SEARCH · Engineering Papers

Results for “Software Common Cause Failure”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 73 records · Page 4

All sources NASA NTRS DOE OSTI

DOE OSTI2022

Resilience Design Patterns: A Structured Approach to Resilience at Extreme Scale (V.2.0)

Reliability is a serious concern for future extreme-scale high-performance computing (HPC) systems. Projections based on the current generation of HPC systems and technology roadmaps suggest the prevalence of very high fault rates in future systems. The errors resulting from these faults will propagate and generate various kinds of failures, which may result in outcomes ranging from result corruptions to catastrophic application crashes. Therefore, the resilience challenge for extreme-scale HPC systems requires coordination between various hardware and software technologies that are capable of handling a broad set of fault models at accelerated fault rates. Also, due to practical limits on power consumption in future HPC systems, they are likely to embrace innovative architectures, increasing the levels of hardware and software complexities. Therefore, the techniques that seek to improve resilience must navigate the complex trade-off space between resilience and the overheads to power consumption and performance. While the HPC community has developed various resilience solutions, application-level techniques as well as system-based solutions, the solution space of HPC resilience techniques remains fragmented. There are no formal methods to integrate the various HPC resilience techniques into composite solutions, nor are there methods to holistically evaluate the adequacy and efficacy of such solutions in terms of their protection coverage, and their performance & power efficiency characteristics. Additionally, few implementations of current resilience solutions are portable to newer architectures and software environments that will be deployed on future systems. We developed a new structured approach to the management of HPC resilience using the concept of resilience-based design patterns. In general, a design pattern is a repeatable solution to a commonly occurring problem. We identified the well-known solutions that are commonly used to deal with faults, errors and failures in HPC systems. In the initial design patterns specification (version 1.0), we described the various solutions, which address specific problems in the design of resilient HPC environments, in the form of patterns. Each pattern describes a problem caused by a fault, error or failure event in an HPC environment, and then describes the core of the solution of the problem in such a way that this solution may be adapted to different systems and implemented at different layers of the system stack. The catalog of these resilience design patterns provides designers with a collection of design elements. To construct complete resilience solutions using combinations of various patterns, we defined a framework that enhances HPC designers' understanding of the important constraints and the opportunities for the design patterns to be implemented and deployed at various layers of the system stack. The design framework is also useful for establishing interfaces and mechanisms to coordinate flexible fault management across hardware and software components, as well as to consider the trade-off between performance, resilience, and power consumption when constructing a solution. The resilience design patterns specification version 1.1 included more detailed explanations of the pattern solutions, the context in which the patterns are applicable, and the implications for hardware or software design. It also provided several additional examples and detailed case studies to demonstrate the use of patterns to build realistic solutions. In version 1.2 of the specification document, we have improved the pattern descriptions, including graphical representations of the pattern components. These improvements are largely based on critical comments, feedback and suggestions received from pattern experts and readers of the previous versions of the specification. The pattern classification has been modified to further clarify the relationships between pattern categories. This version of the specification also introduces a pattern language for resilience design patterns. The pattern language presents the patterns in the catalog as a network, revealing the relations among the resilience patterns. The language provides designers with the means to explore alternative techniques for handling a specific fault model that may have different efficiency and complexity characteristics. Using the pattern language also enables the design and implementation of comprehensive resilience solutions as a set of interconnected resilience patterns that can be instantiated across layers of the system stack. The overall goal of this work is to provide hardware and software designers, as well as the users and operators of HPC systems, a systematic methodology for the design and evaluation of resilience technologies in HPC systems that keep scientific applications running to a correct solution in a timely and cost-efficient manner despite frequent faults, errors, and failures of various types. Version 2.0 expands the resilience design pattern classification and catalog to include self-stabilization patterns and reliability, availability and performance models for each structural pattern.

