Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Software Safety”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 253 records · Page 14
All sourcesNASA NTRSDOE OSTI
DOE OSTI2023

SAS4A/SASSYS-1 Commercial Grade Dedication Example Report for a Generic Sodium Pool-Type Fast Reactor Application

In the U.S., a key component of the commercialization of advanced reactors is completion of a license application, which must ultimately be approved by the Nuclear Regulatory Commission (NRC). The approval of the license application by the NRC is contingent on satisfactory demonstration of the design basis and the response of the advanced reactor design to transient and accident scenarios using accepted codes and methods. This report describes the qualification and dedication requirements that the advanced reactor safety analysis system software SAS4A/SASSYS-1 are expected to need to fulfill to be used for sodium-cooled pool-type fast reactor licensing. The qualification and dedication requirements are identified through performance critical characteristics and evaluation model acceptance criteria representative of the advanced reactor design considered for licensing. This document captures, additionally, the verification process developed to demonstrate that the software fulfills the qualification and dedication requirements for a generic sodium-cooled pool-type fast reactor as part of the commercial grade dedication process. Like most software that has primarily existed in the research and development space, the most significant challenge facing SAS4A/SASSYS-1 for use in a licensing framework is the availability of a documentation basis describing the code pedigree. SAS4A/SASSYS-1 has been used for licensing of the fast flux test facility (FFTF) and the JOYO sodium-cooled fast reactor in Japan, as well as the design of the CRBR Plant. However, the historical verification and validation (V&V) activities supporting SAS4A/SASSYS-1 development do not align with modern software quality assurance (SQA) and V&V requirements. Two approaches to use of SAS4A/SASSYS-1 in a commercial licensing framework have been identified: commercial-grade dedication (CGD) and software qualification. The methods and requirements prescribed in the ASME NQA-1-2008/2009 Standard and Regulatory Guide 1.203 on the evaluation model development and assessment process (EMDAP) have been used as guidance to define the CGD and qualification processes, respectively. A qualification and dedication requirements matrix has been developed which utilizes fundamental software verification. In this process, software verification is defined as a software quality process aimed at defining software requirement specifications, developing software design documentation, and performing and documenting acceptance testing of the code against requirements. A key element of software qualification and dedication includes determination of software acceptance with respect to critical characteristics relevant to the functional requirements of the software. To assist with identification of cross-cutting transient phenomena and functional requirements, domestic SFR vendor designs have been reviewed to identify a reference SFR design. For this report, the reference design is defined as a pool-type reactor with metal alloy fuel, a liquid-metal intermediate heat transport system, and passive decay heat rejection systems. Given this reference, a series of high-level cross-cutting phenomena was identified for a general class of single-fault undercooling or reactivity insertion transients that scopes the design basis space, with the goal of assisting with prioritization of documentation development efforts for key transient models in SAS: 1) Reactivity feedback response prior to scram; 2) System-wide thermal inertia; 3) Transition in natural circulation flow regime in heat removal systems; 4) Decay heat generation; 5) Steady-state fuel characterization; 5) Clad/fuel behavior at elevated temperatures; 6) Point kinetics and decay heat; 7) Pump coastdown behavior; 8) Core flow redistribution in loss of forced convection; 9) Pool stratification. As a demonstration of CGD of SAS4A/SASSYS-1 for a sodium pool reactor, a software qualification and dedication gap analysis as it relates to code documentation has been performed. This effort leverages the framework established as part of the SAS4A/SASSYS-1 SQA Program. This CGD demonstration provides a framework that vendors can build upon to demonstrate the applicability of the SAS4A/SASSYS-1 software for licensing a sodium-cooled pool-type fast reactor.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
NASA NTRS1987

Security for safety critical space borne systems

The Space Station contains safety critical computer software components in systems that can affect life and vital property. These components require a multilevel secure system that provides dynamic access control of the data and processes involved. A study is under way to define requirements for a security model providing access control through level B3 of the Orange Book. The model will be prototyped at NASA-Johnson Space Center.

