SEARCH · Search NASA

Results for “model based mission assurance”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 145 records · Page 8

All sources NASA NTRS DOE OSTI

NASA NTRS2024

Testing of Advanced Capabilities to Enable In-time Safety Management and Assurance for Future Flight Operations

In order to refine an initial Concept of Operations, explore Concepts of Use, and expose/validate requirements for future In-Time Aviation Safety Management Systems (IASMS), testing architectures were created, along with a set of capabilities and underlying information exchange protocols. These systems were conceived and developed based on hazards associated with two envisioned urban area flight domains: (1) highly autonomous small uncrewed aerial systems (sUAS) operating at low altitudes, and (2) highly autonomous air taxis. The initial scope of this development is described in [1]; this report provides an update, focusing on the subsequent developments and test activities. As stated in [1], it is important to note that there are many capabilities already in use by the industry (or soon to be in use) that will play critical roles in future IASMS designs. Those reported here were developed to address a gap in the current state-of-the-art regarding specific hazards/risks, and/or to allow for investigation of the interplay between and across hazard types — particularly regarding how overall safety risk can be reduced or managed effectively. Results of testing and development activities are organized by the operational phase wherein a particular capability would be employed (i.e., preflight, in-flight, and post-flight/off-line). Pre-flight: A set of capabilities were developed to help mitigate safety risk prior to flight (e.g., during flight and mission planning). Results of testing summarize (1) validation activities to raise the Technology Readiness Level (TRL) and (2) evaluation activities where the capabilities were applied to flight/mission planning procedures and used by operators/pilots. For the latter, flight plans were automatically assessed, and operators/pilots were notified of hazardous flight segments so as to enable adjustment of the flight plan and re-evaluation, and/or to better inform go/no-go decisions. Capabilities addressed hazards associated with power consumption, third-party risk, wind, navigation system performance, radiofrequency interference, and proximity to geo-spatial threats (e.g., buildings, trees, and no-fly zones). In-flight: Flight experiments tested capabilities that detect and respond to hazards encountered during flight. In the first series, safety hazards were monitored and assessed onboard, and system-generated mitigation maneuvers were recorded (but not acted upon by the vehicle). In the second series, mitigation maneuver commands directed the aircraft in response to safety hazards (i.e., auto-mitigation). The sUAS used for testing is described in full, as is the test architecture, which included commercial avionics, research avionics, and onboard software designed to detect, assess, and respond to hazards. The onboard system was designed as a run-time assurance framework, consistent with [2] and supportive of both supervisory and automated modes. The primary functions included: real-time risk assessment (RTRA), auto-pilot monitoring, constraint monitoring, and contingency select/triggering. RTRA performs integrated risk assessment considering data from several hazard-related monitors (e.g., battery, motors, navigation, communications, population density, and loss-of-control). Post-flight/off-line: Data monitored and recorded during flights can enable IASMS capabilities that execute after flights have completed (or “off-line”). These include: (1) the ability to identify anomalies and trends that may only be observable when comparing data spanning a number of similar flights; (2) the ability to update and validate pre-flight and in-flight capabilities and any underlying models to improve their performance; (3) the ability to report anomalies/off-nominals that may indicate design changes or maintenance actions are needed; and (4) the ability for humans involved in operations to report safety-relevant observations to help in understanding the flight data and/or the operational context of a flight. Progress on three such capabilities is summarized; the first investigates anomaly detection given a limited set of flight logs and applies an approach previously used for space operations. The second explores what could be identified using a larger set of flight logs, including from web-based forums where flight logs are posted by sUAS autopilot users. The third creates a new means of collecting information on UAS incidents and accidents via the Aviation Safety Reporting System (ASRS).

sUAS↗

NASA NTRS1998

A Cognitive-System Model for En Route Air Traffic Management

NASA Ames Research Center has been engaged in the development of advanced air traffic management technologies whose basic form is cognitive aiding systems for air traffic controller and flight deck operations. In the design and evaluation of such systems the dynamic interaction between the airborne aiding system and the ground-based aiding systems forms a critical coupling for control. The human operator is an integral control element in the system and the optimal integration of human decision and performance parameters with those of the automation aiding systems offers a significant challenge to cognitive engineering. This paper presents a study in full mission simulation and the development of a predictive computational model of human performance. We have found that this combination of methodologies provide a powerful design-aiding process. We have extended the computational model Man Machine Integrated Design and Analysis System (N13DAS) to include representation of multiple cognitive agents (both human operators and intelligent aiding systems), operating aircraft airline operations centers and air traffic control centers in the evolving airspace. The demands of this application require the representation of many intelligent agents sharing world-models, and coordinating action/intention with cooperative scheduling of goals and actions in a potentially unpredictable world of operations. The operator's activity structures have been developed to include prioritization and interruption of multiple parallel activities among multiple operators, to provide for anticipation (knowledge of the intention and action of remote operators), and to respond to failures of the system and other operators in the system in situation-specific paradigms. We have exercised this model in a multi-air traffic sector scenario with potential conflict among aircraft at and across sector boundaries. We have modeled the control situation as a multiple closed loop system. The inner and outer loop alerting structure of air traffic management has many implications that need to be investigated to assure adequate design. First, there are control and stability factors implicit in the design. As the inner loop response time approaches that of the outer loop, system stability may be compromised in that controllers may be solving a problem the nature of which has already been changed by pilot action. Second, information exchange and information presentation for both air and ground must be designed to complement as opposed to compete with each other. Third, the level of individual and shared awareness in trajectory modification and flight conformance needs to be defined. Fourth, the level of required awareness and performance impact of mixed fleet operations and failed-mode recovery must be explored.

