Results for “probability of failure” — Page 62

NASA NTRS2019

Safe and Optimal Techniques Enabling Recovery, Integrity, and Assurance

There is a trend in the aviation industry to go from federated to integrated computing systems. Combining a number of traditional stand-alone federated systems into an integrated common platform (called Integrated Modular Avionics, IMA) has the benefit of increased power efficiency, reduced support hardware, and reduced cabling. However, changing from federated to integrated has a significant impact on the system architecture and hence the process of how avionic systems are to be analyzed. Traditional approaches to safety analysis become inefficient when functional boundaries can no longer be assumed for failure independence and fault isolation. In this report, we describe a tool that we developed to accelerate the safety engineer's ability to perform safety analysis of IMA systems through modeling, as well as optimize the system engineer's ability to develop a system through architecture synthesis. This work was the result of a three-year research effort called SOTERIA (Safe and Optimal Techniques Enabling Recovery, Integrity, and Assurance). We developed a compositional modeling language that supports rapid development, modification, and evaluation of architectures. The modeling language is structured such that the end-user defines a library of components with information on component reliability, connectivity, and fault propagation logic. The system model is built by instantiating the components from the library, connecting the components, and identifying the top-level faults of interest. Our tool is compositional in that the end-user only needs to define safety aspects at the component level. The tool takes the model and automatically synthesizes both the qualitative and quantitative safety analyses. We go further by allowing users to describe system information such as components to use in an architecture and their connection compatibility and automatically synthesize an architecture that meets the top-level probability target adhering to end-user specified constraints. This capability allows users to rapidly explore a design space..

Siu, Kit Y.↗

NASA NTRS2013

Application of Statistically Derived CPAS Parachute Parameters

The Capsule Parachute Assembly System (CPAS) Analysis Team is responsible for determining parachute inflation parameters and dispersions that are ultimately used in verifying system requirements. A model memo is internally released semi-annually documenting parachute inflation and other key parameters reconstructed from flight test data. Dispersion probability distributions published in previous versions of the model memo were uniform because insufficient data were available for determination of statistical based distributions. Uniform distributions do not accurately represent the expected distributions since extreme parameter values are just as likely to occur as the nominal value. CPAS has taken incremental steps to move away from uniform distributions. Model Memo version 9 (MMv9) made the first use of non-uniform dispersions, but only for the reefing cutter timing, for which a large number of sample was available. In order to maximize the utility of the available flight test data, clusters of parachutes were reconstructed individually starting with Model Memo version 10. This allowed for statistical assessment for steady-state drag area (CDS) and parachute inflation parameters such as the canopy fill distance (n), profile shape exponent (expopen), over-inflation factor (C(sub k)), and ramp-down time (t(sub k)) distributions. Built-in MATLAB distributions were applied to the histograms, and parameters such as scale (sigma) and location (mu) were output. Engineering judgment was used to determine the "best fit" distribution based on the test data. Results include normal, log normal, and uniform (where available data remains insufficient) fits of nominal and failure (loss of parachute and skipped stage) cases for all CPAS parachutes. This paper discusses the uniform methodology that was previously used, the process and result of the statistical assessment, how the dispersions were incorporated into Monte Carlo analyses, and the application of the distributions in trajectory benchmark testing assessments with parachute inflation parameters, drag area, and reefing cutter timing used by CPAS.

Romero, Leah M.↗

NASA NTRS2012

Onboard Sensor Data Qualification in Human-Rated Launch Vehicles

The avionics system software for human-rated launch vehicles requires an implementation approach that is robust to failures, especially the failure of sensors used to monitor vehicle conditions that might result in an abort determination. Sensor measurements provide the basis for operational decisions on human-rated launch vehicles. This data is often used to assess the health of system or subsystem components, to identify failures, and to take corrective action. An incorrect conclusion and/or response may result if the sensor itself provides faulty data, or if the data provided by the sensor has been corrupted. Operational decisions based on faulty sensor data have the potential to be catastrophic, resulting in loss of mission or loss of crew. To prevent these later situations from occurring, a Modular Architecture and Generalized Methodology for Sensor Data Qualification in Human-rated Launch Vehicles has been developed. Sensor Data Qualification (SDQ) is a set of algorithms that can be implemented in onboard flight software, and can be used to qualify data obtained from flight-critical sensors prior to the data being used by other flight software algorithms. Qualified data has been analyzed by SDQ and is determined to be a true representation of the sensed system state; that is, the sensor data is determined not to be corrupted by sensor faults or signal transmission faults. Sensor data can become corrupted by faults at any point in the signal path between the sensor and the flight computer. Qualifying the sensor data has the benefit of ensuring that erroneous data is identified and flagged before otherwise being used for operational decisions, thus increasing confidence in the response of the other flight software processes using the qualified data, and decreasing the probability of false alarms or missed detections.

Wong, Edmond↗

NASA NTRS2018

Sea-Level Rise: Projections for Maryland 2018

In fulfillment of requirements of the Maryland Commission on Climate Change Act of 2015, this report provides updated projections of the amount of sea-level rise relative to Maryland coastal lands that is expected into the next century. These projections represent the consensus of an Expert Group drawn from the Mid-Atlantic region. The framework for these projections is explicitly tied to the projections of global sea-level rise included in the Intergovernmental Panel on Climate Change Fifth Assessment (2014) and incorporates regional factors such as subsidence, distance from melting glaciers and polar ice sheets, and ocean currents. The probability distribution of estimates of relative sea-level rise from the baseline year of 2000 are provided over time and, after 2050, for three different greenhouse gas emissions pathways: Growing Emissions (RCP8.5), Stabilized Emissions (RCP4.5), and meeting the Paris Agreement (RCP2.6). This framework has been recently used in developing relative sea-level rise projections for California, Oregon, Washington, New Jersey, and Delaware as well as several metropolitan areas. The Likely range (66% probability) of the relative rise of mean sea level expected in Maryland between 2000 and 2050 is 0.8 to 1.6 feet, with about a one-in-twenty chance it could exceed 2.0 feet and about a one-in-one hundred chance it could exceed 2.3 feet. Later this century, rates of sea-level rise increasingly depend on the future pathway of global emissions of greenhouse gases during the next sixty years. If emissions continue to grow well into the second half of the 21st century, the Likely range of sea-level rise experienced in Maryland is 2.0 to 4.2 feet over this century, two to four times the sea-level rise experienced during the 20th century. Moreover, there is a one-in-twenty chance that it could exceed 5.2 feet. If, on the other hand, global society were able to bring net greenhouse gas emissions to zero in time to meet the goals of the Paris Climate Agreement and reduce emissions sufficient to limit the increase in global mean temperature to less than 2°Celsius over pre-industrial levels, the Likely range for 2100 is 1.2 to 3.0 feet, with a one-in-twenty chance that it would exceed 3.7 feet. The difference in sea-level rise between these contrasting scenarios would diverge even more during the next century, with the failure to reduce emissions in the near term resulting in much greater sea-level rise 100 years from now. Moreover, recent research suggests that, without imminent and substantial reductions in greenhouse gas emissions, the loss of polar ice sheets-and thus the rate of sea-level rise-may be more rapid than assumed in these projections, particularly under the Growing Emissions scenario. These probabilistic sea-level rise projections can and should be used in planning and regulation, infrastructure siting and design, estimation of changes in tidal range and storm surge, developing inundation mapping tools, and adaptation strategies for high-tide flooding and saltwater intrusion.