Legrand, Sue↗
NASA NTRS1991

Statistical modelling of software reliability

During the six-month period from 1 April 1991 to 30 September 1991 the following research papers in statistical modeling of software reliability appeared: (1) A Nonparametric Software Reliability Growth Model; (2) On the Use and the Performance of Software Reliability Growth Models; (3) Research and Development Issues in Software Reliability Engineering; (4) Special Issues on Software; and (5) Software Reliability and Safety.

Miller, Douglas R.↗
NASA NTRS2006

Building the Core Architecture of a Multiagent System Product Line: With an example from a future NASA Mission

The field of Software Product Lines (SPL) emphasizes building a core architecture for a family of software products from which concrete products can be derived rapidly. This helps to reduce time-to-market, costs, etc., and can result in improved software quality and safety. Current AOSE methodologies are concerned with developing a single Multiagent System. We propose an initial approach to developing the core architecture of a Multiagent Systems Product Line (MAS-PL), exemplifying our approach with reference to a concept NASA mission based on multiagent technology.

Pena, Joaquin↗
NASA NTRS2007

Robust, Flexible Motion Control for the Mars Explorer Rovers

The Mobility Flight Software, running on computers aboard the Mars Explorer Rover (MER) robotic vehicles Spirit and Opportunity, affords the robustness and flexibility of control to enable safe and effective operation of these vehicles in traversing natural terrain. It can make the vehicles perform specific maneuvers commanded from Earth, and/or can autonomously administer multiple aspects of mobility, including choice of motion, measurement of actual motion, and even selection of targets to be approached. Motion of a vehicle can be commanded by use of multiple layers of control, ranging from motor control at a low level, direct drive operations (e.g., motion along a circular arc, motion along a straight line, or turn in place) at an intermediate level to goal-position driving (that is, driving to a specified location) at a high level. The software can also perform high-level assessment of terrain and selection of safe paths across the terrain: this involves processing of the digital equivalent of a local traversability map generated from images acquired by stereoscopic pairs of cameras aboard the vehicles. Other functions of the software include interacting with the rest of the MER flight software and performing safety checks.

Maimone, Mark↗
NASA NTRS2009

Machine-Checkable Timed CSP

The correctness of safety-critical embedded software is crucial, whereas non-functional properties like deadlock-freedom and real-time constraints are particularly important. The real-time calculus Timed Communicating Sequential Processes (CSP) is capable of expressing such properties and can therefore be used to verify embedded software. In this paper, we present our formalization of Timed CSP in the Isabelle/HOL theorem prover, which we have formulated as an operational coalgebraic semantics together with bisimulation equivalences and coalgebraic invariants. Furthermore, we apply these techniques in an abstract specification with real-time constraints, which is the basis for current work in which we verify the components of a simple real-time operating system deployed on a satellite.

Goethel, Thomas↗
NASA NTRS2011

Safety and Mission Assurance: A NASA Perspective

Safety and Mission Assurance (S&MA) consists of the safety, reliability, maintainability, software assurance and quality disciplines, which are applied to reduce the probability of mishaps and ensure mission success. NASA uses a risk management process which requires various organizations to identify, analyze and mitigate/control risks associated with operations and decision making processes.

Higginbotham, Scott Alan↗
DOE OSTI2016

Software Dependability for Digital Instrumentation and Control Systems in Nuclear Power Plants - Lessons Learnt from a DOE Sponsored Project

