SEARCH · Engineering Papers

Results for “Failing Safely”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

358 records · Page 20

All sources NASA NTRS DOE OSTI

NASA NTRS1998

Objective Situation Awareness Measurement Based on Performance Self-Evaluation

The research was conducted in support of the NASA Safe All-Weather Flight Operations for Rotorcraft (SAFOR) program. The purpose of the work was to investigate the utility of two measurement tools developed by the British Defense Evaluation Research Agency. These tools were a subjective workload assessment scale, the DRA Workload Scale and a situation awareness measurement tool. The situation awareness tool uses a comparison of the crew's self-evaluation of performance against actual performance in order to determine what information the crew attended to during the performance. These two measurement tools were evaluated in the context of a test of innovative approach to alerting the crew by way of a helmet mounted display. The situation assessment data are reported here. The performance self-evaluation metric of situation awareness was found to be highly effective. It was used to evaluate situation awareness on a tank reconnaissance task, a tactical navigation task, and a stylized task used to evaluated handling qualities. Using the self-evaluation metric, it was possible to evaluate situation awareness, without exact knowledge the relevant information in some cases and to identify information to which the crew attended or failed to attend in others.

DeMaio, Joe↗

NASA NTRS2011

Geoscience Laser Altimetry System (GLAS) Loop Heat Pipe Anomaly and On Orbit Testing

The Geoscience Laser Altimetry System (GLAS) is the sole instrument on the ICESat Satellite. On day 230 of 2003, the GLAS Component Loop Heat Pipe (CLHP) entered a slow circulation mode that resulted in the main electronics box reaching its hot safing temperature, after which the entire instrument was turned off. The CLHP had a propylene working fluid and was actively temperature controlled via a heater on the compensation chamber. The slow circulation mode happened right after a planned propulsive yaw maneuver with the spacecraft. It took several days to recover the CLHP and ensure that it was still operational. The recovery occurred after the entire instrument was cooled to survival temperatures and the CLHP compensation chamber cycled on a survival heater. There are several theories as to why this slow circulation mode exhibited itself, including: accumulation of Non-Condensible Gas (NCG), the secondary wick being under designed or improperly implemented, or an expanded (post-launch) leak across the primary wick. Each of these is discussed in turn, and the secondary wick performance is identified as the most likely source of the anomalous behavior. After the anomaly, the CLHP was controlled to colder temperatures to improve its performance (as the surface tension increases with lower temperature, as does the volume of liquid in the compensation chamber) and only precursor pulses occurred later in the mission. After GLAS s last laser failed, in late 2009, a decision was made to conduct engineering tests of both LHPs to try and duplicate this flight anomaly. The engineering tests consisted of control setpoint changes, sink changes, and one similar propulsive Yaw maneuver. The only test that showed any similar anomaly precursors on the CLHP was the propulsive maneuver followed by a setpoint increase. The ICESat Satellite was placed in a decaying orbit and ended its mission on August 30, 2010 in Barents Sea.

