Results for “Behavior Based Safety” — Page 16

NASA NTRS2016

Extending the Operational Envelope of a Turbofan Engine Simulation into the Sub-Idle Region

In many non-linear gas turbine simulations, operation in the sub-idle region can lead to model instability. This paper lays out a method for extending the operational envelope of a map based gas turbine simulation to include the sub-idle region. This method develops a multi-simulation solution where the baseline component maps are extrapolated below the idle level and an alternate model is developed to serve as a safety net when the baseline model becomes unstable or unreliable. Sub-idle model development takes place in two distinct operational areas, windmilling/shutdown and purge/cranking/ startup. These models are based on derived steady state operating points with transient values extrapolated between initial (known) and final (assumed) states. Model transitioning logic is developed to predict baseline model sub-idle instability, and transition smoothly and stably to the backup sub-idle model. Results from the simulation show a realistic approximation of sub-idle behavior as compared to generic sub-idle engine performance that allows the engine to operate continuously and stably from shutdown to full power.

aerothermodynamics↗

DOE OSTI2018

VARI3D & PERSENT: Perturbation and Sensitivity Analysis

The nodal diffusion method is one of the most widely used approaches in modern reactor analysis. In the nodal diffusion method, a coarse multi-group set of “homogenized” parameters is constructed such that the complex geometry of a reactor core along with the energy dependence of neutron and gamma ray cross sections in a nuclear reactor are conserved in the simpler geometry. The homogenization is typically done on a fuel assembly level as is the case in the DIF3D code developed at Argonne National Laboratory. The nodal methodology is used primarily to predict fuel cycle behavior of nuclear systems of which there is a substantial amount of validation in the literature. Another use of the nodal method is to obtain reactivity coefficients and kinetics parameters for use in a safety analysis of a given nuclear reactor. While there are many ways to obtain reactivity worth and kinetics parameters, the work presented in this manuscript is unique as it provides the user with the ability to compute reactivity worths, kinetics parameters, and cross section sensitivities with a Cartesian and hexagonal geometry based transport code.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗

DOE OSTI2020

VARI3D & PERSENT: Perturbation and Sensitivity Analysis

The nodal diffusion method is one of the most widely used approaches in modern reactor analysis. In the nodal diffusion method, a coarse multi-group set of “homogenized” parameters is constructed such that the complex geometry of a reactor core along with the energy dependence of neutron and gamma ray cross sections in a nuclear reactor are conserved in the simpler geometry. The homogenization is typically done on a fuel assembly level as is the case in the DIF3D code developed at Argonne National Laboratory. The nodal methodology is used primarily to predict fuel cycle behavior of nuclear systems of which there is a substantial amount of validation in the literature. Another use of the nodal method is to obtain reactivity coefficients and kinetics parameters for use in a safety analysis of a given nuclear reactor. While there are many ways to obtain reactivity worth and kinetics parameters, the work presented in this manuscript is unique as it provides the user with the ability to compute reactivity worths, kinetics parameters, and cross section sensitivities with a Cartesian and hexagonal geometry based transport code.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗

DOE OSTI2020

VARI3D & PERSENT: Perturbation and Sensitivity Analysis

The nodal diffusion method is one of the most widely used approaches in modern reactor analysis. In the nodal diffusion method, a coarse multi-group set of “homogenized” parameters is constructed such that the complex geometry of a reactor core along with the energy dependence of neutron and gamma ray cross sections in a nuclear reactor are conserved in the simpler geometry. The homogenization is typically done on a fuel assembly level as is the case in the DIF3D code developed at Argonne National Laboratory. The nodal methodology is used primarily to predict fuel cycle behavior of nuclear systems of which there is a substantial amount of validation in the literature. Another use of the nodal method is to obtain reactivity coefficients and kinetics parameters for use in a safety analysis of a given nuclear reactor. While there are many ways to obtain reactivity worth and kinetics parameters, the work presented in this manuscript is unique as it provides the user with the ability to compute reactivity worths, kinetics parameters, and cross section sensitivities with a Cartesian and hexagonal geometry based transport code.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗

