Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “design for safety”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 595 records · Page 33

Formal Verification of Safety Properties for Aerospace Systems Through Algorithms Based on Exhaustive State-Space Exploration

The Runway Safety Monitor (RSM) designed by Lockheed Martin is part of NASA's effort to reduce aviation accidents. We developed a Petri net model of the RSM protocol and used the model checking functions of our tool SMART to investigate a number of safety properties in RSM. To mitigate the impact of state-space explosion, we built a highly discretized model of the system, obtained by partitioning the monitored runway zone into a grid of smaller volumes and by considering scenarios involving only two aircraft. The model also assumes that there are no communication failures, such as bad input from radar or lack of incoming data, thus it relies on a consistent view of reality by all participants. In spite of these simplifications, we were able to expose potential problems in the RSM conceptual design. Our findings were forwarded to the design engineers, who undertook corrective action. Additionally, the results stress the efficiency attained by the new model checking algorithms implemented in SMART, and demonstrate their applicability to real-world systems. Attempts to verify RSM with NuSMV and SPIN have failed due to excessive memory consumption.

Ciardo, Gianfranco↗

Formal Verification of the Runway Safety Monitor

The Runway Safety Monitor (RSM) designed by Lockheed Martin is part of NASA's effort to reduce runway accidents. We developed a Petri net model of the RSM protocol and used the model checking functions of our tool SMART to investigate a number of safety properties in RSM. To mitigate the impact of state-space explosion, we built a highly discretized model of the system, obtained by partitioning the monitored runway zone into a grid of smaller volumes and by considering scenarios involving only two aircraft. The model also assumes that there are no communication failures, such as bad input from radar or lack of incoming data, thus it relies on a consistent view of reality by all participants. In spite of these simplifications, we were able to expose potential problems in the RSM conceptual design. Our findings were forwarded to the design engineers, who undertook corrective action. Additionally, the results stress the efficiency attained by the new model checking algorithms implemented in SMART, and demonstrate their applicability to real-world systems.

Siminiceanu, Radu↗

Manufacture and static firing of X259-E6 rocket motor serial number XJ04/0001

A single motor was cast and static fired to demonstrate the performance of high energy crosslinked double base (XLDB) propellant in standard X259 rocket motor hardware. Prior to motor fabrication, the motor was analyzed to predict the results of static firing the X259 motor loaded with XLDB propellant. As a result of the analyses, a forward dome shrinkage liner was added to the design. With this design change it was determined that adequate margins of safety existed. The motor, designated the X259-E6 model with serial number XJ04/0001, was fabricated using a slurry-casting technique and was assembled with a standard X259-B4 nozzle which had the nozzle throat machined to a smaller inside diameter than the B4 model and the exit cone cut short for Bacchus Works altitude expansion. The motor was static fired on 20 February 1974 with the nozzle failing during motor operation. Nozzle failure was attributed to spalling of the throat material leading to complete nozzle break-up. However, the propellant functioned as predicted in the motor chamber, ignition was normal, and char and erosion of the internal insulator were as expected.

Robertson, D. R.↗

Proceedings of the 8th Annual Summer Conference: NASA/USRA Advanced Design Program

Papers presented at the 8th Annual Summer Conference are categorized as Space Projects and Aeronautics projects. Topics covered include: Systematic Propulsion Optimization Tools (SPOT), Assured Crew Return Vehicle Post Landing Configuration Design and Test, Autonomous Support for Microorganism Research in Space, Bioregenerative System Components for Microgravity, The Extended Mission Rover (EMR), Planetary Surface Exploration MESUR/Autonomous Lunar Rover, Automation of Closed Environments in Space for Human Comfort and Safety, Walking Robot Design, Extraterrestrial Surface Propulsion Systems, The Design of Four Hypersonic Reconnaissance Aircraft, Design of a Refueling Tanker Delivering Liquid Hydrogen, The Design of a Long-Range Megatransport Aircraft, and Solar Powered Multipurpose Remotely Powered Aircraft.

