SEARCH · Engineering Papers

Results for “Failing Safely”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 307 records · Page 17

All sources NASA NTRS DOE OSTI

NASA NTRS1991

Digging in the coronal graveyard - A Rosat observation of the red giant Arcturus

A deep exposure of the bright star Arcturus (Alpha Bootis: K1 III) with the Roentgensatellit (Rosat) failed to detect soft X-ray emission from the archetype 'noncoronal' red giant. The 3-sigma upper limit in the energy band 0.1-2.4 keV corresponds to an X-ray luminosity of less than 3 x 10 to the 25th erg/s, equivalent to a coronal surface flux density of less than 0.0001 solar. The nondetection safely eliminates coronal irradiation as a possible mechanism to produce the highly variable He I 10830 feature and emphasizes the sharp decline in solarlike coronal activity that accompanies the evolution of low-mass single stars away from the main sequence. While the most conspicuous object in the Rosat field of view was not visible in X-rays, at least one fainter star is among the about 60 sources recorded: the Sigma Sct variable CN Boo, an A8 giant in the UMa Stream.

Ayres, Thomas R.↗

NASA NTRS2019

Maneuver design overview of the 2018 InSight Mars lander mission

Launched on May 5, 2018, the Interior Exploration using Seismic Investigations, Geodesy, and Heat Transport (InSight) spacecraft landed safely on Mars on November 26, 2018. To deliver the lander accurately to the landing site, six trajectory correction maneuvers (TCMs) were planned along the reference trajectory from Earth launch to Mars entry. For the last two TCMs, there were two corresponding contingency TCMs planned that could be executed in the event that the corresponding nominal one failed. There were also twenty pre-designed menu TCMs available for execution at the time of the last contingency TCM, about 8 hours before the Mars entry, descent, and landing. This navigation paper overviews the maneuver design of each TCM, as well as how each one actually performed during operations.

Wallace, Mark↗

DOE OSTI2025

Evaluating Variable-Impedance Magnetically-Insulated Transmission Lines as a Risk-Mitigation Measure for Next-Generation Pulsed Power

This project has produced the first detailed characterizations of power flow resulting from applying the “variable-impedance MITL” concept to real-life systems in Sandia’s pulsed power program (Z and next-generation pulsed power (NGPP)). We present simulation results and analyses for constant-impedance versions of both Z and NGPP and survey the operational viability of several variable-impedance re-designs in the parameter space of linear tapers. Circuit modeling (SCREAMER/Bertha) was used to pinpoint promising candidate designs, and EM-PIC (Empire) simulations were used to evaluate these candidates more rigorously. This approach was particularly successful in the Z regime which resulted in the identification of several viable variable-impedance MITL designs for each level. The approach was more challenged in the operating space NGPP occupies, producing data points that speak to a more restrictive design space due to anode plasma turn-on. In the end, we were able to converge on one viable variable-impedance design for the highest inductance line (level “F”) and one for the highest current line (level “A”). Altogether, the body of simulation evidence presented in this report suggest there does exist flexibility in operating space for magnetically-insulated transmission lines (MITLs) having variable geometric impedance to be a potential enabling technology for safely increasing current delivery (and potentially lowering stack voltage) in pulsed-power drivers by manipulating electron losses; however, operating points for a particular design must be carefully screened. Circuit and EM-PIC modeling provided consistent verdicts in safe operating regimes for operational viability, but additional physics such as anode plasma turn-on which is included in Empire but not in SCREAMER/Bertha was found to be a critical factor affecting power flow that lead to different assessments between the codes. It is not always the case that the occurrence of anode plasma caused a design to fail (some designs turned on anode plasma yet still delivered load currents meeting design targets); the details matter such as how early in the pulse anode surfaces break down (and how large a region). However, in every case that it did fail it was found that the feedback from anode plasma was the cause (i.e., turning off the anode plasma model in Empire restored agreement with the circuit model prediction). As circuit simulations represent an efficient and practical means of surveying design space compared to more computationally-expensive approaches such as EM-PIC, it could be prudent to invest in the research and development of models to include the effects of anode plasma such as ion emission in circuit codes. The variable-impedance MITL design is a new concept that enables controlled manipulation of the initial electron losses in the outer MITL and can be tested on Z today. We encourage follow-on work to explore further optimization (including alternative variable-impedance profiles, e.g., having constant dZ/dR), and to confirm the major findings presented in this report by fielding test hardware on actual Z shots.