DOE OSTI2024

Report on RIA Relevant Modified Burst Testing of ATF Cladding Materials

The mechanical performance of accident-tolerant fuel (ATF) cladding candidates in light-water reactors (LWRs) must be similar to or better than that of current conventional nuclear fuel claddings to reduce dose to the public and ensure a that the core coolable geometry is maintained during a postulated reactivity-initiated accident (RIA) in light-water reactors (LWRs). During an RIA event, the rapid thermal expansion of nuclear fuel can deform the cladding once the fuel–cladding gap closes. In some cases, the pellet–cladding mechanical interaction (PCMI) can induce mechanical failure in ATF candidates. Thus, the mechanical response of ATF cladding must be investigated by mimicking the conditions of RIA and potentially performing Transient Reactor Test (TREAT) experiments to establish or verify the safety envelope. The work presented in this report investigated the failure behavior of as-received, hydrided, and chromium-coated (Cr-coated) Zircaloy-4 (Zry-4) cladding tube under strain-driven mechanical conditions, mimicking postulated RIA loading conditions. Mechanical testing was performed at 300°C via modified burst test (MBT) equipment with pulse width control previously developed under the Department of Energy’s (DOE’s) Advanced Fuel Campaign (AFC). The mechanical strains were determined using 2D digital image correlation (DIC) techniques. The base Zry-4 acquired by Cameco Inc. was in stress-relieved annealed (SRA) condition. Because of the observed large deformation of the cladding tubes, the failure strain definition was updated for the MBT, which can also be applied to other tube tests where significant bulging (out-of-plane deformation) is present. The failure strain was determined to be affected by the speed of the test or the RIA event. As the RIA-like event duration decreased from 75 to 15 ms, the failure strain decreased 5, 7 and 1% for as-received, hydrided, and Cr-coated specimens, respectively. Fractography on the Cr-coated specimens indicated the presence of two failure mechanisms: (i) crenulation at the outer surface of the coating due to the tensile tractional forces along with coatings grain microstructure and (ii) formation of critical defect at the coating/cladding interface that initiated coating rupture after severe plastic deformation of the Zry- 4 substrate. Based on the MBT results and fractography observations, performing mechanical property testing at high strain rates—in particular on Cr-coated tubes—and semi-integral TREAT experiments are required future efforts to ensure ATF cladding performance during transients. The testing recommended would also inform the development of long-term generalized cladding technologies.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗

DOE OSTI2025

VARI3D & PERSENT: Perturbation and Sensitivity Analysis

The nodal diffusion method is one of the most widely used approaches in modern reactor analysis. In the nodal diffusion method, a coarse multi-group set of “homogenized” parameters is constructed such that the complex geometry of a reactor core along with the energy dependence of neutron and gamma ray cross sections in a nuclear reactor are conserved in the simpler geometry. The homogenization is typically done on a fuel assembly level as is the case in the DIF3D code developed at Argonne National Laboratory. The nodal methodology is used primarily to predict fuel cycle behavior of nuclear systems of which there is a substantial amount of validation in the literature. Another use of the nodal method is to obtain reactivity coefficients and kinetics parameters for use in a safety analysis of a given nuclear reactor. While there are many ways to obtain reactivity worth and kinetics parameters, the work presented in this manuscript is unique as it provides the user with the ability to compute reactivity worths, kinetics parameters, and cross section sensitivities with a Cartesian and hexagonal geometry based transport code. This manuscript serves as a single manual for two separate codes: VARI3D and PERSENT. The VARI3D code (VARIational 3D) is based upon the classic finite difference diffusion theory solver available in DIF3D. The PERSENT code (PERturbation and SENitivity for Transport) is based upon the variational nodal method employed in DIF3D termed VARIANT. The VARIANT solver was added to DIF3D in 1995 and has seen continued development and use for the last 18 years. Because VARI3D primarily uses deprecated coding practices, rather than incorporating the perturbation and sensitivity treatments for transport within VARI3D, a new coding development was built using modern Fortran coding. The primary purpose of this manual is to describe the theory behind PERSENT (and by convenience, that of VARI3D) and discuss the input and output of PERSENT along with giving potential users an idea of how to use it. While this manuscript does describe the input and output of VARI3D, the PERSENT code is intended to be the replacement capability of VARI3D as PERSENT can generate nearly identical (if not superior) diffusion theory results. In this manuscript, the relevant aspects of generalized perturbation theory and exact perturbation theory that apply to both VARI3D and PERSENT are covered. The input and output of VARI3D is displayed by excerpting several of the example problems. Similarly, the input and output of PERSENT is displayed along with tips on how best to use the code. Note that the input and output of the inhomogeneous solver wrapped around DIF3D (DIF3D_IFS) is also discussed as it is needed to carry out some of the sensitivities in PERSENT such as reaction rate ratios. This manuscript describes several perturbation and sensitivity problems, and the results computed using PERSENT. From these sections, potential users should find that PERSENT provides not only the typical tables of numbers desired in perturbation and sensitivity analysis work, but also can visually plot the result for a more thorough understanding of the space and energy distribution (Section 5). Overall, PERSENT is observed to produce accurate reactivity worths and sensitivities for the displayed set of test problems and clearly demonstrates the need to have a transport-based sensitivity capability as evident from the thousands of percent errors observed in the 21-group hexagonal fast reactor problem (covered in Section 7). The uncertainty calculation capability is described in Section 3 and demonstrated in Section 7.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

