SEARCH · Engineering Papers

Results for “Software and System Safety”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 199 records · Page 11

All sources NASA NTRS DOE OSTI

DOE OSTI2023

Risk Analysis of Various Design Architectures for High Safety-significant Safety-related Digital Instrumentation and Control Systems of Nuclear Power Plants during Accident Scenarios

This report documents the plus-up activities performed by Idaho National Laboratory (INL) during Fiscal Year (FY) 2022 for the U.S. Department of Energy (DOE) Light Water Reactor Sustainability (LWRS) Program, Risk Informed Systems Analysis (RISA) Pathway, digital instrumentation and control (DI&C) risk assessment project. In FY 2019, the RISA Pathway initiated a project to develop a risk assessment strategy for delivering a strong technical basis to support effective, licensable, and secure DI&C technologies for digital upgrades/designs. An integrated risk assessment technology for the DI&C systems was proposed for this strategy, which aims to (1) provide a best-estimate, risk-informed capability to quantitatively and accurately estimate the safety margin obtained from plant modernization, especially for the high safety-significant safety-related (HSSSR) DI&C systems, (2) support and supplement existing advanced risk-informed DI&C design guides by providing quantitative risk information and evidence, (3) offer a capability of design architecture evaluation of various DI&C systems to support system design decisions and diversity and redundancy applications, (4) assure the long-term safety and reliability of HSSSR DI&C systems, and (5) reduce uncertainty in costs and support integration of DI&C systems in the plant. To achieve these technical goals and deal with the expensive licensing justifications from regulatory insights, the LWRS-developed framework instructs nuclear vendors and utilities on how to effectively lower the costs associated with digital compliance and speed industry advances by: (1) defining an integrated risk-informed analysis process for DI&C upgrade, including hazard analysis, reliability analysis, and consequence analysis, (2) applying systematic and risk-informed tools to address common cause failures (CCFs) and quantify corresponding failure probabilities for DI&C technologies, particularly software CCFs, (3) evaluating the impact of digital failures at the component level, system level, and plant level, and (4) providing insights and suggestions on designs to manage the risks, thus to support the development, licensing, and deployment of advanced DI&C technologies on nuclear power plant (NPPs). Adding diversity within system or components is the main means to eliminate and mitigate CCFs, but diversity also increases plant complexity and errors and may not address all sources of systematic failures. How to optimize the diversity and redundancy applications for the safety-critical DI&C systems remains a challenge. To deal with the technical issues in addressing potential software CCFs in HSSSR DI&C systems of NPPs and supporting relevant design optimization, the framework provides: ? An integrated best-estimate, risk-informed capability to address new technical digital issues quantitatively, accurately, and efficiently in plan modernization progress, such as software CCFs in HSSSR DI&C systems of NPPs ? A common and a modularized platform for DI&C designers, software developers, cybersecurity analysts, and plant engineers to efficiently predict and prevent risk in the early design stage of DI&C systems ? Technical bases and risk-informed insights to assist U.S. Nuclear Regulatory Commission (NRC) and industry to address and fulfill the risk-informed alternatives for evaluation of CCFs in HSSSR DI&C systems of NPPs ? An integrated risk-informed tool that offers a capability of design architecture evaluation of various DI&C systems to support system design decisions in diversity and redundancy applications. The plus-up research and development efforts of this project in FY 2022 are focused on methodology improvement of software CCF modeling and estimation, prevention analysis, importance analysis and risk analysis of various design architectures of HSSSR DI&C systems. This work greatly enhances the capability of the LWRS-developed framework for the risk assessment and design optimization of safety-critical DI&C systems. It should be noted that all the analyses are performed for the demonstration of the LWRS-developed framework, not for the evaluation of relevant systems. Results are obtained based on very limited design information and testing data.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

NASA NTRS1993

Applying Formal Methods and Object-Oriented Design to Existing Flight Software

This paper describes a project appling formal methods to a portion of the shuttle on-orbit digital autopilot (DAP). Three objectives of the project were to: demonstrate the use of formal methods on a shuttle application, facilitate the incorporation and validation of new requirements for the system, and verify the safety-critical properties to be exhibited by the software.