24 POWER TRANSMISSION AND DISTRIBUTION↗

NASA NTRS1999

Results from the First Two Flights of the Static Computer Memory Integrity Testing Experiment

This paper details the scientific objectives, experiment design, data collection method, and post flight analysis following the first two flights of the Static Computer Memory Integrity Testing (SCMIT) experiment. SCMIT is designed to detect soft-event upsets in passive magnetic memory. A soft-event upset is a change in the logic state of active or passive forms of magnetic memory, commonly referred to as a "Bitflip". In its mildest form a soft-event upset can cause software exceptions, unexpected events, start spacecraft safeing (ending data collection) or corrupted fault protection and error recovery capabilities. In it's most severe form loss of mission or spacecraft can occur. Analysis after the first flight (in 1991 during STS-40) identified possible soft-event upsets to 25% of the experiment detectors. Post flight analysis after the second flight (in 1997 on STS-87) failed to find any evidence of soft-event upsets. The SCMIT experiment is currently scheduled for a third flight in December 1999 on STS-101.

Hancock, Thomas M., III↗

NASA NTRS2011

Measurement of CPAS Main Parachute Rate of Descent

The Crew Exploration Vehicle Parachute Assembly System (CPAS) is being designed to land the Orion Crew Module (CM) at a safe rate of descent at splashdown. Flight test performance must be measured to a high degree of accuracy to ensure this requirement is met with the most efficient design possible. Although the design includes three CPAS Main parachutes, the requirement is that the system must not exceed 33 ft/s under two Main parachutes, should one of the Main parachutes fail. Therefore, several tests were conducted with clusters of two Mains. All of the steady-state rate of descent data are normalized to standard sea level conditions and checked against the limit. As the Orion design gains weight, the system is approaching this limit to within measurement precision. Parachute "breathing," cluster interactions, and atmospheric anomalies can cause the rate of descent to vary widely and lead to challenges in characterizing parachute terminal performance. An early test had contradictory rate of descent results from optical trajectory and Differential Global Positioning Systems (DGPS). A thorough analysis of the data sources and error propagation was conducted to determine the uncertainty in the trajectory. It was discovered that the Time Space Position Information (TSPI) from the optical tracking provided accurate position data. However, the velocity from TPSI must be computed via numerical differentiation, which is prone to large error. DGPS obtains position through pseudo-range calculations from multiple satellites and velocity through Doppler shift of the carrier frequency. Because the velocity from DGPS is a direct measurement, it is more accurate than TSPI velocity. To remedy the situation, a commercial off-the-shelf product that combines GPS and an Inertial Measurement Unit (IMU) was purchased to significantly improve rate of descent measurements. This had the added benefit of solving GPS dropouts during aircraft extraction. Statistical probability distributions for CPAS Main parachute rate of descent and drag coefficient were computed and plotted. Using test data, a terminal rate of descent at splashdown can be estimated as a function of canopy loading.

Ray, Eric S.↗

NASA NTRS1998

Framework for Small-Scale Experiments in Software Engineering: Guidance and Control Software Project: Software Engineering Case Study

Software is becoming increasingly significant in today's critical avionics systems. To achieve safe, reliable software, government regulatory agencies such as the Federal Aviation Administration (FAA) and the Department of Defense mandate the use of certain software development methods. However, little scientific evidence exists to show a correlation between software development methods and product quality. Given this lack of evidence, a series of experiments has been conducted to understand why and how software fails. The Guidance and Control Software (GCS) project is the latest in this series. The GCS project is a case study of the Requirements and Technical Concepts for Aviation RTCA/DO-178B guidelines, Software Considerations in Airborne Systems and Equipment Certification. All civil transport airframe and equipment vendors are expected to comply with these guidelines in building systems to be certified by the FAA for use in commercial aircraft. For the case study, two implementations of a guidance and control application were developed to comply with the DO-178B guidelines for Level A (critical) software. The development included the requirements, design, coding, verification, configuration management, and quality assurance processes. This paper discusses the details of the GCS project and presents the results of the case study.