NASA NTRS2018

Structural Certification of Human-Rated Inflatable Space Structures

This paper details the results of an initial study to develop a certification plan for human-rated inflatable space structures, including guidelines for qualification testing. Habitable softgoods inflatables are multi-layered shell structures that use high-strength webbing, cordage and broadcloth fabric to carry the skin loads of a variety of volumetric shapes and structural architectures. The primary objectives of this study are to define the key parameters that affect these structures and propose a statistically robust approach to defining safety and knockdown factors based on test and analysis. Current NASA standards for habitable inflatable space structures use a factor of safety of 4, which was inherited from airship design criteria. An updated approach to defining a design factor, taking into account material strength variability, load variability in the article, number of test samples, and damage and degradation effects is specified. Accurate analytical modeling of these structures is hindered by the difficulty of obtaining accurate and consistent material data due to load-history- dependent, nonlinear load versus strain behavior. A building block approach to certification is detailed that uses stochastic modeling and statistical test design and analysis to address the unique challenges these high-strength softgoods structures present. Human-rated inflatable modules are a transformative capability for launching much larger habitable volumes into space than is possible with rigid shell structures. This research aims to provide the framework for certifying these structures for future human space exploration missions.

Jones, Thomas C.↗

NASA NTRS2014

Improving Sensorimotor Adaptation Following Long Duration Space Flight by Enhancing Vestibular Information Transfer

Crewmember adapted to the microgravity state may need to egress the vehicle within a few minutes for safety and operational reasons after gravitational transitions. The transition from one sensorimotor state to another consists of two main mechanisms: strategic and plastic-adaptive and have been demonstrated in astronauts returning after long duration space flight. Strategic modifications represent "early adaptation" - immediate and transitory changes in control that are employed to deal with short-term changes in the environment. If these modifications are prolonged then plastic-adaptive changes are evoked that modify central nervous system function, automating new behavioral responses. More importantly, this longer term adaptive recovery mechanism was significantly associated with their strategic ability to recover on the first day after return to Earth G. We are developing a method based on stochastic resonance to enhance information transfer by improving the brain's ability to detect vestibular signals (Vestibular Stochastic Resonance, VSR) especially when combined with balance training exercises such as sensorimotor adaptability (SA) training for rapid improvement in functional skill, for standing and mobility. This countermeasure to improve detection of vestibular signals is a stimulus delivery system that is wearable/portable providing low imperceptible levels of white noise based binaural bipolar electrical stimulation of the vestibular system (stochastic vestibular stimulation). To determine efficacy of vestibular stimulation on physiological and perceptual responses during otolith-canal conflicts and dynamic perturbations we have conducted a series of studies: We have shown that imperceptible binaural bipolar electrical stimulation of the vestibular system across the mastoids enhances balance performance in the mediolateral (ML) plane while standing on an unstable surface. We have followed up on the previous study showing VSR stimulation improved balance performance in both ML and anteroposterior planes while stimulating in the ML axis only. We have shown the efficacy of VSR stimulations on enhancing physiological and perceptual responses of whole-body orientation during low frequency perturbations (0.1 Hz) on the ocular motor system using a variable radius centrifuge on both physiological (using eye movements) and perceptual responses (using a joystick) to track imposed oscillations. The variable radius centrifuge provides a selective tilting sensation that is detectable only by the otolith organs providing conflicting information from the canal organs of the vestibular system (intra-vestibular conflict). These results indicate that VSR can improve performance in sensory conflict scenarios like that experienced during space flight. We have showed the efficacy of VSR stimulation to improve balance and locomotor control on subjects exposed to continuous, sinusoidal lateral motion of the support surface while walking on a treadmill while viewing perceptually matched linear optic flow. We have shown the safety of short term continuous use of up to 4 hours of VSR stimulation and its efficacy in improving balance and locomotor function in Parkinson's Disease patients. This technique for improving vestibular signal detection may thus provide additional information to improve strategic abilities. We hypothesize that VSR stimulation will act synergistically with SA training to improve adaptability by increased utilization of vestibular information and therefore serve to optimize and personalize the SA countermeasure prescription. This forms the basis of its usefulness both as a training modality and further help in significantly reducing the number of days required to recover functional performance to preflight levels after long duration space flight.