Corker, Kevin M.↗

NASA NTRS2007

Full Life-Cycle Defect Management Assessment: Initial Inspection Data Collection Results and Research Questions for Further Study

It is often the case in software projects that when schedule and budget resources are limited, the Verification and Validation (V&V) activities suffer. Fewer V&V activities can be afforded and moreover, short-term challenges can result in V&V activities being scaled back or dropped altogether. As a result, too often the default solution is to save activities for improving software quality until too late in the life-cycle, relying on late-term code inspections followed by thorough testing activities to reduce defect counts to acceptable levels. As many project managers realize, however, this is a resource-intensive way of achieving the required quality for software. The Full Life-cycle Defect Management Assessment Initiative, funded by NASA s Office of Safety and Mission Assurance under the Software Assurance Research Program, aims to address these problems by: Improving the effectiveness of early life-cycle V&V activities to make their benefits more attractive to team leads. Specifically, we focus on software inspection, a proven method that can be applied to any software work product, long before executable code has been developed; Better communicating this effectiveness to software development teams, along with suggestions for parameters to improve in the future to increase effectiveness; Analyzing the impact of early life-cycle V&V on the effectiveness and cost required for late life-cycle V&V activities, such as testing, in order to make the tradeoffs more apparent. This white paper reports on an initial milestone in this work, the development of a preliminary model of inspection effectiveness across multiple NASA Centers. This model contributes toward reaching our project goals by: Allowing an examination of inspection parameters, across different types of projects and different work products, for an analysis of factors that impact defect detection effectiveness. Allowing a comparison of this NASA-specific model to existing recommendations in the literature regarding how to plan effective inspections. Forming a baseline model which can be extended to incorporate factors describing: the numbers and types of defects that are missed by inspections; how such defects flow downstream through software development phases; how effectively they can be caught by testing activities in the late stages of development. The model has been implemented in a prototype web-enabled decision-support tool which allows developers to enter their inspection data and receive feedback based on a comparison against the model. The tool also allows users to access reusable materials (such as checklists) from projects included in the baseline. Both the tool itself and the model underlying it will continue to be extended throughout the remainder of this initiative. As results of analyzing inspection effectiveness for defect containment are determined, they can be shared via the tool and also via updates to existing training courses on metrics and software inspections. Moreover, the tool will help satisfy key CMMI requirements for the NASA Centers, as it will enable NASA to take a global view across peer review results for various types of projects to identify systemic problems. This analysis can result in continuous improvements to the approach to verification.

Shull, Forrest↗

DOE OSTI2025

Advancing Additive Manufacturing Through Artificial Intelligence–Powered, High-Throughput, Nondestructive Characterization and Process Optimization

This Cooperative Research and Development Agreement (CRADA) between Oak Ridge National Laboratory (ORNL) and ZEISS Industrial Metrology has demonstrated the transformative potential of artificial intelligence (AI)-enabled x-ray computed tomography (XCT) to accelerate the qualification and certification of additively manufactured (AM) parts. At the core of this effort is Simurgh, an AI-powered XCT reconstruction framework jointly advanced by ORNL and ZEISS that integrates computer-aided design (CAD) models, physics-based simulations, and deep learning to overcome the long-standing challenges of metal artifact correction, long scan durations, and limited flaw detectability in dense and geometrically complex components. Simurgh enables high-throughput, high-quality 3D reconstruction from sparse and fast scans, which reduces XCT acquisition times by more than an order of magnitude and simultaneously improves defect detection limits by up to fourfold compared with industry-standard approaches. This capability reduces scan costs by more than 50%, lowers labor overhead, and makes XCT characterization economically viable for routine industrial use. By enabling reliable flaw detection in minutes rather than hours, Simurgh facilitates real-time feedback loops for process parameter optimization, which was highlighted in a recent npj Computational Materials (a Nature journal) issue. In the published study, more than 100 alloy coupons were characterized within a single day. This work represents a tenfold acceleration in the development of novel AM alloys and processes compared with conventional workflows. The ZEISS collaboration has also demonstrated the scalability of Simurgh to diverse application domains, including aerospace, nuclear, automotive, and biomedical components; in these applications, ensuring structural integrity is paramount. By drastically reducing barriers to XCT adoption, this partnership has laid the foundation for digital twins and data-driven certification pipelines and directly addressed bottlenecks in qualifying new materials and designs. Together, ORNL and ZEISS have shown that Simurgh advances the state of the art in nondestructive evaluation and aligns with the broader mission of enabling Industry 4.0 manufacturing ecosystems, in which intelligent, cost-effective, rapid quality assurance is integral to accelerating innovation and ensuring safety in critical applications.

36 MATERIALS SCIENCE↗

DOE OSTI2025

Advancing Additive Manufacturing Through Artificial Intelligence–Powered, High-Throughput, Nondestructive Characterization and Process Optimization

36 MATERIALS SCIENCE↗

NASA NTRS2020

Building a standardized Observing System Simulation Experiment (OSSE) framework for Mars

We advocate that the Decadal Survey recommends the NASA Science Mission Directorate to develop a rigorous Observing System Simulation Experiment (OSSE) framework for Mars, to optimize future atmospheric observations. Atmospheric conditions on Mars are a potential hazard source for landing missions. Errors in the estimates of atmospheric density profiles, inadequate knowledge of wind vertical structure and dust concentration as a function of height are likely causes of uncertainty at the landing site on the order of kilometers. An operational real-time weather forecasting capability for Mars would reduce such uncertainties, carrying enormous benefits to future robotic missions, and would be an invaluable prerequisite for human missions.A real-time forecasting capability relies upon three fundamental components: a critical mass of observing systems, a data assimilation system (DAS), and a global forecast model. The DAS allows the model to ingest the data effectively, optimizing the observational information content,and transforming them into a gridded representation of the atmosphere at a given time, called an ‘analysis’. The analysis is the best estimate of the atmospheric state for that time, and also represents a set of ‘initial conditions’ from which a global model can be initialized, to predict a future state of the atmosphere. The connection between analysis and forecast represents the foundation of modern weather forecasting. However, from the point of view of a forecast system,not all observations are equally impactful, partially because of the problem of “observational error correlation”, one important research topic in data assimilation development. For the Earth, partly due to the spontaneous and deregulated development of observations and forecast capabilities worldwide for more than half a century,the use of observations in contemporary operational forecast systems is suboptimal, with many potentially useful data being underutilized. On the contrary, Mars atmospheric scientists are in the unique situation of designing the next-generation observing systems by learning from the experience gathered on the Earth, so as to assure that the future instruments are specifically optimized to give the maximum benefit to a future weather forecast capability.An immensely powerful tool that has been firmly established by atmospheric scientists on the Earth is represented by a properly designed OSSE framework. A realistic OSSE framework cannot only quantify the benefit of future data types, be them surface based or space borne, but can also help design and optimize an entire observational network. Furthermore, OSSEs can provide deep insights into an atmosphere’s behavior, by addressing conceptual problems of its intrinsic predictability and delineating the regions or features of the atmosphere which are more sensitive to additional data and would benefit from a denser sampling. The difficulties posed by OSSEs are fundamentally different for Earth and Mars. For Earth, the enormous data volume imposes a tremendous constraint on any innovation in the observing systems: it is very hard for a single sensor to impact the skill. For Mars, the problem is the opposite: almost any additional instrument will exert some impact. However, OSSEs can help to evaluate the cost/benefit for every sensor and suggest optimal data configuration and density.The purpose of this white paper is to provide an introduction to a rigorously designed OSSE framework, explain the underlying problems and challenges, and engage the Mars community to collaborate with Earth Atmospheric scientists in order to develop a joint-OSSE framework for Mars with the largest consensual basis possible. An OSSE infrastructure would increase the understanding of the Martian atmosphere, would help NASA to optimize instrument specifications and orbit choice, providing the maximium benefit for a given expenditure of resources, and could even help establishing a roadmap for a future real-time weather forecasting capability.