Hayhurst, Kelly J.↗

NASA NTRS2002

Minimum Control Requirements for Advanced Life Support Systems

Advanced control technologies are not necessary for the safe, reliable and continuous operation of Advanced Life Support (ALS) systems. ALS systems can and are adequately controlled by simple, reliable, low-level methodologies and algorithms. The automation provided by advanced control technologies is claimed to decrease system mass and necessary crew time by reducing buffer size and minimizing crew involvement. In truth, these approaches increase control system complexity without clearly demonstrating an increase in reliability across the ALS system. Unless these systems are as reliable as the hardware they control, there is no savings to be had. A baseline ALS system is presented with the minimal control system required for its continuous safe reliable operation. This baseline control system uses simple algorithms and scheduling methodologies and relies on human intervention only in the event of failure of the redundant backup equipment. This ALS system architecture is designed for reliable operation, with minimal components and minimal control system complexity. The fundamental design precept followed is "If it isn't there, it can't fail".

Boulange, Richard↗

NASA NTRS2009

An Indirect Adaptive Control Scheme in the Presence of Actuator and Sensor Failures

The problem of controlling a system in the presence of unknown actuator and sensor faults is addressed. The system is assumed to have groups of actuators, and groups of sensors, with each group consisting of multiple redundant similar actuators or sensors. The types of actuator faults considered consist of unknown actuators stuck in unknown positions, as well as reduced actuator effectiveness. The sensor faults considered include unknown biases and outages. The approach employed for fault detection and estimation consists of a bank of Kalman filters based on multiple models, and subsequent control reconfiguration to mitigate the effect of biases caused by failed components as well as to obtain stability and satisfactory performance using the remaining actuators and sensors. Conditions for fault identifiability are presented, and the adaptive scheme is applied to an aircraft flight control example in the presence of actuator failures. Simulation results demonstrate that the method can rapidly and accurately detect faults and estimate the fault values, thus enabling safe operation and acceptable performance in spite of failures.

Sun, Joy Z.↗

NASA NTRS2012

Tools Ensure Reliability of Critical Software

In November 2006, after attempting to make a routine maneuver, NASA's Mars Global Surveyor (MGS) reported unexpected errors. The onboard software switched to backup resources, and a 2-day lapse in communication took place between the spacecraft and Earth. When a signal was finally received, it indicated that MGS had entered safe mode, a state of restricted activity in which the computer awaits instructions from Earth. After more than 9 years of successful operation gathering data and snapping pictures of Mars to characterize the planet's land and weather communication between MGS and Earth suddenly stopped. Months later, a report from NASA's internal review board found the spacecraft's battery failed due to an unfortunate sequence of events. Updates to the spacecraft's software, which had taken place months earlier, were written to the wrong memory address in the spacecraft's computer. In short, the mission ended because of a software defect. Over the last decade, spacecraft have become increasingly reliant on software to carry out mission operations. In fact, the next mission to Mars, the Mars Science Laboratory, will rely on more software than all earlier missions to Mars combined. According to Gerard Holzmann, manager at the Laboratory for Reliable Software (LaRS) at NASA's Jet Propulsion Laboratory (JPL), even the fault protection systems on a spacecraft are mostly software-based. For reasons like these, well-functioning software is critical for NASA. In the same year as the failure of MGS, Holzmann presented a new approach to critical software development to help reduce risk and provide consistency. He proposed The Power of 10: Rules for Developing Safety-Critical Code, which is a small set of rules that can easily be remembered, clearly relate to risk, and allow compliance to be verified. The reaction at JPL was positive, and developers in the private sector embraced Holzmann's ideas.