Boesch, D. F.↗

NASA NTRS2011

Single-Event Gate Rupture in Power MOSFETs: A New Radiation Hardness Assurance Approach

Almost every space mission uses vertical power metal-semiconductor-oxide field-effect transistors (MOSFETs) in its power-supply circuitry. These devices can fail catastrophically due to single-event gate rupture (SEGR) when exposed to energetic heavy ions. To reduce SEGR failure risk, the off-state operating voltages of the devices are derated based upon radiation tests at heavy-ion accelerator facilities. Testing is very expensive. Even so, data from these tests provide only a limited guide to on-orbit performance. In this work, a device simulation-based method is developed to measure the response to strikes from heavy ions unavailable at accelerator facilities but posing potential risk on orbit. This work is the first to show that the present derating factor, which was established from non-radiation reliability concerns, is appropriate to reduce on-orbit SEGR failure risk when applied to data acquired from ions with appropriate penetration range. A second important outcome of this study is the demonstration of the capability and usefulness of this simulation technique for augmenting SEGR data from accelerator beam facilities. The mechanisms of SEGR are two-fold: the gate oxide is weakened by the passage of the ion through it, and the charge ionized along the ion track in the silicon transiently increases the oxide electric field. Most hardness assurance methodologies consider the latter mechanism only. This work demonstrates through experiment and simulation that the gate oxide response should not be neglected. In addition, the premise that the temporary weakening of the oxide due to the ion interaction with it, as opposed to due to the transient oxide field generated from within the silicon, is validated. Based upon these findings, a new approach to radiation hardness assurance for SEGR in power MOSFETs is defined to reduce SEGR risk in space flight projects. Finally, the potential impact of accumulated dose over the course of a space mission on SEGR susceptibility is explored. SEGR evaluation of gamma-irradiated power MOSFETs suggests a non-significant SEGR susceptibility enhancement due to accumulated dose from gamma rays. During SEGR testing, an unexpected enhanced dose effect from heavy-ion irradiation was detected. We demonstrate that this effect could be due to direct ionization by two or more ions at the same channel location. The probability on-orbit for such an occurrence is near-zero given the low heavy-ion fluence over a typical mission lifetime, and did not affect SEGR susceptibility. The results of this work can be used to bound the risk of SEGR in power MOSFETs considered for insertion into spacecraft and instruments.

Lauenstein, Jean-Marie↗

NASA NTRS2011

Crew Survivability After a Rapid Cabin Depressurization Event

Anecdotal evidence acquired through historic failure investigations involving rapid cabin decompression (e.g. Challenger, Columbia and Soyuz 11) show that full evacuation of the cabin atmosphere may occur within seconds. During such an event, the delta-pressure between the sealed suit ventilation system and the cabin will rise at the rate of the cabin depressurization; potentially at a rate exceeding the capability of the suit relief valve. It is possible that permanent damage to the suit pressure enclosure and ventilation loop components may occur as the integrated system may be subjected to delta pressures in excess of the design to pressures. Additionally, as the total pressure of the suit ventilation system decreases, so does the oxygen available to the crew. The crew may be subjected to a temporary incapacitating, but non-lethal, hypoxic environment. It is expected that the suit will maintain a survivable atmosphere on the crew until the vehicle pressure control system recovers or the cabin has otherwise attained a habitable environment. A common finding from the aforementioned reports indicates that the crew would have had a better chance at surviving the event had they been in a protective configuration, that is, in a survival suit. Making use of these lessons learned, the Constellation Program implemented a suit loop in the spacecraft design and required that the crew be in a protective configuration, that is suited with gloves on and visors down, during dynamic phases of flight that pose the greatest risk for a rapid and uncontrolled cabin depressurization event: ascent, entry, and docking. This paper details the evaluation performed to derive suit pressure garment and ventilation system performance parameters that would lead to the highest probability of crew survivability after an uncontrolled crew cabin depressurization event while remaining in the realm of practicality for suit design. This evaluation involved: (1) assessment of stakeholder expectations to validate the functionality being imposed; (2) review/refinement of concept of operations to establish the potential triggers for such an event and define the response of the spacecraft and suit ventilation loop pressure control systems; and (3) assessment of system capabilities with respect to structural capability and pressure control. 1 Crew and Thermal Systems Division, NASA Johnson Space Center, Mail Code: AES29, 2101 NASA Parkway, Houston,

