SEARCH · Engineering Papers

Results for “software failure”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 1,261 records · Page 70

All sources NASA NTRS DOE OSTI

NASA NTRS2001

Code Sharing and Collaboration: Experiences From the Scientist's Expert Assistant Project and Their Relevance to the Virtual Observatory

In the Virtual Observatory (VO), software tools will perform the functions that have traditionally been performed by physical observatories and their instruments. These tools will not be adjuncts to VO functionality but will make up the very core of the VO. Consequently, the tradition of observatory and system independent tools serving a small user base is not valid for the VO. For the VO to succeed, we must improve software collaboration and code sharing between projects and groups. A significant goal of the Scientist's Expert Assistant (SEA) project has been promoting effective collaboration and code sharing among groups. During the past three years, the SEA project has been developing prototypes for new observation planning software tools and strategies. Initially funded by the Next Generation Space Telescope, parts of the SEA code have since been adopted by the Space Telescope Science Institute. SEA has also supplied code for the SIRTF (Space Infrared Telescope Facility) planning tools, and the JSky Open Source Java library. The potential benefits of sharing code are clear. The recipient gains functionality for considerably less cost. The provider gains additional developers working with their code. If enough users groups adopt a set of common code and tools, de facto standards can emerge (as demonstrated by the success of the FITS standard). Code sharing also raises a number of challenges related to the management of the code. In this talk, we will review our experiences with SEA--both successes and failures, and offer some lessons learned that might promote further successes in collaboration and re-use.

Korathkar, Anuradha↗

NASA NTRS1991

Isothermal thermogravimetric data acquisition analysis system

The description of an Isothermal Thermogravimetric Analysis (TGA) Data Acquisition System is presented. The system consists of software and hardware to perform a wide variety of TGA experiments. The software is written in ANSI C using Borland's Turbo C++. The hardware consists of a 486/25 MHz machine with a Capital Equipment Corp. IEEE488 interface card. The interface is to a Hewlett Packard 3497A data acquisition system using two analog input cards and a digital actuator card. The system provides for 16 TGA rigs with weight and temperature measurements from each rig. Data collection is conducted in three phases. Acquisition is done at a rapid rate during initial startup, at a slower rate during extended data collection periods, and finally at a fast rate during shutdown. Parameters controlling the rate and duration of each phase are user programmable. Furnace control (raising and lowering) is also programmable. Provision is made for automatic restart in the event of power failure or other abnormal terminations. Initial trial runs were conducted to show system stability.

Cooper, Kenneth, Jr.↗

DOE OSTI2014

Overview of New Tools to Perform Safety Analysis: BWR Station Black Out Test Case

Dynamic Probabilistic Risk Assessment (DPRA) methodologies couple system simulator codes (e.g., RELAP, MELCOR) with simulation controller codes (e.g., RAVEN, ADAPT). While system simulator codes accurately model system dynamics deterministically, simulation controller codes introduce both deterministic (e.g., system control logic, operating procedures) and stochastic (e.g., component failures, parameter uncertainties) elements into the simulation. Typically, a DPRA is performed by: 1) sampling values of a set of parameters from the uncertainty space of interest (using the simulation controller codes), and 2) simulating the system behavior for that specific set of parameter values (using the system simulator codes). For complex systems, one of the major challenges in using DPRA methodologies is to analyze the large amount of information (i.e., large number of scenarios ) generated, where clustering techniques are typically employed to allow users to better organize and interpret the data. In this paper, we focus on the analysis of a nuclear simulation dataset that is part of the Risk Informed Safety Margin Characterization (RISMC) Boiling Water Reactor (BWR) station blackout (SBO) case study. We apply a software tool that provides the domain experts with an interactive analysis and visualization environment for understanding the structures of such high-dimensional nuclear simulation datasets. Our tool encodes traditional and topology-based clustering techniques, where the latter partitions the data points into clusters based on their uniform gradient flow behavior. We demonstrate through our case study that both types of clustering techniques complement each other in bringing enhanced structural understanding of the data.