Software Failures↗

DOE OSTI2021

SAM Theory Manual

The System Analysis Module (SAM) is an advanced and modern system analysis tool under development at Argonne National Laboratory for advanced non-LWR reactor safety analysis. It aims to provide fast-running, modest-fidelity, whole-plant transient analyses capabilities, which are essential for fast turnaround design scoping and engineering analyses of advanced reactor concepts. While SAM is being developed as a system-level modeling and simulation tool, advanced modeling techniques being implemented include a reduced-order three-dimensional module, pseudo 3-D conjugate heat transfer modeling in reactor core, flexible and multi-scale modeling of heat transfer between fluid and structures, in addition to the advances in software environments and design, and numerical methods. SAM aims to be a generic system-level safety analysis tool for advanced non-LWRs, including Liquid-Metal-cooled fast Reactors (LMR), Molten Salt Reactors (MSR), Fluoride-salt-cooled High- temperature Reactors (FHR), and High-Temperature Gas-cooled Reactors (HTGR). SAM takes ad- vantage of advances in physical modeling, numerical methods, and software engineering to enhance its user experience and usability. It utilizes an object-oriented computational framework (MOOSE), and its underlying meshing and finite-element library and linear and non-linear solvers, to leverage the modern advanced software environments and numerical methods. This document provides the theoretical and technical basis of the code to help users understand the underlying physical models (such as governing equations, closure models, and component models), system modeling approaches, numerical discretization and solution methods, and the overall capabilities in SAM. As new code capabilities and features are added, the SAM Theory Manual will be updated periodically to keep it consistent with the state of the development.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

DOE OSTI2025

SAM Theory Manual

The System Analysis Module (SAM) is an advanced and modern system analysis tool under development at Argonne National Laboratory for advanced non-LWR reactor safety analysis. It aims to provide fast-running, modest-fidelity, whole-plant transient analyses capabilities, which are essential for fast turnaround design scoping and engineering analyses of advanced reactor concepts. While SAM is being developed as a system-level modeling and simulation tool, advanced modeling techniques being implemented include a reduced-order three-dimensional module, pseudo 3-D conjugate heat transfer modeling in reactor core, flexible and multi-scale modeling of heat transfer between fluid and structures, in addition to the advances in software environments and design, and numerical methods. SAM aims to be a generic system-level safety analysis tool for advanced non-LWRs, including Liquid-Metal-cooled fast Reactors (LMR), Molten Salt Reactors (MSR), Fluoride-salt-cooled High-temperature Reactors (FHR), and High-Temperature Gas-cooled Reactors (HTGR). SAM takes advantage of advances in physical modeling, numerical methods, and software engineering to enhance its user experience and usability. It utilizes an object-oriented computational framework (MOOSE), and its underlying meshing and finite-element library and linear and non-linear solvers, to leverage the modern advanced software environments and numerical methods. This document provides the theoretical and technical basis of the code to help users understand the underlying physical models (such as governing equations, closure models, and component models), system modeling approaches, numerical discretization and solution methods, and the overall capabilities in SAM. As new code capabilities and features are added, the SAM Theory Manual will be updated periodically to keep it consistent with the state of the development.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

NASA NTRS2013

Evidence Arguments for Using Formal Methods in Software Certification

We describe a generic approach for automatically integrating the output generated from a formal method/tool into a software safety assurance case, as an evidence argument, by (a) encoding the underlying reasoning as a safety case pattern, and (b) instantiating it using the data produced from the method/tool. We believe this approach not only improves the trustworthiness of the evidence generated from a formal method/tool, by explicitly presenting the reasoning and mechanisms underlying its genesis, but also provides a way to gauge the suitability of the evidence in the context of the wider assurance case. We illustrate our work by application to a real example-an unmanned aircraft system- where we invoke a formal code analysis tool from its autopilot software safety case, automatically transform the verification output into an evidence argument, and then integrate it into the former.