Sargusingh, Miriam J.↗

NASA NTRS2012

Crew Survivability After a Rapid Cabin Depressurization Event

Anecdotal evidence acquired through historic failure investigations involving rapid cabin decompression (e.g. Challenger, Columbia and Soyuz 11) show that full evacuation of the cabin atmosphere may occur within seconds. During such an event, the delta-pressure between the sealed suit ventilation system and the cabin will rise at the rate of the cabin depressurization; potentially at a rate exceeding the capability of the suit relief valve. It is possible that permanent damage to the suit pressure enclosure and ventilation loop components may occur as the integrated system may be subjected to delta pressures in excess of the design-to pressures. Additionally, as the total pressure of the suit ventilation system decreases, so does the oxygen available to the crew. The crew may be subjected to a temporarily incapacitating, but non-lethal, hypoxic environment. It is expected that the suit will maintain a survivable atmosphere on the crew until the vehicle pressure control system recovers or the cabin has otherwise attained a habitable environment. A common finding from the aforementioned reports indicates that the crew would have had a better chance at surviving the event had they been in a protective configuration, that is, in a survival suit. Making use of these lessons learned, the Constellation Program implemented a suit loop in the spacecraft design and required that the crew be in a protective configuration, that is suited with gloves on and visors down, during dynamic phases of flight that pose the greatest risk for a rapid and uncontrolled cabin depressurization event: ascent, entry, and docking. This paper details the evaluation performed to derive suit pressure garment and ventilation system performance parameters that would lead to the highest probability of crew survivability after an uncontrolled crew cabin depressurization event while remaining in the realm of practicality for suit design. This evaluation involved: (1) assessment of stakeholder expectations to validate the functionality being imposed; (2) review/refinement of concept of operations to establish the potential triggers for such an event and define the response of the spacecraft and suit ventilation loop pressure control systems; and (3) assessment of system capabilities with respect to structural capability and pressure control.

Sargusingh, Miriam J.↗

DOE OSTI2020

2D Dam-Break Analysis of L Lake and PAR Pond Dams Using HEC-RAS

In 1991 a dam-break study was conducted for the high hazard dams located at L Lake and PAR Pond on the Savannah River Site. Two scenarios were considered, over topping from a Probable Maximum Flood (PMF), and a fair weather dam-break for either or both dams. Unfortunately, no inundation map was developed from the study. The purpose of this project was to redo the original dam-break study with improved data and methodology to generate Inundation maps to assist with emergency response and evacuation plans. The Hydrologic Engineering Center's River Analysis System (HEC-RAS) is a free to download river analysis modeling program developed by the US Army Corps of Engineers capable of 1D and 2D hydraulic calculations. Version 5.0.7 (released March 2019) was used for this project. Digital elevation models for the area were retrieved from the US Geological Survey database and converted to a .hdf file within the program. Then the 2D flood area was identified from the contours. Both L Lake and PAR Pond were inputted as 1D storage areas because DEM data does not contain elevation values under water bodies. An elevation vs volume curve was available for both storage areas. Initial elevations were set for both scenarios. Both dams are earthen dams. The Steel Creek dam at L Lake has 6 ft diameter conduit with an upper and lower sluice gate. PAR pond dam consist of a weir and sluice gate connected to an 8 x 8 ft channel. Both outlets were modeled with a pool elevation vs discharge curve. The steel creek dam sluice gates were assumed to be fully open in all cases. As in the previous study, the dams were set to breach when they were overtopped by 1.5 ft during PMF conditions (Figure 1). A fair weather breach was set to be due to a piping failure (Figure 1). In the dual dam break during fair weather conditions the PAR pond dam fails 3 hours after Steel Creek to achieve maximum flooding in the down stream reaches. Simulation was run 3 days for each case and with a 1 minute computational interval. Maximum flooding occurs under PMF conditions with the failure of both dams. PAR pond dam fails first 16 hours and 32 minutes after the start of the simulation with the Steel creek dam failing 6 minutes later. In all cases, the bridges and roads spanning Steel Creek and Lower Three Runs will be inundated and potentially washed away. The Burtons Ferry Highway south of the storage areas will be partially flooded during PMF failure, dual fair weather failure, and PAR pond failure under fair weather conditions.

54 ENVIRONMENTAL SCIENCES↗

NASA NTRS2000

A Reliable Earth Return System for Safe Recovery of Mars Samples

The objective of a Mars sample return mission is to bring selected Mars surface materials to Earth. Numerous approaches for the Earth-return segment have been analyzed including propulsive or aerocapture return to low-Earth orbit followed by Space Shuttle rendezvous and direct entry. Of these approaches, ballistic entry of a small capsule terminating in a ground landing has been shown to be the lowest risk strategy. Over the past two years, significant work has been performed towards development of a robust direct entry vehicle for Mars sample return. In June 1999, the NASA Planetary Protection Officer provided initial guidance to the former Mars Sample Return Project. The sample return phase of the mission was assigned a restricted Earth return planetary protection classification. The draft mission requirement states that the total mean probability of release of unsterilized Mars material into the Earth;s biosphere must be less than 1.0E-06 (1 in a million). This strict requirement drives the approach and design of the Earth return system. To meet this requirement, selection of the Earth return strategy and development of the Earth return system must be guided by risk, not performance, based decisions. An initial Probabilistic Risk Assessment (PRA) was performed to address the direct entry Earth return system containment assurance reliability and to identify high-risk elements of this system. The results of this PRA identified risk elements that include thermal protection system performance during entry, spin-eject orientation and aerodynamic stability during entry, structural integrity under atmospheric deceleration and impact loads, and tracking/recovery of this system. This initial probabilistic risk quantification demonstrates that, with the proper development program, a prototypical direct entry design can satisfy the containment assurance reliability requirement. Through the current Mars Sample Return Advanced Technology Development effort, an extensive design, analysis, and test program is presently proceeding with the aim of reducing the containment assurance risk of this system. This technology development effort, guided by a continuing PRA, focuses on key risk areas of a direct entry Earth return system including: the thermal protection system, impact dynamics, structural performance, aerodynamic stability, and ground recovery. This development program will culminate in a system validation flight test, 1-2 years prior to launch of the flight system. This flight test would include the launch, entry, and recovery of a full-scale Earth return system, as a scientific validation of the key risk elements to verify nominal design performance. The results of the initial PRA suggested several dominant failure sequences that can be validated in a flight test. These include: demonstrating the thermal protection system reliability and performance during entry, demonstrating the spin-eject orientation and aero-dynamic stability during entry, demonstrating the structural integrity under atmospheric deceleration and impact loads, and demonstrating tracking and recovery of the Earth return system. This single test will directly address over 50% of the total containment assurance risk elements. This presentation will begin by presenting the relative risk of various Earth return strategies. The results of the initial probabilistic risk assessment will be presented followed by a discussion of the development accomplishments and plans for demonstration of a highly reliable direct entry Earth return system.