Oreste Reale↗

NASA NTRSDate not supplied

Overview of Micrometeoroid and Orbital Debris Analysis Process for Mars Sample Return Earth Entry System

Introduction: Micrometeoroid and orbital debris (MMOD) risk analyses for the Mars Sample Return (MSR) Earth Entry System (EES) have been significantly more rigorous than previously flown missions because of its categorization as a Class V restricted return mission. This means the returned samples present significant concern for biogenic contamination. These analyses seek to determine if a micrometeoroid or orbital debris strike would result in loss of containment assurance and are summarized in the flowchart in Fig. 1. Methodology: The mission is considered in two MMOD phases: a pre-release phase where the EES is protected by a Micrometeoroid Protection System (MMPS) and a post-release phase called “free-flight” where the EES is exposed directly to the MMOD environment. These phases correspond to interplanetary cruise and imminent re-entry, respectively. To inform the MMPS design, a 30-shot high velocity impact testing (HVIT) series on candidate configurations at NASA White Sands Test Facility was completed in the summer of 2022. Sample post-shot images are shown in Fig 2 [1]. These data are used to baseline the MMPS design and to tune the hydrocode simulations. ALE3D, CTH, and SPHC are the hydrocodes that simulate physics of high-speed impacts [2]. Results generated with these populate a penetration depth versus energy space beyond the testable velocity regime of HVIT (~7 km/s). The penetration depth versus energy space data are used to define a critical projectile diameter function called a Ballistic Limit Equation (BLE), where the projectile “criticality” is determined by zone dependent failure criteria defined a-priori [3]. For example, the nose of the heatshield has a failure criterion of 50% TPS penetration, assigned because the landing loads are concentrated on that region and no substructure damage is permitted. The BLEs for each vehicle material zone are input into the BUMPER 3 code, along with the vehicle surface mesh and the corresponding space environment model, to calculate a probability of penetration or number of penetrations. The environment models, MEM3 for MM and ORDEM 3.2 for OD, simulate the meteoroid environment from 0.2 to 2 au based on the Grün flux equation, and the debris environment up to 40,000 km altitude from Earth surface, respectively [4,5]. Presentation Focus: The presentation or poster will present the results to-date focusing on the full risk analysis process flow seen in Fig. 1. Details on the derivation of the failure criteria will be discussed, along with HVIT results and how these influenced the MMPS configuration baseline decision. Further, results of hydrocode simulations will be presented and the tuning to HVIT outputs will be described. Finally, the strategies that direct the BLE formulation will be reviewed, specifically, for the EES elements that are most exposed to the MMOD environment.

mmod↗

NASA NTRS2018

Overview of Heatshield for Extreme Entry Environment Technology (HEEET) Project

The objective of the Heatshield for Extreme Entry Environment Technology (HEEET) projects is to mature a 3-D Woven Thermal Protection System (TPS) to Technical Readiness Level (TRL) 6 to support future NASA missions to destinations such as Venus and Saturn. Destinations that have extreme entry environments with heat fluxes up to 5000 watts per square centimeter and pressures up to 5 atmospheres, entry environments that NASA has not flown since Pioneer-Venus and Galileo. The scope of the project is broad and can be split into roughly four areas, Manufacturing/Integration, Structural Testing and Analysis, Thermal Testing and Analysis and Documentation. Manufactruing/Integration covers from raw materials, piece part fabrication to final integration on a 1-meter base diameter 45-degree sphere cone Engineering Test Unit (ETU). A key aspect of the project was to transfer as much of the manufacturing technology to industry in preparation to support future mission infusion. The forming, infusion and machining approaches were transferred to Fiber Materials Inc. and FMI then fabricated the piece parts from which the ETU was manufactured. The base 3D-woven material consists of a dual layer weave with a high density outer layer to manage recession in the system and a lower density, lower thermal conductivity inner layer to manage the heat load. At the start of the project it was understood that due to weaving limitations the heat shield was going to be manufactured from a series of tiles. And it was recognized that the development of a seam solution that met the structural and thermal requirements of the system was going to be the most challenging aspect of the project. It was also recognized that the seam design would drive the final integration approach and therefore the integration of the ETU was kept in-house within NASA. A final seam concept has been successfully developed and implemented on the ETU and will be discussed. The structural testing and analysis covers from characterization of the different layers of the infused material as functions of weave direction and temperature, to sub-component level testing such as 4-pt bend testing at sub-ambient and elevated temperature. ETU test results are used to validate the structural models developed using the element and sub-component level tests. Given the seam has to perform both structurally and aerothermally during entry a novel 4-pt bend test fixture was developed allowing articles to be tested while the front surface is heated with a laser. These tests are intended to establish the system's structural capability during entry. A broad range of aerothermal tests (arcjet tests) are being performed to develop material response models for predicting the required TPS thickness to meet a mission's needs and to evaluate failure modes. These tests establish the capability of the system and assure robustness of the system during entry. The final aspect of the project is to develop a comprehensive Design and Data Book such that a future mission will have the information necessary to adopt the technology. This presentation will provide an overview and status of the project and describe the status of the tehnology maturation level for the inner and outer planet as well as earth entry sample return missions.

