SEARCH · Engineering Papers

Results for “software failure”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 181 records · Page 10

All sources NASA NTRS DOE OSTI

DOE OSTI2021

Quantitative Risk Analysis of High Safety Significant Safety-related Digital Instrumentation and Control Systems in Nuclear Power Plants using IRADIC Technology

This report documents the activities performed by Idaho National Laboratory (INL) during fiscal year (FY) 2021 for the U.S. Department of Energy (DOE) Light Water Reactor Sustainability (LWRS) Program, Risk Informed Systems Analysis (RISA) Pathway, digital instrumentation and control (DI&C) Risk Assessment project. In FY-2019, the RISA Pathway initiated a project to develop a risk assessment strategy for delivering a strong technical basis to support effective, licensable, and secure DI&C technologies for digital upgrades/designs. An integrated risk assessment technology for the DI&C systems (IRADIC technology) was proposed for this strategy, which aims to (1) provide a best-estimate risk-informed capability to quantitatively and accurately estimate the safety margin obtained from plant modernization, especially for the High Safety Significant Safety-related (HSSSR) DI&C systems, (2) develop an advanced risk assessment technology to support transition from analog to DI&C technologies for nuclear industry, (3) assure the long-term safety and reliability of vital HSSSR DI&C systems, (4) reduce uncertainty in costs and support integration of DI&C systems in the plant. To achieve these technical goals and deal with the expensive licensing justifications from regulatory insights, the IRADIC technology is instructive for nuclear vendors and utilities to effectively lower the costs associated with digital compliance and speed industry advances by: (1) defining an integrated risk-informed analysis process for DI&C upgrade, including hazard analysis, reliability analysis, and consequence analysis, (2) applying systematic and risk-informed tools to address common cause failures (CCFs) and quantify responding failure probabilities for DI&C technologies, particularly software CCFs, (3) evaluating the impact of digital failures at the individual level, system level, and plant level, (4) providing insights and suggestions on designs to manage the risks; thus, to support the development, licensing, and deployment of advanced DI&C technologies on nuclear power plant (NPPs). In this report, an approach for performing software CCF analysis, given limited data, is developed and demonstrated using a case study of a highly redundant digital reactor trip system. Consequence analysis is also performed based on different accident scenarios. Results indicate that plant modernization including the improvement of HSSSR DI&C systems will make great benefits to plant safety by providing more safety margins to accident management. In addition, a novel approach is proposed in this report for the quantification of software hazards when sufficient operational and testing data available. The method incorporates software development quality as well as strong analysis techniques to identify and link software defects to potential failure modes. The approach includes both semantic and test-based analysis to detect failures that can exist in different stages of the software development life cycle. This method is applied to an advanced human system interface relevant to reactor trip safety developed from the APR 1400 design.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

NASA NTRS1980

Software reliability: A comparison of results obtained from established software reliability models

Two models of the software error detection process are compared, the Jelinski-Moranda model and a Bayes inference model. Simulation techniques are used to generate software related system failure data which is analyzed by both models. Point estimates and confidence limits are compared. It is demonstrated that uncertainty may be considerable for reasonable samples sizes and should be considered in any application of these techniques. The Jelinski-Moranda model is sensitive to the failure of data to follow internal assumptions of the model, often not providing any point estimates, a factor which may limit its usefulness in many real world situations. The Bayes model is shown to respond to the introduction of additional errors in the software correction process, a condition where error counting models such as the Jelinski-Moranda generally fail to converge.

Horn, M. H.↗

NASA NTRS2004

Control System Architectures, Technologies and Concepts for Near Term and Future Human Exploration of Space

Technologies that facilitate the design and control of complex, hybrid, and resource-constrained systems are examined. This paper focuses on design methodologies, and system architectures, not on specific control methods that may be applied to life support subsystems. Honeywell and Boeing have estimated that 60-80Y0 of the effort in developing complex control systems is software development, and only 20-40% is control system development. It has also been shown that large software projects have failure rates of as high as 50-65%. Concepts discussed include the Unified Modeling Language (UML) and design patterns with the goal of creating a self-improving, self-documenting system design process. Successful architectures for control must not only facilitate hardware to software integration, but must also reconcile continuously changing software with much less frequently changing hardware. These architectures rely on software modules or components to facilitate change. Architecting such systems for change leverages the interfaces between these modules or components.