Source record↗

Inflatable Habitats Technology Development

For many years inflatable structures have been theorized for use as satellite dishes, deployable arrays and human habitats. They fall into human-rated and non-human rated structures. As such the structural design requirements and safety redundancy are much different. This paper will discuss the Habitat and Surface Construction Technology that would support the development of Mars greenhouses as well as habitats. This paper will briefly describe the ISS TransHab architectural design and structural testing for the proposed as a habitation module for the International Space Station. It will also discuss inflatable greenhouse design considerations and examples.

Kennedy, Kriss J.↗

Lunar and Mars Ascent and Descent/Entry Crew Abort Modes for the Hercules Single-Stage Reusable Vehicle

The Hercules single-stage reusable vehicle is designed to support crewed missions to both the lunar surface and Mars surface. The design maximizes crew safety by providing full coverage crew abort capability during ascent and entry/descent, either through abort-to-surface or abort-to-orbit. This paper outlines each of the abort modes and discuss the Hercules vehicle design along with the base and orbital infrastructure required to enable the full coverage abort capability. For each abort mode, trajectory simulations are flown that illustrate the requisite design capabilities and highlight the sensitivity to key design variables.

Komar, David R.↗

Apollo Spacecraft and Saturn V Launch Vehicle Pyrotechnics/Explosive Devices

The Apollo Mission employs more than 210 pyrotechnic devices per mission.These devices are either automatic of commanded from the Apollo spacecraft systems. All devices require high reliability and safety and most are classified as either crew safety critical or mission critical. Pyrotechnic devices have a wide variety of applications including: launch escape tower separation, separation rocket ignition, parachute deployment and release and electrical circuit opening and closing. This viewgraph presentation identifies critical performance, design requirements and safety measures used to ensure quality, reliability and performance of Apollo pyrotechnic/explosive devices. The major components and functions of a typical Apollo pyrotechnic/explosive device are listed and described (initiators, cartridge assemblies, detonators, core charges). The presentation also identifies the major locations and uses for the devices on: the Command and Service Module, Lunar Module and all stages of the launch vehicle.

Interbartolo, Michael↗

A Safety Index and Method for Flightdeck Evaluation

If our goal is to improve safety through machine, interface, and training design, then we must define a metric of flightdeck safety that is usable in the design process. Current measures associated with our notions of "good" pilot performance and ultimate safety of flightdeck performance fail to provide an adequate index of safe flightdeck performance for design evaluation purposes. The goal of this research effort is to devise a safety index and method that allows us to evaluate flightdeck performance holistically and in a naturalistic experiment. This paper uses Reason's model of accident causation (1990) as a basis for measuring safety, and proposes a relational database system and method for 1) defining a safety index of flightdeck performance, and 2) evaluating the "safety" afforded by flightdeck performance for the purpose of design iteration. Methodological considerations, limitations, and benefits are discussed as well as extensions to this work.

Latorella, Kara A.↗

Human-rated Safety Certification of a High Voltage Robonaut Lithium-ion Battery

NASA's rigorous certification process is being followed for the R2 high voltage battery program for use of R2 on International Space Station (ISS). Rigorous development testing at appropriate levels to credible off-nominal conditions and review of test data led to design improvements for safety at the virtual cell, cartridge and battery levels. Tests were carried out at all levels to confirm that both hardware and software controls work. Stringent flight acceptance testing of the flight battery will be completed before launch for mission use on ISS.

Jeevarajan, Judith↗

The Ultimate Factor of Safety for Aircraft and Spacecraft Its History, Applications and Misconceptions

The ultimate factor of safety (FOSULT) concept used in aircraft and spacecraft has evolved over many decades. Currently an FOSULT 1.5 is the FAR‐mandated value for aircraft while an FOSULT of 1.4 has been used in various spacecraft. This paper was motivated by the desire to concisely explain the origins, proper interpretation and application of the ultimate factor of safety concept, since the authors have seen throughout their careers many misconceptions and incorrect applications of this concept. The history of the ultimate factor of safety concept is briefly summarized, the proper application of the factor of safety in aircraft design, structural analysis and operations is covered in detail, examples of limit load exceedance in aircraft and spacecraft are discussed, the evolution of the 1.4 FOSULT for spacecraft is described and some misconceptions regarding the ultimate factor of safety concept are addressed. It is hoped that this paper can be a summary resource for engineers to understand the origin, purpose and proper application of the ultimate factor of safety.