97 MATHEMATICS AND COMPUTING↗

NASA NTRS1997

The Design of Model-Based Training Programs

This paper proposes a model-based training program for the skills necessary to operate advance avionics systems that incorporate advanced autopilots and fight management systems. The training model is based on a formalism, the operational procedure model, that represents the mission model, the rules, and the functions of a modem avionics system. This formalism has been defined such that it can be understood and shared by pilots, the avionics software, and design engineers. Each element of the software is defined in terms of its intent (What?), the rationale (Why?), and the resulting behavior (How?). The Advanced Computer Tutoring project at Carnegie Mellon University has developed a type of model-based, computer aided instructional technology called cognitive tutors. They summarize numerous studies showing that training times to a specified level of competence can be achieved in one third the time of conventional class room instruction. We are developing a similar model-based training program for the skills necessary to operation the avionics. The model underlying the instructional program and that simulates the effects of pilots entries and the behavior of the avionics is based on the operational procedure model. Pilots are given a series of vertical flightpath management problems. Entries that result in violations, such as failure to make a crossing restriction or violating the speed limits, result in error messages with instruction. At any time, the flightcrew can request suggestions on the appropriate set of actions. A similar and successful training program for basic skills for the FMS on the Boeing 737-300 was developed and evaluated. The results strongly support the claim that the training methodology can be adapted to the cockpit.

Polson, Peter↗

NASA NTRS2014

Morpheus Vertical Test Bed Flight Testing

NASA's Morpheus Project has developed and tested a prototype planetary lander capable of vertical takeoff and landing, that is designed to serve as a testbed for advanced spacecraft technologies. The lander vehicle, propelled by a LOX/Methane engine and sized to carry a 500kg payload to the lunar surface, provides a platform for bringing technologies from the laboratory into an integrated flight system at relatively low cost. Morpheus onboard software is autonomous from ignition all the way through landing, and is designed to be capable of executing a variety of flight trajectories, with onboard fault checks and automatic contingency responses. The Morpheus 1.5A vehicle performed 26 integrated vehicle test flights including hot-fire tests, tethered tests, and two attempted freeflights between April 2011 and August 2012. The final flight of Morpheus 1.5A resulted in a loss of the vehicle. In September 2012, development began on the Morpheus 1.5B vehicle, which subsequently followed a similar test campaign culminating in free-flights at a simulated planetary landscape built at Kennedy Space Center's Shuttle Landing Facility. This paper describes the integrated test campaign, including successes and setbacks, and how the system design for handling faults and failures evolved over the course of the project.

Hart, Jeremy↗

DOE OSTI2017

Risk informed cyber security for nuclear power plants - 342

Nuclear power plants are increasingly adding digital components for plant operation, safety, and security. These digital components fill a gap with legacy equipment where replacement components no longer exist. They also benefit operation of the plant by increasing efficiency in power generation, monitoring of equipment and plant parameters, as well as aiding operator control. However, the addition of digital components and systems also adds cyber risks with previously unanalyzed failure modes and attack vectors are introduced with these new systems. These risks are difficult to identify, analyze, and mitigate due to the increasingly complex nature of the digital components and the integration of these components with additional plant processes and communication networks. The research presented in this paper develops a new method that addresses the cyber risk to inform appropriate levels of protection. EPRI and Sandia are working under a Cooperative Research and Development Agreement to develop an effective method of evaluating the cyber risk in production nuclear power facilities. The Cyber Hazards Analysis Risk Methodology (CHARM) focuses on ensuring adequate controls are in place for appropriate cyber protection of the plant from radiological release or generation risk. Existing plant hazards analyses (e.g., PRA, FTA) do not account for software deficiencies or adversarial intent. This method leverages existing plant analyses and MIT's Systems Theoretic Process Analysis (STPA) to create cyber informed fault trees. These new fault trees will provide the basis for comprehensive cyber risk analysis and help ensure potential gaps in cyber security controls are identified and corrected. (authors)