Argumentation↗

DOE OSTI2024

Evaluating Methods of Software Bill of Materials Generation to Enhance Nuclear Power Plant Cybersecurity

Instrumentation and control (I&C) systems in nuclear power plants (NPPs) are potential targets of cyberattacks and can prove deleterious for the safety of the NPPs. A Software Bill of Materials (SBOM) provides a detailed list of the various components and their dependencies in software, which helps in vulnerability and risk assessment for cyber hygiene and situational awareness. For an NPP, the process of generating an accurate SBOM report can be complex due to the legacy systems and firmware binaries involved. While most current SBOM tools are focused more on modern internet technology software, this research provides insights and guidelines for an NPP to generate an accurate and efficient SBOM. Here, the paper proposes a new methodology to help NPPs categorize software and use appropriate tools to generate SBOMs for their digital I&C systems.

SBOM↗

DOE OSTI2026

MARVEL Instrumentation, Control, and Software Considerations

This paper details the various I&C considerations and design decisions made throughout the MARVEL (Micro-reactor Applications Research Validation and Evaluation) project, including sensor and actuator selection, safety-related functionality, digital control hardware and software, and testing methodologies. Key challenges such as managing radiation, temperature, and space constraints are discussed, along with the trade-offs between using standard equipment and custom solutions. The successful integration of off-the-shelf components, the emphasis on minimizing safety-related instrumentation, and the lessons learned from prototyping and testing are highlighted. The authors aim to provide insights that can benefit future micro-reactor designs and emphasize the importance of real-world testing in advancing reactor technology.

46 - INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AN↗

NASA NTRS1999

Streamlining Software Aspects of Certification: Report on the SSAC Survey

The aviation system now depends on information technology more than ever before to ensure safety and efficiency. To address concerns about the efficacy of software aspects of the certification process, the Federal Aviation Administration (FAA) began the Streamlining Software Aspects of Certification (SSAC) program. The SSAC technical team was commissioned to gather data, analyze results, and propose recommendations to maximize efficiency and minimize cost and delay, without compromising safety. The technical team conducted two public workshops to identify and prioritize software approval issues, and conducted a survey to validate the most urgent of those issues. The SSAC survey, containing over two hundred questions about the FAA's software approval process, reached over four hundred industry software developers, aircraft manufacturers, and FAA designated engineering representatives. Three hundred people responded. This report presents the SSAC program rationale, survey process, preliminary findings, and recommendations.

Hayhurst, Kelly J.↗

DOE OSTI2021

SAM Co-Development to Support Fluoride-salt-cooled High-temperature Reactor Design and Licensing (CRADA 2018-18177 Final Report)

This project aims to raise the SAM code's technical and commercial maturity level to enable the Kairos Power ("Kairos") to use SAM to support its KP-FHR design analysis and licensing application. Argonne National Laboratory ("Argonne") has actively developed and maintained SAM, a modern system-level analysis tool for advanced nonlight water reactors safety analysis. Kairos is currently actively pursuing development of an FHR design and associated technology, and consequently requires a pedigreed safety analysis tool. The purpose of this project is to increase the maturity of the SAM code for the modeling and simulation of the KP-FHR design, thus enabling its use in safety analyses that support licensing application. Argonne will primarily be responsible for software design, development, and testing; while Kairos will be responsible for software requirements, assessment of software capabilities, needs, gaps, and priorities, and development of proprietary models. The research and development activities for the joint SAM development project include: a series of identification and prioritization studies on design characteristics, event sequences, relevant phenomena, and software capabilities; SAM capability enhancements for specific KP-FHR systems and components; performing code verification and validations; integrating uncertainty quantification (UQ), model calibration, and sensitivity analysis (SA) techniques in safety analyses; and raising the software quality rigor level for commercial-grade applications.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