97 MATHEMATICS AND COMPUTING↗

NASA NTRS2006

Fault Management Techniques in Human Spaceflight Operations

This paper discusses human spaceflight fault management operations. Fault detection and response capabilities available in current US human spaceflight programs Space Shuttle and International Space Station are described while emphasizing system design impacts on operational techniques and constraints. Preflight and inflight processes along with products used to anticipate, mitigate and respond to failures are introduced. Examples of operational products used to support failure responses are presented. Possible improvements in the state of the art, as well as prioritization and success criteria for their implementation are proposed. This paper describes how the architecture of a command and control system impacts operations in areas such as the required fault response times, automated vs. manual fault responses, use of workarounds, etc. The architecture includes the use of redundancy at the system and software function level, software capabilities, use of intelligent or autonomous systems, number and severity of software defects, etc. This in turn drives which Caution and Warning (C&W) events should be annunciated, C&W event classification, operator display designs, crew training, flight control team training, and procedure development. Other factors impacting operations are the complexity of a system, skills needed to understand and operate a system, and the use of commonality vs. optimized solutions for software and responses. Fault detection, annunciation, safing responses, and recovery capabilities are explored using real examples to uncover underlying philosophies and constraints. These factors directly impact operations in that the crew and flight control team need to understand what happened, why it happened, what the system is doing, and what, if any, corrective actions they need to perform. If a fault results in multiple C&W events, or if several faults occur simultaneously, the root cause(s) of the fault(s), as well as their vehicle-wide impacts, must be determined in order to maintain situational awareness. This allows both automated and manual recovery operations to focus on the real cause of the fault(s). An appropriate balance must be struck between correcting the root cause failure and addressing the impacts of that fault on other vehicle components. Lastly, this paper presents a strategy for using lessons learned to improve the software, displays, and procedures in addition to determining what is a candidate for automation. Enabling technologies and techniques are identified to promote system evolution from one that requires manual fault responses to one that uses automation and autonomy where they are most effective. These considerations include the value in correcting software defects in a timely manner, automation of repetitive tasks, making time critical responses autonomous, etc. The paper recommends the appropriate use of intelligent systems to determine the root causes of faults and correctly identify separate unrelated faults.

O'Hagan, Brian↗

NASA NTRS2004

Analysis of SSEM Sensor Data Using BEAM

A report describes analysis of space shuttle main engine (SSME) sensor data using Beacon-based Exception Analysis for Multimissions (BEAM) [NASA Tech Briefs articles, the two most relevant being Beacon-Based Exception Analysis for Multimissions (NPO- 20827), Vol. 26, No.9 (September 2002), page 32 and Integrated Formulation of Beacon-Based Exception Analysis for Multimissions (NPO- 21126), Vol. 27, No. 3 (March 2003), page 74] for automated detection of anomalies. A specific implementation of BEAM, using the Dynamical Invariant Anomaly Detector (DIAD), is used to find anomalies commonly encountered during SSME ground test firings. The DIAD detects anomalies by computing coefficients of an autoregressive model and comparing them to expected values extracted from previous training data. The DIAD was trained using nominal SSME test-firing data. DIAD detected all the major anomalies including blade failures, frozen sense lines, and deactivated sensors. The DIAD was particularly sensitive to anomalies caused by faulty sensors and unexpected transients. The system offers a way to reduce SSME analysis time and cost by automatically indicating specific time periods, signals, and features contributing to each anomaly. The software described here executes on a standard workstation and delivers analyses in seconds, a computing time comparable to or faster than the test duration itself, offering potential for real-time analysis.

Zak, Michail↗

NASA NTRS1993

Software For Fault-Tree Diagnosis Of A System

Fault Tree Diagnosis System (FTDS) computer program is automated-diagnostic-system program identifying likely causes of specified failure on basis of information represented in system-reliability mathematical models known as fault trees. Is modified implementation of failure-cause-identification phase of Narayanan's and Viswanadham's methodology for acquisition of knowledge and reasoning in analyzing failures of systems. Knowledge base of if/then rules replaced with object-oriented fault-tree representation. Enhancement yields more-efficient identification of causes of failures and enables dynamic updating of knowledge base. Written in C language, C++, and Common LISP.

Iverson, Dave↗

NASA NTRS2014

Is Model-Based Development a Favorable Approach for Complex and Safety-Critical Computer Systems on Commercial Aircraft?

A system is safety-critical if its failure can endanger human life or cause significant damage to property or the environment. State-of-the-art computer systems on commercial aircraft are highly complex, software-intensive, functionally integrated, and network-centric systems of systems. Ensuring that such systems are safe and comply with existing safety regulations is costly and time-consuming as the level of rigor in the development process, especially the validation and verification activities, is determined by considerations of system complexity and safety criticality. A significant degree of care and deep insight into the operational principles of these systems is required to ensure adequate coverage of all design implications relevant to system safety. Model-based development methodologies, methods, tools, and techniques facilitate collaboration and enable the use of common design artifacts among groups dealing with different aspects of the development of a system. This paper examines the application of model-based development to complex and safety-critical aircraft computer systems. Benefits and detriments are identified and an overall assessment of the approach is given.