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

DOE OSTI2022

Methods for estimating X-ray machine output through measurement and simulation

We report ball grid arrays are increasingly being applied in the electronics industry and may require X-ray inspection to ensure the integrity and correct placement of solder pins. However, as the architecture of integrated circuits continues to narrow while simultaneously growing more complex, the risk of electronic failure due to radiation damage increases. While medical X-ray devices have been held to high standards and are repeatedly shown to be well characterized, devices used for electronic inspection are often lacking detailed characterization. This study presents unique methods to solve for important properties in X-ray inspection devices such as source to object distance and energy spectrum. This information can then be applied to Monte Carlo models to achieve better overall dose estimates to electronics, which will lead to superior manufactured products. Since X-ray devices can vary greatly in source characteristics, this work investigates spectral measurement and Monte Carlo representation of three X-ray devices. For a Philips SRO 33 100 medical diagnostic device, the spectral output followed expected trends given by the prediction software SpekCalc and Spektr. For the Dage XD7500NT, direct measurement showed a spectral artifact that through the use of Gafchromic films, was shown to be a contributing effect in the dose output. For the Rad Source RS1800, a high powered irradiation device, direct spectral measurement was not achieved. However, a Monte Carlo model using an assumed spectra was found to match ion chamber measurements to a high degree.

47 OTHER INSTRUMENTATION↗

NASA NTRSDate not supplied

Computational Study of Oxidative Etch Pitting in FiberForm and the Effect on Its Material Properties

Erosion of carbon due to oxidation does not occur uniformly but through the formation of localized etch pits because of active surface sites. These active sites are formed due to the presence of atomic defects on the carbon surface, and have much higher reactivity compared to average non-defective sites. Thus, these active sites are first to react during ablation, resulting in their removal. This causes all the neighboring atoms to be defective and increase their reactivity, thus leading to the localized carbon removal around these “active” sites. In this manner, these highly reactive defective sites serve as nucleation sites for the formation and growth of etch pits with potentially detrimental effects on the structural integrity. In order to understand the influence of these etch pits on the material properties of carbon fiber microstructures, we have developed a new capability within direct simulation Monte Carlo (DSMC) to capture the etch pit formation process. This capability is developed within the DSMC code SPARTA (Stochastic PArallel Rarefied-gas Time-accurate Analyzer) and can model the material removal in presence of active sites leading to the formation of etch pits. The focus of the current work will be to study the effect of etch pits on the material properties of FiberForm, a commonly used base material within many thermal protection system materials (TPS). The microstructure of virgin FiberForm obtained directly from X-ray microtomography experiments is used within SPARTA to obtain the ablated geometries with etch pits. These pitted microstructures are then imported within the Porous Microstructure Analysis (PuMA) software and various material properties such as elasticity, thermal conductivity, and permeability are computed. The variation of these properties as a result of the complex evolution of the surface topology due to etch pit formation is studied and analyzed. Furthermore, the effect of pitting is compared to the case of shrinking fibers, which has been the standard for modelling ablation of carbon structures; and significant differences are observed. Thus, such a physically realistic modeling of material removal through the formation of etch pits will be helpful in predicting the degradation of carbon-based TPS more accurately during oxidation; as well as other mechanisms such as spallation, which involves the removal of chunks of material into the flow due to etch pit growth. This will ultimately improve our understanding of the failure modes in these materials due to ablation.

Carbon Ablators↗

NASA NTRSDate not supplied

Computational Study of Oxidative Etch Pitting in FiberForm and the Effect on Its Material Properties

Carbon Ablators↗

DOE OSTI2014

Analysis of the Space Propulsion System Problem Using RAVEN

This paper presents the solution of the space propulsion problem using a PRA code currently under development at Idaho National Laboratory (INL). RAVEN (Reactor Analysis and Virtual control ENviroment) is a multi-purpose Probabilistic Risk Assessment (PRA) software framework that allows dispatching different functionalities. It is designed to derive and actuate the control logic required to simulate the plant control system and operator actions (guided procedures) and to perform both Monte- Carlo sampling of random distributed events and Event Tree based analysis. In order to facilitate the input/output handling, a Graphical User Interface (GUI) and a post-processing data-mining module are available. RAVEN allows also to interface with several numerical codes such as RELAP5 and RELAP-7 and ad-hoc system simulators. For the space propulsion system problem, an ad-hoc simulator has been developed and written in python language and then interfaced to RAVEN. Such simulator fully models both deterministic (e.g., system dynamics and interactions between system components) and stochastic behaviors (i.e., failures of components/systems such as distribution lines and thrusters). Stochastic analysis is performed using random sampling based methodologies (i.e., Monte-Carlo). Such analysis is accomplished to determine both the reliability of the space propulsion system and to propagate the uncertainties associated to a specific set of parameters. As also indicated in the scope of the benchmark problem, the results generated by the stochastic analysis are used to generate risk-informed insights such as conditions under witch different strategy can be followed.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2022

