Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Safety Case”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2
All sourcesNASA NTRSDOE OSTI
DOE OSTI2016

The Importance of Getting it Right - Lessons from the Failure and Subsequent Approval of the LLWR Environmental Safety Case - 16691

The Low Level Waste Repository (LLWR) in the UK submitted an Environmental Safety Case in 2002 which was rejected by the Environment Agency 3 years later. Almost a decade after the rejection, the LLWR submitted a completely different document which was approved in November 2015. This paper looks at the lessons learned from the failed submission and documents the strategy employed by the Site's new contractor to overcome both the challenging technical issues that led to the initial rejection and overcome the resistance to long term disposal by the local community. It will describe the journey it has taken to move from a flawed safety case, to a technically sound safety case, to one that is approved by the regulator, and accepted by the community. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗
DOE OSTI2012

Towards a defensible safety case for deep geologic disposal of DOE HLW and DOE SNF in bedded salt

The primary objective of this study is to investigate the feasibility and utility of developing a defensible safety case for disposal of United States Department of Energy (U.S. DOE) high-level waste (HLW) and DOE spent nuclear fuel (SNF) in a conceptual deep geologic repository that is assumed to be located in a bedded salt formation of the Delaware Basin. A safety case is a formal compilation of evidence, analyses, and arguments that substantiate and demonstrate the safety of a proposed or conceptual repository. A safety case also provides the necessary structure for organizing and synthesizing existing knowledge in order to help DOE prioritize its future research and development (R&D) activities. We conclude that a defensible initial safety case for potential licensing could be readily compiled by capitalizing on the extensive technical basis that exists from prior work on the Waste Isolation Pilot Plant (WIPP), work on other repository development programs, and the work published through international efforts in salt repository programs such as in Germany.

Mackinnon, Robert James↗
DOE OSTI2012

The LLWR's 2011 Environmental Safety Case - 12143

The Low Level Waste Repository (LLWR) is the United Kingdom's principal facility for the disposal of LLW. The LLWR recently submitted an Environmental Safety Case (ESC), which will support applications to regulatory and government authorities to dispose of LLW and to start to install final closure engineering. The ESC is a major submission, with important implications for the future of the LLWR and the United Kingdom's management of LLW. The paper describes the context of the ESC, the ESC, its results and conclusions, and its implementation. The description shows that our ESC is a modern safety case developed as a range of safety arguments concerning our management, scientific and technical understanding, optimisation of the facility, as well as assessment calculations. The LLWR's 2011 ESC is a major submission, with important implications for the future of the LLWR and the United Kingdom's management of LLW. The description given of the scope of the ESC shows that it is a modern safety case developed as a range of safety arguments concerning our management, scientific and technical understanding, optimisation of the facility, as well as assessment calculations. A number of key advances have been made since the previous submission. In particular, the 2011 ESC addresses the criticisms made by the regulator on the previous submission in 2002, including those relating to lack of demonstration of optimisation, high calculated doses and risks compared with guidance levels, treatment of coastal erosion, and treatment of uncertainty. The ESC is being reviewed by the environmental regulator and it is hoped that a new permit for disposal of LLW and installation of closure engineering, along with the appropriate planning permission, will be obtained during 2013. The ESC, including its proposed waste acceptance arrangements, is already being implemented by the LLWR where consistent with our current Permit. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗
NASA NTRS2009

Deriving Safety Cases from Automatically Constructed Proofs

Formal proofs provide detailed justification for the validity of claims and are widely used in formal software development methods. However, they are often complex and difficult to understand, because the formalism in which they are constructed and encoded is usually machine-oriented, and they may also be based on assumptions that are not justified. This causes concerns about the trustworthiness of using formal proofs as arguments in safety-critical applications. Here, we present an approach to develop safety cases that correspond to formal proofs found by automated theorem provers and reveal the underlying argumentation structure and top-level assumptions. We concentrate on natural deduction style proofs, which are closer to human reasoning than resolution proofs, and show how to construct the safety cases by covering the natural deduction proof tree with corresponding safety case fragments. We also abstract away logical book-keeping steps, which reduces the size of the constructed safety cases. We show how the approach can be applied to the proofs found by the Muscadet prover.