Torres-Pomales, Wilfredo↗

DOE OSTI2024

An Integrated Framework for Risk Assessment of Safety-related Digital Instrumentation and Control Systems in Nuclear Power Plants: Methodology Advancement and Application

This report documents activities performed by Idaho National Laboratory (INL) during fiscal year (FY) 2024 for the U.S. Department of Energy (DOE) Light Water Reactor Sustainability (LWRS) Program, Risk Informed Systems Analysis (RISA) Pathway, Digital Instrumentation and Control (DI&C) Risk Assessment project. The goal of the RISA Pathway is to optimize safety margins and minimize uncertainties to achieve economic efficiencies while maintaining high levels of safety. This is accomplished by providing scientific basis to better represent safety margins and factors that contribute to cost and safety, and by developing new technologies that reduce operating costs. The research efforts for FY 2024 encompass methodology refinement and exploration. The efforts include: (1) The implementation of a natural language processing tool to expedite key aspects of the reliability analysis methods developed by INL; (2) advances to support intersystem CCF analysis by providing guidance for and identification of coupling mechanisms that may contribute to CCF; (3) the investigation of how generative artificial intelligence tools can aid in hazard analysis and diversity and defense in depth (i.e., D3) assessments; (4) Industry collaboration, allowing the demonstration of and INL's risk assessment tools to support risk assessment of DI&C systems at early and late stages of development; (4) a roadmap for the development of a software for each of INL's risk assessment tools; (5) The development of a theory and methodology manual for a risk quantification methodology; (6) the development of a reliability analysis for machine learning (ML)-integrated control systems.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

NASA NTRS1990

VIPER project

The VIPER project has so far produced a formal specification of a 32 bit RISC microprocessor, an implementation of that chip in radiation-hard SOS technology, a partial proof of correctness of the implementation which is still being extended, and a large body of supporting software. The time has now come to consider what has been achieved and what directions should be pursued in the future. The most obvious lesson from the VIPER project was the time and effort needed to use formal methods properly. Most of the problems arose in the interfaces between different formalisms, e.g., between the (informal) English description and the HOL spec, between the block-level spec in HOL and the equivalent in ELLA needed by the low-level CAD tools. These interfaces need to be made rigorous or (better) eliminated. VIPER 1A (the latest chip) is designed to operate in pairs, to give protection against breakdowns in service as well as design faults. We have come to regard redundancy and formal design methods as complementary, the one to guard against normal component failures and the other to provide insurance against the risk of the common-cause failures which bedevil reliability predictions. Any future VIPER chips will certainly need improved performance to keep up with increasingly demanding applications. We have a prototype design (not yet specified formally) which includes 32 and 64 bit multiply, instruction pre-fetch, more efficient interface timing, and a new instruction to allow a quick response to peripheral requests. Work is under way to specify this device in MIRANDA, and then to refine the spec into a block-level design by top-down transformations. When the refinement is complete, a relatively simple proof checker should be able to demonstrate its correctness. This paper is presented in viewgraph form.

Kershaw, John↗

NASA NTRS2006

An Efficient Approach for the Reliability Analysis of Phased-Mission Systems with Dependent Failures

We consider the reliability analysis of phased-mission systems with common-cause failures in this paper. Phased-mission systems (PMS) are systems supporting missions characterized by multiple, consecutive, and nonoverlapping phases of operation. System components may be subject to different stresses as well as different reliability requirements throughout the course of the mission. As a result, component behavior and relationships may need to be modeled differently from phase to phase when performing a system-level reliability analysis. This consideration poses unique challenges to existing analysis methods. The challenges increase when common-cause failures (CCF) are incorporated in the model. CCF are multiple dependent component failures within a system that are a direct result of a shared root cause, such as sabotage, flood, earthquake, power outage, or human errors. It has been shown by many reliability studies that CCF tend to increase a system's joint failure probabilities and thus contribute significantly to the overall unreliability of systems subject to CCF.We propose a separable phase-modular approach to the reliability analysis of phased-mission systems with dependent common-cause failures as one way to meet the above challenges in an efficient and elegant manner. Our methodology is twofold: first, we separate the effects of CCF from the PMS analysis using the total probability theorem and the common-cause event space developed based on the elementary common-causes; next, we apply an efficient phase-modular approach to analyze the reliability of the PMS. The phase-modular approach employs both combinatorial binary decision diagram and Markov-chain solution methods as appropriate. We provide an example of a reliability analysis of a PMS with both static and dynamic phases as well as CCF as an illustration of our proposed approach. The example is based on information extracted from a Mars orbiter project. The reliability model for this orbiter considers the various phases of Launch, Cruise, Mars Orbit Insertion, and Orbit. Some of the CCF for the orbiter in this mission include environmental effects, such as micrometeoroids, human operator errors, and software errors.

