correctly estimate the system state, and on the speed of its response to the current or impending failure effects. This paper describes how this theory has been successfully applied on the National Aeronautics and Space Administration's (NASA) Space Launch System (SLS) Program to quantitatively estimate the effectiveness of proposed abort triggers so as to select the most effective suite to protect the astronauts from catastrophic failure of the SLS. The premise behind this process is to be able to quantitatively provide the value versus risk trade‐off for any given abort trigger, allowing decision makers to make more informed decisions. All current and planned crewed launch vehicles have some form of vehicle health management system integrated with an emergency launch abort system to ensure crew safety. While the design can vary, the underlying principle is the same: detect imminent catastrophic vehicle failure, initiate launch abort, and extract the crew to safety. Abort triggers are the detection mechanisms that identify that a catastrophic launch vehicle failure is occurring or is imminent and cause the initiation of a notification to the crew vehicle that the escape system must be activated. While ensuring that the abort triggers provide this function, designers must also ensure that the abort triggers do not signal that a catastrophic failure is imminent when in fact the launch vehicle can successfully achieve orbit. That is, the abort triggers must have low false negative rates to be sure that real crew‐threatening failures are detected, and also low false positive rates to ensure that the crew does not abort from non‐crew‐threatening launch vehicle behaviors. The analysis process described in this paper is a compilation of over six years of lessons learned and refinements from experiences developing abort triggers for NASA's Constellation Program (Ares I Project) and the SLS Program, as well as the simultaneous development of SHM/FM theory. The paper will describe the abort analysis concepts and process, developed in conjunction with SLS Safety and Mission Assurance (S&MA) to define a common set of mission phase, failure scenario, and Loss of Mission Environment (LOME) combinations upon which the SLS Loss of Mission (LOM) Probabilistic Risk Assessment (PRA) models are built. This abort analysis also requires strong coordination with the Multi‐Purpose Crew Vehicle (MPCV) and SLS Structures and Environments (STE) to formulate a series of abortability tables that encapsulate explosion dynamics over the ascent mission phase. The design and assessment of abort conditions and triggers to estimate their Loss of Crew (LOC) Benefits also requires in‐depth integration with other groups, including Avionics, Guidance, Navigation and Control(GN&C), the Crew Office, Mission Operations, and Ground Systems. The outputs of this analysis are a critical input to SLS S&MA's LOC PRA models. The process described here may well be the first full quantitative application of SHM/FM theory to the selection of a sensor suite for any aerospace system.
Lo, Yunnhon↗
Evaluation of Physical Security Risk for Potential Implementation of FLEX using Dynamic Simulation Methods
The requirements for United States nuclear power plants to maintain a large onsite physical security force contribute to their large operational costs. The cost of maintaining the current physical security posture is approximately 10% of the overall operation and maintenance budget for commercial nuclear power plants. The goal of the Light Water Reactor Sustainability Program Physical Security Pathway is to develop tools, methods, and technologies and provide the technical basis for an optimized physical security posture. This pathway will analyze and minimize the conservatisms built into current security postures in order to reduce security costs while still ensuring adequate security and operational safety. The research performed at Idaho National Laboratory within this pathway has successfully developed a dynamic force-on-force (FOF) modeling framework using various computer simulation tools and integrated them with the dynamic assessment Event Modeling Risk Assessment using Linked Diagrams (EMRALD) tool. This document provides an overview of lessons learned in applying a dynamic computational framework that links results from a commercially available FOF simulation tool, a commercially available thermal-hydraulic tool, and EMRALD to an operating commercial nuclear power plant. This process of including plant procedures and multiple analysis results is being called Modeling and Analysis for Safety Security using Dynamic EMRALD Framework. Previous reports described how a user could integrate their plant-specific FOF models with the dynamic simulation tool EMRALD, model operator actions, integrate with probabilistic risk assessment tools, such as Computer Aided Fault Tree Analysis System or Systems Analysis Programs for Hands-on Integrated Reliability Evaluations, and with thermal-hydraulic tools, such as RELAP-5. Previous reports applied various combinations of available simulations codes with EMRALD using generic plant models to demonstrate how to perform the analysis. This report documents the results of applying the dynamic computational framework to an actual nuclear facility using their security scenarios and timelines. The purpose of this study was to verify that results achieved using generic models are similar to actual plant results and to refine our guidance of the use of the framework. Such an assessment enables further analysis, such as what-if scenarios and staff-reduction evaluation, thereby optimizing physical security at plants. NOTE: The work performed in this report is based on a generic EMRALD model with actual plant data used for the analysis. However, only the generic model and general results of the analysis are in the report. No plant’s sensitive information is discussed in this report. The discussion shows examples of insights that can be obtained from the MASS-DEF methodology.