Ellerby, Don↗

NASA NTRS2022

Assurance Equations: A Cost and Criticality Model for Optimizing Quality Assurance Surveillance

The cost of quality vs cost of failure correction has been a long-running topic of discussion within the Aerospace community. It leads directly to concepts of “risk tolerance”, and risk-based decision-making. It would be valuable if there was a way to compute the optimal investment in customer-executed quality assurance activities using defect significance with respect to performance objectives, the activities’ defect detection effectiveness, and the cost-penalty for late discovery of impactful defects. This optimization is particularly of interest to projects whose budget constraints significantly limit their risk management options.The cost to fix defects (i.e., failure correction) escalates as the project matures. There have been studies attempting to determine the relative cost of fixing defects discovered during various phases of a project life cycle with important implications, all of which suggest growth factors are large. The commonly referred to 1:10:100 rule represents a cost multiplier for repair/rework across the Design to Fab to Test hardware development phases. Cost premiums for QA activities also accumulate when they are treated as mandatory (due to schedule drag) or are performed later than their assigned phase.This paper describes the modeling of development phase -dependencies in the conduct of typical customer-executed quality assurance activities. Our initial modeling encompasses:• Distinct phases of the production lifecycle• Multiple kinds of Defects, each with some a-priori likelihood of being present• Each defect’s impact on performance Objectives for a type of hardware• The cost and efficacy of assurance techniques at detecting such Defects• The costs of fixing those Defects detected in a given phase of the production lifecycleThe model captures assurance activities’ abilities to Detect defects. Upon detection it is assumed that the Defect is immediately fixed. Defects that “escape” detection by some activity may thereafter be detected by a later activity, but by then the cost of fixing the Defect may have escalated. Defects are related to the performance Objectives they would detract from, were those Defects to remain present in the operating system.We have constructed and are exploring, a model that relates the importance of hardware system elements to mission objectives, the impact of types of Defects on those hardware types, the cost of customer-executed assurance activities (i.e., supplier controls) and their effectiveness towards reducing an impactful quality escape, and the cost of Defect correction across production phase. We describe the approach taken to select the key model aspects, why they are relevant to our NASA mission, and our efforts to populate it with relevant and contemporary data. We use a notional example to illustrate model design and function.

Plante, Jeannette↗

NASA NTRSDate not supplied

Dynamic Assurance of Autonomous Systems through Ground Control Software

Assurance cases are being increasingly acknowledged as a way to build trust in complex systems with autonomous capabilities [1]. An assurance case is a comprehensive, defensible, and valid justification that a system will function as intended for the specific mission and operating environment. Such justifications for systems with autonomous capabilities are often based on various probabilistic quantifications [2]. Due to the dynamic nature of the environmental conditions in which these systems operate, as well as the changing nature of the autonomous systems themselves, these probabilistic quantifications cannot be simply estimated once during design time. Rather, they need to be continually evaluated during systems operations to ensure that the assurance case justifications are valid. We refer to the assurance case that combines both the static and dynamic elements as a Dynamic Assurance Case (DAC). Such complex systems with autonomous capabilities are often deployed with a Ground Control Software (GCS) component to enable remote operation. Whether the system is composed of a single unit or a fleet of units, deployed distributed or in remote environments, GCS acts as a window into the behavior of the deployed system. It receives telemetry from the system, issues commands to the system and provides various functionalities to visualize the system performance. We propose a dynamic assurance framework where the GCS acts as a relay between the autonomous system and its DAC. GCS can be used to measure both unit-specific as well as system-wide probabilistic quantifications using the incoming telemetry. We embed these quantifications throughout the DAC as variables that can be updated by external sources. We use the GCS to periodically update these variables, which allows us to continually evaluate the formally defined assurance case justifications. We demonstrate our dynamic assurance framework in the NASA Ames project Troupe1 that aims at developing a fleet of rovers capable of au- tonomously mapping their environment. The rovers work cooperatively, each collecting data for different parts of the environment. Each rover runs an identical core Flight System (cFS) [4] application. Troupe1 uses OpenC3 Cosmos [5] as the ground system, and AdvoCATE [3] to capture the system DAC. We show how we can measure both rover-specific and system-wide quantifications in Cosmos using its Ruby scripting editor and pass them into the DAC modelled in AdvoCATE. Then, we show how these incoming variables can be embedded in different parts of the DAC and how effects of their updates can be observed

Irfan Sljivo↗

NASA NTRS2003

Definition of International GPM GV Research Program

The Global Precipitation Measurement (GPM) Mission will consist of a constellation of rain-measuring satellites, the main member of which (the core satellite) will serve as the measurement reference to the other members of the constellation. The core satellite is being developed jointly by the National Aeronautics and Space Administration (NASA) and the newly-named Japan Aerospace Exploration Agency (JAXA -- previously NASDA) along with its government partner, the Communications Research Laboratory (CRL). The GPM mission was proposed as a follow-up mission to the Tropical Rainfall Measuring Mission (TRMM) by both NASA and NASDA based on the unparalleled scientific success of TRMM, and has recently been joined by the European Space Agency (ESA) via its formulation of the European GPM mission (i.e., EGPM). GPM is an ambitious mission designed to produce accurate and frequent global observations of precipitation (both rain and snow) made possible by replacing the TRMM satellite with the new core satellite carrying an advanced radar-radiometer system, and serving as the centerpiece for the constellation of some eight (8) additional satellites being provided through international cooperation. The core satellite is to be flown up to high latitudes (inclined some 65-70 degrees), and will carry a Ku/Ka-band, nadir-scanning, dual-frequency precipitation radar (DPR) that is being developed by JAXA and CRL, along with a large aperture, extended frequency-range, conically-scanning passive microwave radiometer being developed by NASA and its industrial partners. Each constellation satellite will also carry some type of multi-channel passive microwave radiometer (as well as a multi-beam Ka-band radar in the case of EGPM) whose rain estimates will be calibrated and referenced to those made by the core satellite, producing for the first time fully-global, continuous, and bias-free precipitation datasets. GPM data will be delivered in near-realtime, taking a major step toward the operational use of precipitation information for model initialization and data assimilation in a number of application areas such as hazardous weather forecasting, flood warning, fresh water resource assessment, and crop growth prediction. In addition, GPM data will complement the now-existing global temperature record, allowing for improved assessments of climate change, particularly those processes in which the global water cycle both forces and responds to climatic drifts in global temperature conditions. A foremost element of this international constellation mission is a parallel international ground validation (GV) network. This GV network is needed to determine uncertainties in the rain retrievals, critical for application of the retrieval information in weather and hydrometeorological modeling and climate diagnostics, as well as assurances that the satellite retrievals of surface rainfall are consistent with those actually measured at the surface. The key aspects of this network is that it must be worldwide and created through the GPM partnership process. Therefore the network will consist of a confederation of government agencies, academic organizations, private institutions, and individual scientists from a collection of nations who have initiated the process by gathering in Abingdon to develop the fundamentals of the international GPM GV research programme. Therefore in keeping with our responsibilities as the front-runners of the programme, the main objectives of this workshop are: (1) to present and share opinions on interests, perspectives, and concerns about GPM GV research; (2) to examine the conceptual and/or planned GPM GV site templates from NASA, NASDA, ESA, and other partners; (3) to define the main scientific objectives of the international GPM GV research programme; (4) to formulate a preliminary set of international GPM GV science and measurement requirements; and (5) to convene a Steering Committee to aid the organization of the GPM GV program, to document its science implementation plans, and to aid planning for follow-up GPM GV meetings.