Source record↗

NASA NTRS1997

Dynamics Questions Associated with the AERCam Sprint Free-Flyer

The International Space Station will require the development of small robotic vehicles for such tasks as external inspection, monitoring of extravehicular activities (EVA's) and station build-up, and providing additional lighting at EVA worksites. The Autonomous EVA Robotic Camera (AERCam) family of free-flyers is currently being developed at NASA Johnson Space Center to perform these functions; the first member of the family is the AERCam Sprint vehicle. Many interesting dynamical questions are associated with the Sprint free-flyer. For instance, the reaction of a vehicle which is nearly spherically symmetric (such as Sprint) to a stuck-on thruster is significantly more complicated than that obtained for an idealized, perfectly spherical, spacecraft model. In particular, the real spacecraft will experience a form of forced nutation, with convergence towards either its major or minor principal axis, depending on both the applied torque and the mass properties of the vehicle. Furthermore, the body-fixed jet force vector may have a significant component along this principal axis, so giving rise to a considerable net linear acceleration of the spacecraft. The large velocity that can result is very important, as it may lead to collision with the nearby Orbiter, and is completely overlooked in the idealized analysis. This report will firstly briefly describe the stuck-on thruster dynamics of the real vehicle, and outline how the small products of inertia of the spacecraft determine the time constants of the motion. Secondly, the dynamical effects of a failed-off jet on the Sprint free-flyer will be described in more detail, and compared with the stuck-on thruster case. This will help to show whether the two malfunctions should be dealt with differently in flight. Finally, the stuck-on thruster detection software (known as the uncommanded motion algorithm) that is proposed to be flown on the Sprint vehicle will be analyzed, and all possible perturbation sources that may tend to give rise to false stuck-on thruster alarms quantified. It will be shown that false alarms can be triggered by discrete events such as a failed-off thruster, a glancing collision with Orbiter structure, or thruster saturation. They can also be triggered by a combination of errors introduced by constantly present sources such as thrust level errors, thruster misalignment, inertial cross-coupling, angular rate sensor noise, and structural vibrations induced by thruster firings. Based on this fact, the original plan to have the spacecraft enter safe mode whenever the uncommanded motion algorithm is triggered does not appear to be advisable. A better approach seems to be to provide the Sprint pilot with a warning whenever uncommanded motion is detected, and then allow the crew to determine whether safing the vehicle is appropriate.

Williams, Trevor↗

DOE OSTI2021

Structural Health Monitoring: Using an Autoencoder to Identify Damage in a Bolted Joint [Capstone Project]

Los Alamos National Laboratory (LANL) is an important fixture in the United States Department of Energy’s (DOE) National Nuclear Security Agency (NNSA) complex. LANL is one of the largest national laboratories in the country, and the laboratory’s primary mission is to support the nation’s nuclear stockpile. The lab functions as a design agencies for the NNSA and performs extensive testing on weapons as part of that mission. The shock and vibration test team at LANL utilizes electrodynamic shaker systems for important qualification testing in support of the laboratory’s mission. Modern engineering relies heavily on bolted joints to connect two objects. During these shaker tests, engineers depend on bolted joints to secure the test article to a fixture and the fixture to the table. The test article may be hazardous and contain high explosives which could create a safety issue if a bolted joint failed. A loss of preload in a bolt will affect the way energy is input to the system and may introduce nonlinearities as the joint opens and closes. The loss of preload can create challenges controlling the test and make acquired signals useless. Being able to monitor preload within bolted joints during testing can improve the quality of the data and keep workers safe.

42 ENGINEERING↗

NASA NTRS2014

Addressing Challenges to the Design & Test of Operational Lighting Environments for the International Space Station

In our day to day lives, the availability of light, with which to see our environment, is often taken for granted. The designers of land based lighting systems use sunlight and artificial light as their toolset. The availability of power, quantity of light sources, and variety of design options are often unlimited. The accessibility of most land based lighting systems makes it easy for the architect and engineer to verify and validate their design ideas. Failures with an implementation, while sometimes costly, can easily be addressed by renovation. Consider now, an architectural facility orbiting in space, 260 miles above the surface of the earth. This human rated architectural facility, the International Space Station (ISS) must maintain operations every day, including life support and appropriate human comforts without fail. The facility must also handle logistics of regular shipments of cargo, including new passengers. The ISS requires accommodations necessary for human control of machine systems. Additionally, the ISS is a research facility and supports investigations performed inside and outside its livable volume. Finally, the facility must support remote operations and observations by ground controllers. All of these architectural needs require a functional, safe, and even an aesthetic lighting environment. At Johnson Space Center, our Habitability and Human Factors team assists our diverse customers with their lighting environment challenges, via physical test and computer based analysis. Because of the complexity of ISS operational environment, our team has learned and developed processes that help ISS operate safely. Because of the dynamic exterior lighting environment, uses computational modeling to predict the lighting environment. The ISS' orbit exposes it to a sunrise every 90 minutes, causing work surfaces to quickly change from direct sunlight to earthshine to total darkness. Proper planning of vehicle approaches, robotics operations, and crewed Extra Vehicular Activities are mandatory to ensure safety to the crew and all others involved. Innovation in testing techniques is important as well. The advent of Solid State Lighting technology and the lack of stable national and international standards for its implementation pose new challenges on how to design, test and verify individual light fixtures and the environment that uses them. The ISS will soon be replacing its internal fluorescent lighting system to a solid state LED system. The Solid State Lighting Assembly will be used not only for general lighting, but also as a medical countermeasure to control the circadian rhythm of the crew. The new light source has performance criteria very specific to its spectral fingerprint, creating new challenges that were originally not as significant during the original design of the ISS. This presentation will showcase findings and toolsets our team is using to assist in the planning of tasks, and design of operational lighting environments on the International Space Station.