Baker, Charles↗

DOE OSTI2022

MECHANISTIC MULTIPHYSICS MODELING OF CLADDING RUPTURE IN NUCLEAR FUEL RODS DURING LOSS-OF-COOLANT ACCIDENT CONDITIONS

The Loss of Coolant Accident (LOCA) is a design basis accident that is included as part of the safety analysis of nuclear power plants. As the nuclear industry desires to increase the cycle length and discharge burnup of existing nuclear power plants they must demonstrate safe operation during a LOCA on high burnup fuel. During a LOCA transient on high burnup fuel rods, the rods may undergo a process known as fuel fragmentation, relocation, and dispersal (FFRD). To permit dispersal, the cladding encapsulating the fuel must rupture with an opening size large enough to allow the fragmented fuel particles to release. Current licensing tools used by industry and the United States Nuclear Regulatory Commission are limited in geometric fidelity and materials that can be analyzed. These simulation tools generally employ a quasi-two-dimensional (1.5D or Layered1D) or 2D-RZ axisymmetric geometric representations exclusively. While a valid approach under some instances, there are times when important physics have an asymmetric behavior in the fuel rod. Examples include fuel fragmentation, thermal-hydraulic boundary conditions, and cladding rupture, all of which are important for LOCA analysis. As industry pursues burnup extensions it must be demonstrated that fuel dispersal can be mitigated or eliminated. To do this, an understanding of the rupture opening after cladding failure is required. This work presents the development of a model for predicting the size and location of the rupture opening in failed fuel rods during LOCA conditions using advanced modeling and simulation tools. In order to supply the rupture model with appropriate boundary conditions, improvements to fuel fragmentation, axial relocation and oxidation modeling were required. First, the eXtended Finite Element Method (XFEM) is used to mechanistically predict the number of fuel fragments that form due to material strength randomization, criteria for strength randomization, mesh density, power ramping rates and irradiation effects. These predictions with associated uncertainty were compared to empirical correlations developed for UO2 verifying that they can be used with increased confidence in subsequent axial relocation analyses. Secondly, a new first-of-its-kind Layered2D computational framework was developed that provides the ability to apply azimuthally varying boundary conditions while providing discrete layers to track fuel movement during the LOCA. An existing fuel axial relocation model developed for Layered1D was extended to work within the Layered2D framework. A large sensitivity study was performed on the initial version of the model to identify modeling parameters of particular importance, with the emissivity used for radiation after blowdown being the primary source of uncertainty. Then, a simplistic approach to incorporate mechanical degradation of the cladding due to oxidation was also developed to investigate the impact of reduced cladding thickness on predictions of the time to failure of cladding tubes. It was found that the cladding will typically rupture prior to a reduction in thickness that is sufficient to impact the rupture behavior. A model was then developed for predicting cladding rupture that transfers the cladding surface temperatures, rod internal and external pressures, fast neutron fluence, and fast neutron flux from a more detailed Layered1D, Layered2D, or 2D-RZ analysis to a 3D cladding only analysis. Comparisons of the rupture model to a few experiments indicate reasonable predictions. The rupture model was then applied to two accident tolerant fuel concepts (FeCrAl and Cr-coated Zircaloy) where it predicted that both ATF concepts would have smaller rupture openings and delayed rupture times than the standard Zircaloy-4 cladding material under identical loading conditions.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗

DOE OSTI2020

Structural, Criticality, and Radiation Dose Calculations to support SNF Loading into a DOE Standard Canister

The DOE Standard Canister Demonstration Project includes the development of an internal support structure (ISS) for the 4.6-m long and 45.7-cm diameter canister. This study presents structural evaluations, criticality safety assessments, and dose rate calculations conducted within the scope of the ISS design process to support smooth canister loading operations and to ensure safe storage, transportation, and disposal of Peach Bottom 1 Core II (PB2) and Fort St. Vrain (FSV) SNF, currently stored at the CPP-603 facility of the INL. The ISS includes a 316L stainless steel basket that holds twelve PB2 SNF rods. Further, six individual, 78.7-cm long, 316L stainless steel columns are equally spaced and welded to the inner canister wall at the lower end of the shell. These columns represent the FSV basket and can hold one FSV SNF element. An A92014 T6 aluminum spacer disc is bolted to the bottom plate of the PB2 basket to vertically restrain the FSV SNF element after the PB2 basket is placed inside the canister on top of the FSV basket. The structural evaluations of the ISS followed applicable ASME BPVC.III.3 guidelines and included finite element (FE) analyses of the PB2 basket structure; analyses of welds and bolds; buckling analyses of selected components, and acceptability assessments of the expected basket deformations under loading operations. The criticality safety assessments used the Monte Carlo N-Particle (MCNP) software architecture version 6.2 including ENDF/B-V continuous energy cross-section libraries, considering intact SNF in a single storage overpack or two multi-storage overpack configurations, and intact or failed SNF configured for disposal. The dose rate computations are based on source terms taken from the DOE Spent Fuel Database. The isotopic composition was decay corrected for the year 2022 using the ORIGEN module in the SCALE suite. A 19-group photon spectrum and 27-group neutron-source spectra were generated and used in MCNP to calculate estimated dose-equivalent rates, both on DOE Standard Canister contact and at a radial distance of from the canister surface. The results of this study indicate a structurally sound system that can uphold its criticality safety functions throughout its intended operational phases. Further, they increase confidence that sufficient radiological protection is technically achievable.

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

DOE OSTI2022

Structural, Criticality, and Radiation Dose Calculations to Support SNF Loading into a DOE Standard Canister