Mulavara, A. P.↗

DOE OSTI2024

VARI3D & PERSENT: Perturbation and Sensitivity Analysis (Revision 5)

The nodal diffusion method is one of the most widely used approaches in modern reactor analysis. In the nodal diffusion method, a coarse multi-group set of “homogenized” parameters is constructed such that the complex geometry of a reactor core along with the energy dependence of neutron and gamma ray cross sections in a nuclear reactor are conserved in the simpler geometry. The homogenization is typically done on a fuel assembly level as is the case in the DIF3D code developed at Argonne National Laboratory. The nodal methodology is used primarily to predict fuel cycle behavior of nuclear systems of which there is a substantial amount of validation in the literature. Another use of the nodal method is to obtain reactivity coefficients and kinetics parameters for use in a safety analysis of a given nuclear reactor. While there are many ways to obtain reactivity worth and kinetics parameters, the work presented in this manuscript is unique as it provides the user with the ability to compute reactivity worths, kinetics parameters, and cross section sensitivities with a Cartesian and hexagonal geometry-based transport code.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

NASA NTRS2010

Utilizing Earth Observations for Societal Issues

Over the last four decades a tremendous progress has been made in the Earth science space-based remote sensing observations, technologies and algorithms. Such advancements have improved the predictability by providing lead-time and accuracy of forecast in weather, climate, natural hazards, and natural resources. It has further reduced or bounded the overall uncertainties by partially improving our understanding of planet Earth as an integrated system that is governed by non-linear and chaotic behavior. Many countries such as the US, European Community, Japan, China, Russia, India has and others have invested billions of dollars in developing and launching space-based assets in the low earth (LEO) and geostationary (GEO) orbits. However, the wealth of this scientific knowledge that has potential of extracting monumental socio-economic benefits from such large investments have been slow in reaching the public and decision makers. For instance, there are a number of areas such as water resources and availability, energy forecasting, aviation safety, agricultural competitiveness, disaster management, air quality and public health, which can directly take advantage. Nevertheless, we all live in a global economy that depends on access to the best available Earth Science information for all inhabitants of this planet. This presentation discusses a process to transition Earth science data and products for societal needs including NASA's experience in achieving such objectives. It is important to mention that there are many challenges and issues that pertain to a number of areas such as: (1) difficulties in making a speedy transition of data and information from observations and models to relevant Decision Support Systems (DSS) or tools, (2) data and models inter-operability issues, (3) limitations of spatial, spectral and temporal resolution, (4) communication limitations as dictated by the availability of image processing and data compression techniques. Additionally, the most critical element amongst all is the organizational and management boundaries that must be resolved at local, state, national and international levels to implement and realize free flow of such vital information.

