SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
The problem that we address in this paper is assessing the expected degree of success of the system or mission based on the degree to which each requirement is satisfied and the relative weight of the requirements.
Probabilistic safety requirements currently formulated or proposed for space systems, nuclear reactor systems, nuclear weapon systems, and other types of systems that have a low-probability potential for high-consequence accidents depend on showing that the probability of such accidents is below a specified safety threshold or goal. Verification of compliance depends heavily upon synthetic modeling techniques such as PRA. To determine whether or not a system meets its probabilistic requirements, it is necessary to consider whether there are significant risks that are not fully considered in the PRA either because they are not known at the time or because their importance is not fully understood. The ultimate objective is to establish a reasonable margin to account for the difference between known risks and actual risks in attempting to validate compliance with a probabilistic safety threshold or goal. In this paper, we examine data accumulated over the past 60 years from the space program, from nuclear reactor experience, from aircraft systems, and from human reliability experience to formulate guidelines for estimating probabilistic margins to account for risks that are initially unknown or underappreciated. The formulation includes a review of the safety literature to identify the principal causes of such risks.
Attention is given to the Manned Transportation System (MTS) Study, initiated to help identify the 'right' transportation system architectures needed for human access to space. A listing of the requirements used for this study and the rationale behind them are given. Attributes allow comparison of elements that meet the requirements and the 'needs' (mission model). The attributes include: safety, probability of mission success, funding profile, architecture cost risk, schedule confidence, dependability, availability, mission growth potential, environment, resiliency, and alternate access. The attributes need to be measurable, to have repeatable calculations and well-defined assumptions, to have their weight determined relative to other attributes, and to be a discriminator. The process used to determine the attributes, which involved the MTS team forum and some of the quality function deployment techniques, is discussed.
In the previous study and report, we developed a computational framework to explore the technical and economic viability of the dual use of pumped storage hydropower (PSH) for both transmission assets and market participation. The rationale for the dual-use application is to improve the resource utilization rate and reduce the cost recovery burden. A PSH-based transmission solution generally has a large capacity, which corresponds to a higher investment cost compared to a traditional line solution. Market participation may allow the PSH asset to offset part of its high investment cost. A critical question is whether it is economically and technically viable to allow dual use of a PSH-based transmission project without jeopardizing transmission system reliability. And a more specific follow-up question is how to improve market participation performance while maintaining transmission reliability. In this study, we extend the computational framework by updating the method to determine transmission service obligation requirements dynamically based on the possibility of the need for transmission service in operation. Specifically, we correlate the need for transmission service with the probability of thermal overloading on a monitored transmission line, which is essentially based on the probability distribution of power flow and its probability of exceeding the line rating based on system dispatch and operational uncertainties. In addition, the need depends on the level of risk that a system operator is willing to take. The higher the risk tolerance, the lower the requirement that the system operator would apply to the PSH project as a transmission asset. The requirements are updated every day before the PSH project determines its market participation strategy. With the updated transmission service requirements, it is expected that a PSH project can serve as a transmission asset when the transmission system is at risk and really needs it, while it can participate in a market with sufficient information and certain restrictions. In this way, the transmission service quality and market participation performance can both be improved.