The DOE Standard Canister Demonstration Project includes the development of an internal support structure (ISS) for the 4.6-m-long and 45.7-cm-diameter canister. This study presents structural evaluations, criticality safety assessments, and dose rate calculations conducted within the scope of the ISS design process to support smooth canister loading operations and to ensure safe storage, transportation, and disposal of Peach Bottom 1 Core II (PB2) and Fort St. Vrain (FSV) SNF, currently stored at INL’s CPP-603 facility. The ISS includes a 316L stainless-steel basket that holds 12 PB2 SNF rods. The PB2 basket rests on top of six individual, 78.7-cm-long, 316L stainless-steel columns that are equally spaced and welded to the inner canister wall at the lower end of the shell. These columns represent the FSV basket and can hold one FSV SNF element. An A92014 T6 aluminum spacer disc is bolted to the bottom plate of the PB2 basket to vertically restrain the FSV SNF element after the PB2 basket is placed inside the canister above the FSV basket. The structural evaluations of the ISS followed applicable ASME BPVC.III.3 guidelines and included finite element (FE) analyses of the PB2 basket structure; analyses of welds and bolds; buckling analyses of selected components, and acceptability assessments of the expected basket deformations under loading operations. The criticality safety assessments used the Monte Carlo N-Particle (MCNP) software architecture Version 6.2, including ENDF/B-V continuous-energy cross-section libraries, considering intact SNF in a single storage overpack or two multistorage overpack configurations and intact or failed SNF configured for disposal. The dose rate computations are based on source terms taken from the DOE Spent Fuel Database. The isotopic composition was decay corrected for the year 2022 using the ORIGEN module in the SCALE suite. A 19-group photon spectrum and a 27-group neutron-source spectrum were generated and used in MCNP to calculate estimated dose-equivalent rates, both on DOE Standard Canister contact and at a radial distance of 1 m from the canister surface. The results of this study indicate a structurally sound system that can uphold its criticality safety functions throughout its intended operational phases. Furthermore, this study provides confidence that sufficient radiological protection is technically achievable.

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

NASA NTRS2019

Health Management and Prognostics for Electric Aircraft Powertrain

W and c Any air borne vehicle needs incorporating safety as key parameter of measure, and inclusion of autonomy raises the critical need for safety under autonomous operations. Management of faults and component degradation is key as complexity in autonomous operations grow over the period of time. Therefore, in addition to basic operational requirements, an autonomous electric vehicle should be able to make accurate estimates of its current system health and take the correct decisions to complete its mission successfully. Real-time safety and state-awareness tools are therefore essential for the vehicle to be able to reach its destination in a safe and successful manner. The need for safety assurance and health management capabilities is particularly relevant for aircraft electric propulsion systems, which are relatively new and with limited historical to learn. They are critical systems requiring high power density along with reliability, resilience, efficient management of weight, and operational costs. A model- based fault diagnosis and prognostics approach of complex critical systems can successfully accomplish the safety and state awareness goal for such electric propulsion systems, enabling autonomous decision making capability for safe and efficient operation. To identify critical components in the system a Qualitative Bayesian approach using FMECA is implemented. This requires the assessment of some quantities representing the state of the electric unmanned aerial systems (e-UAS), as well as look-ahead forecasts of such states during the entire flight, presented in form of safety metrics (SM). In-service data and performance data gathered from degraded components sup- ports diagnostic and prognostic methods for these systems, but this data can be difficult to obtain as weight and packaging restrictions reduce redundancy and instrumentation on-board the vehicle. Therefore, an model-based framework should be capable or operating with limited data. In addition to data scarcity, the variability of such complex critical systems re- quires the model-based framework to reason in the presence of uncertainty, such as sensor noise, and modeling imperfections. Quantification of errors and uncertainties in the measured states and quantities is therefore a fundamental step for a precise estimation of such SMs; un-modeled uncertainty may result in erroneous state assessment and un- reliable predictions of future states of e-UAVs. Typical, centralized model-based schemes suffer from inherent disadvantages such as computational complexity, single point of failure, and scalability issues, and therefore may fail in such a complex scenario. This paper presents a methodology for developing a system level diagnostics and prognostics approach using a Qualitative Bayesian FMECA approach along with a formal uncertainty management framework for an e-UAS. In this work we demonstrate the efficacy of the framework to predict effects of sub-system level degradation on vehicle operation incorporating uncertainty management to predict future behavior under different operating conditions.

Kulkarni, Chetan↗

NASA NTRS2004

Trajectory Specification for High-Capacity Air Traffic Control

In the current air traffic management system, the fundamental limitation on airspace capacity is the cognitive ability of human air traffic controllers to maintain safe separation with high reliability. The doubling or tripling of airspace capacity that will be needed over the next couple of decades will require that tactical separation be at least partially automated. Standardized conflict-free four-dimensional trajectory assignment will be needed to accomplish that objective. A trajectory specification format based on the Extensible Markup Language is proposed for that purpose. This format can be used to downlink a trajectory request, which can then be checked on the ground for conflicts and approved or modified, if necessary, then uplinked as the assigned trajectory. The horizontal path is specified as a series of geodetic waypoints connected by great circles, and the great-circle segments are connected by turns of specified radius. Vertical profiles for climb and descent are specified as low-order polynomial functions of along-track position, which is itself specified as a function of time. Flight technical error tolerances in the along-track, cross-track, and vertical axes define a bounding space around the reference trajectory, and conformance will guarantee the required separation for a period of time known as the conflict time horizon. An important safety benefit of this regimen is that the traffic will be able to fly free of conflicts for at least several minutes even if all ground systems and the entire communication infrastructure fail. Periodic updates in the along-track axis will adjust for errors in the predicted along-track winds.