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
Probabilistic analysis of air carrier accidents
In order to estimate the potential risks due to carbon fibers (CF) released from aircraft accidents, it was necessary to quantify the probability of an accident or incident at a major hub airport. This probability was contingent upon various conditions surrounding the incident including the phase of operation, aircraft type, and the weather conditions. The type of accident predicted was categorized according to its location relative to the runway and the severity of damage sustained. The methodology utilized to estimate the probability of a specific type of accident is outlined and the various models that were developed in the course of this work are described.
Source record↗
Comparison of Artemis 2 and Artemis 5 Model Outcomes Using the Impact Probabilistic Risk Assessment Tool
BACKGROUND The Artemis campaign is a Moon exploration program with a series of six planned missions, five of which will be crewed. These five crewed missions will contain a single mission segment (space flight), or multiple mission segments involving space flight (Orion), lunar landing (LTV) and/or space habitat (Gateway). Each crewed segment faces the risk of unique medical conditions, necessitating medical sets/kits tailored to those specificities. To support and enable a data-driven and evidence-based decision-making process through out a mission’s life cycle, a software tool called IMPACT was developed. Using probabilistic risk assessment (PRA) methodologies, IMPACT (Informing Mission Planning via Analysis of Complex Tradespaces) is a novel tool built for analyzing the possibility of encountering complex medical risks during space flight, and for identifying the medical resources and capabilities needed to treat those potential at-risk medical conditions. This presentation will seek to compare IMPACT’s computational results upon potential complex space medical conditions (e.g., sprain/strain back or sleep disturbance) using IMPACT’s risk metrics and the associated optimized medical sets/kits between two Artemis missions: single segment Artemis 2 and multi-segmented Artemis 5. OVERVIEW By identifying potential medical conditions in space using input criteria such as crew quantity and composition, certain crew physical characteristics, mission duration and mission activities, IMPACT can produce analyses on the type of medical resources and capabilities needed to produce an optimized medical set/kit to address those medical conditions. IMPACT achieves this by performing hundreds of thousands of Monte Carlo simulations of missions to build aggregate pictures of medical risk. IMPACT’s risk metrics include loss of crew life (LOCL) – a measure of crew mortality due to medical conditions in space, return to definitive care (RTDC) – the need to perform crew evacuation, and task time lost (TTL) – a measure of the inability to perform activities due to crew disability. These risk metrics are applied to every medical condition identified by IMPACT’s computation analyses for every segment of the mission. Medical sets/kits are optimized to address these medical conditions but must fit within the stated Artemis Design Reference Mission (DRM) request for mass and volume physical size constraints. ANTICIPATED ANALYSIS AND CONCLUSION Using two Artemis missions, Artemis 2 and Artemis 5, IMPACT will provide the analyses for comparison of medical set/kit contents based upon mass and/or volume requirements and identify the at-risk medical conditions within both missions. This paper serves as an initial exploration of probabilistic risk assessment (PRA) medical risk calculations between two crewed Artemis missions and is not intended to be deemed the official medical response for the Artemis campaign.
probabilistic risk assessment↗
Reliability and risk assessment of structures
Development of reliability and risk assessment of structural components and structures is a major activity at Lewis Research Center. It consists of five program elements: (1) probabilistic loads; (2) probabilistic finite element analysis; (3) probabilistic material behavior; (4) assessment of reliability and risk; and (5) probabilistic structural performance evaluation. Recent progress includes: (1) the evaluation of the various uncertainties in terms of cumulative distribution functions for various structural response variables based on known or assumed uncertainties in primitive structural variables; (2) evaluation of the failure probability; (3) reliability and risk-cost assessment; and (4) an outline of an emerging approach for eventual certification of man-rated structures by computational methods. Collectively, the results demonstrate that the structural durability/reliability of man-rated structural components and structures can be effectively evaluated by using formal probabilistic methods.