Basir, Nurlida↗
DOE OSTI2015

Enhancements to a dissolver burn up credit safety case to reduce further GD use in the thermal oxide reprocessing plant (THORP), Sellafield - 14229

THORP reprocesses fuel from Britain's Advanced Gas-cooled Reactors (AGRs) and fuel from Light Water Reactors (LWRs). The THORP dissolvers use nitric acid poisoned with Gadolinium (Gd) to ensure criticality safety. The dissolver criticality safety case uses a burnup credit approach to determine a minimum required Gd concentration. The burn up credit approach followed originates from a time when fuel receipts for THORP were ongoing and hence models a deliberately conservative and artificial fuel type to cover all potential fuel receipts. External fuel receipts have now ceased and detailed information on post irradiation U and Pu isotopics is available for all fuel scheduled for reprocessing. Work has therefore been undertaken to determine whether the burn up credit safety case could be revised to be more representative of the fuel actually remaining for reprocessing and hence to reduce further the required Gd concentration for the dissolvers. This would ultimately reduce the quantity of high active liquid waste requiring treatment and storage. The great majority of fuel remaining for reprocessing in THORP is AGR fuel, for which the typical burnup is known to be much higher than was previously assumed in the safety case. Pu and U isotopics for irradiated AGR fuel were examined with the fuel inventory code FISPIN. Modelling with the code MONK then showed that the Gd requirement for irradiated AGR fuel of a given burnup was much lower than in the previous safety case due to the change in Pu:U ratio and Pu{sup 240} in Pu for AGR fuel compared with the previous conservative assumptions. The burnup of all remaining LWR fuel was found to be high and hence lower dissolver Gd concentrations could also be tolerated for reprocessing this fuel. The work has concluded that the THORP dissolver Gd concentration can be halved for all remaining LWR and AGR fuel campaigns with a consequent cost saving of ∼ UK pound 4 m in Gd and high active waste processing time. Implementation of this improvement is currently ongoing on the plant. (author)

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗
NASA NTRS2008

How Past Loss of Control Accidents May Inform Safety Cases for Advanced Control Systems on Commercial Aircraft

This paper describes five loss of control accidents involving commercial aircraft, and derives from those accidents three principles to consider when developing a potential safety case for an advanced flight control system for commercial aircraft. One, among the foundational evidence needed to support a safety case is the availability to the control system of accurate and timely information about the status and health of relevant systems and components. Two, an essential argument to be sustained in the safety case is that pilots are provided with adequate information about the control system to enable them to understand the capabilities that it provides. Three, another essential argument is that the advanced control system will not perform less safely than a good pilot.

Holloway, C. M.↗
DOE OSTI2013

Update on the review of the LLWR 2011 environmental safety case

The UK Low Level Waste Repository has submitted a fully revised Environmental Safety Case (ESC) to the Environment Agency for the continued operation of the site. The Environment Agency is reviewing the submission. As part of the review of the ESC, we have been engaging with the Environment Agency to answer questions and provide further clarification where required. Once the review is complete, LLWR will apply for a revised permit for the continued operation of the site. We are required by our current Permit to operate the site in accordance with the assumptions of the ESC. We have developed a process for the implementation and maintenance of the ESC as a 'live' safety case under formal change control, and the development of waste acceptance arrangements identified as necessary to ensure that the repository is operated in a safe and optimised way, consistent with the assumptions and results of the ESC. Engagement with waste consignors has been essential in the development of revised waste acceptance criteria. Additional work has also been carried out in the development of an Article 37 submission, presenting the ESC to local stakeholders and developing of waste emplacement strategies. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗
NASA NTRS2009

Deriving Safety Cases from Machine-Generated Proofs

Proofs provide detailed justification for the validity of claims and are widely used in formal software development methods. However, they are often complex and difficult to understand, because they use machine-oriented formalisms; they may also be based on assumptions that are not justified. This causes concerns about the trustworthiness of using formal proofs as arguments in safety-critical applications. Here, we present an approach to develop safety cases that correspond to formal proofs found by automated theorem provers and reveal the underlying argumentation structure and top-level assumptions. We concentrate on natural deduction proofs and show how to construct the safety cases by covering the proof tree with corresponding safety case fragments.