Zipay, John J.↗

Numerical Simulation of a Natural Convection–Driven Air-Cooled Reactor Cavity Cooling System Experiment

Ensuring the efficient removal of decay heat from the reactor vessel is essential for the safety of advanced reactor technologies. Several Generation-IV concepts incorporate variations in the reactor vessel cooling systems to achieve this objective. High-temperature gas-cooled reactors utilize a reactor cavity cooling system (RCCS), a passive ex-vessel system designed to operate without active components or external power during accident conditions. The RCCS removes decay heat primarily through radiative and convective heat transfer mechanisms. Here, this study presents a comprehensive validation of a computational fluid dynamics Reynolds-averaged Navier-Stokes model for the University of Wisconsin-Madison air-cooled RCCS facility. Validation was conducted for both high- and low-power natural convection cases under a uniform heating profile. Near-wall resolution was found to be critical for accurately modeling natural convection in the RCCS; employing an all-𝑦 + wall treatment resulted in wall temperature discrepancies exceeding 50 °⁢𝐶 compared to a wall-resolved mesh. Thermal-hydraulic behaviors under natural and forced convection conditions were compared within the heated cavity and RCCS. A turbulence model sensitivity analysis indicated that low-Reynolds number k-ɛ, k-ω shear stress transport (SST), and Reynolds stress transport models produce similar wall temperature predictions. A buoyancy modeling sensitivity study revealed that the Boussinesq approximation significantly underpredicted thermal-hydraulic behavior in the RCCS. Based on these findings, modeling recommendations are provided. The validated data set along with identified sensitivities refine the modeling of natural convection in the RCCS. The information produced by this study supports RCCS design, optimization, and safety evaluations, enabling the calibration and verification of reduced-order thermal-hydraulic models.

22 - GENERAL STUDIES OF NUCLEAR REACTORS↗

Using computer graphics to enhance astronaut and systems safety

The Operator Station Design System (OSDS), a technique of applied computer graphics featuring a flexible interactive software package, is presented in terms of man-machine analyses, flight operations, and systems engineering. In man-machine analyses, the OSDS was used to determine if viewing from the Shuttle Remote Manipulator System was satisfactory and to identify requirements for a pallet-mounted television camera. In another study, extravehicular activity was analyzed using the example of emergency access to latches should they fail in orbit. In terms of flight operations, OSDS can be used to evaluate array monitoring of a solar array power system complex and to provide animated scenarios of mission operations. The most important application of OSDS is in relation to systems engineering, as OSDS can be used to analyze spacecraft and payload design and integration. Payload configurations are included.