Chamis, C. C.↗
Adapting Traditional Hazards Analysis Methods to Address Cyber Risks
Traditional hazards analysis (HA) methods, originally developed to address physical and operational risks, often fall short when it comes to identifying and mitigating cyber threats. These cyber threats pose unique and evolving risks to critical infrastructure and industrial control systems (ICS). This report explores the integration of Cyber-Informed Engineering (CIE) principles into existing HA methods to enhance their ability to address cyber-induced risks. CIE provides organizations with a practical, cost-effective approach to closing the gap between traditional HA methods and the need for cyber risk mitigation. By leveraging existing safety processes and controls, CIE allows users to examine and mitigate cyber vulnerabilities without overhauling existing HA methods. This report identifies areas where HA and CIE naturally align and where their approaches diverge. It emphasizes how CIE principles can be used to adapt HA methods, broadening their scope to include cyber risks and enabling the mitigation of cyber- induced impacts alongside traditional hazards and failure scenarios. This report examines how CIE can be applied across various HA methods—such as Hazard and Operability Studies (HAZOP), Probabilistic Risk Assessment (PRA), Failure Modes and Effects Analysis (FMEA), Systems-Theoretic Process Analysis (STPA), Hazard and Consequence Analysis for Digital Systems (HAZCADS), and Layers of Protection Analysis (LOPA). It provides strategies for integrating CIE to strengthen the identification, assessment, and mitigation of cyber-induced risks. The findings offer a structured entry point for organizations to embed CIE concepts into hazards and safety analyses, as well as broader engineering processes, ultimately supporting the design and operation of a more resilient infrastructure.
42 ENGINEERING↗
Adapting Traditional Hazards Analysis Methods to Address Cyber Risks
Traditional hazards analysis (HA) methods, originally developed to address physical and operational risks, often fall short when it comes to identifying and mitigating cyber threats. These cyber threats pose unique and evolving risks to critical infrastructure and industrial control systems (ICS). This report explores the integration of Cyber-Informed Engineering (CIE) principles into existing HA methods to enhance their ability to address cyber-induced risks. CIE provides organizations with a practical, cost-effective approach to closing the gap between traditional HA methods and the need for cyber risk mitigation. By leveraging existing safety processes and controls, CIE allows users to examine and mitigate cyber vulnerabilities without overhauling existing HA methods. This report identifies areas where HA and CIE naturally align and where their approaches diverge. It emphasizes how CIE principles can be used to adapt HA methods, broadening their scope to include cyber risks and enabling the mitigation of cyber- induced impacts alongside traditional hazards and failure scenarios. This report examines how CIE can be applied across various HA methods—such as Hazard and Operability Studies (HAZOP), Probabilistic Risk Assessment (PRA), Failure Modes and Effects Analysis (FMEA), Systems-Theoretic Process Analysis (STPA), Hazard and Consequence Analysis for Digital Systems (HAZCADS), and Layers of Protection Analysis (LOPA). It provides strategies for integrating CIE to strengthen the identification, assessment, and mitigation of cyber-induced risks. The findings offer a structured entry point for organizations to embed CIE concepts into hazards and safety analyses, as well as broader engineering processes, ultimately supporting the design and operation of a more resilient infrastructure.
42 - ENGINEERING↗
Electrical Substation Configuration Effect on Substation Reliability
The nation’s electrical grid must be reliable because of its critical role in the economy, defense, and security of the nation. Many common tasks and industrial operations rely on proper electrical power distribution. In the design of new bus systems or evaluation of existing bus systems, the type of bus configuration affects the risk, reliability, maintenance, and cost of the system. This work utilizes Systems Analysis Programs for Hands-on Integrated Reliability Evaluations (SAPHIRE) to perform a probabilistic risk assessment (PRA) based sensitivity study on the reliability of substations with differing bus configurations. This study examines single bus, main and transfer, breaker and a half, double bus/double breaker, and ring bus configurations applied to busses of varying number of lines. The case variances, methods, and rankings presented can provide a guide for bus configuration for future electrical grid design and analysis.