reliability analysis↗

DOE OSTI2017

Resilience Design Patterns - A Structured Approach to Resilience at Extreme Scale (version 1.2)

We developed a new structured approach to the management of HPC resilience using the concept of resilience-based design patterns. In general, a design pattern is a repeatable solution to a commonly occurring problem. We identified the well-known solutions that are commonly used to deal with faults, errors and failures in HPC systems. In the initial design patterns specification (version 1.0), we described the various solutions, which address specific problems in the design of resilient HPC environments, in the form of patterns. Each pattern describes a problem caused by a fault, error or failure event in an HPC environment, and then describes the core of the solution of the problem in such a way that this solution may be adapted to different systems and implemented at different layers of the system stack. The catalog of these resilience design patterns provides designers with a collection of design elements. To construct complete resilience solutions using combinations of various patterns, we defined a framework that enhances HPC designers’ understanding of the important constraints and the opportunities for the design patterns to be implemented and deployed at various layers of the system stack. The design framework is also useful for establishing interfaces and mechanisms to coordinate flexible fault management across hardware and software components, as well as to consider the trade-off between performance, resilience, and power consumption when constructing a solution. The resilience design patterns specification version 1.1 included more detailed explanations of the pattern solutions, the context in which the patterns are applicable, and the implications for hardware or software design. It also provided several additional examples and detailed case studies to demonstrate the use of patterns to build realistic solutions. In this version 1.2 of the specification document, we have improved the pattern descriptions, including graphical representations of the pattern components. These improvements are largely based on critical comments, feedback and suggestions received from pattern experts and readers of the previous versions of the specification. The pattern classification has been modified to further clarify the relationships between pattern categories. This version of the specification also introduces a pattern language for resilience design patterns. The pattern language presents the patterns in the catalog as a network, revealing the relations among the resilience patterns. The language provides designers with the means to explore alternative techniques for handling a specific fault model that may have different effciency and complexity characteristics. Using the pattern language also enables the design and implementation of comprehensive resilience solutions as a set of interconnected resilience patterns that can be instantiated across layers of the system stack. The overall goal of this work is to provide hardware and software designers, as well as the users and operators of HPC systems, a systematic methodology for the design and evaluation of resilience technologies in HPC systems that keep scientific applications running to a correct solution in a timely and cost-effcient manner despite frequent faults, errors, and failures of various types.

97 MATHEMATICS AND COMPUTING↗

NASA NTRS2024

Historical Aerospace Software Errors Categorized to Influence Fault Tolerance

Since the first use of computers in space and aircraft, software errors have occurred. These errors can manifest as loss-of-life or less catastrophically. As the demand for automation increases, software in mission or safety-critical systems should be designed to be tolerant to the most likely software faults. This paper categorizes a set of 55 historic aerospace software error incidents from 1962 to 2023 to determine trends of how and where automation is most likely to fail, behaving unexpectedly. A distinction between software producing unexpected (erroneous) output versus no output (failsilent) is introduced. Of the historical incidents analyzed, 85% were from software producing wrong output rather than simply stopping. Rebooting was found to be ineffective to clear erroneous behavior, and not reliable to recover from silent failures. Error origin was within the code/logic itself in 58% of cases, 16% from configurable data, 15% from unexpected sensor input, and 11% from command/operator input. A substantial forty percent (40%) of unexpected software behavior was indicated by the absence of code, arising from unanticipated situations and missing requirements, and 16% of incidents were subjectively deemed “unknown-unknowns”. No incidents were found to be the result of programming language, compiler, tool, or operating system; and only sixteen percent (16%) of all incidents were considered errors traditional computer science/programming in nature. These findings indicate that for fault tolerance, erroneous automation behavior must be a primary consideration especially at critical moments, and reboot recoverability may not be viable. Special care should be taken to validate configurable data and commands prior to use. “Test-like-you-fly”, including hardware-in-the-loop combined with robust off-nominal testing should be used to uncover missing logic arising from unanticipated situations not covered by requirements alone. This study uniquely focuses on manifestations of unexpected flight software behavior, independent of ultimate root cause. We characterize software error behavior and origin to improve software design, test, and operations for resilience to the most common manifestations, and provide a rich dataset for further study.