This paper discusses the lessons learnt from a sponsored study undertaken under the sponsorship of the Department of Energy by a team of scientists at the Ohio State University in collaboration with Technology Resources and experts around the world. This paper makes recommendations for future research and studies based on these lessons learnt. The purpose of the research was to provide a software dependability quantification framework that would allow its evaluation along the software development life cycle for safety critical instrumentation and control systems (I and C) such as those found in nuclear power plants. A typical example of safety critical system is the reactor protection system. The research funded by the Department of Energy built on preliminary research carried out for the US NRC that had focused solely on software reliability quantification. Quantification of software dependability is important for safety critical I and C because the regulatory framework in use in the United States for nuclear power plants is risk informed. Quantification of risk requires quantification of all contributors to risk and those include instrumentation and control systems. The purpose of the study was to help developers of software-based I and C with an early evaluation of the potential risk an application would represent at different stages of the software development life cycle by building gates at the end of each life cycle phase. Life cycle phases of software development comprehend phases such as requirements, design, coding and test. The gates' function would be to stop development from moving forward if the assessed dependability objective for that phase were not met. Gates thresholds were to be defined based on measurements collected during the life cycle phase under evaluation and phases that preceded it and an understanding of the mechanisms that would lead to threatening the dependability objectives. The information contained in the gates would in addition help steer the development towards areas that needed improvement. The following are four high level conclusions to our study. First the study demonstrates a lack of consensus on mechanisms that will threaten the dependability attributes. This lack of consensus should be resolved. The lack of consensus appears for all measures to the exception of reliability. Second, measures should be developed for software availability and safety. Third, for all dependability attributes (with the exception of reliability) consistency of the measurement threads should evaluated and measurement-based development gates derived. Finally our ability to perform such type of research depends in a significant manner on access to vendor and/or utility data. The licensing environment and the first-of-a-kind nature of current software-based applications for nuclear I and C make it difficult to collect the relevant data. An approach which would either increase access to data by providing 'immunity' to the vendor or utility or the development of a software-based I and C for the sole purpose of data collection for research should be investigated. (authors)

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
NASA NTRS2004

Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System (SATS)Concept

New concepts for automating air traffic management functions at small non-towered airports raise serious safety issues associated with the software implementations and their underlying key algorithms. The criticality of such software systems necessitates that strong guarantees of the safety be developed for them. In this paper we present a formal method for modeling and verifying such systems using the PVS theorem proving system. The method is demonstrated on a preliminary concept of operation for the Small Aircraft Transportation System (SATS) project at NASA Langley.

Carrreno, Victor A.↗
DOE OSTI2020

Safety Risk Reliability Model Library

SR2ML is a software package which contains a set of safety and reliability models designed to be interfaced with the INL developed RAVEN code. These models can be employed to perform both static and dynamic system risk analysis and determine risk importance of specific elements of the considered system. Two classes of reliability models have been developed; the first class includes all classical reliability models (Fault-Trees, Event-Trees, Markov models and Reliability Block Diagrams) which have been extended to deal not only with Boolean logic values but also time dependent values. The second class includes several components aging models. Models of these two classes are designed to be included in a RAVEN ensemble model to perform time dependent system reliability analysis (dynamic analysis). Similarly, these models can be interfaced with system analysis codes to determine failure time of systems and evaluate accident progression (static analysis).

Wang, Congjian↗
DOE OSTI2014

Methodology for Sensitivity and Uncertainty-Based Criticality Safety Validation

Monte Carlo radiation transport software is used extensively for determining the effective multiplication factor k of fissionable systems towards assessing the criticality safety of operations. Understanding the predictive capability of the Monte Carlo software and nuclear data libraries for calculations of specific applications is vital towards making these assessments. Recently, sensitivity and uncertainty (S/U) methods have been developed for this purpose. A computational tool has been developed that uses the S/U methods with MCNP6 to select critical experiment benchmarks that have similar sources of computational bias, and extreme value theory is then used to determine suitable and conservative calculational margins. The S/U techniques are then used to perform nuclear data adjustments, which are then used to determine a suitable margin of subcriticality from cross section uncertainties. This document gives an overview of the theory of S/U methods used for criticality safety validation. First an overview is given for using the sensitivity coefficients and nuclear co variance data towards determining neutronic similarity factors is then discussed. Next, the extreme value theory (EVT) to determine a calculational margin is given along with how the similarity factors are used in the analysis. Then, the Generalized Linear Least Squares (GLLS) method for performing data adjustment and how that method is used to reject benchmarks and compute adjusted nuclear data uncertainties in k are discussed. Last, a discussion of the margin of subcriticality is given along with how to apply of the GLLS data adjustment methods to quantify the effect of nuclear data variability on k.