The Integrated Medical Model (IMM) helps capture and use organizational knowledge across the space medicine, training, operations, engineering, and research domains. The IMM uses this domain knowledge in the context of a mission and crew profile to forecast crew health and mission success risks. The IMM is most helpful in comparing the risk of two or more mission profiles, not as a tool for predicting absolute risk. The process of building the IMM adheres to Probability Risk Assessment (PRA) techniques described in NASA Procedural Requirement (NPR) 8705.5, and uses current evidence-based information to establish a defensible position for making decisions that help ensure crew health and mission success. The IMM quantitatively describes the following input parameters: 1) medical conditions and likelihood, 2) mission duration, 3) vehicle environment, 4) crew attributes (e.g. age, sex), 5) crew activities (e.g. EVA's, Lunar excursions), 6) diagnosis and treatment protocols (e.g. medical equipment, consumables pharmaceuticals), and 7) Crew Medical Officer (CMO) training effectiveness. It is worth reiterating that the IMM uses the data sets above as inputs. Many other risk management efforts stop at determining only likelihood. The IMM is unique in that it models not only likelihood, but risk mitigations, as well as subsequent clinical outcomes based on those mitigations. Once the mathematical relationships among the above parameters are established, the IMM uses a Monte Carlo simulation technique (a random sampling of the inputs as described by their statistical distribution) to determine the probable outcomes. Because the IMM is a stochastic model (i.e. the input parameters are represented by various statistical distributions depending on the data type), when the mission is simulated 10-50,000 times with a given set of medical capabilities (risk mitigations), a prediction of the most probable outcomes can be generated. For each mission, the IMM tracks which conditions occurred and decrements the pharmaceuticals and supplies required to diagnose and treat these medical conditions. If supplies are depleted, then the medical condition goes untreated, and crew and mission risk increase. The IMM currently models approximately 30 medical conditions. By the end of FY2008, the IMM will be modeling over 100 medical conditions, approximately 60 of which have been recorded to have occurred during short and long space missions.
The International Space Station (ISS) was originally designed to operate until 2015 with a plan for deorbiting the ISS in 2016. Currently, the international partnership has agreed to extend the operations until 2020 and discussions are underway to extend the life even further to 2028. Each partner is responsible for the sustaining engineering, sparing, and maintenance of their own segments. National Aeronautics and Space Administration's (NASA's) challenge is to purchase the needed number of spares to maintain the functional availability of the ISS systems necessary for the United States On-Orbit Segment s contribution. This presentation introduces an analytical approach to assessing uncertainty in ISS hardware necessary to extend the life of the vehicle. Some key areas for consideration are: establishing what confidence targets are required to ensure science can be continuously carried out on the ISS, defining what confidence targets are reasonable to ensure vehicle survivability, considering what is required to determine if the confidence targets are too high, and whether sufficient number of spares are purchased. The results of the analysis will provide a methodological basis for reassessing vehicle subsystem confidence targets. This analysis compares the probability of existing spares exceeding the total expected unit demand of the Orbital Replacement Unit (ORU) in functional hierarchies approximating the vehicle subsystems. In cases where the functional hierarchies' availability does not meet subsystem confidence targets, the analysis will further identify which ORUs may require additional spares to extend the life of the ISS. The resulting probability is dependent upon hardware reliability estimates. However, the ISS hardware fleet carries considerable epistemic uncertainty which must be factored into the development and execution of sparing risk postures. In addition, it is also recognized that uncertainty in the assessment is due to disconnects between modeled functions and actual subsystem operations. Perhaps most importantly, it is acknowledged that conservative confidence targets per subsystem are currently accepted. This presentation will also discuss how subsystem confidence targets may be relaxed based on calculating the level of uncertainty for each corresponding ORU-function. The presentation will conclude with the various strengths and limitations for implementing the analytical approach in sustaining the ISS through end of life; 2020 and beyond.