Paielli, Russell A.↗

NASA NTRS2008

Leading Your Leaders

Even though working on a problem has been your primary effort for the past year, your leadership may have heard about this once in a briefing a decade ago. Now they are basically clueless. Pretend that you are talking to your daughter's fifth-grade class. Explain how your complicated gizmo works. If possible, do not use acronyms. Define your terms. Put your work in context. Assume your leader has no idea what you do, who you work for, or what your gizmo does. That is a good place to start. Remember, taking the next century to study the problem or spending the Gross National Product to invent a new solution are probably not going to be acceptable solutions. Real engineers and technicians build real hardware that works in the real world in a reasonable manner within a reasonable time at a reasonable cost. True, skimping on time or money can cause mistakes, but folks whose gizmos are delayed unreasonably or cost more than is practical get their programs canceled, force the business into bankruptcy, or give the market over to the competition. Real engineers and technicians always consider cost and schedule in their work. Raising questions is important. However, we are in the business of doing things. Engineers and technicians are paid to get things done. Yes, you have to identify the problem, frame the design, identify the tests, perform the analysis, and assemble the hardware. But the goal is to solve the problem. Nobody ever said flying in space was easy. We make it look easy the same way that an Olympic champion makes her sport look easy: by working hard at improving performance every day. Better are the results of a well-defined test. Remember that a test on a laboratory bench is always an approximation of reality, and rules similar to those for good analysis also apply. One should always be mindful of Mechelay's rule: "It is better to be stupid than to run a stupid test." Often we try to overtest. If a piece of hardware passes an unbelievably difficult test, then life is good. More often when an unbelievably difficult test fails, we are left with a very long discussion of why and what was wrong in the design or execution of the test. Make sure that the test is well defined. Even then, it is important to explain to your leaders what inherent accuracy (or error) the test conditions or equipment have and what the assumptions or initial conditions were for the test. Test results without a good understanding of the test's accuracy or the pedigree of the test assumptions are worth very little. Finally, there is flight test data. Always limited, never at the edge of the envelope, it still shows how the real hardware works in a combined environment. Flight experience is dangerous because it typically doesn't show how close to the edge of the cliff the equipment is operating, but it does demonstrate how the hardware really works. A flight test is the ultimate test, again taken with the knowledge that it is probably not the extreme but something more like the middle of the environmental and systems performance. Good understanding of a problem and its solution always relies on a combination of all these methods. Be sure to lead your leaders by using all the tools you have at your disposal. At the end of the day, decisions in space flight always come down to a risk trade. Our business is not remotely safe, not in the sense that the public, the media, or our legislators use the term. Everything we do has a risk, cost, schedule, or performance trade-off. For your leaders to make an appropriate decision, you need to educate them, lead them, talk with them, and engage them in the discussion until full understanding takes place. It's your job. *