73 NUCLEAR PHYSICS AND RADIATION PHYSICS↗
NASA NTRS2003

Fault Tree Analysis Application for Safety and Reliability

Many commercial software tools exist for fault tree analysis (FTA), an accepted method for mitigating risk in systems. The method embedded in the tools identifies a root as use in system components, but when software is identified as a root cause, it does not build trees into the software component. No commercial software tools have been built specifically for development and analysis of software fault trees. Research indicates that the methods of FTA could be applied to software, but the method is not practical without automated tool support. With appropriate automated tool support, software fault tree analysis (SFTA) may be a practical technique for identifying the underlying cause of software faults that may lead to critical system failures. We strive to demonstrate that existing commercial tools for FTA can be adapted for use with SFTA, and that applied to a safety-critical system, SFTA can be used to identify serious potential problems long before integrator and system testing.

Wallace, Dolores R.↗
NASA NTRS2001

A Practical Approach to Modified Condition/Decision Coverage

Testing of software intended for safety-critical applications in commercial transport aircraft must achieve modified condition/decision coverage (MC/DC) of the software structure. This requirement causes anxiety for many within the aviation software community. Results of a survey of the aviation software industry indicate that many developers believe that meeting the MC/DC requirement is difficult, and the cost is exorbitant. Some of the difficulties stem, no doubt, from the scant information available on the subject. This paper provides a practical 5-step approach for assessing MC/DC for aviation software products, and an analysis of some types of errors expected to be caught when MC/DC is achieved1.

Hayhurst, Kelly J.↗
DOE OSTI2016

Rich-Text based PSA Model Transformation and Verification in RiskA

Nuclear Energy is one of the most possible alternative to fossil energy in large-scale. Nuclear safety is the lifeline of nuclear energy development, and has been an important part of national security, especially after the accident of Fukushima. On the basis of computer codes, reliability engineering and Probabilistic Risk Assessment (PSA) is effective methods to improve the safety of nuclear power plants. After many years of development, the methodologies, applications and relevant soft programs have been quite sufficient in the area of nuclear safety. However, it is still difficult for the current PSA technologies and software to meet the needs of dealing with the problems of quantitatively public risk assessment in the digital society. Especially, there are so many software that adopted different modeling and analyzing methods, which brings difficulties to the comparison, evaluation or verification for different software and models. By using its own academic advantages, the advanced nuclear energy research team, i.e., FDS Team has invested a few hundreds person-years of independent research and development of a reliability and probabilistic safety assessment software system RiskA. The system consists of three main functions: device reliability optimization management, probabilistic safety assessment and instantaneous risk monitoring, and the comprehensive public risk assessment in digital society. RiskA establishes an integrated risk evaluation system for the device reliability, nuclear power plant (NPP) risk monitoring and public risk assessment. Currently, RiskA has successfully been applied in more than 600 organizations and institutes from a variety of fields in 39 countries, involving nuclear, aerospace, defense and so on. For example, RiskA has been used in the safety analysis of International Thermonuclear Experimental Reactor (ITER), FDS series fusion reactor, and the Strategic Priority Research Program of Chinese Academy of Sciences 'the Future Advanced Nuclear Fission Energy - Accelerator Driven Sub-critical (ADS) transmutation system'. Also, RiskA has been used in public risk communication and risk assessment. Among them, Third Qinshan nuclear power plant Risk Monitor (TQRM), which is the China's first domestic nuclear safety analysis software used in the actual online operation, has been highly apprised by renowned experts in the field. Meanwhile, it has been identified as the first domestic nuclear power plant risk monitoring system with completely independent intellectual property rights, and has reached the international advanced level. (authors)