Towards Low-Overhead Resilience for Data Parallel Deep Learning

Data parallel techniques have been widely adopted both in academia and industry as a tool to enable scalable training of deep learning models. At scale, DL training jobs can fail due to software or hardware bugs, may need to be preempted or terminated due to unexpected events, or may perform suboptimally because they were misconfigured. Under such circumstances, there is a need to recover and/or reconfigure data-parallel DL training jobs on-the-fly, while minimizing the impact on the accuracy of the DNN model and the runtime overhead. In this regard, state-of-art techniques adopted by the HPC community mostly rely on checkpoint-restart, which inevitably leads to loss of progress, thus increasing the runtime overhead. In this paper we explore alternative techniques that exploit the properties of modern deep learning frameworks (overlapping of gradient averaging and weight updates with local gradient computations through pipeline parallelism) to reduce the overhead of resilience/elasticity. To this end we introduce a failure simulation framework and two resilience strategies (immediate mini-batch rollback and lossy forward recovery), which we study compared with checkpoint-restart approaches in a variety of settings in order to understand the trade-offs between the accuracy loss of the DNN model and the runtime overhead.

data-parallel training↗

DOE OSTI2019

Data Analytics for Electrical Distribution Systems with Micro PMUs (GMLC 1.4.9 Technical Report)

This report describes how electrical utilities with residential, industrial, commercial and government customers make decisions using Data Analytics (DA) applications and discusses how OpenFMB was leveraged to share that data among disparate types of devices for DA. OpenFMB is a data standard developed by utilities for distributed communication and control of power system assets. Here we explored how OpenFMB can be used for sharing analytics and what those analytics could be for a set of representative grid devices. A review of DA applications performed by electrical utilities and customers is presented. An overview of how the testbed we used was built and configured is summarized. Several experiments which were carried out to explore the capabilities of OpenFMB alongside other data sharing mechanisms for gathering sensor measurements and sharing analytics is also discussed. And finally a comparison of OpenFMB and LBNL’s SPARK framework is summarized. Today’s electrical utilities focus on monitoring the real-time customer consumptions, offering new real-time tariff models based on customer usage habits (rewards and punishments), providing energy peak during peak load times (plan energy generation and distribution), improving the load management for transformers and power lines, and controlling the energy and grid resources efficiently. On the other hand, the DA applications for residential customers are based on modifying the customer electricity usage habit to save money, making accurate and timely decisions for electrical billing. However, the DA applications for industrial, commercial and government customers focus on creating efficient programs to improve the environmental condition (reducing CO₂ emission), developing better load forecasting for industrial and/or commercial activities. In this project, a testbed was built to explore how the OpenFMB framework can be used to distribute data among various types of representative grid edge devices. Micro PMUs (Phasor Measurement Unit) were used to collect and transmit data to an OpenPDC server alongside relays with a framework configured with a system using OpenFMB to collect and transmit data. The testbed was composed of a physical asset based on a 60 Hz AC radial power system constructed using SI-GRID components. The power system consisted of a 3-phase 14 volts line-to-ground (24 volts line-to-line) power source, three 3-phase line emulators, a programmable resistive load bank, two smart relays, two micro PMUs, and a (SCADA) and Phasor Data Concentrator (PDC) computer. This testbed configuration allowed us to perform breaker operation tests collecting data from the micro PMUs and from the relays’ sensors. During the micro PMU breaker operation tests we collected the measured and estimated fundamental voltages, currents, frequency as well as the total true, reactive and apparent power. The displacement power factor from two micro PMUs located in parallel power lines was also used. The software steps for the implementation of the Synchrophasor system are explained in detail in this report. The setting (1-2-3) and data collection (4-5) phases were performed with a free download open source software. In the setting phase, the micro PMUs were set (1), the data stream for each micro PMU was validated, and the connection and configuration files were created (2). The PDC computer was set using the connection and configuration files of the micro PMUs (3). In the data collection phase, the binary data from the micro PMUs was collected (4), and the binary data files of the micro PMUs was converted to analyze the test results (5). OpenFMB was configured to use protocol translators to read Modbus and transform the reading into the OpenFMB data model to be read for DA applications.Our experiments showed that by leveraging the OpenFMB data model and the micro PMUs together we could obtain better situational awareness of network faults, which in some cases could lead to failures in the system and would be less perceivable otherwise. For example, in one experiment the fundamental RMS current angle, and the fundamental displacement power factor (estimated by the ratio between the measured real and apparent total power) had a disturbance at the micro PMU connected to the beginning of the parallel power line because the breaker was opened without the operators or SCADA system’s knowledge, and no current was available. Based on the breaker state scenarios and micro PMU locations, the DA applications using the current angle and displacement power factor from the micro PMUs should be studied in detail to avoid a non-desired measurement that could affect the decision from the DA. Also, the sample rates for PMU, Relay and micro PMU devices were compared. The DA application improved the control and operation between the electrical utilities and their customers (residential, industrial, transportation, commercial and government). The higher the sample rate, the better the quality of the measurement for DA estimations.