Habib, Shahid↗

DOE OSTI2025

Development and application of two-step uncertainty propagation and sensitivity analysis methodology for fast reactor safety analysis

Uncertainty quantification (UQ) in nuclear reactors for transients is directly linked with safety assessment through the cross-sections uncertainties, provided as a covariance matrix, which are propagated through the reactor system to output of interest pertaining to reactor safety, such as peak temperatures in fuel/clad/coolant. Using a two-step approach, uncertainties are first quantified and propagated from basic input variables (such as reaction cross-sections) to intermediate quantities (such as reactivity feedback coefficients) through lattice level calculations. Uncertainties of intermediate quantities (from the first step) are then propagated through the system transient calculations, in the second step, to obtain uncertainties on reactor safety output parameters of interest. The scope of this work consists of Uncertainty Quantification & Propagation of nuclear data uncertainties that are highly correlated through unprotected transient overpower and unprotected loss of flow to assess their impact on core safety parameters. This two-step approach in the presence of covariance renders the sensitivity analysis very challenging. In fact, usually the sensitivity analysis is restricted to each step, which limits its application since the sensitivities between the system output quantities and the basic input variables are difficult to obtain. Here, in this work, we address this issue by proposing a simple, general methodology to combine the sensitivity indices obtained in each step by assuming the model behavior being linear. For the first step Generalized Perturbation theory based indices are used while in the second step the recently studied Johnson indices. The uncertainty quantification and sensitivity methodologies discussed here are demonstrated on a generic LFR design which is based on the 500 MWth demonstration Lead-cooled fast reactor (DLFR) using oxide fuel, developed by Westinghouse Electric Company (WEC).

42 - ENGINEERING↗

NASA NTRS1994

Cargo systems manual: Heat Pipe Performance (HPP) STS-66

The purpose of the cargo systems manual (CSM) is to provide a payload reference document for payload and shuttle flight operations personnel during shuttle mission planning, training, and flight operations. It includes orbiter-to-payload interface information and payload system information (including operationally pertinent payload safety data) that is directly applicable to the Mission Operations Directorate (MOD) role in the payload mission. The primary objectives of the heat pipe performance (HPP) are to obtain quantitative data on the thermal performance of heat pipes in a microgravity environment. This information will increase understanding of the behavior of heat pipes in space and be useful for application to design improvements in heat pipes and associated systems. The purpose of HPP-2 is to establish a complete one-g and zero-g data base for axial groove heat pipes. This data will be used to update and correlate data generated from a heat pipe design computer program called Grooved Analysis Program (GAP). The HPP-2 objectives are to: determine heat transport capacity and conductance for open/closed grooved heat pipes and different Freon volumes (nominal, under, and overcharged) using a uniform heat load; determine heat transport capacity and conductance for single/multiple evaporators using asymmetric heat loads; obtain precise static, spin, and rewicking data points for undercharged pipes; investigate heat flux limits (asymmetric heat loads); and determine effects of positive body force on thermal performance.

Napp, Robert↗

DOE OSTI2020

A multi-dimensional dataset for two-phase instability in low pressure natural circulation based on direct transient local measurement

Thermal hydraulic instability can challenge the control and the safety of nuclear reactors. This experimental research captures and investigates the instability in a low-pressure (1–10 atmospheres) natural circulation loop with an adiabatic chimney installed above the heated section. Direct transient local measurement of two-phase flow is performed at multiple axial locations along the flow channel with thermocouples and conductivity probes traversed by customized high-precision mechanisms. Based on the periodicity of oscillations, a post-processing method is proposed to align the data captured non-simultaneously to reconstruct the instability behavior in one representative period. The averaging operation over multiple oscillation cycles is performed to reduce the random errors. Cyclic phenomena are clearly demonstrated by the post-processed data, and rapid void fraction change induced by the flashing is observed to be significant in the driving mechanism for low pressure oscillations. Parametric effects of inlet subcooling, heat flux, inlet flow restriction and system pressure are studied within the experiment range, and qualitative results are explained and compared with existing literature. The ratio between the oscillation period and the travelling time of the fluid particle through the test section is compared with the theoretical value for the density wave oscillation. The new dataset contains directly measured transient multi-dimensional two-phase data along the flow channel for natural circulation under density wave oscillations. The generated dataset is valuable for the validation of system analysis codes and CFD codes in the simulation of natural circulation phenomena and dynamic two-phase flow.