Hale, Wayne N.↗

NASA NTRS1996

Cross-Cultural Barriers to Effective Communication in Aviation

Communication is essential to safe flight, as evidenced by several accidents in which crew communicates was found to have contributed to the accidents. This chapter documents the essential role of explicit efficient communication to flight safety with a global context. It addresses communication between flight crews and air traffic controllers in regions a the world where pilots and controllers speak different native languages, as well as cases in which crew members within the flight deck represent different native languages and cultures. It also addresses problems associated with "exporting" crew resource management training programs to parts of the world which values and norms differ from those of the United States, where these programs were initially developed. This chapter is organized around several central questions: (1) What are various kinds of communication failures and what are their consequences; (2) What are the causes of communication failure; (3) What are features of effective crew communication; (4) What can be done to enhance communication success? To explore a wider range of communication failures than available from accident reports, we examined a set of incident reports from the Aviation Safety Reporting System. These could be classified into three major categories: those in which language actually interfered with transmission of a message; those in which transmission was adequate but the context was not expressed unambiguously and thus the message received was not the same as the message intended; and those in which the message was received as intended, but was not adequately understood or acted upon, mainly because of cultural factors. The consequences of failed communication can be flight errors (such as when a clearance is not received correctly), loss of situation awareness, or failure of crew members (or ATC and pilots) to build a shared understanding of a situation. Causes of misunderstanding can be traced to a number of sources, often grounded in faulty assumptions held by one or both parties to a conversation. Speakers and listeners often experience "illusionary understanding" in which they think they understand each other, but in fact do not. While this problem can exist within a single culture, it is much more serious across cultures. Training in effective explicit communication is a component of Crew Resource Management training programs developed in the U.S. These programs are being adopted by airlines around the world, with varying degrees of success. The level of success in part depends on how similar the conversational and social styles of those cultures are to those of the U.S. A factor that influences conversational style is a culture's relative positioned on two major dimensions that distinguish national cultural groups: individualism vs. collectivism and degree of power distance. The chapter concludes with a discussion of techniques for overcoming the various classes of communication failures and for effectively adapting training programs to fit the values and norms of cultures around the globe.

Fischer, U.↗

NASA NTRS2007

Testing of Full Scale Flight Qualified Kevlar Composite Overwrapped Pressure Vessels

Many decades ago NASA identified a need for low-mass pressure vessels for carrying various fluids aboard rockets, spacecraft, and satellites. A pressure vessel design known as the composite overwrapped pressure vessel (COPV) was identified to provide a weight savings over traditional single-material pressure vessels typically made of metal and this technology has been in use for space flight applications since the 1970's. A typical vessel design consisted of a thin liner material, typically a metal, overwrapped with a continuous fiber yarn impregnated with epoxy. Most designs were such that the overwrapped fiber would carry a majority of load at normal operating pressures. The weight advantage for a COPV versus a traditional singlematerial pressure vessel contributed to widespread use of COPVs by NASA, the military, and industry. This technology is currently used for personal breathing supply storage, fuel storage for auto and mass transport vehicles and for various space flight and aircraft applications. The NASA Engineering and Safety Center (NESC) was recently asked to review the operation of Kevlar 2 and carbon COPVs to ensure they are safely operated on NASA space flight vehicles. A request was made to evaluate the life remaining on the Kevlar COPVs used on the Space Shuttle for helium and nitrogen storage. This paper provides a review of Kevlar COPV testing relevant to the NESC assessment. Also discussed are some key findings, observations, and recommendations that may be applicable to the COPV user community. Questions raised during the investigations have revealed the need for testing to better understand the stress rupture life and age life of COPVs. The focus of this paper is to describe burst testing of Kevlar COPVs that has been completed as a part of an the effort to evaluate the effects of ageing and shelf life on full scale COPVs. The test articles evaluated in this discussion had a diameter of 22 inches for S/N 014 and 40 inches for S/N 011. The time between manufacture and burst was 28 and 22 years. Visual inspection, shearography, heat soak thermography and borescope inspection were performed on vessel S/N 011 and all but shearography was performed on S/N 014 before they were tested and details of this work can be found in a companion paper titled, "Nondestructive Methods and Special Test Instrumentation Supporting NASA Composite Overwrapped Pressure Vessel Assessments." The vessels were instrumented so that measurements could be made to aid in the understanding of vessel response. Measurements made on the test articles included girth, boss displacement, internal volume, multiple point strain, full field strain, eddy current, acoustic emission (AE) pressure and temperature. The test article before and during burst is shown with the pattern used for digital image correlation full field strain measurement blurring as the vessel fails.

Greene, Nathanael↗

NASA NTRSDate not supplied

A System to Provide Deterministic Flight Software Operation and Maximize Multicore Processing Performance: The Safe and Precise Landing – Integrated Capabilities Evolution (SPLICE) Datapath

A method and design are described for a system that processes multiple data streams, utilizing a multicore asymmetric processing architecture, that eliminates data interrupts to the application processors. The design supports a deterministic environment for flight software in NASA’s Safe and Precise Landing – Integrated Capabilities Evolution (SPLICE) project. The SPLICE project develops sensor, algorithm, and compute technologies for Precision Landing and Hazard Avoidance (PL&HA) capabilities. The compute technology for SPLICE is the Descent and Landing Computer (DLC). The DLC hosts several SPLICE algorithms with high computational resource requirements that must be executed in a real-time and deterministic manner. The software runs on a custom Single Board Computer (SBC), with a Xilinx Ultrascale+ Multiprocessor System-on-a-Chip (MPSoC). Input data for the flight software is from a variety of sensors, unique with respect to data rate and packet size. A data path between the SPLICE sensors and algorithms is designed to efficiently deliver this data to the flight software using the MPSoC asymmetric processing cores and Field Programmable Gate Array (FPGA) fabric. This is implemented in a manner that isolates the application processors running the flight software from interrupts associated with the input data. By leveraging real-time processors on the MPSoC, and a structure with the appropriate interfaces in the shared memory on the SBC, the flight software can use the full set of application processors. The available utilization for each processor in this set is also maximized for the SPLICE applications, providing a sufficiently deterministic execution environment without the cost and overhead of a real-time operating system.