Smith, Eric A.↗

NASA NTRS2011

NASA System Safety Handbook: System Safety Framework and Concepts for Implementation - Volume 1

System safety assessment is defined in NPR 8715.3C, NASA General Safety Program Requirements as a disciplined, systematic approach to the analysis of risks resulting from hazards that can affect humans, the environment, and mission assets. Achievement of the highest practicable degree of system safety is one of NASA's highest priorities. Traditionally, system safety assessment at NASA and elsewhere has focused on the application of a set of safety analysis tools to identify safety risks and formulate effective controls.1 Familiar tools used for this purpose include various forms of hazard analyses, failure modes and effects analyses, and probabilistic safety assessment (commonly also referred to as probabilistic risk assessment (PRA)). In the past, it has been assumed that to show that a system is safe, it is sufficient to provide assurance that the process for identifying the hazards has been as comprehensive as possible and that each identified hazard has one or more associated controls. The NASA Aerospace Safety Advisory Panel (ASAP) has made several statements in its annual reports supporting a more holistic approach. In 2006, it recommended that "... a comprehensive risk assessment, communication and acceptance process be implemented to ensure that overall launch risk is considered in an integrated and consistent manner." In 2009, it advocated for "... a process for using a risk-informed design approach to produce a design that is optimally and sufficiently safe." As a rationale for the latter advocacy, it stated that "... the ASAP applauds switching to a performance-based approach because it emphasizes early risk identification to guide designs, thus enabling creative design approaches that might be more efficient, safer, or both." For purposes of this preface, it is worth mentioning three areas where the handbook emphasizes a more holistic type of thinking. First, the handbook takes the position that it is important to not just focus on risk on an individual basis but to consider measures of aggregate safety risk and to ensure wherever possible that there be quantitative measures for evaluating how effective the controls are in reducing these aggregate risks. The term aggregate risk, when used in this handbook, refers to the accumulation of risks from individual scenarios that lead to a shortfall in safety performance at a high level: e.g., an excessively high probability of loss of crew, loss of mission, planetary contamination, etc. Without aggregated quantitative measures such as these, it is not reasonable to expect that safety has been optimized with respect to other technical and programmatic objectives. At the same time, it is fully recognized that not all sources of risk are amenable to precise quantitative analysis and that the use of qualitative approaches and bounding estimates may be appropriate for those risk sources. Second, the handbook stresses the necessity of developing confidence that the controls derived for the purpose of achieving system safety not only handle risks that have been identified and properly characterized but also provide a general, more holistic means for protecting against unidentified or uncharacterized risks. For example, while it is not possible to be assured that all credible causes of risk have been identified, there are defenses that can provide protection against broad categories of risks and thereby increase the chances that individual causes are contained. Third, the handbook strives at all times to treat uncertainties as an integral aspect of risk and as a part of making decisions. The term "uncertainty" here does not refer to an actuarial type of data analysis, but rather to a characterization of our state of knowledge regarding results from logical and physical models that approximate reality. Uncertainty analysis finds how the output parameters of the models are related to plausible variations in the input parameters and in the modeling assumptions. The evaluation of unrtainties represents a method of probabilistic thinking wherein the analyst and decision makers recognize possible outcomes other than the outcome perceived to be "most likely." Without this type of analysis, it is not possible to determine the worth of an analysis product as a basis for making decisions related to safety and mission success. In line with these considerations the handbook does not take a hazard-analysis-centric approach to system safety. Hazard analysis remains a useful tool to facilitate brainstorming but does not substitute for a more holistic approach geared to a comprehensive identification and understanding of individual risk issues and their contributions to aggregate safety risks. The handbook strives to emphasize the importance of identifying the most critical scenarios that contribute to the risk of not meeting the agreed-upon safety objectives and requirements using all appropriate tools (including but not limited to hazard analysis). Thereafter, emphasis shifts to identifying the risk drivers that cause these scenarios to be critical and ensuring that there are controls directed toward preventing or mitigating the risk drivers. To address these and other areas, the handbook advocates a proactive, analytic-deliberative, risk-informed approach to system safety, enabling the integration of system safety activities with systems engineering and risk management processes. It emphasizes how one can systematically provide the necessary evidence to substantiate the claim that a system is safe to within an acceptable risk tolerance, and that safety has been achieved in a cost-effective manner. The methodology discussed in this handbook is part of a systems engineering process and is intended to be integral to the system safety practices being conducted by the NASA safety and mission assurance and systems engineering organizations. The handbook posits that to conclude that a system is adequately safe, it is necessary to consider a set of safety claims that derive from the safety objectives of the organization. The safety claims are developed from a hierarchy of safety objectives and are therefore hierarchical themselves. Assurance that all the claims are true within acceptable risk tolerance limits implies that all of the safety objectives have been satisfied, and therefore that the system is safe. The acceptable risk tolerance limits are provided by the authority who must make the decision whether or not to proceed to the next step in the life cycle. These tolerances are therefore referred to as the decision maker's risk tolerances. In general, the safety claims address two fundamental facets of safety: 1) whether required safety thresholds or goals have been achieved, and 2) whether the safety risk is as low as possible within reasonable impacts on cost, schedule, and performance. The latter facet includes consideration of controls that are collective in nature (i.e., apply generically to broad categories of risks) and thereby provide protection against unidentified or uncharacterized risks.