Title 10 of the United States (US) Code of Federal Regulations (CFR), Part 71, Packaging and Transportation of Radioactive Material includes requirements for the transport of fissile material in packages. These regulations provide requirements for packaging that is certified by the US Nuclear Regulatory Commission (NRC) to transport fissile material, but the regulations also include provisions that allow for shipment of fissile material in packages that are not required to be certified by the NRC. These provisions include criteria for exemptions from classification as fissile material (10 CFR 71.15) and permit general licenses for limited quantities of fissile material and plutonium-beryllium special form sources (10 CFR 71.22 and 10 CFR 71.23, respectively). These regulations were revised by NRC as part of a broad rulemaking effort in 2004. These regulations are used frequently for a wide-variety of fissile material shipping operations and shippers must interpret the regulations for particular shipping situations. The quantity of fissile material that presents a criticality safety risk depends on the other materials in the system that might absorb neutrons emitted from fission or moderate (slow) those neutrons to lower energies where the probability of them creating an additional fission is highest. Besides the absorption and moderation of neutrons, other parameters that must be considered to ensure criticality safety are: the mass, concentration, or isotopic distribution of the fissile material; and the system geometry and neutron reflection of the package from surrounding materials. These parameters were carefully considered in developing the requirements for the exemptions from the classification of fissile material and the requirements for general licenses for fissile material. This paper will review the technical basis, intent, and anticipated usage of each of the fissile material exemption and general license provisions. Additionally, this paper will discuss the recent regulatory history of the Part 71 fissile material exemptions and general licenses, including the 2015 rulemaking effort. Finally, this paper will outline an upcoming NUREG/CR document regarding the fissile material exemptions and general licenses, and discuss recommendations that are being formulated for potential future revisions to the regulations. (authors)
Incorporation of real-time component information using equipment condition assessment (ECA) through the development of enhanced risk monitors (ERM) for active components in advanced reactor (AR) and advanced small modular reactor (SMR) designs. We incorporate time-dependent failure probabilities from prognostic health management (PHM) systems to dynamically update the risk metric of interest. This information is used to augment data used for supervisory control and plant-wide coordination of multiple modules by providing the incremental risk incurred due to aging and demands placed on components that support mission requirements.
Credit enhancements represent a variety of financial support structures that are designed to reduce risk to those holding the debt, including debt raised via a securitization process, and thus lower the required yield associated with the security. The purpose of all forms of credit enhancement is to increase the collateral against which notes are secured (Lin,1999). The following section evaluates is not guaranteed. Perceived risks of the solar asset class--including those related to technology, offtaker creditworthiness, and regulatory policy--can increase the required yield, increase probability of investor loss of interest and/or principal, or both. In many cases, this is a cyclical phenomenon: risk perception is fed by lack of historical knowledge, which is in turn fed by risk perception. Therefore, successful access to capital market investment in order to spur low-cost solar deployment depends on the success of this initial fledgling period.
The problem that we address in this paper is assessing the expected degree of success of the system or mission based on the degree to which each requirement is satisfied and the relative weight of the requirements. We assume a complete list of the requirements, the relevant risk elements and their probability of occurrence and the quantified effect of the risk elements on the requirements. In order to assess the degree to which each requirement is satisfied, we need to determine the effect of the various risk elements on the requirement.
Enceladus, a moon of Saturn, has geyser-like jets that spray plumes of material into orbit. These jets could enable a free-flying spacecraft to collect samples and return them to Earth for study to determine if they contain the building blocks of life. The Office of Planetary Protection at NASA requires containment of any unsterilized samples and prohibits destructive impact of the spacecraft upon return to Earth, with a sample release probability of less than 1 in 1,000,000 as a recommended goal. This paper describes a probabilistic risk assessment model that uses dynamic simulation techniques to capture the physics-based, time- and state-dependent interactions between the sample return system and the environment, which drive the risk of sample release. The dynamic approach uses a Monte Carlo-style simulation to integrate the many phases and sources of risk for a sample return mission. The model is used to assess the achievability of the planetary protection reliability goal. This is accomplished by performing sensitivity studies assessing the impact of modeling assumptions to identify where uncertainties drive the risk. These results, in turn, are used to examine the feasibility of meeting key design and performance parameters that are needed to achieve the reliability goal for a given architecture with existing technologies.