Braun, R.↗

NASA NTRS2011

NASA System Safety Handbook: System Safety Framework and Concepts for Implementation - Volume 1

System safety assessment is defined in NPR 8715.3C, NASA General Safety Program Requirements as a disciplined, systematic approach to the analysis of risks resulting from hazards that can affect humans, the environment, and mission assets. Achievement of the highest practicable degree of system safety is one of NASA's highest priorities. Traditionally, system safety assessment at NASA and elsewhere has focused on the application of a set of safety analysis tools to identify safety risks and formulate effective controls.1 Familiar tools used for this purpose include various forms of hazard analyses, failure modes and effects analyses, and probabilistic safety assessment (commonly also referred to as probabilistic risk assessment (PRA)). In the past, it has been assumed that to show that a system is safe, it is sufficient to provide assurance that the process for identifying the hazards has been as comprehensive as possible and that each identified hazard has one or more associated controls. The NASA Aerospace Safety Advisory Panel (ASAP) has made several statements in its annual reports supporting a more holistic approach. In 2006, it recommended that "... a comprehensive risk assessment, communication and acceptance process be implemented to ensure that overall launch risk is considered in an integrated and consistent manner." In 2009, it advocated for "... a process for using a risk-informed design approach to produce a design that is optimally and sufficiently safe." As a rationale for the latter advocacy, it stated that "... the ASAP applauds switching to a performance-based approach because it emphasizes early risk identification to guide designs, thus enabling creative design approaches that might be more efficient, safer, or both." For purposes of this preface, it is worth mentioning three areas where the handbook emphasizes a more holistic type of thinking. First, the handbook takes the position that it is important to not just focus on risk on an individual basis but to consider measures of aggregate safety risk and to ensure wherever possible that there be quantitative measures for evaluating how effective the controls are in reducing these aggregate risks. The term aggregate risk, when used in this handbook, refers to the accumulation of risks from individual scenarios that lead to a shortfall in safety performance at a high level: e.g., an excessively high probability of loss of crew, loss of mission, planetary contamination, etc. Without aggregated quantitative measures such as these, it is not reasonable to expect that safety has been optimized with respect to other technical and programmatic objectives. At the same time, it is fully recognized that not all sources of risk are amenable to precise quantitative analysis and that the use of qualitative approaches and bounding estimates may be appropriate for those risk sources. Second, the handbook stresses the necessity of developing confidence that the controls derived for the purpose of achieving system safety not only handle risks that have been identified and properly characterized but also provide a general, more holistic means for protecting against unidentified or uncharacterized risks. For example, while it is not possible to be assured that all credible causes of risk have been identified, there are defenses that can provide protection against broad categories of risks and thereby increase the chances that individual causes are contained. Third, the handbook strives at all times to treat uncertainties as an integral aspect of risk and as a part of making decisions. The term "uncertainty" here does not refer to an actuarial type of data analysis, but rather to a characterization of our state of knowledge regarding results from logical and physical models that approximate reality. Uncertainty analysis finds how the output parameters of the models are related to plausible variations in the input parameters and in the modeling assumptions. The evaluation of unrtainties represents a method of probabilistic thinking wherein the analyst and decision makers recognize possible outcomes other than the outcome perceived to be "most likely." Without this type of analysis, it is not possible to determine the worth of an analysis product as a basis for making decisions related to safety and mission success. In line with these considerations the handbook does not take a hazard-analysis-centric approach to system safety. Hazard analysis remains a useful tool to facilitate brainstorming but does not substitute for a more holistic approach geared to a comprehensive identification and understanding of individual risk issues and their contributions to aggregate safety risks. The handbook strives to emphasize the importance of identifying the most critical scenarios that contribute to the risk of not meeting the agreed-upon safety objectives and requirements using all appropriate tools (including but not limited to hazard analysis). Thereafter, emphasis shifts to identifying the risk drivers that cause these scenarios to be critical and ensuring that there are controls directed toward preventing or mitigating the risk drivers. To address these and other areas, the handbook advocates a proactive, analytic-deliberative, risk-informed approach to system safety, enabling the integration of system safety activities with systems engineering and risk management processes. It emphasizes how one can systematically provide the necessary evidence to substantiate the claim that a system is safe to within an acceptable risk tolerance, and that safety has been achieved in a cost-effective manner. The methodology discussed in this handbook is part of a systems engineering process and is intended to be integral to the system safety practices being conducted by the NASA safety and mission assurance and systems engineering organizations. The handbook posits that to conclude that a system is adequately safe, it is necessary to consider a set of safety claims that derive from the safety objectives of the organization. The safety claims are developed from a hierarchy of safety objectives and are therefore hierarchical themselves. Assurance that all the claims are true within acceptable risk tolerance limits implies that all of the safety objectives have been satisfied, and therefore that the system is safe. The acceptable risk tolerance limits are provided by the authority who must make the decision whether or not to proceed to the next step in the life cycle. These tolerances are therefore referred to as the decision maker's risk tolerances. In general, the safety claims address two fundamental facets of safety: 1) whether required safety thresholds or goals have been achieved, and 2) whether the safety risk is as low as possible within reasonable impacts on cost, schedule, and performance. The latter facet includes consideration of controls that are collective in nature (i.e., apply generically to broad categories of risks) and thereby provide protection against unidentified or uncharacterized risks.