24 POWER TRANSMISSION AND DISTRIBUTION↗
Evaluation of Joint Cyber/Safety Risk in Nuclear Power Systems
This report presents an analysis of the Emergency Core Cooling System (ECCS) for a generic Boiling Water Reactor (BWR)-4 NPP. The Electric Power Research Institute (EPRI) developed Hazards and Consequences Analysis for Digital Systems (HAZCADS) process is applied to the ECCS and its subsystems to identify unsafe control actions (UCAs) which act as possible cyber events of concern. The analysis is performed for two design basis events: Small-break Loss of Coolant Accident (SLOCA) and general transients (TRANS), such as unintended reactor trip. In previous work, HAZCADS UCAs were combined with other cyber-attack analysis to develop a risk-informed approach; however, this was for a single system. This report explores advanced systems engineering modeling approaches to model the interactions between digital assets across multiple systems which may be targeted by cyber adversaries. The complex and interdependent design of digital systems has the potential to introduce emergent cyber properties that are generally not covered by hazard analyses nor formal nuclear Probabilistic Risk Assessment (PRA). The R&D and supporting analysis presented here explores approaches to predict and manage how interdependent system properties effect risk. To show the potential impact of a successful cyber-attack to formal PRA event tree probabilities, HAZCADS analysis was also used. HAZCADS was also used to model the automatic depressurization system (ADS) automatic actuation. This analysis extended to an integrated system analysis for common-cause failure (CCF). In this aspect, the HAZCADS analysis continued by analyzing plant design details for system connectivity in support of critical plant functions. A dependency matrix was developed to depict the integrated functionality of the interconnected systems. Areas of potential CCF are indicated. Future work could include adversary attack development to show how CCF could be caused, resulting in PRA events. Across the multiple systems that comprise the ECCS, the analysis shows that the change in such probabilities was very different between systems. This indicates that some systems have a larger potential risk impact from successful cyber-attack or digital failure, which indicates a need for these systems to have a higher priority for design and defensive measures. Furthermore, we were able to establish that a risk analysis using any arbitrary threat model establishes an ordering of components with regard to cyber-risk. This ordering can be used to influence the overall system design with an eye to lowering risk, or as a way to understand real-time risk to operational systems based on a current threat landscape. Expert knowledge of both the analysis process and the system being analyzed is required to perform a HAZCADS analysis. The need for a tiered risk analysis is demonstrated by the results of this report.
21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
Near-Earth Phase Risk Comparison of Human Mars Campaign Architectures
A risk analysis of the launch, orbital assembly, and Earth-departure phases of human Mars exploration campaign architectures was completed as an extension of a probabilistic risk assessment (PRA) originally carried out under the NASA Constellation Program Ares V Project. The objective of the updated analysis was to study the sensitivity of loss-of-campaign risk to such architectural factors as composition of the propellant delivery portion of the launch vehicle fleet (Ares V heavy-lift launch vehicle vs. smaller/cheaper commercial launchers) and the degree of launcher or Mars-bound spacecraft element sparing. Both a static PRA analysis and a dynamic, event-based Monte Carlo simulation were developed and used to evaluate the probability of loss of campaign under different sparing options. Results showed that with no sparing, loss-of-campaign risk is strongly driven by launcher count and on-orbit loiter duration, favoring an all-Ares V launch approach. Further, the reliability of the all-Ares V architecture showed significant improvement with the addition of a single spare launcher/payload. Among architectures utilizing a mix of Ares V and commercial launchers, those that minimized the on-orbit loiter duration of Mars-bound elements were found to exceed the reliability of no spare all-Ares V campaign if unlimited commercial vehicle sparing was assumed
Manning, Ted A.↗