Brown, J. W.↗

A Machine Learning Approach to Improve Air Traffic Management Initiatives

Collaborating closely with commercial air carriers and related organizations, the Federal Aviation Administration(FAA) regulates air traffic and ensures the safety and efficiency of air operations. Air traffic controllers make strategic decisions, such as delaying, rerouting, or canceling flights, partly based on guidance provided by the FAA’s Air TrafficControl System Command Center (ATCSCC). The guidance includes, among other things, control measures known asTraffic Management Initiatives (TMIs) designed to enhance safety and improve operational efficiency. TMIs play a crucial role in managing the demand and capacity within the U.S. National Airspace System (NAS). Two major TMIs that are routinely used (primarily to mitigate the adverse effects of bad weather) are Ground Delay Programs (GDPs) andGround Stops (GSs). In a GDP, flights destined for airports facing thunderstorm activity experience delays at their origin airports. This proactive approach minimizes the risk of routing aircraft through hazardous weather conditions and also replaces (fuel burning) airborne delays with ground delays. In a GS, a temporary restriction is imposed on the departure or arrival of aircraft at a specific airport or within a designated airspace. Although other TMIs (e.g., miles-in-trail) are also implemented as part of (air) traffic flow management in the NAS, the focus of this work is on GDPs and GSs. Since TMIs, by design, lead to flight delays or cancellations, it is crucial to put in place the right set of parameters(e.g., scope and duration of the GDP). For example, when the end time of a GDP extends beyond what is necessary, it imposes unnecessary delays on departing flights. This situation could occur as a result of inaccurate prediction of the(required) duration of the GDP based on the weather forecast. On the other hand, if a GDP ends prematurely before the underlying capacity constraints are resolved at the destination airport, it may result in airborne holding. The delicate balance lies in matching the termination of the GDP precisely with the resolution of capacity constraints, avoiding both the imposition of unnecessary ground delays and the need for airborne holding due to premature program termination.Failing to specify the right parameters for TMIs also leads to flight delays, creating a significant obstacle in managing the increasing traffic volumes causing increased work load for the controllers. To address this issue, we propose the integration of Machine Learning (ML) models in the traffic flow management(TFM) pipeline. In current operations, decisions are made by human experts based on extensive training, historical patterns, available traffic and weather data. Since we have an abundance of data from past events that tell us the likely impact of various TMIs, by ingesting historical data, properly trained ML models can offer valuable insights and aid human decision-making. With the FAA increasingly exploring advanced analytics, ML emerges as a focal point for enhancing TFM within the National Airspace System (NAS). As a first step, this study aims to provide traffic controllers with decision-making support for the issuance and adjustment of TMIs. Data analytics and machine learning have been previously employed to address some of the challenges associated with TMIs. Numerous studies have concentrated on various facets of TMI issuance, exploring factors influencing TMI parameters, including arrival rate, airport capacity, and delay prediction. For example, using weather forecasts, several statistical methods were used to produce probabilistic capacity profiles which in conjunction with deterministic models provided insights into the GDP planning process [1–4]. The downside of using deterministic models is that they rely on fixed inputs and predetermined rules, which lack the ability to account for the inherent uncertainty and variability present in real-world scenarios. In a separate series of studies, researchers aimed to predict the occurrences of GDPs and GSs. The majority of these studies utilized various supervised learning methods, including Decision Trees, Naive Bayes, Support VectorMachines, and Random Forests to analyze the influence of weather conditions and arrival demand on TMI incidents[5–8]. However, these studies primarily focused on predicting the incidence of TMIs without explicitly addressing the scope of TMIs, including their duration and their geographical coverage. Furthermore, the emphasis of these studies was largely on GDPs, given their higher frequency and longer duration when compared to GSs. A limited number of studies focused on predicting the parameters of TMIs, specifically addressing their duration and extent. In one such study focusing on optimizing the TMI parameters at San Francisco International Airport (SFO),the authors utilized a probabilistic forecast of fog [9]. They simulated various capacity scenarios based on the (fog)burn-off forecasts, selecting GDP parameters that minimized airborne and overall ground delays. However, this approach exclusively emphasizes stratus (fog) burn-off as the primary determinant of GDP and GS, neglecting other influential factors like severe weather events, runway closures, lower capacity than traffic demand, and other important variables. Given the complexity of predicting the TMI and determining its scope, we seek a more holistic approach. We aim to consider all significant factors that could impact TMIs and their parameters. What sets this research apart is the fusion of all data sources relevant