Dezfuli, Homayoon↗

NASA NTRS1998

Measuring Thermal Conductivity and Moisture Absorption of Cryo-Insulation Materials

NASA is seeking to develop thermal insulation material systems suitable for withstanding both extremely high temperatures encountered during atmospheric re-entry heating and aero- braking maneuvers, as well as extremely low temperatures existing in liquid fuel storage tanks. Currently, materials used for the high temperature insulation or Thermal Protection System (TPS) are different from the low temperature, or cryogenic insulation. Dual purpose materials are necessary to the development of reusable launch vehicles (RLV). The present Space Shuttle (or Space Transportation System, STS) employs TPS materials on the orbiter and cryo-insulation materials on the large fuel tank slung under the orbiter. The expensive fuel tank is jettisoned just before orbit is achieved and it burns up while re-entering over the Indian Ocean. A truly completely reusable launch vehicle must store aR cryogenic fuel internally. The fuel tanks will be located close to the outer surface. In fact the outer skin of the craft will probably also serve as the fuel tank enclosure, as in jet airliners. During a normal launch the combined TPS/cryo-insulation system will serve only as a low temperature insulator, since aerodynamic heating is relatively minimal during ascent to orbit. During re-entry, the combined TPS/cryo-insulation system will serve only as a high temperature insulator, since all the cryogenic fuel will have been expended in orbit. However, in the event of an.aborted launch or a forced/emergency early re-entry, the tanks will still contain fuel, and the TPS/cryo-insulation will have to serve as both low and high temperature insulation. Also, on long duration missions, such as to Mars, very effective cryo-insulation materials are needed to reduce bod off of liquid propellants, thereby reducing necessary tankage volume, weight, and cost. The conventional approach to obtaining both low and high temperature insulation, such as is employed for the X-33 and X-34 spacecraft, is to use separate TPS and cryo-insulation materials, which are connected by means of adhesives or stand-offs (spacers). Three concepts are being considered: (1) the TPS is bonded directly to the cryo-insulation which, in turn, is bonded to the exterior of the tank, (2) stand-offs are used to make a gap between the TPS and the cryo-insulation, which is bonded externally to the tank, (3) TPS is applied directly or with stand-offs to the exterior so the tank, and cryo-insulation is applied directly to the interior of the tank. Many potential problems are inherent in these approaches. For example, mismatch between coefficients of thermal expansion of the TPS and cryo-insulation, as well as aerodynamic loads, could lead to failure of the bond. Internal cryo-insulation must be prevent from entering the sump of the fuel turbo-pump. The mechanical integrity of the stand-off structure (if used) must withstand multiple missions. During ground hold (i.e., prior to launch) moisture condensation must be minimized in the gap between the cryo-insulation and the TPS. The longer term solution requires the development of a single material to act as cryo- insulation during ground hold and as TPS during re-entry. Such a material minimizes complexity and weight while improving reliability and reducing cost.

Lambert, Michael A.↗

NASA NTRSDate not supplied

Analysis of Launch Vehicle Liftoff Debris: Historical Perspective from Space Shuttle and Application to Artemis I

Human exploration-class launch vehicles are inherently prone to debris due to the extreme environments generated during pre-launch operations, liftoff, and flight. The use of cryogenic propellants often requires thermal protection system (TPS) coatings, typically foam, to maintain the propellant conditions in the tank and prevent an accumulation ice on the external surface of the vehicle. Some ice growth is to be expected at umbilical interfaces, vents, flanges, or brackets where it is difficult to apply TPS. This ice may come loose at any time due to wind on the launch pad, structural vibration and acoustics after rocket ignition, or aerodynamic forces during flight. This phenomena is especially apparent on vehicles with no TPS, such as the Saturn V rockets used in the Apollo Program, see Figure 1. During propellant tanking, the thermal contraction of the underlying substrate may generate cracks in the TPS (Figure 1). Chunks of TPS can release due to the expansion of ingested gas from cryopumping or from aerodynamic forces if the crack creates an offset surface. Most foams will also have a certain amount of “popcorning” where small pieces of foam will pop off during flight because of the differential between the static surface pressure and the pressure of the gas trapped in the foam cell structure. There are a number of other coating or closeout materials that may be shed from the vehicle and become debris. During pre-launch operations and liftoff, the vehicle may also be exposed to debris originating from the launch pad or ground support equipment. This debris is separate from foreign object debris, or FOD, which is not intended to be present and is strictly controlled through operations and maintenance procedures. In this case, debris is generated from hardware and materials that are necessary for launch and are subject to the intense vibration, acoustics, and direct plume impingement of the launch environment. Examples include ice from umbilicals, tape and tie wraps that protect cables, and rust or corrosion from the launch platform. While NASA has historically been aware of debris as a potential issue that could cause a failure resulting in loss of mission, loss of vehicle, or loss of crew, the likelihood and severity of that risk was not always well understood or given sufficient weight in program and flight decisions. After the Space Shuttle Columbia accident (STS-107), the investigation found that foam TPS debris shed from the external tank was the proximate cause of the damage to the orbiter wing. Six previous observations of debris released from the foam ramp that covered the bipod connecting the forward end of the orbiter to the external tank resulted in minor changes or were determined to be accepted flight risks. Two occurrences of bipod ramp foam loss were not identified until the STS-107 investigation. Despite the damage inflicted by these debris strikes, the Shuttle Program Requirements Control Board deemed the vehicle safe to fly. During the Return to Flight effort following the Columbia disaster, NASA Engineering developed a process for the assessment of debris transport, impact, and damage tolerance to support independent assessments of risk by NASA Safety and Mission Assurance (S&MA). Under this system, each element (vehicle or ground system) defines a catalog of all expected debris based on launch history, component testing, or analysis. Debris transport analysis (DTA) is conducted using the debris catalog characteristics and potential flow transport mechanisms (e.g., vehicle aerodynamics, gravity, wind, plume-driven). The predicted debris impact locations and velocities are provided to the hardware owners, who use available test data and analysis to determine whether each component can withstand the impacts. In cases where the element hardware may be severely damaged or fail, the options are to mitigate the debris source through some change in design or operation, or to work with S&MA to try to characterize the probability of the impact and damage for program risk acceptance. Because of the differences in debris characteristics and transport, the DTA has been divided between the Liftoff and Ascent regimes. The development and application of Liftoff DTA methodology from the Shuttle Program to the current Artemis Program is the subject of this paper. Liftoff DTA covers the time from the start of pre-launch operations at the launch pad, up until the vehicle clears the launch tower and there is no longer any interaction with ground systems. Debris transport during this period is broadly classified as either gravity, wind, and plume-entrained (GWPE) or plume driven (PD). GWPE debris is generally lower speed, travelling in a forward-to-aft direction. PD transport includes flow features from the rocket ignition transient, as well as plume impingement and recirculation that occur as the vehicle lifts off the launch platform. In these cases, the debris typically moves in an aft-to-forward direction at higher speeds. The applicable transport mechanisms must be considered for each piece of debris depending on the material, and release location and time. For example, rust or metallic debris from the tower could fall (GWPE) and impact the vehicle before landing on the launch platform deck where it could be also be transported by plume impingement (PD). However, falling ice (GWPE) from an umbilical is unlikely to survive impact with the vehicle or launch platform and be available for PD transport. Modeling of debris transport is accomplished using a set of DTA tools which simulate debris trajectories subject to a reference frame acceleration (i.e., gravity) and aerodynamic drag. Where the trajectory encounters a solid surface, the debris is allowed to rebound with a specified coefficient of restitution. The drag is calculated by interpolating the fluid state at each point in the debris trajectory from high-fidelity computational fluid dynamics (CFD) simulations of the launch vehicle and pad. The CFD data may either be static (steady state or time averaged), typically for GWPE transport, or dynamic (time-accurate) for PD flow features like the ignition transient. Examples of the CFD flow field solutions for the Space Launch System (SLS) rocket and launch pad are shown in Figure 2. Typical SLS debris trajectory predictions from DTA are illustrated in Figure 3. The final version of this paper will include a more detailed examination of the Liftoff DTA process developed during the Shuttle Program, and how it has been augmented and applied to the SLS rocket under the Artemis Program. Comparisons with debris observations from the Artemis I launch will demonstrate validation of the tools and methodology.