Clark, Toni A.↗

DOE OSTI2020

Zincate-Blocking-Functionalized Polysulfone Separators for Secondary Zn–MnO 2 Batteries

Alkaline zinc–manganese dioxide (Zn–MnO 2 ) batteries are well suited for grid storage applications because of their inherently safe, aqueous electrolyte and established materials supply chain, resulting in low production costs. With recent advances in the development of Cu/Bi-stabilized birnessite cathodes capable of the full 2-electron capacity equivalent of MnO 2 (617 mA h/g), there is a need for selective separators that prevent zincate (Zn(OH) 4 ) 2– transport from the anode to the cathode during cycling, as this electrode system fails in the presence of dissolved zinc. In this work, we present the synthesis of N-butylimidazolium-functionalized polysulfone (NBI-PSU)-based separators and evaluate their ability to selectively transport hydroxide over zincate. We then examine their impact on the cycling of high depth of discharge Zn/(Cu/Bi–MnO 2 ) batteries when inserted in between the cathode and anode. Initially, we establish our membranes’ selectivity by performing zincate and hydroxide diffusion tests, showing a marked improvement in zincate-blocking (D Zn (cm 2 /min): 0.17 ± 0.04 × 10 –6 for 50-PSU, our most selective separator vs 2.0 ± 0.8 × 10 –6 for Cellophane 350P00 and 5.7 ± 0.8 × 10 –6 for Celgard 3501), while maintaining similar crossover rates for hydroxide (D OH (cm 2 /min): 9.4 ± 0.1 × 10 –6 for 50-PSU vs 17 ± 0.5 × 10 –6 for Cellophane 350P00 and 6.7 ± 0.6 × 10 –6 for Celgard 3501). We then implement our membranes into cells and observe an improvement in cycle life over control cells containing only the commercial separators (cell lifetime extended from 21 to 79 cycles).

crossover↗

NASA NTRS2008

ISS Contingency Attitude Control Recovery Method for Loss of Automatic Thruster Control

In this paper, the attitude control issues associated with International Space Station (ISS) loss of automatic thruster control capability are discussed and methods for attitude control recovery are presented. This scenario was experienced recently during Shuttle mission STS-117 and ISS Stage 13A in June 2007 when the Russian GN&C computers, which command the ISS thrusters, failed. Without automatic propulsive attitude control, the ISS would not be able to regain attitude control after the Orbiter undocked. The core issues associated with recovering long-term attitude control using CMGs are described as well as the systems engineering analysis to identify recovery options. It is shown that the recovery method can be separated into a procedure for rate damping to a safe harbor gravity gradient stable orientation and a capability to maneuver the vehicle to the necessary initial conditions for long term attitude hold. A manual control option using Soyuz and Progress vehicle thrusters is investigated for rate damping and maneuvers. The issues with implementing such an option are presented and the key issue of closed-loop stability is addressed. A new non-propulsive alternative to thruster control, Zero Propellant Maneuver (ZPM) attitude control method is introduced and its rate damping and maneuver performance evaluated. It is shown that ZPM can meet the tight attitude and rate error tolerances needed for long term attitude control. A combination of manual thruster rate damping to a safe harbor attitude followed by a ZPM to Stage long term attitude control orientation was selected by the Anomaly Resolution Team as the alternate attitude control method for such a contingency.