heterogeneous processing system↗

NASA NTRS2023

A System to Provide Deterministic Flight Software Operation and Maximize Multicore Processing Performance: The Safe and Precise Landing – Integrated Capabilities Evolution (SPLICE) Datapath

David K. Rutishauser↗

NASA NTRS2008

Sensor Selection and Data Validation for Reliable Integrated System Health Management

For new access to space systems with challenging mission requirements, effective implementation of integrated system health management (ISHM) must be available early in the program to support the design of systems that are safe, reliable, highly autonomous. Early ISHM availability is also needed to promote design for affordable operations; increased knowledge of functional health provided by ISHM supports construction of more efficient operations infrastructure. Lack of early ISHM inclusion in the system design process could result in retrofitting health management systems to augment and expand operational and safety requirements; thereby increasing program cost and risk due to increased instrumentation and computational complexity. Having the right sensors generating the required data to perform condition assessment, such as fault detection and isolation, with a high degree of confidence is critical to reliable operation of ISHM. Also, the data being generated by the sensors needs to be qualified to ensure that the assessments made by the ISHM is not based on faulty data. NASA Glenn Research Center has been developing technologies for sensor selection and data validation as part of the FDDR (Fault Detection, Diagnosis, and Response) element of the Upper Stage project of the Ares 1 launch vehicle development. This presentation will provide an overview of the GRC approach to sensor selection and data quality validation and will present recent results from applications that are representative of the complexity of propulsion systems for access to space vehicles. A brief overview of the sensor selection and data quality validation approaches is provided below. The NASA GRC developed Systematic Sensor Selection Strategy (S4) is a model-based procedure for systematically and quantitatively selecting an optimal sensor suite to provide overall health assessment of a host system. S4 can be logically partitioned into three major subdivisions: the knowledge base, the down-select iteration, and the final selection analysis. The knowledge base required for productive use of S4 consists of system design information and heritage experience together with a focus on components with health implications. The sensor suite down-selection is an iterative process for identifying a group of sensors that provide good fault detection and isolation for targeted fault scenarios. In the final selection analysis, a statistical evaluation algorithm provides the final robustness test for each down-selected sensor suite. NASA GRC has developed an approach to sensor data qualification that applies empirical relationships, threshold detection techniques, and Bayesian belief theory to a network of sensors related by physics (i.e., analytical redundancy) in order to identify the failure of a given sensor within the network. This data quality validation approach extends the state-of-the-art, from red-lines and reasonableness checks that flag a sensor after it fails, to include analytical redundancy-based methods that can identify a sensor in the process of failing. The focus of this effort is on understanding the proper application of analytical redundancy-based data qualification methods for onboard use in monitoring Upper Stage sensors.

Garg, Sanjay↗

DOE OSTI2022

Report on Year-4 of Water NSTF Matrix Testing: Facility Maintenance and Accident Testing