Debris↗

NASA NTRS2006

Evaluation Of Risk And Possible Mitigation Schemes For Previously Unidentified Hazards

This report presents the results of arc track testing conducted to determine if such a transfer of power to un-energized wires is possible and/or likely during an arcing event, and to evaluate an array of protection schemes that may significantly reduce the possibility of such a transfer. The results of these experiments may be useful for determining the level of protection necessary to guard against spurious voltage and current being applied to safety critical circuits. It was not the purpose of these experiments to determine the probability of the initiation of an arc track event only if an initiation did occur could it cause the undesired event: an inadvertent thruster firing. The primary wire insulation used in the Orbiter is aromatic polyimide, or Kapton , a construction known to arc track under certain conditions [3]. Previous Boeing testing has shown that arc tracks can initiate in aromatic polyimide insulated 28 volts direct current (VDC) power circuits using more realistic techniques such as chafing with an aluminum blade (simulating the corner of an avionics box or lip of a wire tray), or vibration of an aluminum plate against a wire bundle [4]. Therefore, an arc initiation technique was chosen that provided a reliable and consistent technique of starting the arc and not a realistic simulation of a scenario on the vehicle. Once an arc is initiated, the current, power and propagation characteristics of the arc depend on the power source, wire gauge and insulation type, circuit protection and series resistance rather than type of initiation. The initiation method employed for these tests was applying an oil and graphite mixture to the ends of a powered twisted pair wire. The flight configuration of the heater circuits, the fuel/oxider (or ox) wire, and the RCS jet solenoid were modeled in the test configuration so that the behavior of these components during an arcing event could be studied. To determine if coil activation would occur with various protection wire schemes, 145 tests were conducted using various fuel/ox wire alternatives (shielded and unshielded) and/or different combinations of polytetrafuloroethylene (PTFE), Mystik tape and convoluted wraps to prevent unwanted coil activation. Test results were evaluated along with other pertinent data and information to develop a mitigation strategy for an inadvertent RCS firing. The SSP evaluated civilian aircraft wiring failures to search for aging trends in assessing the wire-short hazard. Appendix 2 applies Weibull statistical methods to the same data with a similar purpose.

Linzey, William↗

NASA NTRS1996

Chemical Characterization and Reactivity Testing of Fuel-Oxidizer Reaction Product (Test Report)

The product of incomplete reaction of monomethylhydrazine (MMH) and nitrogen tetroxide (NTO) propellants, or fuel-oxidizer reaction product (FORP), has been hypothesized as a contributory cause of an anomaly which occurred in the chamber pressure (PC) transducer tube on the Reaction Control Subsystem (RCS) aft thruster 467 on flight STS-51. A small hole was found in the titanium-alloy PC tube at the first bend below the pressure transducer. It was surmised that the hole may have been caused by heat and pressure resulting from ignition of FORP. The NASA Johnson Space Center (JSC) White Sands Test Facility (WSTF) was requested to define the chemical characteristics of FORP, characterize its reactivity, and simulate the events in a controlled environment which may have lead to the Pc-tube failure. Samples of FORP were obtained from the gas-phase reaction of MMH with NTO under laboratory conditions, the pulsed firings of RCS thrusters with modified PC tubes using varied oxidizer or fuel lead times, and the nominal RCS thruster firings at WSTF and Kaiser-Marquardt. Fourier transform infrared spectroscopy (FTIR), differential scanning calorimetry (DSC), accelerating rate calorimetry (ARC), ion chromatography (IC), inductively coupled plasma (ICP) spectrometry, thermogravimetric analysis (TGA) coupled to FTIR (TGA/FTIR), and mechanical impact testing were used to qualitatively and quantitatively characterize the chemical, thermal, and ignition properties of FORP. These studies showed that the composition of FORP is variable but falls within a limited range of compositions that depends on the fuel loxidizer ratio at the time of formation, composition of the post-formation atmosphere (reducing or oxidizing), and reaction or postreaction temperature. A typical composition contains methylhydrazinium nitrate (MMHN), ammonium nitrate (AN), methylammonium nitrate (MAN), and trace amounts of hydrazinium nitrate and 1,1-dimethylhydrazinium nitrate. The thermal decomposition reactions of FORP compositions used in this study were unremarkable, Neither the various compositions of FORP, the pure major components of FORP, nor mixtures of FORP with propellant-system corrosion products showed any unusual thermal activity when decomposed under laboratory conditions. Off-limit thruster operations were simulated by rapid mixing of liquid MMH and liquid NTO in a confined space. The test hardware was constructed with pressure- and temperature-measurement devices to determine if the expected fuel oxidizer reaction would result in increased energy release when FORP, FORP constituents, or propellant-system corrosion products were present. These tests demonstrated that FORP, MMHN, AN, or Inconel corrosion products can induce a mixture of MMH and NTO to produce component-damaging energies. The simulation-test program was not extensive enough to provide statistical probabilities for these events but did show that such events can occur. Damaging events required FORP or metal salts to be present at the initial mixing of MMH and NTO. Based on the results of these studies, it is suggested that removal or mitigation of a buildup of these materials may decrease the incidence of these high-energy, potentially damaging events.