Aerospace↗

NASA NTRS2003

High-Performance Acousto-Ultrasonic Scan System Being Developed

Acousto-ultrasonic (AU) interrogation is a single-sided nondestructive evaluation (NDE) technique employing separated sending and receiving transducers. It is used for assessing the microstructural condition and distributed damage state of the material between the transducers. AU is complementary to more traditional NDE methods, such as ultrasonic cscan, x-ray radiography, and thermographic inspection, which tend to be used primarily for discrete flaw detection. Throughout its history, AU has been used to inspect polymer matrix composites, metal matrix composites, ceramic matrix composites, and even monolithic metallic materials. The development of a high-performance automated AU scan system for characterizing within-sample microstructural and property homogeneity is currently in a prototype stage at NASA. This year, essential AU technology was reviewed. In addition, the basic hardware and software configuration for the scanner was developed, and preliminary results with the system were described. Mechanical and environmental loads applied to composite materials can cause distributed damage (as well as discrete defects) that plays a significant role in the degradation of physical properties. Such damage includes fiber/matrix debonding (interface failure), matrix microcracking, and fiber fracture and buckling. Investigations at the NASA Glenn Research Center have shown that traditional NDE scan inspection methods such as ultrasonic c-scan, x-ray imaging, and thermographic imaging tend to be more suited to discrete defect detection rather than the characterization of accumulated distributed microdamage in composites. Since AU is focused on assessing the distributed microdamage state of the material in between the sending and receiving transducers, it has proven to be quite suitable for assessing the relative composite material state. One major success story at Glenn with AU measurements has been the correlation between the ultrasonic decay rate obtained during AU inspection and the mechanical modulus (stiffness) seen during fatigue experiments with silicon carbide/silicon carbide (SiC/SiC) ceramic matrix composite samples. As shown in the figure, ultrasonic decay increased as the modulus decreased for the ceramic matrix composite tensile fatigue samples. The likely microstructural reason for the decrease in modulus (and increase in ultrasonic decay) is the matrix microcracking that commonly occurs during fatigue testing of these materials. Ultrasonic decay has shown the capability to track the pattern of transverse cracking and fiber breakage in these composites.

Roth, Don J.↗

NASA NTRS2010

International Space Station Common Cabin Air Assembly Condensing Heat Exchanger Hydrophilic Coating Failures and Lessons Learned

The ability to control the temperature and humidity of an environment or habitat is critical for human survival. These factors are important to maintaining human health and comfort, as well as maintaining mechanical and electrical equipment in good working order to support the human and to accomplish mission objectives. The temperature and humidity of the International Space Station (ISS) United States On-orbit Segment (USOS) cabin air is controlled by the Common Cabin Air Assembly (CCAA). The CCAA consists of a fan, a condensing heat exchanger (CHX), an air/water separator, temperature and liquid sensors, and electrical controlling hardware and software. The CHX is the primary component responsible for control of temperature and humidity. The CCAA CHX contains a chemical coating that was developed to be hydrophilic and thus attract water from the humid influent air. This attraction forms the basis for water removal and therefore cabin humidity control. However, there have been several instances of CHX coatings becoming hydrophobic and repelling water. When this behavior is observed in an operational CHX, the unit s ability to remove moisture from the air is compromised and the result is liquid water carryover into downstream ducting and systems. This water carryover can have detrimental effects on the cabin atmosphere quality and on the health of downstream hardware. If the water carryover is severe and widespread, this behavior can result in an inability to maintain humidity levels in the USOS. This paper will describe the operation of the five CCAAs within in the USOS, the potential causes of the hydrophobic condition, and the impacts of the resulting water carryover to downstream systems. It will describe the history of this behavior and the actual observed impacts to the ISS USOS. Information on mitigation steps to protect the health of future CHX hydrophilic coatings and potential remediation techniques will also be discussed.