42 ENGINEERING↗

DOE OSTI2023

Fuel Salt Qualification and Associated Fuel Cycle Opportunities & Issues

NRC staff have defined fuel qualification as a process which provides high confidence that the physical and chemical behavior of fuel is sufficiently understood so that it can be adequately modeled for both normal and accident conditions, reflecting the role of the fuel design in the overall safety of the facility. Uncertainties are defined so that calculated fission product releases include the appropriate margins to ensure conservative calculation of radiological dose consequences. The Advisory Committee on Reactor Safeguards (ACRS) has accepted the methodology described in NUREG/CR-7299 as an acceptable method for fuel qualification for molten salt reactors. The fuel salt qualification process described in NUREG/CR-7299 is based upon understanding the role that the fuel salt plays in achieving the fundamental safety functions, which in-turn is based on the fuel salt thermophysical and thermochemical properties.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗

DOE OSTI2024

MOOSE-Based Fast Reactor Core Bowing Capabilities: Coupled Structural Mechanics – Thermal Fluids Demonstration and Related Verification Efforts

Under the U.S. Department of Energy Office of Nuclear Energy’s Advanced Modeling and Simulation (NEAMS) Program, an integrated multiphysics approach is being developed to model the core bowing phenomena important to liquid metal-cooled fast reactors. Core bowing is an important passive safety mechanism in liquid metal-cooled fast reactors and involves multiphysics effects including radiation transport, fluid flow, heat transfer, and mechanical response to temperature and flux gradients. Verification and assessment efforts continued on the Multiphysics Object Oriented Simulation Environment (MOOSE) capabilities relevant for modeling thermo-mechanical core bowing behavior. IAEA Verification Problem 4, which was started in FY23, was further examined with MOOSE capabilities to rectify discrepancies observed in previous years when compared to IAEA benchmark participant data. Meshing and postprocessing capabilities in MOOSE were also advanced by other teams and utilized this year. A thermal fluids-structural mechanical coupling demonstration has performed on 7-assemblyand 19-assembly fast reactor assembly configurations using MOOSE. Subchannel capabilities are used to calculate coolant temperature, and heat conduction capabilities calculate duct wall temperature as well as heat transfer through the inter-assembly gap. Structural mechanical capabilities then deform the mesh, accounting for contact between assemblies, according to the temperature gradients calculated by the thermal solvers. Power distributions are imposed rather than calculated to demonstrate different deformations.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

DOE OSTI2024

Observation and Modeling of Dynamic Fracture Behaviors of Battery Cell Under Impact Loading Using Enhanced Representative Volume Element Concept

The burgeoning electric automobile industry has increased interest in battery safety. Battery cells experience significant mechanical stress during operation, including the impact of accidents and vibrations from driving. The potential for thermal runaway reactions in battery cells raises safety concerns. Although numerous researchers have defined the dynamic behavior of battery cells and proposed numerical models to describe it, few studies have focused on the high-strain rate mechanical impact phase correlated with the onset of fracture. In this study, we describe the dynamic behavior of pouch battery cells and propose a modeling method to study their mechanical failure under impact situations. Impact tests are conducted at various velocities and heights. To overcome numerical issues commonly encountered under rapid deformation scenarios, a new finite element model is developed based on the representative volume element model. The proposed approach efficiently simulates continuous crack propagation and brittleness behavior during impact by permitting the individual behavior of the cell components. Therefore, engineers can reliably design safer electric vehicle battery cells by measuring the properties of the cell components.