Dezfuli, Homayoon↗

NASA NTRS2009

Architectural Analysis of Complex Evolving Systems of Systems

The goal of this collaborative project between FC-MD, APL, and GSFC and supported by NASA IV&V Software Assurance Research Program (SARP), was to develop a tool, Dynamic SAVE, or Dyn-SAVE for short, for analyzing architectures of systems of systems. The project team was comprised of the principal investigator (PI) from FC-MD and four other FC-MD scientists (part time) and several FC-MD students (full time), as well as, two APL software architects (part time), and one NASA POC (part time). The PI and FC-MD scientists together with APL architects were responsible for requirements analysis, and for applying and evaluating the Dyn-SAVE tool and method. The PI and a group of FC-MD scientists were responsible for improving the method and conducting outreach activities, while another group of FC-MD scientists were responsible for development and improvement of the tool. Oversight and reporting was conducted by the PI and NASA POC. The project team produced many results including several prototypes of the Dyn-SAVE tool and method, several case studies documenting how the tool and method was applied to APL s software systems, and several published papers in highly respected conferences and journals. Dyn-SAVE as developed and enhanced throughout this research period, is a software tool intended for software developers and architects, software integration testers, and persons who need to analyze software systems from the point of view of how it communicates with other systems. Using the tool, the user specifies the planned communication behavior of the system modeled as a sequence diagram. The user then captures and imports the actual communication behavior of the system, which is then converted and visualized as a sequence diagram by Dyn-SAVE. After mapping the planned to the actual and specifying parameter and timing constraints, Dyn-SAVE detects and highlights deviations between the planned and the actual behavior. Requirements based on the need to analyze two inter-system communication protocols that are representative of protocols used in the Aerospace industry have been specified. The protocols are related: APL s Common Ground System (CGS) as used in the MErcury Surface, Space ENvironment, GEochemistry, and Ranging (MESSENGER) and the Radiation Belt Space Probes (RBSP) missions. The analyzed communications were implementations of the Telemetry protocol and the CCSDS File Delivery Protocol (CFDP) protocol. Based on these requirements, three prototypes of Dyn-SAVE were developed and applied to these protocols. The application of Dyn-SAVE to these protocols resulted in the detection of several issues. Dyn-SAVE was also applied to several Testbeds that have previously been used for experimentation earlier on this project, as well as, to other protocols and logs for testing its broader applicability. For example, Dyn-SAVE was used to analyze 1) the communication pattern between a web browser and a web server, 2) the system log of a computer in order to detect offnominal computer shut-down behavior, and 3) the actual test cases of NASA Goddard s Core Flight System (CFS) and automatically generated test cases in order to determine the overlap between the two sets of test cases. In all cases, Dyn-SAVE assisted in providing insightful conclusions about each of the cases identified above.

Lindvall, Mikael↗

NASA NTRS2014

Application of Fault Management Theory to the Quantitative Selection of a Launch Vehicle Abort Trigger Suite

The theory of System Health Management (SHM) and of its operational subset Fault Management (FM) states that FM is implemented as a "meta" control loop, known as an FM Control Loop (FMCL). The FMCL detects that all or part of a system is now failed, or in the future will fail (that is, cannot be controlled within acceptable limits to achieve its objectives), and takes a control action (a response) to return the system to a controllable state. In terms of control theory, the effectiveness of each FMCL is estimated based on its ability to correctly estimate the system state, and on the speed of its response to the current or impending failure effects. This paper describes how this theory has been successfully applied on the National Aeronautics and Space Administration's (NASA) Space Launch System (SLS) Program to quantitatively estimate the effectiveness of proposed abort triggers so as to select the most effective suite to protect the astronauts from catastrophic failure of the SLS. The premise behind this process is to be able to quantitatively provide the value versus risk trade‐off for any given abort trigger, allowing decision makers to make more informed decisions. All current and planned crewed launch vehicles have some form of vehicle health management system integrated with an emergency launch abort system to ensure crew safety. While the design can vary, the underlying principle is the same: detect imminent catastrophic vehicle failure, initiate launch abort, and extract the crew to safety. Abort triggers are the detection mechanisms that identify that a catastrophic launch vehicle failure is occurring or is imminent and cause the initiation of a notification to the crew vehicle that the escape system must be activated. While ensuring that the abort triggers provide this function, designers must also ensure that the abort triggers do not signal that a catastrophic failure is imminent when in fact the launch vehicle can successfully achieve orbit. That is, the abort triggers must have low false negative rates to be sure that real crew‐threatening failures are detected, and also low false positive rates to ensure that the crew does not abort from non‐crew‐threatening launch vehicle behaviors. The analysis process described in this paper is a compilation of over six years of lessons learned and refinements from experiences developing abort triggers for NASA's Constellation Program (Ares I Project) and the SLS Program, as well as the simultaneous development of SHM/FM theory. The paper will describe the abort analysis concepts and process, developed in conjunction with SLS Safety and Mission Assurance (S&MA) to define a common set of mission phase, failure scenario, and Loss of Mission Environment (LOME) combinations upon which the SLS Loss of Mission (LOM) Probabilistic Risk Assessment (PRA) models are built. This abort analysis also requires strong coordination with the Multi‐Purpose Crew Vehicle (MPCV) and SLS Structures and Environments (STE) to formulate a series of abortability tables that encapsulate explosion dynamics over the ascent mission phase. The design and assessment of abort conditions and triggers to estimate their Loss of Crew (LOC) Benefits also requires in‐depth integration with other groups, including Avionics, Guidance, Navigation and Control(GN&C), the Crew Office, Mission Operations, and Ground Systems. The outputs of this analysis are a critical input to SLS S&MA's LOC PRA models. The process described here may well be the first full quantitative application of SHM/FM theory to the selection of a sensor suite for any aerospace system.

Lo, Yunnhon↗

NASA NTRSDate not supplied

Analysis of Launch Vehicle Liftoff Debris: Historical Perspective from Space Shuttle and Application to Artemis I