Boulanger, Richard↗

DOE OSTI2015

Digital Sensor Technology

The nuclear industry has been slow to incorporate digital sensor technology into nuclear plant designs due to concerns with digital qualification issues. However, the benefits of digital sensor technology for nuclear plant instrumentation are substantial in terms of accuracy and reliability. This paper, which refers to a final report issued in 2013, demonstrates these benefits in direct comparisons of digital and analog sensor applications. Improved accuracy results from the superior operating characteristics of digital sensors. These include improvements in sensor accuracy and drift and other related parameters which reduce total loop uncertainty and thereby increase safety and operating margins. An example instrument loop uncertainty calculation for a pressure sensor application is presented to illustrate these improvements. This is a side-by-side comparison of the instrument loop uncertainty for both an analog and a digital sensor in the same pressure measurement application. Similarly, improved sensor reliability is illustrated with a sample calculation for determining the probability of failure on demand, an industry standard reliability measure. This looks at equivalent analog and digital temperature sensors to draw the comparison. The results confirm substantial reliability improvement with the digital sensor, due in large part to ability to continuously monitor the health of a digital sensor such that problems can be immediately identified and corrected. This greatly reduces the likelihood of a latent failure condition of the sensor at the time of a design basis event. Notwithstanding the benefits of digital sensors, there are certain qualification issues that are inherent with digital technology and these are described in the report. One major qualification impediment for digital sensor implementation is software common cause failure (SCCF).

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗

NASA NTRS1991

A nonparametric software-reliability growth model

The authors (1985) previously introduced a nonparametric model for software-reliability growth which is based on complete monotonicity of the failure rate. The authors extend the completely monotone software model by developing a method for providing long-range predictions of reliability growth, based on the model. They derive upper and lower bounds on extrapolation of the failure rate and the mean function. These are then used to obtain estimates for the future software failure rate and the mean future number of failures. Preliminary evaluation indicates that the method is competitive with parametric approaches, while being more robust.

Sofer, Ariela↗

NASA NTRS1989

A real time microcomputer implementation of sensor failure detection for turbofan engines

An algorithm was developed which detects, isolates, and accommodates sensor failures using analytical redundancy. The performance of this algorithm was demonstrated on a full-scale F100 turbofan engine. The algorithm was implemented in real-time on a microprocessor-based controls computer which includes parallel processing and high order language programming. Parallel processing was used to achieve the required computational power for the real-time implementation. High order language programming was used in order to reduce the programming and maintenance costs of the algorithm implementation software. The sensor failure algorithm was combined with an existing multivariable control algorithm to give a complete control implementation with sensor analytical redundancy. The real-time microprocessor implementation of the algorithm which resulted in the successful completion of the algorithm engine demonstration, is described.

Delaat, John C.↗

NASA NTRS1990

A real time microcomputer implementation of sensor failure detection for turbofan engines

An algorithm was developed that detects, isolates, and accommodates sensor failures using analytical redundancy. The performance of this algorithm has been demonstrated on a full-scale F100 turbofan engine. The algorithm was implemented in real-time on a microprocessor-based controls computer which includes parallel processing and high order language programming. Parallel processing was used to achieve the required computational power for the real-time implementation. High order language programming was used in order to reduce the programming and maintenance costs of the algorithm implementation software. The sensor failure algorithm was combined with an existing multivariable control algorithm to give a complete control implementation with sensor analytical redundancy. The real-time microprocessor implementation of the algorithm, which resulted in the successful completion of the algorithm engine demonstration, is described.

Delaat, John C.↗

NASA NTRS1995

Probabilistic Fatigue And Flaw-Propagation Analysis

Probabilistic Failure Assessment for Fatigue and Flaw Propagation (PFAFAT II) package of software utilizing probabilistic failure-assessment (PFA) methodology to model flaw-propagation and low-cycle-fatigue modes of failure of structural components. Comprises one program for performing probabilistic crack-growth analysis and two programs for performing probabilistic low-cycle-fatigue analysis. These programs perform probabilistic fatigue and crack-propagation analysis by means of Monte Carlo simulation. PFAFAT II is extension of, rather than replacement for, PFAFAT software (NPO-18965). Written in FORTRAN 77.