The Integrated Medical Model (IMM) is a probabilistic model that uses simulation to predict mission medical risk. Given a specific mission and crew scenario, medical events are simulated using Monte Carlo methodology to provide estimates of resource utilization, probability of evacuation, probability of loss of crew, and the amount of mission time lost due to illness. Mission and crew scenarios are defined by mission length, extravehicular activity (EVA) schedule, and crew characteristics including: sex, coronary artery calcium score, contacts, dental crowns, history of abdominal surgery, and EVA eligibility. The Integrated Medical Evidence Database (iMED) houses the model inputs for one hundred medical conditions using in-flight, analog, and terrestrial medical data. Inputs include incidence, event durations, resource utilization, and crew functional impairment. Severity of conditions is addressed by defining statistical distributions on the dichotomized best and worst-case scenarios for each condition. The outcome distributions for conditions are bounded by the treatment extremes of the fully treated scenario in which all required resources are available and the untreated scenario in which no required resources are available. Upon occurrence of a simulated medical event, treatment availability is assessed, and outcomes are generated depending on the status of the affected crewmember at the time of onset, including any pre-existing functional impairments or ongoing treatment of concurrent conditions. The main IMM outcomes, including probability of evacuation and loss of crew life, time lost due to medical events, and resource utilization, are useful in informing mission planning decisions. To date, the IMM has been used to assess mission-specific risks with and without certain crewmember characteristics, to determine the impact of eliminating certain resources from the mission medical kit, and to design medical kits that maximally benefit crew health while meeting mass and volume constraints.
The Integrated Medical Model (IMM) is a probabilistic model that uses simulation to predict mission medical risk. Given a specific mission and crew scenario, medical events are simulated using Monte Carlo methodology to provide estimates of resource utilization, probability of evacuation, probability of loss of crew, and the amount of mission time lost due to illness. Mission and crew scenarios are defined by mission length, extravehicular activity (EVA) schedule, and crew characteristics including: sex, coronary artery calcium score, contacts, dental crowns, history of abdominal surgery, and EVA eligibility. The Integrated Medical Evidence Database (iMED) houses the model inputs for one hundred medical conditions using in-flight, analog, and terrestrial medical data. Inputs include incidence, event durations, resource utilization, and crew functional impairment. Severity of conditions is addressed by defining statistical distributions on the dichotomized best and worst-case scenarios for each condition. The outcome distributions for conditions are bounded by the treatment extremes of the fully treated scenario in which all required resources are available and the untreated scenario in which no required resources are available. Upon occurrence of a simulated medical event, treatment availability is assessed, and outcomes are generated depending on the status of the affected crewmember at the time of onset, including any pre-existing functional impairments or ongoing treatment of concurrent conditions. The main IMM outcomes, including probability of evacuation and loss of crew life, time lost due to medical events, and resource utilization, are useful in informing mission planning decisions. To date, the IMM has been used to assess mission-specific risks with and without certain crewmember characteristics, to determine the impact of eliminating certain resources from the mission medical kit, and to design medical kits that maximally benefit crew health while meeting mass and volume constraints.
Effective levee planning must balance capital cost, risk reduction, and community priorities. These objectives are rarely optimized together. This study presents a feasibility phase, simulationin-the-loop framework that couples terrain-based flood modeling with a socially aware multiobjective optimizer. Flood risk is measured as Expected Annual Exposed Population (EAEP), obtained by integrating exposure over Annual Exceedance Probability (AEP) nodes, mirroring the Hydrologic Engineering Center's Flood Damage Reduction Analysis (HEC-FDA) expected-annual formulation but with people rather than dollars. Exposure per scenario is computed by overlaying binary inundation masks with a population surface at the tract level. Distributional fairness is encoded through a Group Benefit Share (GBS) constraint that requires high-SVI tracts to receive at least a baseline share of annualized benefits. Capital cost is represented by a height-dependent unit-cost model suitable for screening. This study addresses the two-objective problem, minimize cost and expected annual exposure subject to the GBS constraint, using Non-Dominated Sorting Genetic Algorithm II (NSGA-II) and leveraging Pareto front for feasibility phase decision making. Implemented with terrain-based flood modeling, GeoFlood, for rapid scenario evaluation, the framework is demonstrated in Southeast Texas. The results reveal clear trade-offs among cost, risk, and social benefits and identify non-dominated levee height configurations that satisfy the benefit-share floor. The contributions are a scalable decision support method that operationalizes expected annual population-based risk, embeds enforceable benefit-sharing guarantees, and uses lightweight simulation to explore large design spaces before higher fidelity design stages.