Human exploration-class launch vehicles are inherently prone to debris due to the extreme environments generated during pre-launch operations, liftoff, and flight. The use of cryogenic propellants often requires thermal protection system (TPS) coatings, typically foam, to maintain the propellant conditions in the tank and prevent an accumulation ice on the external surface of the vehicle. Some ice growth is to be expected at umbilical interfaces, vents, flanges, or brackets where it is difficult to apply TPS. This ice may come loose at any time due to wind on the launch pad, structural vibration and acoustics after rocket ignition, or aerodynamic forces during flight. This phenomena is especially apparent on vehicles with no TPS, such as the Saturn V rockets used in the Apollo Program, see Figure 1. During propellant tanking, the thermal contraction of the underlying substrate may generate cracks in the TPS (Figure 1). Chunks of TPS can release due to the expansion of ingested gas from cryopumping or from aerodynamic forces if the crack creates an offset surface. Most foams will also have a certain amount of “popcorning” where small pieces of foam will pop off during flight because of the differential between the static surface pressure and the pressure of the gas trapped in the foam cell structure. There are a number of other coating or closeout materials that may be shed from the vehicle and become debris. During pre-launch operations and liftoff, the vehicle may also be exposed to debris originating from the launch pad or ground support equipment. This debris is separate from foreign object debris, or FOD, which is not intended to be present and is strictly controlled through operations and maintenance procedures. In this case, debris is generated from hardware and materials that are necessary for launch and are subject to the intense vibration, acoustics, and direct plume impingement of the launch environment. Examples include ice from umbilicals, tape and tie wraps that protect cables, and rust or corrosion from the launch platform. While NASA has historically been aware of debris as a potential issue that could cause a failure resulting in loss of mission, loss of vehicle, or loss of crew, the likelihood and severity of that risk was not always well understood or given sufficient weight in program and flight decisions. After the Space Shuttle Columbia accident (STS-107), the investigation found that foam TPS debris shed from the external tank was the proximate cause of the damage to the orbiter wing. Six previous observations of debris released from the foam ramp that covered the bipod connecting the forward end of the orbiter to the external tank resulted in minor changes or were determined to be accepted flight risks. Two occurrences of bipod ramp foam loss were not identified until the STS-107 investigation. Despite the damage inflicted by these debris strikes, the Shuttle Program Requirements Control Board deemed the vehicle safe to fly. During the Return to Flight effort following the Columbia disaster, NASA Engineering developed a process for the assessment of debris transport, impact, and damage tolerance to support independent assessments of risk by NASA Safety and Mission Assurance (S&MA). Under this system, each element (vehicle or ground system) defines a catalog of all expected debris based on launch history, component testing, or analysis. Debris transport analysis (DTA) is conducted using the debris catalog characteristics and potential flow transport mechanisms (e.g., vehicle aerodynamics, gravity, wind, plume-driven). The predicted debris impact locations and velocities are provided to the hardware owners, who use available test data and analysis to determine whether each component can withstand the impacts. In cases where the element hardware may be severely damaged or fail, the options are to mitigate the debris source through some change in design or operation, or to work with S&MA to try to characterize the probability of the impact and damage for program risk acceptance. Because of the differences in debris characteristics and transport, the DTA has been divided between the Liftoff and Ascent regimes. The development and application of Liftoff DTA methodology from the Shuttle Program to the current Artemis Program is the subject of this paper. Liftoff DTA covers the time from the start of pre-launch operations at the launch pad, up until the vehicle clears the launch tower and there is no longer any interaction with ground systems. Debris transport during this period is broadly classified as either gravity, wind, and plume-entrained (GWPE) or plume driven (PD). GWPE debris is generally lower speed, travelling in a forward-to-aft direction. PD transport includes flow features from the rocket ignition transient, as well as plume impingement and recirculation that occur as the vehicle lifts off the launch platform. In these cases, the debris typically moves in an aft-to-forward direction at higher speeds. The applicable transport mechanisms must be considered for each piece of debris depending on the material, and release location and time. For example, rust or metallic debris from the tower could fall (GWPE) and impact the vehicle before landing on the launch platform deck where it could be also be transported by plume impingement (PD). However, falling ice (GWPE) from an umbilical is unlikely to survive impact with the vehicle or launch platform and be available for PD transport. Modeling of debris transport is accomplished using a set of DTA tools which simulate debris trajectories subject to a reference frame acceleration (i.e., gravity) and aerodynamic drag. Where the trajectory encounters a solid surface, the debris is allowed to rebound with a specified coefficient of restitution. The drag is calculated by interpolating the fluid state at each point in the debris trajectory from high-fidelity computational fluid dynamics (CFD) simulations of the launch vehicle and pad. The CFD data may either be static (steady state or time averaged), typically for GWPE transport, or dynamic (time-accurate) for PD flow features like the ignition transient. Examples of the CFD flow field solutions for the Space Launch System (SLS) rocket and launch pad are shown in Figure 2. Typical SLS debris trajectory predictions from DTA are illustrated in Figure 3. The final version of this paper will include a more detailed examination of the Liftoff DTA process developed during the Shuttle Program, and how it has been augmented and applied to the SLS rocket under the Artemis Program. Comparisons with debris observations from the Artemis I launch will demonstrate validation of the tools and methodology.

Debris↗

NASA NTRS2000

Stardust Navigation Covariance Analysis

The Stardust spacecraft was launched on February 7, 1999 aboard a Boeing Delta-II rocket. Mission participants include the National Aeronautics and Space Administration (NASA), the Jet Propulsion Laboratory (JPL), Lockheed Martin Astronautics (LMA) and the University of Washington. The primary objective of the mission is to collect in-situ samples of the coma of comet Wild-2 and return those samples to the Earth for analysis. Mission design and operational navigation for Stardust is performed by the Jet Propulsion Laboratory (JPL). This paper will describe the extensive JPL effort in support of the Stardust pre-launch analysis of the orbit determination component of the mission covariance study. A description of the mission and it's trajectory will be provided first, followed by a discussion of the covariance procedure and models. Predicted accuracy's will be examined as they relate to navigation delivery requirements for specific critical events during the mission. Stardust was launched into a heliocentric trajectory in early 1999. It will perform an Earth Gravity Assist (EGA) on January 15, 2001 to acquire an orbit for the eventual rendezvous with comet Wild-2. The spacecraft will fly through the coma (atmosphere) on the dayside of Wild-2 on January 2, 2004. At that time samples will be obtained using an aerogel collector. After the comet encounter Stardust will return to Earth when the Sample Return Capsule (SRC) will separate and land at the Utah Test Site (UTTR) on January 15, 2006. The spacecraft will however be deflected off into a heliocentric orbit. The mission is divided into three phases for the covariance analysis. They are 1) Launch to EGA, 2) EGA to Wild-2 encounter and 3) Wild-2 encounter to Earth reentry. Orbit determination assumptions for each phase are provided. These include estimated and consider parameters and their associated a-priori uncertainties. Major perturbations to the trajectory include 19 deterministic and statistical maneuvers planned for the mission. The spacecraft is three axis stabilized and has unbalanced thrusters for attitude control. Accelerations due to the attitude control system are treated stochastically. The tracking scenario for the study is patterned after the actual schedule employed during the different phases of the mission. Conventional X-band two-way Doppler and SRA range data was simulated and the standard accuracy for these data types was assumed throughout most of the mission. However, a deweighting scheme was used for the Doppler data during times of low Sun-Earth-Probe angles, especially in the case of the DSM. Optical data is assumed to be available starting at 50 days prior to the comet encounter. The optical data will be used to improve the ephemeris of Wild-2, which is considered crucial to properly target the comet flyby. Results of the covariance analysis are presented for all mission phases. Navigation capability will be discussed in terms of the uncertainty in the encounter B-Plane (B.R and B.T) and linearized time of flight. Delivery errors based on the final maneuver prior to the comet encounter will be presented. The most stringent navigation requirement is for the Earth reentry. The uncertainty in the flight path angle must be less than 0.02 degree (orbit determination and maneuver performance) to assure successful recovery of the SRC. Results presented show that this requirement can be met.