Moore, Nicholas↗

DOE OSTI2017

SymPLe 1131: A novel architectural solution for the realization of verifiable digital I and C systems and embedded digital devices - 387

One of the main reasons for the increasing popularity of FPGAs in embedded systems and digital I and C systems is that they provide many of the advantages from both hardware and software components. FPGAs provide configurability approaching that of SW, while at the same time delivering deterministic behavior of pure hardware solutions. However, with regard to Software Common Cause Failures (CCF), the use of FPGAs in digital I and C platforms should not be seen as plug-in remedy for reduction or elimination of CCF. To address CCF, we argue that it is not enough to manage the complexity of an I and C device or system, but we must also have the ability to constrain complexity (as needed) and rigorously reason about execution and device functionality. This paper presents the work done regarding an FPGA overlay architecture called SymPLe. SymPLe is designed to reduce the gap between software and hardware approaches for digital I and C systems and increases deterministic behavior and verifiability of the application, architecture and safety-critical system while reasoning about CCF. (authors)

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗

NASA NTRS2022

Reliability-Aware Requirements Development for Autonomy Software

Autonomy is the ability of a system to make decisions and take actions in the presence of uncertainty. Validating autonomy, therefore, is a matter of validating that the system makes intelligent decisions even when there might be discrepancies between the observed and the expected state of the world as well as when the possible outcome of each of the possible courses of action is uncertain. During the requirements engineering phase, the functions, including those that are required to be autonomous and their expected behavior are specified. However, in the case of autonomous software system, it is challenging to specify all possible scenarios that the software may encounter. Additionally, since autonomous behaviors cannot always be fully predetermined, it is difficult to reason about their completeness and correctness. While these challenges are also faced with non-autonomous system, they are more prevalent for autonomous system due to their complexity and emergent behavior. Our efforts have been three-fold. On one hand, we have developed a goal-based method for requirements decomposition. We have embedded this approach into a higher-level systems engineering framework and then developed methods for decision and reliability analysis within this framework. And finally, we use simulation analysis to validate the more theoretical methods and provide a feedback mechanism. The decision analysis approach (DA) helps in identifying and mitigating the run-time risks, by bringing to the forefront the uncertainties, decisions, interactions, and other factors that may cause autonomous software to make erroneous decisions. The DA framework is used to quantify, for each decision that the software can make, failure risk due to uncertainties. The information about the key decisions and circumstances that can cause autonomous system to make incorrect decisions are used to generate test scenarios to be run in a simulator to ensure that the system can handle error-prone circumstances. The results or outcomes from decisions, based on the simulated scenarios, can then be leveraged to further gain insight of the assured system. We combine a goal-based approach with simulation analysis to facilitate requirements development for autonomous systems and further provide a method for run-time systems level reliability considerations during the autonomous software development process. The DA and the reliability analysis methods provide a formalism for the consideration of uncertainty in the run time decision-making process for autonomous software. This formalism considers the uncertainty involved in the outcome of different courses of action, in terms of performance and cost, as well as a method to consider the system level reliability implications. System level reliability considerations for autonomous software decision making contribute to the satisfaction of the system level goals over the lifecycle of a given mission. We demonstrate our approach using a hypothetical rover path planning example. The requirements for our rover simulator are based on existing literature about Mars rovers and lessons learned from real world observations at JPL. The specifics of the autonomy design for the Mars rovers, that have not been previously cleared for external release, are not used for our demonstrations.

Lindvall, Mikael↗

NASA NTRS1980

Orbiter subsystem hardware/software interaction analysis. Volume 8: AFT reaction control system, part 2

The orbiter subsystems and interfacing program elements which interact with the orbiter computer flight software are analyzed. The failure modes identified in the subsystem/element failure mode and effects analysis are examined. Potential interaction with the software is examined through an evaluation of the software requirements. The analysis is restricted to flight software requirements and excludes utility/checkout software. The results of the hardware/software interaction analysis for the forward reaction control system are presented.