In hypothetical severe accident scenarios, nuclear power plant safety is challenged by core degradation and release of fission products. To aid the plant operator and technical support center staff, research has been performed to develop understanding of severe accident phenomenology, assessing their risk and devise measures to mitigate accident consequences (Sehgal, 2011). Nuclear power plant accidents involve highly complex physical and chemical interactions, a large number of safety related systems, and emergency operating procedures (EOP) and severe accident management guidelines (SAMG). Large number of factors with uncertainty and stress can overwhelm the operators. The overall objective of the present research is to develop a methodology and tools that an operator can use to predict severe accident progression and make effective decisions to arrest and manage the accident under large uncertainties. Towards this goal, this study examines a novel approach that brings to bear a combined use of techniques in artificial intelligence (Russel and Norvig, 2010), including Bayesian Network (BN), Answer Set Programming (ASP) and Fuzzy Inference (FI) to achieve faster-than-real-time, yet sufficiently accurate analysis of severe accident progression. Bayesian network (BN) is a type of probabilistic graphical models that can be used to represent knowledge and conditional dependencies about an uncertain realm. It is useful for capturing the causal relationships in a complex system. It also allows prediction via Bayesian inference (Kelly and Smith, 2012). It is composed of nodes and edges, which express random variables and probabilistic relationships between the nodes, respectively. This relationship, given by conditional probability is calculated using stochastic methods. The BN is used in several systems for analysis and management of accident risk; e.g. (Knochenhauer and Frid, 2010). In those systems, the nodes or so-called 'effective factors' are presumably known within the network by system descriptions in SAMGs. There are two steps to configure the BN, namely (i) identifying compositions within the network and (ii) defining conditional dependency between nodes. The first step is performed following the spirit of ASP (Baral, 2003) using Prolog (Wielemaker, 2005). Knowledge representation is used to build databases required for processing by ASP. Knowledge representation is defined as the expression of knowledge in a way that is understandable to both human and computers. Originally knowledge indicates data, information and facts. To focus, knowledge should be formed to achieve a goal. In a severe accident, key physics and safety related components status are defined according to a failure mode. The conditional dependencies between nodes are generated by approximate reasoning using Fuzzy inference (Zadeh, 1995). Fuzzy logic is a multiple-valued logic to treat ambiguous features such as linguistic description. It indicates possibility, which is distinguished from probability. Fuzzy set consists of linguistic variables according to the fixed rule. In other words, even uncertain states could be expressed as not binary logic, but as many-value logic by rule-based technology. Fuzzy control system is comprised of Fuzzy inference engine that is performed based on the 'If-Then Rule'. The 'If-Then Rule' is of the following form. If Y1 is B11 and Y2 is B12 then Z is C1. If Y1 is B21 and Y2 is B22 then Z is C2. Y1 and Y2 are inputs, which indicate conditional variables. Z indicates decision-making and both B and C are linguistic variables. With this rule-based technique, the approximate reasoning can be realized by Fuzzy inference. (authors)
Computational (also known as Dynamic) Probabilistic Risk Assessment (PRA) methods employs system simulation codes coupled with stochastic analysis tools in order to determine probabilities of certain outcomes such as system failure. In contrast to classical PRA methods (i.e., Event-Tree and Fault-Tree) in which timing and sequencing of events is set by the analyst, accident progression is dictated by the system control logic and its interaction with system temporal evolution. Due to the nature of the problem, Simulation-Based PRA methods require large amount of computationally expensive simulation runs. In addition, these methods usually generate a large number of simulation runs (database storage may be on the order of gigabytes or higher). In this paper we investigate and apply several methods and algorithms to analyze these large amounts of time-dependent data. Furthermore, the scope of this article is to present a broad overview of methods and algorithms that can be used to improve data quality and to analyze and extract information from large data sets containing time dependent data. In this context, “extracting information” means constructing input-output correlations, finding commonalities, and identifying outliers.