Balistreri, Steven F.↗

NASA NTRS2003

High-Performance Acousto-Ultrasonic Scan System Being Developed

Acousto-ultrasonic (AU) interrogation is a single-sided nondestructive evaluation (NDE) technique employing separated sending and receiving transducers. It is used for assessing the microstructural condition and distributed damage state of the material between the transducers. AU is complementary to more traditional NDE methods, such as ultrasonic cscan, x-ray radiography, and thermographic inspection, which tend to be used primarily for discrete flaw detection. Throughout its history, AU has been used to inspect polymer matrix composites, metal matrix composites, ceramic matrix composites, and even monolithic metallic materials. The development of a high-performance automated AU scan system for characterizing within-sample microstructural and property homogeneity is currently in a prototype stage at NASA. This year, essential AU technology was reviewed. In addition, the basic hardware and software configuration for the scanner was developed, and preliminary results with the system were described. Mechanical and environmental loads applied to composite materials can cause distributed damage (as well as discrete defects) that plays a significant role in the degradation of physical properties. Such damage includes fiber/matrix debonding (interface failure), matrix microcracking, and fiber fracture and buckling. Investigations at the NASA Glenn Research Center have shown that traditional NDE scan inspection methods such as ultrasonic c-scan, x-ray imaging, and thermographic imaging tend to be more suited to discrete defect detection rather than the characterization of accumulated distributed micro-damage in composites. Since AU is focused on assessing the distributed micro-damage state of the material in between the sending and receiving transducers, it has proven to be quite suitable for assessing the relative composite material state. One major success story at Glenn with AU measurements has been the correlation between the ultrasonic decay rate obtained during AU inspection and the mechanical modulus (stiffness) seen during fatigue experiments with silicon carbide/silicon carbide (SiC/SiC) ceramic matrix composite samples. As shown in the figure, ultrasonic decay increased as the modulus decreased for the ceramic matrix composite tensile fatigue samples. The likely microstructural reason for the decrease in modulus (and increase in ultrasonic decay) is the matrix microcracking that commonly occurs during fatigue testing of these materials. Ultrasonic decay has shown the capability to track the pattern of transverse cracking and fiber breakage in these composites.

Roth, Don J.↗

NASA NTRS2018

A Prognostic Launch Vehicle Probability of Failure Assessment Methodology for Conceptual Systems Predicated on Human Causal Factors

Create an improved method to calculate reliability of a conceptual launch vehicle system prior to fabrication by using historic data of actual root causes of failures. While failures have unique "proximate causes", there are typically a finite amount of common "root causes". Heretofore launch vehicle reliability evaluation typically hardware-centric statistical analyses, while most root causes of failures are been shown to be human-centric. A method based on human-centric root causes can be used to quantify reliability assessments and focus proposed actions to mitigate problems. Existing methods have been optimistic in their projections of launch vehicle reliability compared to actuals. Hypothesis: reliability of a conceptual launch vehicle can be more accurately evaluated based on a rational, probabilistic approach using past failure assessment teams' findings predicated on human-centric causes."Human Reliability Analysis Methods Selection Guidance for NASA"Chandler F.T., et al., NASA HQ/OSMA study group, July 2006. Outside HRA experts from academia, other federal labs, and the private sector. 50 system reliability methods considered, fourteen selected for further study, four finally selected as best suited for human spaceflight. Probabilistic Risk Analysis (PRA) + Human Reliability Analysis (HRA) enabled incorporating effects and probabilities of human errors. While four down-selected methods deemed appropriate for failure assessment, it did not appear that these methods could be concisely applied to perform major system-wide assessment of probability of failure of a conceptual design without becoming unwieldy."Engineering a Safer World", Detailed, comprehensive study external to NASA Leveson N. G., MIT, 2011.Systems-Theoretic Accident Model and Processes (STAMP). All-encompassing accident model based on systems theory analyzed accidents after they occurred and created approaches to prevent occurrence in developing systems not focused on failure prevention per se, but rather reducing hazards by influencing human behavior through use of constraints, hierarchical control structures, and process models to improve system safetySystem Theoretic Process Analysis (STPA) addresses predictive part of problem (a "hazard analysis"). Includes all causal factors identified in STAMP: "...design errors, software flaws, component interaction accidents, cognitively complex human decision-making errors, and social organizational and management factors contributing to accidents" can guide design process rather than require it to exist before-hand did not appear capable of concise application for system-wide assessment of probability of failure of a conceptual design without becoming unwieldy.