Under support from the Department of Energy (DOE) and the Office of Advanced Reactor Technologies (ART), a large-scale test facility has been constructed at Argonne National Laboratory to generate NQA-1 qualified validation data for passive decay heat removal systems in advanced reactors. The Natural convection Shutdown heat removal Test Facility (NSTF) reflects key features of a ½ scale, water-based, Reactor Cavity Cooling System (RCCS) and is intended to study the behavior, bound performance, and ultimately guide design decisions for passive decay heat removal systems for advanced reactors. In addition to the experimental activities detailed in this report, a supportive computational modeling effort is on-going which has been demonstrated to significantly strengthen the experimental program while also improving accuracy of the computer models. Together these create a mutually beneficial relationship integral to meeting the overall program objective of examining the heat removal performance of the RCCS concept. This report serves as a summary of maintenance and experimental activities during the program’s fourth year of water-based operation. A planned six-month maintenance period began in August 2021, during which major inspections, repairs, cleaning, and installation of new instrumentation and data acquisition hardware were conducted. Most significantly, two heaters that faulted during Year-3 were repaired, allowing the facility to resume use of the full heated section area and full range of available electric power. The remainder of the year consisted of eight months of test operations, during which the facility logged 211 hours of active heating across one bake-out (following the maintenance period) and seven matrix tests; five classifieds as Accepted per NQA-1, one as Trending, and one as Failed. Testing began by performing two repeat cases to confirm expected facility response and behavior during both single- and two-phase flow conditions, ensuring no changes were introduced during the maintenance period that might have altered the thermal-hydraulic characteristics of the facility. In continuation of the power parametric series initiated in previous years, a high-power test case was then performed examining heat removal performance at a decay heat load equivalent to 2.4 MWt, full-scale, a level exceeding maximum design targets. Additional testing then introduced various blockage scenarios along the network piping, examining the effects of partial and complete blockages of the flow paths on the system behavior and heat removal performance. A study of static boiling tests directed at understanding the geysering two-phase instability was also conducted. The loop was filled only to the bottom of the tank outlet, creating an open loop configuration that prevents any natural circulation flow from occurring, and the heaters were powered on until the facility reached saturation conditions. Following, a series of quasi-steady-state conditions were introduced by adjusting the inventory level in the adiabatic chimney piping at decreasingly lower elevations above the heated region. A strong correlation of geysering characteristics and loop level was observed, with flow and temperature excursions decreasing in intensity, but increasing in frequency, as the fill were reduced to lower elevations along the chimney piping. Once the level fell very low in the chimney, at points near the top of the heated section, the system reached a stable state of continuous boiling without any occurrence of geysering eruptions. A final significant testing accomplishment this year was successful completion of an “accident scenario” test, whose operating conditions were based on a prototypic decay heat curve provided by Framatome and scaled for the NSTF. This test began by establishing steady-state, single-phase “normal operation” conditions, before simulating an accident trip where the availability of active cooling systems was lost. Loop temperatures gradually increased until reaching saturation and subsequent two-phase boiling flow. Over the course of an extended operational period along the defined decay heat curve, steam boil-off caused gradual but continued depletion of liquid inventory until reaching a critically low level causing flow stagnation and cessation of natural circulation heat removal. At this point, after nearly 72 hours of continuous operation, a cold refill was performed to replenish the system inventory and allow the facility to re-establish closed loop natural circulation flow and return to a safe operational state.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

DOE OSTI2022

Minimizing Fraud in the Carbon Offset Market Using Blockchain Technologies

Fraud in the Environmental Benefit Credit (EBC) markets is pervasive. To make matters worse, the cost of creating EBCs is often higher than the market price. Consequently, a method to create, validate, and verify EBCs and their relevance is needed to mitigate fraud. The EBC market has focused on geologic (fossil fuel) CO 2 sequestration projects that are often over budget and behind schedule and has failed to capture the "lowest hanging fruit" EBCs - terrestrial sequestration via the agricultural industry. This project reviews a methodology to attain possibly the least costly EBCs by tracking the reduction of inputs required to grow crops. The use of bio- stimulant products, such as humate, allows a farmer to use less nitrogen without adversely affecting crop yield. Using less nitrogen qualifies for EBCs by reducing nitrous oxide emissions and nitrate runoff from a farmer's field. A blockchain that tracks the bio-stimulant material from source to application provides a link between a tangible (bio-stimulant commodity) and the associated intangible (EBCs) assets. Covert insertion of taggants in the bio-stimulant products creates a unique barcode that allows a product to be digitally tracked from beginning to end. This process (blockchain technology) is so robust, logical, and transparent that it will enhance the value of the associated EBCs by mitigating fraud. It provides a real time method for monetizing the benefits of the material. Substantial amounts of energy are required to produce, transport, and distribute agricultural inputs including fertilizer and water. Intelligent optimization of the use of agricultural inputs can drive meaningful cost savings. Tagging and verification of product application provides a valuable understanding of the dynamics in the water/food energy nexus, a major food security and sustainability issue. As technology in agriculture evolves so to must methods to verify the Enterprise Resource Planning (ERP) potential of innovative solutions. The technology reviewed provides the ability to combine blockchain and taggants ("taggant blockchains") as the engine by which to (1) mitigate fraudulent carbon credits; (2) improve food chain security, and (3) monitor and manage sustainability. The verification of product quality and application is a requirement to validate benefits. Recent upgrades to humic and fulvic quality protocols known as ISO CD 19822 TC134 offers an analytical procedure. This work has been assisted by the Humic Products Trade Association and International Humic Substance Society. In addition, providing proof of application of these products and verification of the correct application of prescriptive humic and bio-stimulant products is required. Individual sources of humate have unique and verifiable characteristics. Additionally, methods for prescription of site- specific agricultural inputs in agricultural fields are available. (See US Patents 734867B2, US 90658633B2.) Finally, a method to assure application rate is required through the use of taggants. Sensors using organic solid to liquid phase change nanoparticles of various types and melting temperatures added to the naturally occurring materials provide a barcode. Over 100 types of nanoparticles exist ensuring numerous possible barcodes to reduce industry fraud. Taggant materials can be collected from soil samples of plant material to validate a blockchain of humic, fulvic and other soil amendment products. Other non-organic materials are also available as taggants; however, the organic tags are biodegradable and safe in the environment allowing for use during differing application timeliness.