NASA NTRS2012

Statechart Analysis with Symbolic PathFinder

We report here on our on-going work that addresses the automated analysis and test case generation for software systems modeled using multiple Statechart formalisms. The work is motivated by large programs such as NASA Exploration, that involve multiple systems that interact via safety-critical protocols and are designed with different Statechart variants. To verify these safety-critical systems, we have developed Polyglot, a framework for modeling and analysis of model-based software written using different Statechart formalisms. Polyglot uses a common intermediate representation with customizable Statechart semantics and leverages the analysis and test generation capabilities of the Symbolic PathFinder tool. Polyglot is used as follows: First, the structure of the Statechart model (expressed in Matlab Stateflow or Rational Rhapsody) is translated into a common intermediate representation (IR). The IR is then translated into Java code that represents the structure of the model. The semantics are provided as "pluggable" modules.

Pasareanu, Corina S.↗

NASA NTRS2008

Integrated Software Systems for Crew Management During Extravehicular Activity in Planetary Terrain Exploration

Initial planetary explorations with the Apollo program had a veritable ground support army monitoring the safety and health of the 12 astronauts who performed lunar surface extravehicular activities (EVAs). Given the distances involved, this will not be possible on Mars. A spacesuit for Mars must be smart enough to replace that army. The next generation suits can do so using 2 software systems serving as virtual companions, LEGACI (Life support, Exploration Guidance Algorithm and Consumable Interrogator) and VIOLET (Voice Initiated Operator for Life support and Exploration Tracking). The system presented in this study integrates data inputs from a suite of sensors into the MIII suit s communications, avionics and informatics hardware for distribution to remote managers and data analysis. If successful, the system has application not only for Mars but for nearer term missions to the Moon, and the next generation suits used on ISS as well. Field tests are conducted to assess capabilities for next generation spacesuits at Johnson Space Center (JSC) as well as the Mars and Lunar analog (Devon Island, Canada). LEGACI integrates data inputs from a suite of noninvasive biosensors in the suit and the astronaut (heart rate, suit inlet/outlet lcg temperature and flowrate, suit outlet gas and dewpoint temperature, pCO2, suit O2 pressure, state vector (accelerometry) and others). In the Integrated Walkback Suit Tests held at NASA-JSC and the HMP tests at Devon Island, communication and informatics capabilities were tested (including routing by satellite from the suit at Devon Island to JSC in Houston via secure servers at VCU in Richmond, VA). Results. The input from all the sensors enable LEGACI to compute multiple independent assessments of metabolic rate, from which a "best" met rate is chosen based on statistical methods. This rate can compute detailed information about the suit, crew and EVA performance using test-derived algorithms. VIOLET gives LEGACI voice activation capability, allowing the crew to query the suit, and receive feedback and alerts that will lead to corrective action. LEGACI and VIOLET can also automatically control the astronaut's cooling and consumable use rate without crew input if desired. These findings suggest that non-invasive physiological and environmental sensors supported with data analysis can allow for more effective management of mission task performance during EVA. Integrated remote and local view of data metrics allow crewmember to receive real time feedback in synch with mission control in preventing performance shortcomings for EVA in exploration missions.

Kuznetz, Lawrence↗

NASA NTRS2019

Software and System Health Management with R2U2

R2U2 (Realizable, Responsive, Unobtrusive Unit) is a hardware-supported tool and framework for the real-time system and software health management of cyber-physical systems. R2U2 continuously monitors properties about safety, performance, and security of the vehicle and can perform diagnostic reasoning. Efficient observers for past-time and future-time Metric Temporal Logic, reasoners for Bayesian Networks, and model-based prognostics algorithms are major components of R2U2. Their combination makes it possible to design powerful models for system runtime monitoring, diagnostics, software health management, prognostics, and security monitoring. The R2U2 monitoring engine is designed for minimal runtime overhead and is available as Simulink block or as a software component for integration into the flight software stack, and enables R2U2 to monitor complex cyber-physical systems without any instrumentation of the flight software. In this presentation, we give an overview of R2U2 architecture and reasoning algorithms, present its features, and give a life demo of the tool.