Basir, Nurlida↗
NASA NTRS2009

Deriving Safety Cases from Machine-Generated Proofs

Proofs provide detailed justification for the validity of claims and are widely used in formal software development methods. However, they are often complex and difficult to understand, because they use machine-oriented formalisms; they may also be based on assumptions that are not justified. This causes concerns about the trustworthiness of using formal proofs as arguments in safety-critical applications. Here, we present an approach to develop safety cases that correspond to formal proofs found by automated theorem provers and reveal the underlying argumentation structure and top-level assumptions. We concentrate on natural deduction proofs and show how to construct the safety cases by covering the proof tree with corresponding safety case fragments.

Basir, Nurlida↗
NASA NTRS2015

Safety Case Patterns: Theory and Applications

We develop the foundations for a theory of patterns of safety case argument structures, clarifying the concepts involved in pattern specification, including choices, labeling, and well-founded recursion. We specify six new patterns in addition to those existing in the literature. We give a generic way to specify the data required to instantiate patterns and a generic algorithm for their instantiation. This generalizes earlier work on generating argument fragments from requirements tables. We describe an implementation of these concepts in AdvoCATE, the Assurance Case Automation Toolset, showing how patterns are defined and can be instantiated. In particular, we describe how our extended notion of patterns can be specified, how they can be instantiated in an interactive manner, and, finally, how they can be automatically instantiated using our algorithm.

Safety Assurance↗
DOE OSTI2012

Implementing Stakeholders' Access to Expertise: Experimenting on Nuclear Installations' Safety Cases - 12160

In 2009 and 2010, the Institute for Nuclear Safety and Radiation Protection (IRSN) led two pilot actions dealing with nuclear installations' safety cases. One concerned the periodical review of the French 900 MWe nuclear reactors, the other concerned the decommissioning of a workshop located on the site of Areva's La Hague fuel-reprocessing plant site in Northwestern France. The purpose of both these programs was to test ways for IRSN and a small number of stakeholders (Non-Governmental Organizations (NGOs) members, local elected officials, etc.) to engage in technical discussions. The discussions were intended to enable the stakeholders to review future applications and provide valuable input. The test cases confirmed there is a definite challenge in successfully opening a meaningful dialogue to discuss technical issues, in particular the fact that most expertise reports were not public and the conflict that exists between the contrary demands of transparency and confidentiality of information. The test case also confirmed there are ways to further improvement of stakeholders' involvement. (authors)