Launch vehicle reliability analysis is largely dependent upon using predicted failure rates from data sources such as MIL-HDBK-217F. Reliability prediction methodologies based on component data do not take into account system integration risks such as those attributable to manufacturing and assembly. These sources often dominate component level risk. While consequence of failure is often understood, using predicted values in a risk model to estimate the probability of occurrence may underestimate the actual risk. Managers and decision makers use the probability of occurrence to influence the determination whether to accept the risk or require a design modification. The actual risk threshold for acceptance may not be fully understood due to the absence of system level test data or operational data. This paper will establish a method and approach to identify the pitfalls and precautions of accepting risk based solely upon predicted failure data. This approach will provide a set of guidelines that may be useful to arrive at a more realistic quantification of risk prior to acceptance by a program.
Protection of commercial nuclear fuel cycles against adversary groups who may attempt to steal weapons-usable material is an issue of interest to the U.S. Department of Energy, Office of Nuclear Energy. The wide array of potential nuclear fuel cycle configurations and the security measures that could be deployed to protect them pose a daunting system design problem. In general, there are billions of potential design configurations. Moreover, the design choices are not independent – the effectiveness of one design feature or security measure can affect the desirability of other design choices. To explore this issue, we develop a mixed-integer optimization problem that solves a complex decision tree to allocate security resources across a commercial nuclear fuel cycle configuration. A nominal UREX+ reprocessing facility is used to demonstrate how the model allocates resources across a particular fuel cycle facility and shows how the problem can be scaled up to include other facilities and design features in the fuel cycle. In our model, the defender first chooses a set of safeguards to implement in order to mitigate the risk of a terrorist theft from various unit operations in the reprocessing facility. The attacker observes the defender’s strategy choice and executes an attack to acquire material, including the possibility of declining to attack at all. The model considers the terrorist as an intelligent adversary with a set of attack strategies known to the defender. The strategic choices made by both the defender and attacker affect the probability of a successful attack by the terrorist and in turn affect the distribution of consequences to the defender. We use a decision tree to illustrate the interactions among costs, decisions, correlated uncertainties, and outcomes, and then show how to formulate the problem as a mixed-integer program with an equivalent solution. The novel features of our formulation include the following. First, as discussed above, we use a sequential game-theoretic formulation (a Stackelberg game). This formulation assumes the attacker can observe the defender’s actions before the attack is executed. Many previous game-theoretic studies have assumed attacker and defender act simultaneously without knowledge of the other’s strategy choice. We believe the sequential game formulation is more applicable for knowledgeable insider adversaries, the focus of this study. Second, we build on our previous work that has developed a methodology to reflect the correlation among probability distributions represented as discrete chance nodes in a decision tree. We illustrate how this methodology can be applied to two chance nodes in a decision tree that relate the quality of the materials that might be stolen or diverted by an adversary with the yield of a weapon that might be constructed from that material. In a decision tree, the dependence of the yield on the quality of the material could be modeled with conditional probabilities of the weapon yield given the quality of the materials obtained. For three outcome discretizations, this would require the assessment of nine conditional probabilities from domain experts as part of the model building effort. In contrast, our methodology will allow this same representation of the tree based on the assessment of the correlation between these two chance nodes by the experts, which we believe is a much easier and more reliable assessment task. The advantage of this approach increases as the number of dependent chance nodes grows in a decision tree representation of this problem. Third, we extend this approach to the approximation of the dependence between discrete binary events such as success or failure represented by binary chance nodes in a decision tree or in the special case of a probabilistic risk analysis (PRA) based on an event tree. This extension is a novel application in this domain, and uses Monte Carlo simulation to determine the appropriate conditional probabilities on the binary chance nodes when the number of correlated uncertainties is more than two. Fourth, we show how these decision trees or probability trees can be formulated and solved as equivalent integer programming (IP) problems. The advantages of the IP representation include the opportunity to use the computing power associated with powerful optimization solver algorithms available on high speed computers to solve very large versions of these trees, and the ability to include several such models of different facilities into a much larger IP with connecting constraints that represent budget restrictions, number of available inspection opportunities in a given time window, or other dependencies among these facilities. Policy makers can use the resulting model to inform their decisions about how to assess terrorism risk and to safeguard the commercial nuclear fuel cycle.