Williams, Craig H.↗

NASA NTRSDate not supplied

Computational Study of Oxidative Etch Pitting in FiberForm and the Effect on Its Material Properties

Erosion of carbon due to oxidation does not occur uniformly but through the formation of localized etch pits because of active surface sites. These active sites are formed due to the presence of atomic defects on the carbon surface, and have much higher reactivity compared to average non-defective sites. Thus, these active sites are first to react during ablation, resulting in their removal. This causes all the neighboring atoms to be defective and increase their reactivity, thus leading to the localized carbon removal around these “active” sites. In this manner, these highly reactive defective sites serve as nucleation sites for the formation and growth of etch pits with potentially detrimental effects on the structural integrity. In order to understand the influence of these etch pits on the material properties of carbon fiber microstructures, we have developed a new capability within direct simulation Monte Carlo (DSMC) to capture the etch pit formation process. This capability is developed within the DSMC code SPARTA (Stochastic PArallel Rarefied-gas Time-accurate Analyzer) and can model the material removal in presence of active sites leading to the formation of etch pits. The focus of the current work will be to study the effect of etch pits on the material properties of FiberForm, a commonly used base material within many thermal protection system materials (TPS). The microstructure of virgin FiberForm obtained directly from X-ray microtomography experiments is used within SPARTA to obtain the ablated geometries with etch pits. These pitted microstructures are then imported within the Porous Microstructure Analysis (PuMA) software and various material properties such as elasticity, thermal conductivity, and permeability are computed. The variation of these properties as a result of the complex evolution of the surface topology due to etch pit formation is studied and analyzed. Furthermore, the effect of pitting is compared to the case of shrinking fibers, which has been the standard for modelling ablation of carbon structures; and significant differences are observed. Thus, such a physically realistic modeling of material removal through the formation of etch pits will be helpful in predicting the degradation of carbon-based TPS more accurately during oxidation; as well as other mechanisms such as spallation, which involves the removal of chunks of material into the flow due to etch pit growth. This will ultimately improve our understanding of the failure modes in these materials due to ablation.

Carbon Ablators↗

NASA NTRSDate not supplied

Computational Study of Oxidative Etch Pitting in FiberForm and the Effect on Its Material Properties

Carbon Ablators↗

DOE OSTI2023

Probabilistic Multi-Hazard Performance Assessment of Concrete Structures in Nuclear Installations

Concrete structures in nuclear installations are subject to time-dependent degradation mechanisms that can deteriorate their physical and mechanical properties, potentially exacerbating the risk of structural failure under external forces such as a seismic event. Previous research has extensively investigated the seismic response of nuclear concrete structures and the associated risk, as well as their effect on structural components safety margins. However, substantial work is still necessary to incorporate concrete aging effects into such evaluations. In fact, most models in the literature assume pristine concrete conditions and do not account for the impact of aging on the structural components’ fragility curves. This work identifies relevant time-dependent degradation mechanisms and provides simplified models to predict the the evolution of key material properties based on data from the literature. Namely, this work focuses on the aging effects of corrosion, alkali–silica reaction (ASR), and irradiation on reinforced concrete within US Department of Energy (DOE) nuclear facilities and nuclear power plants (NPP) structures. Furthermore, degradation models based on literature data are presented that define the relationship between probabilistic material properties and the concrete’s age. In this work, sampled material properties served as input for a simplified finite element model (FEM) of a critical nuclear structural system, with the output of the FEM being the seismic response for a given ground motion. The results of the FEM were then used within a probabilistic performance assessment with a statistically significant number of samples. The research presented herein addresses the detrimental effects of hazards caused by natural phenomena on deteriorated concrete elements of nuclear installations. This work directly benefits the safety analysis performed on US DOE/ National Nuclear Security Administration (NNSA) nuclear facilities located in areas prone to seismic activity. The results presented herein could aid in the improvement of DOE-STD-1020, the DOE Standard that addresses seismic risk analysis and capacity evaluation in DOE facilities. DOE-STD-1020 refers to the requirements in American Society of Civil Engineers (ASCE) 4-98, now superseded by ASCE 4-16, that shall be met in performing dynamic response analyses and generating in-structure response spectra, provided that such requirements are consistent with the requirements of ASCE/Structural Engineering Institute (SEI) 43-05. Moreover, the results presented herein could also aid in the updating of section C3.1.1. of ASCE 4-16 to account for the effects of aging on the stiffness of reinforced elements and American Concrete Institute (ACI) 349.3R-18, “Report on Evaluation and Repair of Existing Nuclear Safety-Related Concrete Structures.” Ultimately, this work can assist the risk assessment of potential lifetime extension of the existing US commercial nuclear fleet (light water reactors) and the safety analysis of the emerging advanced nuclear reactors. The proposed proof-of-concept methodology employs open-source DOE computational tools and is transferable to commercial software commonly used by engineering firms.