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗
DOE OSTI2015

ORNL Evaluation of Electrabel Safety Cases for Doel 3 / Tihange 2: Final Report

Oak Ridge National Laboratory (ORNL) performed a detailed technical review of the 2015 Electrabel (EBL) Safety Cases prepared for the Belgium reactor pressure vessels (RPVs) at Doel 3 and Tihange 2 (D3/T2). The Federal Agency for Nuclear Control (FANC) in Belgium commissioned ORNL to provide a thorough assessment of the existing safety margins against cracking of the RPVs due to the presence of almost laminar flaws found in each RPV. Initial efforts focused on surveying relevant literature that provided necessary background knowledge on the issues related to the quasilaminar flaws observed in D3/T2 reactors. Next, ORNL proceeded to develop an independent quantitative assessment of the entire flaw population in the two Belgian reactors according to the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code, Section XI, Appendix G, Fracture Toughness Criteria for Protection Against Failure, New York (1992 and 2004). That screening assessment of all EBL-characterized flaws in D3/T2 used ORNL tools, methodologies, and the ASME Code Case N-848, Alternative Characterization Rules for QuasiLaminar Flaws . Results and conclusions from the ORNL flaw acceptance assessments of D3/T2 were compared with those from the 2015 EBL Safety Cases. Specific findings of the ORNL evaluation of that part of the EBL structural integrity assessment focusing on stability of the flaw population subjected to primary design transients include the following: ORNL s analysis results were similar to those of EBL in that very few characterized flaws were found not compliant with the ASME (1992) acceptance criterion. ORNL s application of the more recent ASME Section XI (2004) produced only four noncompliant flaws, all due to LOCAs. The finding of a greater number of non-compliant flaws in the EBL screening assessment is due principally to a significantly more restrictive (conservative) criterion for flaw size acceptance used by EBL. ORNL s screening assessment results (obtained using an analysis methodology different from that of EBL) are interpreted herein as confirming the EBL screening results for D3/T2. ORNL s independent refined analysis demonstrated the EBL-characterized flaw 1660, which is non-compliant in the ORNL and EBL screening assessment, is rendered compliant when modeled as a more realistic individual quasi-laminar flaw using a 3-D XFEM analysis approach. ORNL s and EBL s refined analyses are in good agreement for the flaw 1660 close to the clad/base metal interface; ORNL is not persuaded that repeating this exercise for more than one non-compliant flaw is necessary to accept the EBL conclusions derived from the aggregate of EBL refined analysis results. ORNL General Conclusions Regarding the Structural Integrity Assessment (SIA) Conducted by EBL for D3/T2 Based on comparative evaluations of ORNL and EBL SIA analyses and on consideration of other results, ORNL is in agreement with the general conclusions reported by Electrabel in their RPV D3/T2 Technical Summary Note of April 14, 2015: More than 99 percent of flaws in D3/T2 meet the defined screening criterion, rendering them benign with respect to initiation in the event of a design transient. Refined analyses of non-compliant flaws from the screening assessment indicate that only 11 of the 16196 detected flaws have a critical reference-temperature material index (designated RTNDT) that implies the possibility of the initiation of cleavage fracture at some future time. For those 11 2 flaws, the calculated margin in RTNDT (a measure of acceptable embrittlement relative to end-ofservice-life conditions) is significant, being greater than 80 C. Fatigue crack growth is not a concern in the flaw-acceptability analyses. Primary stress re-evaluation confirms that the collapse pressure is more than 1.5 times the design pressure in the presence of defects detected in D3/T2. Sufficient conservatisms are built into the input data and into the different steps of the SIA; in some cases, those conservatisms are quantified and imply that additional margins exist in the SIA. Taken as a whole, the foregoing results and conclusions confirm the structural integrity of Doel 3 and Tihange 2 under all design transients with ample margin in the presence of the 16196 detected flaws.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
NASA NTRS2023

Safety Case for Small Uncrewed Aircraft Systems (sUAS) Beyond Visual Line of Sight (BVLOS) Operations at NASA Langley Research Center