42 ENGINEERING↗

NASA NTRS2004

Planning Mars Memory: Learning from the Mer Mission

Knowledge management for space exploration is part of a multi-generational effort at recognizing, preserving and transmitting learning. Each mission should be built on the learning, of both successes and failures, derived from previous missions. Knowledge management begins with learning, and the recognition that this learning has produced knowledge. The Mars Exploration Rover mission provides us with an opportunity to track how learning occurs, how it is recorded, and whether the representations of this learning will be optimally useful for subsequent missions. This paper focuses on the MER science and engineering teams during Rover operations. A NASA team conducted an observational study of the ongoing work and learning of the these teams. Learning occurred in a wide variety of areas: how to run two teams on Mars time for three months; how to use the instruments within the constraints of the martian environment, the deep space network and the mission requirements; how to plan science strategy; how best to use the available software tools. This learning is preserved in many ways. Primarily it resides in peoples memories, to be carried on to the next mission. It is also encoded in stones, in programming sequences, in published reports, and in lessons learned activities, Studying learning and knowledge development as it happens allows us to suggest proactive ways of capturing and using it across multiple missions and generations.

Linde, Charlotte↗

NASA NTRSDate not supplied

Micrometeoroid and Orbital Debris (MMOD) Testing, Ballistic Limit Equation Definition and Risk Assessment of the Exploration Extravehicular Mobility Unit (xEMU)