Schumann, Johann↗

DOE OSTI2022

An ontology-based fault generation and fault propagation analysis approach for safety-critical computer systems at the design stage

Abstract Fault propagation analysis is a process used to determine the consequences of faults residing in a computer system. A typical computer system consists of diverse components (e.g., electronic and software components), thus, the faults contained in these components tend to possess diverse characteristics. How to describe and model such diverse faults, and further determine fault propagation through different components are challenging problems to be addressed in the fault propagation analysis. This paper proposes an ontology-based approach, which is an integrated method allowing for the generation, injection, and propagation through inference of diverse faults at an early stage of the design of a computer system. The results generated by the proposed framework can verify system robustness and identify safety and reliability risks with limited design level information. In this paper, we propose an ontological framework and its application to analyze an example safety-critical computer system. The analysis result shows that the proposed framework is capable of inferring fault propagation paths through software and hardware components and is effective in predicting the impact of faults.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2021

Considerations regarding the Use of Computer Vision Machine Learning in Safety-Related or Risk-Significant Applications in Nuclear Power Plants

With the advancements made to date in the field of artificial intelligence (AI), significant potential exists to utilize AI capabilities for nuclear power plant (NPP) applications. AI can replicate human decision making and it is usually faster and more accurate than humans. For implementations that impact critical NPP applications (e.g., safety-related or non-safety systems that potentially affect overall plant risk), a deeper safety analysis of the AI methods is necessary. AI applied to NPP operations could resemble the use of digital I&C (DI&C) because such applications involve digital computer hardware and custom-designed software that input plant data, execute complex software algorithms, and output the results to a system or licensed human operator to potentially provoke an action. For AI methods to be compliant with current safety requirements for DI&C, AI compatibility must be evaluated, and AI-related gaps may exist that prevent the prompt deployment of AI in NPPs. This effort aims to evaluate how example AI technologies align with the DI&C safety framework, and discusses how they could be analyzed, modeled, tested, and validated in a manner similar to typical DI&C technologies. Because AI is a broad field that encompasses areas such as machine learning (ML), natural language processing, and computer vision, this research focused on a subset of methods categorized as the computer vision ML (CVML) methods. This report explores two CVML use cases, gauge reading and fire watch, considered relevant to the DI&C standards, as they could play a safety-critical role. For the gauge reading use case, a CVML-enabled technology that can read gauges at oblique angles is utilized. For the fire watch use case, a CVML-enabled technology is utilized that migrates fire watch from a manual (human) approach to automated fire detection. These use cases are mainly intended to give context to the CVML system discussion. This effort assumes the worst-case scenario, with the CVML system being used to replace a safety-related or risk-significant system, thus requiring evaluation. Evaluating CVML against most of the relevant safety requirements for DI&C yielded several CVML-specific considerations due to the uniqueness of its characteristics in comparison with typical DI&C systems. For example, CVML models often employ commonly used (open-source) datasets, and it is not always possible to determine the level of overlap among open-source datasets. Therefore, the independence of the developed CVML models when demonstrating diversity is questionable, therefore creating vulnerability to common cause failure (CCF). The design verification process is also impacted since the data overlap could result in overestimation of the software validation and verification (V&V) performance results. Section 2 of this report evaluates a list of the identified CVML-specific characteristics and discusses the resulting considerations and potential solutions in the context of each referenced requirement. A summation is provided in Section 3. This report is not to be used as a guideline. It was developed to identify and consider issues in the implementation of ML technologies used to augment activities that may have a bearing on plant operation. The report draws parallels to the use of DI&C technologies, for which many standards are available to guide their use in nuclear plant operation. It considers the technologies and some of the potential implications of their use in safety-related applications but is not intended to address regulatory or licensing related issues.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗

NASA NTRS1997

A Framework for Performing Verification and Validation in Reuse Based Software Engineering

Verification and Validation (V&V) is currently performed during application development for many systems, especially safety-critical and mission- critical systems. The V&V process is intended to discover errors, especially errors related to critical processing, as early as possible during the development process. The system application provides the context under which the software artifacts are validated. This paper describes a framework that extends V&V from an individual application system to a product line of systems that are developed within an architecture-based software engineering environment. This framework includes the activities of traditional application-level V&V, and extends these activities into domain engineering and into the transition between domain engineering and application engineering. The framework includes descriptions of the types of activities to be performed during each of the life-cycle phases, and provides motivation for the activities.