54 ENVIRONMENTAL SCIENCES↗

NASA NTRS2009

Cooperative Three-Robot System for Traversing Steep Slopes

Teamed Robots for Exploration and Science in Steep Areas (TRESSA) is a system of three autonomous mobile robots that cooperate with each other to enable scientific exploration of steep terrain (slope angles up to 90 ). Originally intended for use in exploring steep slopes on Mars that are not accessible to lone wheeled robots (Mars Exploration Rovers), TRESSA and systems like TRESSA could also be used on Earth for performing rescues on steep slopes and for exploring steep slopes that are too remote or too dangerous to be explored by humans. TRESSA is modeled on safe human climbing of steep slopes, two key features of which are teamwork and safety tethers. Two of the autonomous robots, denoted Anchorbots, remain at the top of a slope; the third robot, denoted the Cliffbot, traverses the slope. The Cliffbot drives over the cliff edge supported by tethers, which are payed out from the Anchorbots (see figure). The Anchorbots autonomously control the tension in the tethers to counter the gravitational force on the Cliffbot. The tethers are payed out and reeled in as needed, keeping the body of the Cliffbot oriented approximately parallel to the local terrain surface and preventing wheel slip by controlling the speed of descent or ascent, thereby enabling the Cliffbot to drive freely up, down, or across the slope. Due to the interactive nature of the three-robot system, the robots must be very tightly coupled. To provide for this tight coupling, the TRESSA software architecture is built on a combination of (1) the multi-robot layered behavior-coordination architecture reported in "An Architecture for Controlling Multiple Robots" (NPO-30345), NASA Tech Briefs, Vol. 28, No. 10 (October 2004), page 65, and (2) the real-time control architecture reported in "Robot Electronics Architecture" (NPO-41784), NASA Tech Briefs, Vol. 32, No. 1 (January 2008), page 28. The combination architecture makes it possible to keep the three robots synchronized and coordinated, to use data from all three robots for decision- making at each step, and to control the physical connections among the robots. In addition, TRESSA (as in prior systems that have utilized this architecture) , incorporates a capability for deterministic response to unanticipated situations from yet another architecture reported in Control Architecture for Robotic Agent Command and Sensing (NPO-43635), NASA Tech Briefs, Vol. 32, No. 10 (October 2008), page 40. Tether tension control is a major consideration in the design and operation of TRESSA. Tension is measured by force sensors connected to each tether at the Cliffbot. The direction of the tension (both azimuth and elevation) is also measured. The tension controller combines a controller to counter gravitational force and an optional velocity controller that anticipates the motion of the Cliffbot. The gravity controller estimates the slope angle from the inclination of the tethers. This angle and the weight of the Cliffbot determine the total tension needed to counteract the weight of the Cliffbot. The total needed tension is broken into components for each Anchorbot. The difference between this needed tension and the tension measured at the Cliffbot constitutes an error signal that is provided to the gravity controller. The velocity controller computes the tether speed needed to produce the desired motion of the Cliffbot. Another major consideration in the design and operation of TRESSA is detection of faults. Each robot in the TRESSA system monitors its own performance and the performance of its teammates in order to detect any system faults and prevent unsafe conditions. At startup, communication links are tested and if any robot is not communicating, the system refuses to execute any motion commands. Prior to motion, the Anchorbots attempt to set tensions in the tethers at optimal levels for counteracting the weight of the Cliffbot; if either Anchorbot fails to reach its optimal tension level within a specified time, it sends message to the other robots and the commanded motion is not executed. If any mechanical error (e.g., stalling of a motor) is detected, the affected robot sends a message triggering stoppage of the current motion. Lastly, messages are passed among the robots at each time step (10 Hz) to share sensor information during operations. If messages from any robot cease for more than an allowable time interval, the other robots detect the communication loss and initiate stoppage.

Stroupe, Ashley↗