42 ENGINEERING↗

NASA NTRS2018

Implementation of J-A Methodology Elastic-Plastic Crack Instability Analysis Capability into the WARP-3D Code

Characterization of the near crack-tip stress/strain fields is the foundation of fracture mechanics. The description of the near tip stress field and the prediction of when fracture occurs is well established for brittle materials that exhibit linear elastic behavior. However, in ductile materials or conditions that violate linear elastic assumptions (Aluminum alloys, Al 2024-T3, Al 2024- T351 etc.), the elastic-plastic crack-tip stress fields are characterized by the Hutchison-Rice-Rosengren (HRR) field. The J-integral is commonly used to characterize amplitude of the HRR field under elastic-plastic conditions. The J-integral has been demonstrated for crack-tip fields that are under high constraint conditions (i.e., small-scale plasticity where the J-dominance is maintained). However, as the external load increases, yielding changes from small- to largescale plasticity and usually a loss of constraint (i.e., reduction in the triaxial stress field along the crack front). The loss of constraint leads to the deviation of the crack-tip stress fields from that given by the HRR field. Hence, the J-dominance will be gradually lost and additional parameter(s) are required to quantify the crack-tip stress fields and predict fracture behavior. The assessment objectives were to: 1) implement a two-parameter (i.e., J-A) fracture criterion into an elastic-plastic three-dimensional (3D) finite element analysis (FEA), 2) validate the implementation by comparison with the A parameter from literature data, 3) conduct material characterization tests to quantify the material behavior and provide fracture data for validation of the J-A fracture criteria, and (4) perform evaluations to establish if the J-A criteria can be used to predict fracture in a ductile metallic material (e.g., aluminum alloys). The A parameter in these criteria is the second parameter in a three-term elastic-plastic asymptotic expansion of the neartip stress behavior. A series of extensive FEAs were performed using WARP3D software package to obtain solutions for the A parameter for different specimen configurations. The methodology needed for the estimation of the A parameter in the asymptotic expansion was developed and implemented using Matlab®. A user material (UMAT) routine was used to model the material stress-strain response using a Ramberg-Osgood power law with a hardening exponent (n) and a material coefficient (alpha). This UMAT routine was successfully implemented in WARP3D software and validated through comparison with the experimental data. Three configurations were extracted from published results: 1) center cracked plate (CCP), 2) single edge-cracked plate (SECP), and 3) double edge-cracked plate (DECP). These configurations and four other configurations (three-hole tension (THT)), three-point bend (3PTB), three-hole compact tension (3PCT), and compact tension (CT)) were analyzed to verify the methodology that was developed and implemented into WARP3D. Solutions of the A parameter were obtained for remote tension loading conditions that started with small-scale yielding and continued into the large-scale plasticity regime. The results indicate that the methodology developed can be used to calculate the elastic-plastic J-A parameters for test specimens with a range of crack geometries, material strain hardening behaviors, and loading conditions. The J-A parameters were implemented as fracture criteria and used to predict the test results. For comparison, other fracture criteria were used to predict the same test results. Major findings include: The A constraint parameter A varies with specimen type and applied load thus accurate determination is crucial in predicting the failure load, and the A parameter is asymptotic as the failure load is approached, making an accurate determination difficult (i.e., small differences in the A parameter can cause large variations in failure load) for materials exhibiting elastic-plastic behavior. The failure predictions from J-A methodology were more accurate than the traditionally used KC and J methods, and have comparable scatter to that observed when using the crack-tip opening angle (CTOA) method. However, the J-A methodology requires considerable effort (expertise level and labor) to implement and to evaluate the A parameter for different specimen types and materials, or to apply this methodology to part-through crack (e.g., 3D problems) structural applications.

Hamm, Kenneth R., Jr.↗