Menon, Premkumar R.↗

NASA NTRS2009

Influence of Combined Whole-Body Vibration Plus G-Loading on Visual Performance

Recent engineering analyses of the integrated Ares-Orion stack show that vibration levels for Orion crews have the potential to be much higher than those experienced in Gemini, Apollo, and Shuttle vehicles. Of particular concern to the Constellation Program (CxP) is the 12 Hz thrust oscillation (TO) that the Ares-I rocket develops during the final ~20 seconds preceding first-stage separation, at maximum G-loading. While the structural-dynamic mitigations being considered can assure that vibration due to TO is reduced to below the CxP crew health limit, it remains to be determined how far below this limit vibration must be reduced to enable effective crew performance during launch. Moreover, this "performance" vibration limit will inform the operations concepts (and crew-system interface designs) for this critical phase of flight. While Gemini and Apollo studies provide preliminary guidance, the data supporting the historical limits were obtained using less advanced interface technologies and very different operations concepts. In this study, supported by the Exploration Systems Mission Directorate (ESMD) Human Research Program, we investigated display readability-a fundamental prerequisite for any interaction with electronic crew-vehicle interfaces-while observers were subjected to 12 Hz vibration superimposed on the 3.8 G loading expected for the TO period of ascent. Two age-matched groups of participants (16 general population and 13 Crew Office) performed a numerical display reading task while undergoing sustained 3.8 G loading and whole-body vibration at 0, 0.15, 0.3, 0.5, and 0.7 g in the eyeballs in/out (x-axis) direction. The time-constrained reading task used an Orion-like display with 10- and 14-pt non-proportional sans-serif fonts, and was designed to emulate the visual acquisition and processing essential for crew system monitoring. Compared to the no-vibration baseline, we found no significant effect of vibration at 0.15 and 0.3 g on task error rates (ER) or response times (RT). Significant degradations in both ER and RT, however, were observed at 0.5 and 0.7 g for 10-pt, and at 0.7 g for 14-pt font displays. These objective performance measures were mirrored by participants' subjective ratings. Interestingly, we found that the impact of vibration on ER increased with distance from the center of the display, but only for vertical displacements. Furthermore, no significant ER or RT aftereffects were detected immediately following vibration, regardless of amplitude. Lastly, given that our reading task required no specialized spaceflight expertise, our finding that effects were not statistically distinct between our two groups is not surprising. The results from this empirical study provide initial guidance for evaluating the display readability trade-space between text-font size and vibration amplitude. However, the outcome of this work should be considered preliminary in nature for a number of reasons: 1. The single 12 Hz x-axis vibration employed was based on earlier load-cycle models of the induced TO environment at the end of Ares-I first stage flight. Recent analyses of TO mitigation designs suggest that significant concurrent off-axis vibration may also occur. 2. The shirtsleeve environment in which we tested fails to capture the full kinematic and dynamic complexity of the physical interface between crewmember and the still-to-bematured helmet-suit-seat designs, and the impact these will have for vibration transmission and consequent performance. 3. By examining performance in this reading and number processing task, we are only assessing readability, a first and necessary step that in itself does not directly address the performance of more sophisticated operational tasks such as vehicle-health monitoring or manual control of the vehicle.

readability↗

DOE OSTI2025

Evaluation of New Additions to OLI Software in Predicting Mercuric and Mercurous Species in Liquid Waste Operations

Speciation of mercury during the pretreatment steps of tank waste processing is critical to successful mercury removal prior to vitrification during Liquid Waste Operations (LWO) at SRS. OLI software has been used to predict mercury speciation and activity throughout LWO. The OLI software operates based on a thermodynamic framework called the Mixed Solvent Electrolyte (MSE) framework. The MSE framework allows prediction in theoretically infinitely dilute to concentrated mixtures (e.g., purely solute solutions). Before modification to the MSE framework databanks, certain critical mercury species were missing in the MSE databank, and some thermodynamic data needed to be updated for the OLI software to accurately predict mercury chemical species in SRS waste tanks. To better reflect streams across LWO, new mercury species were integrated into the MSE database. To evaluate the changes to the OLI MSE framework per the Technical Task Request (TTR) and the Task Technical and Quality Assurance Plan (TTQAP), waste stream compositions from Tanks 38, 43, and Tank 50 decontaminated salt solution (DSS) were used as model inputs. Models were developed and executed using both the old and new databases. Compositional analyses from caustic Tank 50 DSS and caustic Tanks 38 and 43 were used as the input streams. These streams represent the most comprehensive chemical data sets where both mercury and tank constituents were measured together. Results for Tank 50 DSS predict HgO as the predominant species in both databases. Both methyl and dimethyl Hg species are present when the new database is ‘on’ and are not predicted with the new database turned ‘off’. The new database predicts a greater amount of HgO and a greater fraction of it in the solid phase. Pourbaix diagrams (potential vs. pH) generated for each Tank 50 DSS were identical regardless of which database was used. Elemental Hg and HgO were predicted in the water stable region under basic conditions. Tanks 38 and 43 follow similar trends as the Tank 50 DSS models. Unlike Tanks 38 and 50 DSS, the Tank 43 Pourbaix plot shows a region of stability for an aqueous HgOHCO3 - species between approximately pH 7-11. In all streams, when MeHg+ is included in the inputs, the new database predicts aqueous MeHgOH as the dominant species. If elemental or dimethyl mercury is in the waste stream, the new database model predicts they are unchanged and remain in those states and quantities. Additionally, the total mercury values are reported for both the measured input data and the OLI output data for all considered tanks. The summary indicates that the percentage error between the measured and calculated values is less than 1% in all cases The reconciliations and generation of the Pourbaix diagrams for Tank 50 DSS took approximately ten times longer with the new database ‘on’. In addition, over the course of that time, models with the new database ‘on’ were more likely to crash or display an error. Some modest performance improvements were noted when modeling with an i7 processor versus an i5. An example error is found in Appendix A. Furthermore, Appendix B provides V&V for two chemical systems analyzed with the OLI software, results were satisfactory. It is recommended to utilize the new databases (i.e., HCO.ddb and SR-Hg.ddb) in future Savannah River Mission Completion applications of OLI to represent pseudo steady-state. Furthermore, the integration and utilization of the new databases (i.e., HCO.ddb and SR-Hg.ddb) in modeling applications (e.g., Aspen) is also recommended.

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