Bedrossian, Nazareth↗

NASA NTRSDate not supplied

Gateway Integrated ECLSS Model Analysis of Intermodule Ventilation Failures

The Gateway Integrated ECLSS Model (GIEM) is a set of two independent models, made in Aspen Custom Modeler (ACM) and Thermal Desktop (TD), of the Gateway stack and each modules' associated environment control and life support system (ECLSS). The GIEM utilizes the 41-Node Metabolic Man (METMAN) to simulate crew inside the Gateway consuming O2 and producing CO2, H2O, and heat for the ECLSS to remove. The modules and visiting vehicles all have different levels of ECLSS capabilities and may rely on other modules and Intermodular Ventilation (IMV), which is used to exchange gas between the modules, to ensure the entire Gateway environment is controlled. If IMV were to fail or be turned off, some vehicles may have limited access to necessary ECLSS functions. This analysis focuses on evaluating O2, CO2, and H2O levels when crew are in vehicles without their own life support and IMV has failed to evaluate how long before the atmosphere is unsafe for the crew. This analysis uses the integrated nature of the GIEM to look at time to effect for O2 depletion and CO2 and H2O buildup when crew are working in vehicles that have been cut off from the ECLSS-active portion of the stack. This information is used to inform for how long crew can safely continue working in the ECLSS-inactive vehicles before experiencing a requirement violation or physical limitation and can be referenced when developing maintenance and emergency response concept of operations (ConOps).

Lawrence Barrett↗

DOE OSTI2024

Adaptive Protection and Validated Models to Enable Deployment of High Penetrations of Solar PV (PV-MOD)

The availability and validation of various PV models in commercial tools differ, with some models not yet thoroughly validated for advanced inverter functionalities and reliable performance under weak system conditions. Many existing models do not fully incorporate new inverter control functions, which can affect system stability. The increasing deployment of solar PV and other inverter-based resources (IBRs), including distributed energy resources (DERs), is influencing the reliable operation of protection schemes in distribution systems and microgrids. Emerging adaptive protection schemes (APS) offer new opportunities for protecting these systems during varying configurations and DER operating conditions, though their demonstration and validation remain limited. Adaptive protection schemes face similar challenges, as they are typically designed for specific configurations. There is a growing need for tools and methodologies to streamline the deployment of adaptive protection for safe and reliable DER integration. The project main objective was to develop and validate high-fidelity generic models of solar PV facilities for stability, protection, EMT, and QSTS analyses. This objective was achieved, and these models can now be integrated into commercial software tools, enabling utilities, vendors, and developers to study high-penetration PV systems more confidently. The project also demonstrated advanced applications of these models, including the design and deployment of adaptive protection schemes in high-penetration field applications and microgrids, supporting grid safety and reliability. Several milestones were reached by the end of the project. A sophisticated inverter test plan was developed, and inverters representative of the North American marketplace were selected. EPRI and NREL tested various inverters, conforming to IEEE standards. Improvements were made to existing generic models of IBR units, IBR plants, and aggregated feeders for various analyses. The first generic electromagnetic transient (EMT) model for a solar PV plant was developed, conforming to IEEE Std 2800™-2022 and validated against laboratory measurements of a 2.2 MVA large-scale battery energy storage system (BESS) inverter. That model was then used to produce reference responses illustrating examples of validated and verified IBR plant models that pass or fail tests for technical minimum capability and performance as specified in the IEEE standard. The developed, tested, and validated generic models can be used for transmission planning, stability assessments, expansion planning, and evaluating potential future IBR interconnection requirements. They can also support interconnection screens and conformity assessments of IBR plants, including solar PV. The project significantly contributed to the ongoing standardization and model-based representation and verification of IBR responses. The project further addressed challenges of common distribution protection schemes with increasing deployment of DER by developing, validating, and demonstrating adaptive protection schemes (APS) that can improve the reliable and safe integration of DER into distribution systems. New APS were designed using improved DER models for three common distribution systems: a radial feeder, a meshed network, and a microgrid. Modeling and hardware-in-the-loop (HIL) testing of the APS were conducted, successfully showing their effectiveness and selectivity. Proof-of-concept field demonstration was achieved for two APS, i.e., one on a radial feeder and another one in a microgrid. Field demonstration could not be achieved for the APS on a meshed network, primarily due apprehension of one utility partner and also due to limited access to the protective algorithms in the network protectors. Guidelines developed from the lessons learned in the project lay out the general process followed in the design, installation, and commissioning of APS for various distribution systems. Distribution utility partners’ apprehension about field demonstration of the new APS were addressed—with varying success—by taking a stepped risk-management approach of modeling of a wide range of sensitivities first, performing in-depth proof-of-concept testing in the laboratory including HIL next, and finally deliberately implementing and commissioning the actual protection equipment and algorithms into parts of—or in parallel operation to—the three real distribution systems. Future work should include pilot projects that further show the acceptable performance of the developed APS before these schemes be rolled out more widely. Inclusion of both utility and original equipment manufacturers (OEMs) in future projects could increase chances of successful field demonstration. Despite challenges in achieving the field demonstration goal of the project for all three APS, the research significantly contributed to the innovation of adaptive protection solutions for scalable and reliable DER integration into distribution systems. This project significantly enhances the understanding of the impact of using appropriate inverter models on distribution and transmission (T&D) systems. By addressing the limitations of existing generic models, the project introduces high-fidelity models for stability, protection, electromagnetic transient (EMT), and quasi-static time series (QSTS) analyses. These models, integrated into commercial software tools, enable utilities, vendors, and developers to confidently study high-penetration PV systems. The project also demonstrates advanced applications, including adaptive protection schemes (APS) for distribution systems and microgrids, ensuring grid safety and reliability. The technical effectiveness and economic feasibility of the methods are evident through the development and validation of sophisticated inverter test plans and the selection of representative inverters. Testing by EPRI and NREL on retail, commercial, and utility-scale inverters, conforming to IEEE standards, underscores the robustness of the models. Improvements to existing generic models for various analyses further enhance their validity and applicability. The project also identifies gaps in common distribution protection schemes and designed new APS using improved DER models, demonstrating their effectiveness through modeling and hardware-in-the-loop (HIL) testing. The project’s benefits to the public are manifold. By advancing the standardization and model-based representation of IBR response, it supports transmission planning, stability assessments, and future IBR interconnection requirements. The generic models can facilitate better communication between transmission planners and developers, supporting expected IBR plant capability and performance. Additionally, the development of APS for radial feeders, meshed networks, and microgrids supports the integration of distributed energy resources (DERs) into distribution systems, enhancing grid reliability and safety. The project’s emphasis on thorough testing and simplicity in design ensures practical and scalable solutions for DER integration.