Becker, D. D.↗

NASA NTRS2011

Health Monitor for Multitasking, Safety-Critical, Real-Time Software

Health Manager can detect Bad Health prior to a failure occurring by periodically monitoring the application software by looking for code corruption errors, and sanity-checking each critical data value prior to use. A processor s memory can fail and corrupt the software, or the software can accidentally write to the wrong address and overwrite the executing software. This innovation will continuously calculate a checksum of the software load to detect corrupted code. This will allow a system to detect a failure before it happens. This innovation monitors each software task (thread) so that if any task reports "bad health," or does not report to the Health Manager, the system is declared bad. The Health Manager reports overall system health to the outside world by outputting a square wave signal. If the square wave stops, this indicates that system health is bad or hung and cannot report. Either way, "bad health" can be detected, whether caused by an error, corrupted data, or a hung processor. A separate Health Monitor Task is started and run periodically in a loop that starts and stops pending on a semaphore. Each monitored task registers with the Health Manager, which maintains a count for the task. The registering task must indicate if it will run more or less often than the Health Manager. If the task runs more often than the Health Manager, the monitored task calls a health function that increments the count and verifies it did not go over max-count. When the periodic Health Manager runs, it verifies that the count did not go over the max-count and zeroes it. If the task runs less often than the Health Manager, the periodic Health Manager will increment the count. The monitored task zeroes the count, and both the Health Manager and monitored task verify that the count did not go over the max-count.

Zoerner, Roger↗

DOE OSTI2018

Detecting Anomalies from End-to-End Internet Performance Measurements (PingER) Using Cluster Based Local Outlier Factor

PingER (Ping End-to-End Reporting) is a worldwide end-to-end Internet performance measurement framework. It was developed by the SLAC National Accelerator Laboratory, Stanford, USA and running from the last 20 years. It has more than 700 monitoring agents and remote sites which monitor the performance of Internet links around 170 countries of the world. At present, the size of the compressed PingER data set is about 60 GB comprising of 100,000 flat files. The data is publicly available for valuable Internet performance analyses. However, the data sets suffer from missing values and anomalies due to congestion, bottleneck links, queuing overflow, network software misconfiguration, hardware failure, cable cuts, and social upheavals. Therefore, the objective of this paper is to detect such performance drops or spikes labeled as anomalies or outliers for the PingER data set. In the proposed approach, the raw text files of the data set are transformed into a PingER dimensional model. The missing values are imputed using the k-NN algorithm. The data is partitioned into similar instances using the k-means clustering algorithm. Afterward, clustering is integrated with the Local Outlier Factor (LOF) using the Cluster Based Local Outlier Factor (CBLOF) algorithm to detect the anomalies or outliers from the PingER data. Lastly, anomalies are further analyzed to identify the time frame and location of the hosts generating the major percentage of the anomalies in the PingER data set ranging from 1998 to 2016.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2014

Dakota uncertainty quantification methods applied to the NEK-5000 SAHEX model.

This report summarizes the results of a NEAMS project focused on the use of uncertainty and sensitivity analysis methods within the NEK-5000 and Dakota software framework for assessing failure probabilities as part of probabilistic risk assessment. NEK-5000 is a software tool under development at Argonne National Laboratory to perform computational fluid dynamics calculations for applications such as thermohydraulics of nuclear reactor cores. Dakota is a software tool developed at Sandia National Laboratories containing optimization, sensitivity analysis, and uncertainty quantification algorithms. The goal of this work is to demonstrate the use of uncertainty quantification methods in Dakota with NEK-5000.

Weirs, V. Gregory↗

DOE OSTI2019

Technical Specification Surveillance Interval Extension of Digital Equipment in Nuclear Power Plants: Review and Research. Light Water Reactor Sustainability Program report