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2015

SU-D-BRD-06: Creating a Safety Net for a Fully Automated, Script Driven Electronic Medical Record

Purpose: Demonstrate the effectiveness of in-house software in ensuring EMR workflow efficiency and safety. Methods: A web-based dashboard system (WBDS) was developed to monitor clinical workflow in real time using web technology (WAMP) through ODBC (Open Database Connectivity). Within Mosaiq (Elekta Inc), operational workflow is driven and indicated by Quality Check Lists (QCLs), which is triggered by automation software IQ Scripts (Elekta Inc); QCLs rely on user completion to propagate. The WBDS retrieves data directly from the Mosaig SQL database and tracks clinical events in real time. For example, the necessity of a physics initial chart check can be determined by screening all patients on treatment who have received their first fraction and who have not yet had their first chart check. Monitoring similar “real” events with our in-house software creates a safety net as its propagation does not rely on individual users input. Results: The WBDS monitors the following: patient care workflow (initial consult to end of treatment), daily treatment consistency (scheduling, technique, charges), physics chart checks (initial, EOT, weekly), new starts, missing treatments (>3 warning/>5 fractions, action required), and machine overrides. The WBDS can be launched from any web browser which allows the end user complete transparency and timely information. Since the creation of the dashboards, workflow interruptions due to accidental deletion or completion of QCLs were eliminated. Additionally, all physics chart checks were completed timely. Prompt notifications of treatment record inconsistency and machine overrides have decreased the amount of time between occurrence and execution of corrective action. Conclusion: Our clinical workflow relies primarily on QCLs and IQ Scripts; however, this functionality is not the panacea of safety and efficiency. The WBDS creates a more thorough system of checks to provide a safer and near error-less working environment.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
NASA NTRS2001

Requirements management at NASA

Requirements have always been acknowledged as the backbone of any system. However, in many past development efforts, requirements were paid little heed. At NASA, in recent years, the hue and cry for project development has been "Faster, Better, Cheaper and Safer". This has impacted the way we develop software; it has increased the risks to quality, safety and reliability. At NASA, the Software Assurance Technology Center (SATC) is working with projects to emphasize the criticality of requirements throughout development, not just in the initial phases. This emphasis is on requirements relationship to all aspects of quality, including reliability and safety. In this presentation, we will look at some of these relationships through the eyes of quality.

Requirement management↗
NASA NTRS1997

Demonstration of a Safety Analysis on a Complex System

For the past 17 years, Professor Leveson and her graduate students have been developing a theoretical foundation for safety in complex systems and building a methodology upon that foundation. The methodology includes special management structures and procedures, system hazard analyses, software hazard analysis, requirements modeling and analysis for completeness and safety, special software design techniques including the design of human-machine interaction, verification, operational feedback, and change analysis. The Safeware methodology is based on system safety techniques that are extended to deal with software and human error. Automation is used to enhance our ability to cope with complex systems. Identification, classification, and evaluation of hazards is done using modeling and analysis. To be effective, the models and analysis tools must consider the hardware, software, and human components in these systems. They also need to include a variety of analysis techniques and orthogonal approaches: There exists no single safety analysis or evaluation technique that can handle all aspects of complex systems. Applying only one or two may make us feel satisfied, but will produce limited results. We report here on a demonstration, performed as part of a contract with NASA Langley Research Center, of the Safeware methodology on the Center-TRACON Automation System (CTAS) portion of the air traffic control (ATC) system and procedures currently employed at the Dallas/Fort Worth (DFW) TRACON (Terminal Radar Approach CONtrol). CTAS is an automated system to assist controllers in handling arrival traffic in the DFW area. Safety is a system property, not a component property, so our safety analysis considers the entire system and not simply the automated components. Because safety analysis of a complex system is an interdisciplinary effort, our team included system engineers, software engineers, human factors experts, and cognitive psychologists.

Leveson, Nancy↗