to the issuance and adjustment of TMIs and it represents the first comprehensive attempt to optimize TMIs in this manner. Since this comprehensive solution involves various aspects, we break down the problem into smaller components and input all parameters into a unified model called the “TMI Adjuster”. Figure 1 shows the overall framework and the list of datasets used in each model. The objective of the TMI Adjuster module is to deliver reliable, consistent and expedited recommendations for the progression, adjustment, and termination of TMIs. The ML solution entails developing a pipeline capable of predicting the necessity of a TMI (e.g., GS or GDP) along with its various parameters. For example, in the case of a GS, this includes the scope of the GS either in terms of distance from the destination airport or based on pre-defined airspace sectors. Here, scope refers to those regions and departing airports that are subject to the GS. In this paper, we concentrate on the issuance of GSs in the three major airports in the New York area — LaGuardia(LGA), John F. Kennedy International (JFK), and Newark Liberty International (EWR). We fuse traffic, weather and other relevant aviation data from years 2017 to 2019 to train and validate the ML models. In particular, we use the following datasets: •Terminal Aerodrome Forecast (TAF): meteorological forecasts specific to each airport, issued four times a day, covering predefined time periods. •TMI data: includes all GSs and GDPs along with their respective parameters. •Aviation System Performance Metrics (ASPM): includes traffic related data such as aircraft delays, arrival, and departure rates. •Notices to Airmen (NOTAMs): utilized to extract runway closure data and manage interdependencies between terminals in close proximity. •Flight cancellation data •Airspace Flow Programs (AFP): includes information on flight airborne holdings caused by TMIs. The data preprocessing entails transforming ASPM, TMI, AFP, NOTAMs, and weather data into an hourly format and consolidating all datasets by merging them based on date and time as the primary key. The TMI Adjuster framework comprises two parallel models: one dedicated to GS and a second model focused on GDP. As previously mentioned, our specific focus is on the GS model as a multi-classification problem. In this framework, each data point of the GS model input summarizes ten hours of data. Specifically, the data loader for the GS model generates the input and output of the model as follows: at a given time step, the input includes the actual traffic, weather, and TMI data from the two-hour window before the time step, alongside the weather forecast and scheduled traffic for the next 8 hours starting from the time step. Based on this information, the output of the GS model for each time interval consists of three dimensions. The first dimension represents a binary decision on whether there should be a GS in place for the next hour or not. The second dimension is related to the scope of the GS in the United States, and the third dimension is related to the scope of the GS in Canada (i.e., to determine if the GS impacts airports in Canada).One of the challenges with TMI modeling is the sparsity of TMI events, particularly regarding its scope. To address this challenge in the scope of the GS model output, we implement grouping. The GS scope for the US region is defined based on a list of centers that should be included when the GS is in place. With 20 centers in the US, we utilized historical data to group them into 4 categories. In particular, we summarized our historical data in a graph format where nodes represent centers, and link weights are defined based on the co-occurrence of centers in the scope parameter ofTMIs. By identified strongly connected components in this graph, we were able to partition the centers into four groups. We consider two model structures for the GS Model. Firstly, a hierarchical classification model [10], where the human decision-making for a GS is of hierarchical nature. The decision-maker first decides whether there is a need fora GS, and if the answer is yes, determines the scope. A hierarchical classification model organizes the problem into a class hierarchy, typically a tree or a Directed Acyclic Graph (DAG) structure, and considers the dependency of the decision in the previous step to the next component [10]. Here, we employ the local classifier per level approach, which involves training one multi-class classifier for each level of the class hierarchy. The second structure is the independent structure. In this setting, as the name suggests, we do not consider the dependency of the decisions in the different dimensions of the output of the model. Instead, for each dimension, we train a multi-class classifier independently. Table 1 summarizes GS model statistics for training, validation and testing. The table documents the effect of limiting data to the time steps when there was actually a TMI in place or when a TMI had just terminated. This resulted in a more balanced distribution of the GS class(GS positive class)versus “No GS”(GS negative class), which might help the training process. While JFK and LGA follow very similar distributions, with 40% and 42% GS positive class respectively, EWR has proportionally fewer GS incidents at 28%. Our subsequent phase involves evaluating the performance of both hierarchical structure and independent structure using different state-of-the-art multi-class classifier models such as Random Forest, Decision Trees, K-nearest Neighbors, and Logistic Regression and forecast the duration and scope of the GSs.