The nuclear industry has been slow to incorporate digital technology into nuclear plant designs for several reasons, including: The high cost of design change modifications to implement them, versus simply replacing them with like for like technology when the components fail; Digital technology qualification issues, particularly in safety related applications that are susceptible to software common cause failure. This is a concern both for current operating plants as well as new builds; and, General familiarity and comfort with the existing analog technology on the part of the nuclear plant engineering staff, in spite of the superior performance and reduced maintenance costs of the digital replacements. At the same time, the nuclear industry is under significant cost pressure in the electric marketplace due to the abundance of natural gas generation and renewables. The industry would benefit by investment in new technologies that could lower future operating costs while addressing obsolescence and reliability issues of the current analog technologies. However, the industry has been unable to formulate the business cases to take advantage of these labor savings and production reliability improvements. This paper discusses another potential cost savings benefit of a transition to digital technology, extending the surveillance intervals of technical specification required equipment.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗

DOE OSTI2019

Achieving Verifiable and High Integrity Instrumentation and Control Systems through Complexity Awareness and Constrained Design. Final Report

While most process control industries have been able to embrace digital Instrumentation and Control (I&C) technology to improve performance, reliability, maintainability, and efficiency of production, the nuclear industry has been relatively slow to adopt digital I&C for safety critical plant functions. There are a variety of reasons for this, but in general the nuclear industry takes a conservative stance that new technologies must mature before adoption. A deeper underlying reason for not fully realizing digital I&C and automation in nuclear power is associated with the complexity that can manifest in software-based systems that is different in nature from the complexity of their analog predecessors. Accordingly, this research pursued the development of innovative architectures and methods to “constrain complexity” to enhance verifiability of digital I&C devices. These constraints can positively impact the reduction of Software Common Cause Failures (SCCF) and other systematic errors. The architectural concept developed in this research effort is called SymPLe. SymPLe is specifically aimed at safety critical functions within Nuclear Power Plants and other critical infrastructure where constraining device complexity to support verifiability and safety case arguments is important. The SymPLe architecture is designed to promote “accessible verification” between OEM/utility engineers and the regulatory agencies who review and license nuclear power plant I&C systems. The major contributions of this work to the nuclear industry are: Demonstration of SymPLe as a viable approach to “complexity aware” I&C systems and Embedded Digital Devices.Comprehensive use of model-based design and engineering to produce verifiable I&C systems for the nuclear industry with clear findings on the usability of model-based engineering. Employ comprehensive use of model-based engineering, testing, and verification in an IEC 61508 workflow in support of design assurance. Gathered evidence of “difficult to find” design flaws found using model-based design and testing methods. Detailed the nature of these SCCFs including where they were introduced, the triggers, and how they were found. Gathered evidence on the synergistic use of practical formal methods and testing and how these methods can be used to significantly increase assurance of reduction and avoidance of design flaws.

Testing↗

NASA NTRS1976

Redundant Strapdown Laser Gyro Navigation System

For the last several years, NASA has pursued the development of low-cost high-reliability inertial navigation systems that would satisfy a broad spectrum of future space and avionics missions. Two specific programs have culminated in the construction of a Redundant Strapdown Laser Gyro Navigation System. These two programs were for development of a space ultrareliable modular computer (SUMC) and a redundant laser gyro inertial measurement unit (IMU). The SUMC is a digital computer that employs state-of-the-art large-scale integrated circuits configured in a functional modular breakdown. The redundant laser gyro IMU is a six-pack strapdown sensor package in a dodecahedron configuration which uses six laser gyros to provide incremental angular positions and six accelerometers for linear velocity outputs. The sensor arrangement allows automatic accommodation of two failures; a third failure can be tolerated provided it can be determined. The navigation system also includes redundant power supplies, built-in test-equipment (BITE) circuits for failure detection, and software which provides for navigation, redundancy management, and automatic calibration and alignment.

Mcpherson, B. W.↗

NASA NTRS1982

Galileo spacecraft power distribution and autonomous fault recovery

There is a trend in current spacecraft design to achieve greater fault tolerance through the implemenation of on-board software dedicated to detecting and isolating failures. A combination of hardware and software is utilized in the Galileo power system for autonomous fault recovery. Galileo is a dual-spun spacecraft designed to carry a number of scientific instruments into a series of orbits around the planet Jupiter. In addition to its self-contained scientific payload, it will also carry a probe system which will be separated from the spacecraft some 150 days prior to Jupiter encounter. The Galileo spacecraft is scheduled to be launched in 1985. Attention is given to the power system, the fault protection requirements, and the power fault recovery implementation.

Detwiler, R. C.↗