A well-known hazard associated with exposure to the space environment is the risk of failure due to an impact from a micrometeoroid and orbital debris (MMOD) particle. As NASA prepares to return astronauts to the moon with the Artemis program, the next generation of spacesuit is in development to support future extravehicular activities (EVAs.) An MMOD impact to the spacesuit is of great concern as a large leak could prevent an astronaut from safely reaching an airlock in time resulting in a loss of life. The exploration extravehicular mobility unit (xEMU) must meet MMOD requirements for multiple environments including those in low earth orbit (LEO) as well as the meteoroid and secondary lunar regolith ejecta environments found on the lunar surface. The subject of this paper is an internal xEMU configuration design developed by NASA Johnson Space Center (JSC) personnel. This paper will expand on the hypervelocity impact (HVI) testing and ballistic limit equation (BLE) definition work that was partially presented at the 2nd International Orbital De-bris (IOC-II) Conference held in Sugar Land, TX in December 2023. The xEMU shares similarities with the legacy Extravehicular Mobility Unit (EMU) spacesuit that is currently used for ISS EVAs, however differences in the layup (e.g., materials, thicknesses, and layers) of the fabric environmental protection garment (EPG), portable life support system (xPLSS) and helmet required an extensive test program to determine ballistic performance. Over 100 hypervelocity impact (HVI) tests were performed by the NASA/JSC HVIT and White Sands Test Facility (WSTF) teams on the xEMU EPG, xPLSS and helmet to generate ballistic limit equations (BLEs) for MMOD impacts. Additionally, over 50 low speed tests (< 1km/s) were performed by the NASA/JSC HVIT and Southwest Research Institute (SwRI) teams on the xEMU EPG, xPLSS and helmet to generate BLEs for lunar ejecta impacts. Post testing, ballistic limit equations used to define the performance of the various regions on the xEMU spacesuit were developed from a generic set of BLEs. The HVI and low speed testing was performed to establish a physical basis for the equations with the co-efficients and exponents of the generic BLEs adjusted to fit the test data. The xEMU BLEs were added to the NASA/JSC software application used for space-craft MMOD risk assessments (BUMPER-3). A finite element model (FEM) of the xEMU spacesuit, which defines the size and shape of the spacesuit as well as the locations of the various shielding configurations, was created based on a solid model provided by the xEMU program office. Using the FEM file and added xEMU BLEs, BUMPER-3 assessments of the xEMU spacesuit for probability of no penetration (PNP) were performed. For the LEO assessment of a typical ISS EVA, the orbital debris and meteoroids environments were defined using the latest engineering models, ORDEM 3.2 and MEM-3 respectively. The lunar sur-face assessment again used the MEM-3 engineering model to define the meteoroid environ-ment along with the current released lunar surface ejecta model, NASA SP-8013 (developed during the Apollo Program). The Space Team in the Natural Environments Branch at Mar-shall Space Flight Center (MSFC) will soon release the new Lunar Meteoroid Ejecta Engineering Model (LMEEM), at which time the xEMU lunar surface EVA will be reassessed. Assessment of the MMOD risk for an 8-hour, 2-person EVA in both LEO and on the lunar surface showed that the xEMU spacesuit meets the program technical requirement of 1 in 2500 failure odds. Similar to the legacy EMU spacesuit, the majority of the MMOD risk (96% of the LEO EVA risk and 99% of the lunar surface EVA risk) is concentrated in regions of xEMU that are comprised primarily of softgoods (arms, legs, and gloves) rather than the hardgoods (xPLSS, hard upper torso and helmet).

Micrometeoroid↗

NASA NTRS1988

Space station electrical power system availability study

ARINC Research Corporation performed a preliminary reliability, and maintainability (RAM) anlaysis of the NASA space station Electric Power Station (EPS). The analysis was performed using the ARINC Research developed UNIRAM RAM assessment methodology and software program. The analysis was performed in two phases: EPS modeling and EPS RAM assessment. The EPS was modeled in four parts: the insolar power generation system, the eclipse power generation system, the power management and distribution system (both ring and radial power distribution control unit (PDCU) architectures), and the power distribution to the inner keel PDCUs. The EPS RAM assessment was conducted in five steps: the use of UNIRAM to perform baseline EPS model analyses and to determine the orbital replacement unit (ORU) criticalities; the determination of EPS sensitivity to on-orbit spared of ORUs and the provision of an indication of which ORUs may need to be spared on-orbit; the determination of EPS sensitivity to changes in ORU reliability; the determination of the expected annual number of ORU failures; and the integration of the power generator system model results with the distribution system model results to assess the full EPS. Conclusions were drawn and recommendations were made.