Source record↗

DOE OSTI2020

Application and Certification of Comparative Vacuum Monitoring Sensors for Structural Health Monitoring of 737 Wing Box Fittings

Multi-site fatigue damage, hidden cracks in hard-to-reach locations, disbonded joints, erosion, impact, and corrosion are among the major flaws encountered in today's extensive fleet of aging aircraft and space vehicles. The use of in-situ sensors for real-time health monitoring of aircraft structures are a viable option to overcome inspection impediments stemming from accessibility limitations, complex geometries, and the location and depth of hidden damage. Reliable, structural health monitoring systems can automatically process data, assess structural condition, and signal the need for human intervention. Prevention of unexpected flaw growth and structural failure can be improved if on-board health monitoring systems are used to continuously assess structural integrity. Such systems are able to detect incipient damage before catastrophic failures occurs. Condition-based maintenance practices could be substituted for the current time-based maintenance approach. Other advantages of on-board distributed sensor systems are that they can eliminate costly, and potentially damaging, disassembly, improve sensitivity by producing optimum placement of sensors and decrease maintenance costs by eliminating more time- consuming manual inspections. This report presents a Sandia Labs-aviation industry effort to move SHM into routine use for aircraft maintenance. This program addressed formal SHM technology validation and certification issues so that the full spectrum of concerns, including design, deployment, performance and certification were appropriately considered. The Airworthiness Assurance NDI Validation Center (AANC) at Sandia Labs, in conjunction with Boeing, Delta Air Lines, Structural Monitoring Systems Ltd., Anodyne Electronics Manufacturing Corp. and the Federal Aviation Administration (FAA) carried out a certification program to formally introduce Comparative Vacuum Monitoring (CVM) as a structural health monitoring solution to a specific aircraft wing box application. Validation tasks were designed to address the SHM equipment, the health monitoring task, the resolution required, the sensor interrogation procedures, the conditions under which the monitoring will occur, the potential inspector population, adoption of CVM into an airline maintenance program and the document revisions necessary to allow for routine use of CVM as an alternate means of performing periodic structural inspects. To carry out the validation process, knowledge of aircraft maintenance practices was coupled with an unbiased, independent evaluation. Sandia Labs designed, implemented, and analyzed the results from a focused and statistically-relevant experimental effort to quantify the reliability of the CVM system applied to the Boeing 737 Wing Box fitting application. All factors that affect SHM sensitivity were included in this program: flaw size, shape, orientation and location relative to the sensors, as well as operational and environmental variables. Statistical methods were applied to performance data to derive Probability of Detection (POD) values for CVM sensors in a manner that agrees with current nondestructive inspection (NDI) validation requirements and also is acceptable to both the aviation industry and regulatory bodies. This report presents the use of several different statistical methods, some of them adapted from NDI performance assessments and some proposed to address the unique nature of damage detection via SHM systems, and discusses how they can converge to produce a confident quantification of SHM performance An important element in developing SHM validation processes is a clear understanding of the regulatory measures needed to adopt SHM solutions along with the knowledge of the structural and maintenance characteristics that may impact the operational performance of an SHM system. This report describes the major elements of an SHM validation approach and differentiates the SHM elements from those found in NDI validation. The activities conducted in this program demonstrated the feasibility of routine SHM usage in general and CVM in particular for the application selected. They also helped establish an optimum OEM-airline-regulator process and determined how to safely adopt SHM solutions. This formal SHM validation will allow aircraft manufacturers and airlines to confidently make informed decisions about the proper utilization of CVM technology. It will also streamline the regulatory actions and formal certification measures needed to assure the safe application of SHM solutions.

42 ENGINEERING↗

DOE OSTI2023

AGR-5/6/7 Thermal Model with Non-uniform Gas Gaps

Fuel compact temperatures are a crucial factor in assessing the irradiation performance of tri-structural isotropic fuel particles. In the absence of direct measurement, fuel compact temperatures were calculated using a three-dimensional finite element thermal model, which is subject to simulation uncertainty. The most dominant factor in the uncertainty of calculated fuel temperatures is the gas gap uncertainty due to the nub-to-shell clearance caused by a design error of AGR-5/6/7 capsules. The thermal model was revised to examine the most probable graphite offset position for six different days during the irradiation for Capsules 1 and 2. The analysis varied the offset distance and azimuthal direction at both the top and bottom of the holder. The best-fit offset was estimated based on the minimum root mean square error of the residuals (measured minus calculated) for the operational thermocouples (TCs). From these results, the following conclusions were made: (1) The holder offsets led to slightly lower average temperatures but wider temperature variations (lower minimum and higher peak fuel temperatures) for both Capsule 1 and Capsule 2. (2) During earlier cycles (162A–164B), when numerous TCs were still operational, the best-fit offset distance varied over a specific range for both the top and bottom ([0.002–0.0035 in.] for Capsule 1 and [0.003-0.004 in] for Capsule 2). In contrast, the offset azimuthal direction varied widely, especially for the offset at the bottom of the Capsule 1 holder. This is because holder movement was somewhat constrained at the top of Capsule 1 by the TC leads running through the capsule head and into the holder and by the through tubes in Capsule 2, but the Capsule 1 bottom did not have this type of constraint. (3) During later cycles, when all TCs failed, applying the maximum possible offset of 0.006 in. to the northwest direction for both the top and bottom resulted in a calculated peak fuel temperature of 1557? in Capsule 1 (i.e., a 135? increase from 1422? with zero offset on September 20, 2019 (166A)); the maximum offset of 0.0068 in. to the south for both top and bottom resulted in a calculated peak fuel temperature of 1110°C in Capsule 2 on April 20, 2020 (i.e., a 116? increase from 994? with zero offset (168A)). High peak fuel temperatures in Capsule 1 during Cycle 166A could be the cause of massive particle failure near the end of this cycle. (4) Even though the highest temperature at the tip of Type-N TCs, such as TC-1-7, slightly exceeded 1000?, the temperature along the TC wire reached as high as 1335? assuming an offset of 0.006 in. in the northwest of Capsule 1 holder near the end of Cycle 166A. This temperature significantly exceeds the temperature threshold at which TC degradation is expected to occur, ultimately contributing to considerable particle failures in Capsule 1. For eight Type-N TCs in Capsule 2, the peak TC line temperature was much lower (i.e., 1029°C for TC-2-5), assuming maximum offset of 00068 in. to the south during cycle 168A.