Farzan Masrour Shalmani↗

Technical Reference Suite Addressing Challenges of Providing Assurance for Fault Management Architectural Design

Research into complexities of software systems Fault Management (FM) and how architectural design decisions affect safety, preservation of assets, and maintenance of desired system functionality has coalesced into a technical reference (TR) suite that advances the provision of safety and mission assurance. The NASA Independent Verification and Validation (IVV) Program, with Software Assurance Research Program support, extracted FM architectures across the IVV portfolio to evaluate robustness, assess visibility for validation and test, and define software assurance methods applied to the architectures and designs. This investigation spanned IVV projects with seven different primary developers, a wide range of sizes and complexities, and encompassed Deep Space Robotic, Human Spaceflight, and Earth Orbiter mission FM architectures. The initiative continues with an expansion of the TR suite to include Launch Vehicles, adding the benefit of investigating differences intrinsic to model-based FM architectures and insight into complexities of FM within an Agile software development environment, in order to improve awareness of how nontraditional processes affect FM architectural design and system health management.

Fitz, Rhonda↗

Initial Design Guidelines for Onboard Automation of Flight Path Management

Achieving the National Academy of Science’s vision of advanced aerial mobility will depend on significant developments in automation to achieve safe and efficient operations. Flight path management (FPM), a major category of automation functionality needed to achieve this vision, will provide dynamic management of an aircraft’s flight path, ensuring that it remains feasible to fly to mission completion, deconflicted from hazards, coordinated with other traffic, flexible to accommodate future disturbances, and optimized to meet business objectives. While efforts are underway to advance FPM technology for the Urban Air Mobility application, initial design guidelines are presented for FPM automation capabilities to achieve each of these objectives based on 15+ years of prior FPM automation research and development. Methods to efficiently account for uncertainty in the prediction of trajectories are described, as are additional considerations for prioritizing safety in the design of FPM automation capabilities and interactions between aircraft. Recommendations are supported by extensive experience gained via previous work with the FPM reference automation system, Autonomous Operations Planner, developed by NASA. By employing capable FPM automation supported by cooperative operational flight rules and information sharing, future aircraft operators will benefit from an increased ability to plan and execute safe and efficient flights and to achieve mission success in a dynamic airspace.

Flight Path Management, FPM, AOP, UAM, deconflicti↗

Initial Design Guidelines for Onboard Automation of Flight Path Management

Achieving the National Academy of Science’s vision of advanced aerial mobility will depend on significant developments in automation to achieve safe and efficient operations. Flight path management (FPM), a major category of automation functionality needed to achieve this vision, will provide dynamic management of an aircraft’s flight path, ensuring that it remains feasible to fly to mission completion, deconflicted from hazards, coordinated with other traffic, flexible to accommodate future disturbances, and optimized to meet business objectives. While efforts are underway to advance FPM technology for the Urban Air Mobility application, initial design guidelines are presented for FPM automation capabilities to achieve each of these objectives based on 15+ years of prior FPM automation research and development. Methods to efficiently account for uncertainty in the prediction of trajectories are described, as are additional considerations for prioritizing safety in the design of FPM automation capabilities and interactions between aircraft. Recommendations are supported by extensive experience gained via previous work with the FPM reference automation system, Autonomous Operations Planner, developed by NASA. By employing capable FPM automation supported by cooperative operational flight rules and information sharing, future aircraft operators will benefit from an increased ability to plan and execute safe and efficient flights and to achieve mission success in a dynamic airspace.

Flight Path Management↗

Off-design temperature effects on nuclear fuel pins for an advanced space-power-reactor concept

An exploratory out-of-reactor investigation was made of the effects of short-time temperature excursions above the nominal operating temperature of 990 C on the compatibility of advanced nuclear space-power reactor fuel pin materials. This information is required for formulating a reliable reactor safety analysis and designing an emergency core cooling system. Simulated uranium mononitride (UN) fuel pins, clad with tungsten-lined T-111 (Ta-8W-2Hf) showed no compatibility problems after heating for 8 hours at 2400 C. At 2520 C and above, reactions occurred in 1 hour or less. Under these conditions free uranium formed, redistributed, and attacked the cladding.

Bowles, K. J.↗