14 SOLAR ENERGY↗

DOE OSTI2024

The Challenges of Troubleshooting

Troubleshooting work presents electrical and other workers with a challenging combination of physical hazards, working conditions, and time pressure, which can lead to unwanted outcomes if not carefully managed.Summaries of several incidents in which workers were injured or at risk of injury while performing troubleshooting work are presented, identifying organizational weaknesses and error precursors that contributed to each incident.The primary challenges include:Deranged equipment. Equipment that needs troubleshooting is not in a normal operating condition. Actions that are safe when the equipment is in a normal state may not be safe in the deranged state.Work planning and control. The steps taken in troubleshooting are most often determined by the results of the immediately previous diagnostic test, making effective work planning challenging.Multiple types of hazards. Most equipment will present a troubleshooting worker with several types of hazards, including hazardous energy as defined in 29 CFR 1910.147. Portions of the troubleshooting activity may be infeasible without these hazards present.Time pressure. Restoring operation of failed equipment often involves an explicit or implicit sense of urgency.Equipment design and construction. The physical construction of the equipment in large part will determine to which hazards troubleshooters may be exposed. It will also determine which hazards may be encountered while performing the servicing needed to restore the equipment or system to operation.There are effective methods for addressing each challenge, most of which require a combination of advance preparation and management commitment.

Mertz, David E.↗

NASA NTRS1995

Designing Flight-Deck Procedures

A complex human-machine system consists of more than merely one or more human operators and a collection of hardware components. In order to operate a complex system successfully, the human-machine system must be supported by an organizational infrastructure of operating concepts, rules, guidelines, and documents. The coherency of such operating concepts, in terms of consistency and logic, is vitally important for the efficiency and safety of any complex system. In high-risk endeavors such as aircraft operations, space flight, nuclear power production, manufacturing process control, and military operations, it is essential that such support be flawless, as the price of operational error can be high. When operating rules are not adhered to, or the rules are inadequate for the task at hand, not only will the system's goals be thwarted, but there may also be tragic human and material consequences. To ensure safe and predictable operations, support to the operators, in this case flight crews, often comes in the form of standard operating procedures. These provide the crew with step-by-step guidance for carrying out their operations. Standard procedures do indeed promote uniformity, but they do so at the risk of reducing the role of human operators to a lower level. Management, however, must recognize the danger of over-procedurization, which fails to exploit one of the most valuable assets in the system, the intelligent operator who is "on the scene." The alert system designer and operations manager recognize that there cannot be a procedure for everything, and the time will come in which the operators of a complex system will face a situation for which there is no written procedure. Procedures, whether executed by humans or machines, have their place, but so does human cognition.

Degani, Asaf↗