advanced gas reactors↗

DOE OSTI2023

AGR-5/6/7 Thermal Model with Non-uniform Gas Gaps

Fuel compact temperatures are a crucial factor in assessing the irradiation performance of tri-structural isotropic fuel particles. In the absence of direct measurement, fuel compact temperatures were calculated using a three-dimensional finite element thermal model, which is subject to simulation uncertainty. The most dominant factor in the uncertainty of calculated fuel temperatures is the gas gap uncertainty due to the nub-to-shell clearance caused by a design error of AGR-5/6/7 capsules. The thermal model was revised to examine the most probable graphite offset position for six different days during the irradiation for Capsules 1 and 2. The analysis varied the offset distance and azimuthal direction at both the top and bottom of the holder. The best-fit offset was estimated based on the minimum root mean square error of the residuals (measured minus calculated) for the operational thermocouples (TCs). From these results, the following conclusions were made: (1) The holder offsets led to slightly lower average temperatures but wider temperature variations (lower minimum and higher peak fuel temperatures) for both Capsule 1 and Capsule 2. (2) During earlier cycles (162A–164B), when numerous TCs were still operational, the best-fit offset distance varied over a specific range for both the top and bottom ([0.002–0.0035 in.] for Capsule 1 and [0.003-0.004 in] for Capsule 2). In contrast, the offset azimuthal direction varied widely, especially for the offset at the bottom of the Capsule 1 holder. This is because holder movement was somewhat constrained at the top of Capsule 1 by the TC leads running through the capsule head and into the holder and by the through tubes in Capsule 2, but the Capsule 1 bottom did not have this type of constraint. (3) During later cycles, when all TCs failed, applying the maximum possible offset of 0.006 in. to the northwest direction for both the top and bottom resulted in a calculated peak fuel temperature of 1557? in Capsule 1 (i.e., a 135? increase from 1422? with zero offset on September 20, 2019 (166A)); the maximum offset of 0.0068 in. to the south for both top and bottom resulted in a calculated peak fuel temperature of 1110°C in Capsule 2 on April 20, 2020 (i.e., a 116? increase from 994? with zero offset (168A)). High peak fuel temperatures in Capsule 1 during Cycle 166A could be the cause of massive particle failure near the end of this cycle. (4) Even though the highest temperature at the tip of Type-N TCs, such as TC-1-7, slightly exceeded 1000?, the temperature along the TC wire reached as high as 1335? assuming an offset of 0.006 in. in the northwest of Capsule 1 holder near the end of Cycle 166A. This temperature significantly exceeds the temperature threshold at which TC degradation is expected to occur, ultimately contributing to considerable particle failures in Capsule 1. For eight Type-N TCs in Capsule 2, the peak TC line temperature was much lower (i.e., 1029°C for TC-2-5), assuming maximum offset of 00068 in. to the south during cycle 168A.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗

DOE OSTI2025

AGR-5/6/7 Thermal Model with Non-uniform Gas Gaps

Fuel compact temperatures are a crucial factor in assessing the irradiation performance of tri-structural isotropic fuel particles. In the absence of direct measurement, fuel compact temperatures were calculated using a three-dimensional finite element thermal model, which is subject to simulation uncertainty. The most dominant factor in the uncertainty of calculated fuel temperatures is the gas gap uncertainty due to the nub-to-shell clearance caused by a design error of AGR-5/6/7 capsules. The thermal model was revised to examine the most probable graphite offset position for six different days during the irradiation for Capsules 1 and 2. The analysis varied the offset distance and azimuthal direction at both the top and bottom of the holder. The best-fit offset was estimated based on the minimum root mean square error of the residuals (measured minus calculated) for the operational thermocouples (TCs). From these results, the following conclusions were made: (1) The holder offsets led to slightly lower average temperatures but wider temperature variations (lower minimum and higher peak fuel temperatures) for both Capsule 1 and Capsule 2. (2) During earlier cycles (162A–164B), when numerous TCs were still operational, the best-fit offset distance varied over a specific range for both the top and bottom ([0.002–0.0035 in.] for Capsule 1 and [0.003-0.004 in] for Capsule 2). In contrast, the offset azimuthal direction varied widely, especially for the offset at the bottom of the Capsule 1 holder. This is because holder movement was somewhat constrained at the top of Capsule 1 by the TC leads running through the capsule head and into the holder and by the through tubes in Capsule 2, but the Capsule 1 bottom did not have this type of constraint. (3) During later cycles, when all TCs failed, applying the maximum possible offset of 0.006 in. to the northwest direction for both the top and bottom resulted in a calculated peak fuel temperature of 1557? in Capsule 1 (i.e., a 135? increase from 1422? with zero offset on September 20, 2019 (166A)); the maximum offset of 0.0068 in. to the south for both top and bottom resulted in a calculated peak fuel temperature of 1110°C in Capsule 2 on April 20, 2020 (i.e., a 116? increase from 994? with zero offset (168A)). High peak fuel temperatures in Capsule 1 during Cycle 166A could be the cause of massive particle failure near the end of this cycle. (4) Even though the highest temperature at the tip of Type-N TCs, such as TC-1-7, slightly exceeded 1000?, the temperature along the TC wire reached as high as 1335? assuming an offset of 0.006 in. in the northwest of Capsule 1 holder near the end of Cycle 166A. This temperature significantly exceeds the temperature threshold at which TC degradation is expected to occur, ultimately contributing to considerable particle failures in Capsule 1. For eight Type-N TCs in Capsule 2, the peak TC line temperature was much lower (i.e., 1029°C for TC-2-5), assuming maximum offset of 00068 in. to the south during cycle 168A.

11 - NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