ENERGY STORAGE↗

NASA NTRS1998

Safety Analysis of FMS/CTAS Interactions During Aircraft Arrivals

This grant funded research on human-computer interaction design and analysis techniques, using future ATC environments as a testbed. The basic approach was to model the nominal behavior of both the automated and human procedures and then to apply safety analysis techniques to these models. Our previous modeling language, RSML, had been used to specify the system requirements for TCAS II for the FAA. Using the lessons learned from this experience, we designed a new modeling language that (among other things) incorporates features to assist in designing less error-prone human-computer interactions and interfaces and in detecting potential HCI problems, such as mode confusion. The new language, SpecTRM-RL, uses "intent" abstractions, based on Rasmussen's abstraction hierarchy, and includes both informal (English and graphical) specifications and formal, executable models for specifying various aspects of the system. One of the goals for our language was to highlight the system modes and mode changes to assist in identifying the potential for mode confusion. Three published papers resulted from this research. The first builds on the work of Degani on mode confusion to identify aspects of the system design that could lead to potential hazards. We defined and modeled modes differently than Degani and also defined design criteria for SpecTRM-RL models. Our design criteria include the Degani criteria but extend them to include more potential problems. In a second paper, Leveson and Palmer showed how the criteria for indirect mode transitions could be applied to a mode confusion problem found in several ASRS reports for the MD-88. In addition, we defined a visual task modeling language that can be used by system designers to model human-computer interaction. The visual models can be translated into SpecTRM-RL models, and then the SpecTRM-RL suite of analysis tools can be used to perform formal and informal safety analyses on the task model in isolation or integrated with the rest of the modeled system. We had hoped to be able to apply these modeling languages and analysis tools to a TAP air/ground trajectory negotiation scenario, but the development of the tools took more time than we anticipated.

Nancy G. Leveson↗

DOE OSTI2022

Autonomous System Subversion Tactics: Prototypes and Recommended Countermeasures

One of the fielding requirements for Advanced and Small Modular Reactors (AR/SMR) is the ability to support remote and autonomous operations. Autonomous Control Systems (ACS) are found on platforms such as Autonomous Space Vehicles, Cruise Missiles, and advanced driver-assistance systems. Each of these ACS implementations depends upon a set of decision support subsystems responsible for supporting Autonomous Mission Managers (names vary based upon field and author preferences). These Autonomous Mission Managers receive inputs from system sensors (e.g., LIDAR collection from an automobile travelling down a street; transients from a nuclear reactor), and perform a set of classifications (e.g., Red Traffic Light; Small Pedestrian at 10m; Load Rejection; Single Coolant Pump Trip), and then use these classifications in combination with recommendation algorithms to achieve platform goals (e.g., Stop the Vehicle at the Traffic Light, Avoid the Small Pedestrian; Trip the Reactor to prevent a Safety Event). The design, implementation, and fielding of an ACS capability will alter the cyber-attack surface such that existing risk management plans will need to be updated to include how to protect and defend against data-science and decision-support-system attack classes. These attack classes would include protection of the design and training environments where algorithm selection and testing and training data would be obvious attack vectors. These attack classes would also require an informed set of detection and response procedures to identify anomalous behaviors and document best practices for anomaly assessment and vulnerability mitigation and remediation. Last year we published a Cyber Threat Assessment Methodology for Autonomous and Remote Operations for AR/SMRs along with a companion publication on Cyber Attack and Defense Use Cases. The focus of the methodology was on describing and enumerating ACS processes, components, and functions such that security engineers could: evaluate subversion options against the target; identify threat actor attributes and capabilities derived from each subversion option; and identify security controls and response countermeasures. The Use Cases document offered detailed methodology examples including an assessment of a Military Base SMR, an Autonomous System Decision Loop, and implementation of AR/SMR Machine Learning algorithms. Our proposal at the end of last year was to focus on implementation of subversion prototypes related to the last Use Case area: AR/SMR Machine Learning (ML) Algorithms. We included six attack scenarios in our Use Cases paper: a Poisoning Attack against ML functions implemented using an FPGA; a Trojaning Attack against ML classifiers exploiting the excitability of Nuclear Engineers; a Backdooring Attack against ML Training environments to ensure persistence of an attack vector; a False Positive Evasion Attack against multi-factor Access Control Systems using clever inputs; an Inference Attack against ML models by an Insider with access to the Operational environment; and an Adversarial Reprogramming Attack against a Material Access Control Video Surveillance System. At the beginning of this year these six attack scenarios were provided to our research teams at Georgia Tech and Idaho State University and each team successfully implemented a subversion attack against a ML implementation to include transient misclassifications. While this is a notable outcome from this type of research, this paper offers the reader insight into not only how to structure and execute these types of attacks, but into the thought process behind how the researcher investigated the problem space, performed initial algorithm implementation, and the trial-and-error behind arriving at the successful subversion prototypes. We include in this paper a set of associated Scenarios on how these subversion prototypes could be implemented and an initial set of guidance for AR/SMR architects, Nuclear Regulators, and Cyber Defenders to implement awareness and defense capabilities into their current operational portfolios.

42 ENGINEERING↗