Addy, Edward A.↗

NASA NTRSDate not supplied

Lessons Learned on Mega-Constellation Deployments and Impact to Space Domain Awareness

The breakneck expansion of multi-payload launches in low Earth orbit (LEO) has seen significant escalation over the last three years in the Space Domain Awareness (SDA) enterprise. The uptick in satellite deployment frequency, gradation of Mega-constellation deployments utilizing electric propulsion, and surge in metric observation density from the Space Surveillance Network (SSN) have imposed major system enhancements to ensure spaceflight safety. Beginning with the launch phase, new tactics, software, and procedures have been developed over the last few years to optimize the tasking of the SSN and ensure custody of all recently launched satellites that are added to the space catalog. Ensuring appropriate tasking levels were pivotal during the satellite separation phase, which necessitated updates to the mission systems for improved delineation between clustered satellites in a short window of time. The improved incorporation of utilizing owner operator provided ephemeris coupled with critical code improvements have now revolutionized how we maintain custody of earth orbiting objects. The exponential population growth of low-Earth orbiting satellites have also increased the quantity of Conjunction Data Messages sent out to partners such as the Trajectory Operations Group (TOPO) in Johnson Space Center. We will discuss the need for continued collaboration between the National Aeronautics and Space Administration (NASA) and other Mega-Constellation Satellite Operators to safeguard Human Space Flight operations. Lastly, we will discuss the increase in reentry reporting for satellites falling back to Earth’s atmosphere, and the challenges associated with these events.

Christian C Ramos↗

NASA NTRSDate not supplied

Lessons Learned on Mega-Constellation Deployments and Impact to Space Domain Awareness

The breakneck expansion of multi-payload launches in low Earth orbit (LEO) has seen significant escalation over the last three years in the Space Domain Awareness (SDA) enterprise. The uptick in satellite deployment frequency, gradation of mega-constellation deployments utilizing electric propulsion, and surge in metric observation density from the Space Surveillance Network (SSN) have driven major system enhancements to ensure spaceflight safety. Beginning with the launch phase, new tactics, software, and procedures have been developed over the last few years to optimize the tasking of the SSN and ensure custody of all recently launched satellites that are added to the space catalog. Ensuring appropriate tasking levels were pivotal during the satellite separation phase, which necessitated updates to the mission systems for improved delineation between clustered satellites in a short window of time. The improved incorporation of utilizing satellite owner/operator-provided ephemeris coupled with critical code improvements have revolutionized how we maintain custody of Earth orbiting objects. The exponential population growth of Low-Earth orbiting satellites have also increased the quantity of Conjunction Data Messages sent out to partners such as the Trajectory Operations Group (TOPO) in Johnson Space Center. We will discuss the need for continued collaboration between the National Aeronautics and Space Administration (NASA) and other mega-constellation satellite operators to safeguard human spaceflight operations. Lastly, we will discuss how mega-constellations are driving best practices for safe operations across the space community.

Christian Ramos↗

NASA NTRS1996

The Application of V&V within Reuse-Based Software Engineering

Verification and Validation (V&V) is performed during application development for many systems, especially safety-critical and mission-critical systems. The V&V process is intended to discover errors as early as possible during the development process. Early discovery is important in order to minimize the cost and other impacts of correcting these errors. In reuse-based software engineering, decisions on the requirements, design and even implementation of domain assets can can be made prior to beginning development of a specific system. in order to bring the effectiveness of V&V to bear within reuse-based software engineering. V&V must be incorporated within the domain engineering process.

Addy, Edward↗