Turnquist, Scott R.↗

NASA NTRS2005

Chapter 12 - Flight Envelope

The term "flight envelope" is used to refer to the boundaries of aircraft loading and flight conditions within which operation of the aircraft is satisfactory, and beyond which some aspect becomes unacceptable. This flight envelope represents, in fact, the limiting conditions arising from a matrix of inter-related flight envelopes covering the appropriate variables. Thus, for each loading (i.e., external stores configuration and its associated range of weight and center of gravity (c.g.) position) and aircraft configuration (i.e., position of undercarriage (u/c), flaps, slats, etc.), the envelopes of airspeed versus altitude, airspeed versus load factor, angle of attack versus angle of sideslip, etc., must be investigated to establish the limits within which all aspects such as handling qualities, engine behavior, structural loads, etc., remain acceptable. Flight testing of new or derivative aircraft models is carried out with the initial purpose of defining a flight envelope which is, first and foremost, safe and secondarily, which enables the effective use of the vehicle for its intended purpose. Flight testing occurs only after numerous reviews of the design and review of results from ground tests and predictions of flight characteristics in such areas as structures, aerodynamics, stability and control, flight controls (particularly fly-by-wire control systems, propulsion, etc.). Accordingly, opening and expanding the envelope is a task that must be approached cautiously, systematically, and with coordination and cooperation of the many disciplines involved in the design and test of an airplane. (Sections 8 and 10 cover test planning and safety of flight considerations, respectively). The fundamental tenet in establishing a flight envelope via flight test is risk reduction. This is reflected in the typical sequence of events leading to initial flight test - design reviews (both hardware and software), then ground test involving singular disciplines (windtunnel tests for aerodynamics, structurally loading the wing/fuselage/nacelle on a ground test article with loads anticipated to occur in flight, flight control system control law checkout, propulsion test cell runs and/or flying test bed tests, etc.), and then ground tests involving multi-disciplines (See Section 9). Only after these have been accomplished will an initial, limited, low-risk, flight envelope be established. The limited envelope will typically be in the middle of the projected final flight envelope. Subsequent flight tests will then be devoted to expanding the initial envelope by operating the airplane at increasing ranges - representing increasing risk - of engine operation, airspeeds both fast and slow, altitude, load factor both above and below 1g, centers of gravity (fore and aft), and with system/subsystem failures. Whether flight tests are to define a flight envelope on a new model airplane with the attendant new airframe, new engine(s), and new subsystems (hydraulics, pressurization, etc.), or on an airplane involving only a few of these areas such as new engines in an old airframe, the fundamental approach to establishing an envelope is the same.

H Walgemoed↗

DOE OSTI2016

HyRAM (Hydrogen Risk Assessment Models) v. 1.0

HyRAM is a software toolkit for conducting quantitative risk assessment (QRA) and consequence modeling for hydrogen infrastructure and transportation systems. HyRAM contains validated, simplified hydrogen behavior models, a standardized QRA approach, and engineering models and generic data relevant to hydrogen installations. HyRAM 1.0 was developed by Sandia National Laboratories for the U. S. Department of Energy to increase access to technical data about hydrogen and to enable the use of that data to support development and revision of national and international codes and standards with risk assessment and consequence modeling. The HyRAM toolkit integrates analytical and probabilistic models for quantifying accident scenarios, predicting physical effects, and characterizing the impact of hydrogen hazards (including thermal effects from jet fires and overpressure effects from deflagrations in confined areas) on people and structures. HyRAM incorporates generic probabilities for equipment failures for nine types of components, and probabilistic models for the impact of heat flux on humans and structures, with computationally and experimentally validated analytical first order models of hydrogen release and flame physics. Version 1 can be used to quantify the risk and consequences associated with gaseous hydrogen releases from user-defined hydrogen installations.

Groth, Katrina M.↗

NASA NTRS1990

VIPER project

The VIPER project has so far produced a formal specification of a 32 bit RISC microprocessor, an implementation of that chip in radiation-hard SOS technology, a partial proof of correctness of the implementation which is still being extended, and a large body of supporting software. The time has now come to consider what has been achieved and what directions should be pursued in the future. The most obvious lesson from the VIPER project was the time and effort needed to use formal methods properly. Most of the problems arose in the interfaces between different formalisms, e.g., between the (informal) English description and the HOL spec, between the block-level spec in HOL and the equivalent in ELLA needed by the low-level CAD tools. These interfaces need to be made rigorous or (better) eliminated. VIPER 1A (the latest chip) is designed to operate in pairs, to give protection against breakdowns in service as well as design faults. We have come to regard redundancy and formal design methods as complementary, the one to guard against normal component failures and the other to provide insurance against the risk of the common-cause failures which bedevil reliability predictions. Any future VIPER chips will certainly need improved performance to keep up with increasingly demanding applications. We have a prototype design (not yet specified formally) which includes 32 and 64 bit multiply, instruction pre-fetch, more efficient interface timing, and a new instruction to allow a quick response to peripheral requests. Work is under way to specify this device in MIRANDA, and then to refine the spec into a block-level design by top-down transformations. When the refinement is complete, a relatively simple proof checker should be able to demonstrate its correctness. This paper is presented in viewgraph form.

Kershaw, John↗