This Technical Memorandum (TM) is written to provide for dissemination of the methods and safety considerations for operations of small Uncrewed Aerial Systems (sUAS) Beyond Visual Line-of-Sight (BVLOS)at NASA Langley Research Center. It includes the Safety Case used to acquire a BVLOS Certificate of Authorization (COA) from the FAA and is being published to enable others to benefit from this work. The intended operations, subject to approval from the Federal Aviation Administration (FAA) and the National Aeronautics and Space Administration (NASA), will include a combination of Within Visual Line of Sight (WVLOS) and Beyond Visual Line of Sight (BVLOS) flights, comprising of at most five sUAS operating concurrently, with no more than three operating BVLOS. Flights will occur in a subset of the Langley Air Force Base (LAFB) Class D airspace (KLFI) at a maximum altitude of 400 ft AGL. Most operations within this subset will take place in the City Environment Range Testing for Autonomous Integrated Navigation (CERTAIN) Range. The CERTAIN Range includes airspace inside the borders of NASA Langley Research Center (LaRC). Additional airspace over the northern section of CERTAIN will be requested as part of the Certificate of Authorization (COA). NASA LaRC BVLOS operations on the CERTAIN Range can be broken down into five critical components needed to meet the 14 CFR § 91.113 see and avoid requirement: 1) procedural deconfliction with LAFB for UAS operations at or below 400 ft and manned aircraft at or above 900’ AGL; 2) ground equipment for detection of intruder aircraft and to support communications between crewmembers ; 3) sUAS vehicles with advanced onboard automation capable of autonomously maintaining safe separation; 4) BVLOS standardized operating procedures (SOPs); 5) and personnel to execute the flight operations in accordance with the SOPs and respond to airborne contingencies. The introduction of new ground equipment includes the use of the Remote Operations for Autonomous Missions (ROAM) UAS Operations Center, development and use of an Integrated Airspace Display (IAD), use of the L-STAR and GA-9120 radars, and the incorporation of standardized Vertiports. The ROAM Operations Center will be the central point for all BVLOS sUAS operations. All command and control (C2), voice communications and airspace awareness displays will reside inside ROAM. The IAD will provide raw data from ADS-B, FLARM, radar tracks and telemetered GPS vehicle positions for interpretation by an Airspace Monitor. The radars will search the class D airspace around the CERTAIN Range and serve as a backup to procedural deconfliction procedures coordinated with LAFB. In the event of a procedural deconfliction breakdown, radar detections of non-participating aircraft will be available so that the 91.113 see and avoid requirement can still be safely met. Finally, the incorporation of Vertiports will have video and network connectivity that enables large numbers of sUAS launches and recoveries from a single location. This is a continuation of the remote command and control of unpiloted aircraft component focused on evaluating unpiloted aircraft flight crew roles and responsibilities, control interfaces and the associated data links needed to operate a fleet of aircraft within a UAM Ecosystem. This work supports the development of future aviation operational concepts based on an Urban Air Mobility Maturity Level (UML) 4 environment (Patterson, 2020). It is assumed that future airspace will include hundreds of simultaneous aircraft operations within the airspace, therefore scalable operations are essential for enabling this future airspace to become a reality. Follow on work includes envisioned flights that expand operations beyond the CERTAIN range and lead to an effective Maritime Surveillance capability.

Matthew W Coldsnow↗
NASA NTRS2010

Model Transformation for a System of Systems Dependability Safety Case

Software plays an increasingly larger role in all aspects of NASA's science missions. This has been extended to the identification, management and control of faults which affect safety-critical functions and by default, the overall success of the mission. Traditionally, the analysis of fault identification, management and control are hardware based. Due to the increasing complexity of system, there has been a corresponding increase in the complexity in fault management software. The NASA Independent Validation & Verification (IV&V) program is creating processes and procedures to identify, and incorporate safety-critical software requirements along with corresponding software faults so that potential hazards may be mitigated. This Specific to Generic ... A Case for Reuse paper describes the phases of a dependability and safety study which identifies a new, process to create a foundation for reusable assets. These assets support the identification and management of specific software faults and, their transformation from specific to generic software faults. This approach also has applications to other systems outside of the NASA environment. This paper addresses how a mission specific dependability and safety case is being transformed to a generic dependability and safety case which can be reused for any type of space mission with an emphasis on software fault conditions.

Murphy, Judy↗
DOE OSTI2020

Deep Isolation-Development of the Safety Case for Disposal of Radioactive Wastes in Horizontal Boreholes - 20028

Deep Isolation has developed a safe, secure, and permanent geological disposal method for high-level waste, including spent nuclear fuel as well as sealed sources and other highly radioactive materials. The method leverages well established directional drilling technology to create horizontal repositories deep underground. The combination of great depth (1-3 km) and the ability to precisely position repositories in a horizontal orientation provides access to geologic strata that are inaccessible for typical mined and deep vertical borehole repositories. A number of potential direct and indirect safety benefits accrue including:1) greater depth below regional freshwater aquifers; 2) increased flexibility and more geologic options for siting; 3) access to deep formations with persistent and sustained reducing conditions. In addition there are a number of safety elements related specifically to the horizontal repository geometry including: 1) passive direction of thermally driven fluid and radionuclide movement away from the vertical access hole and toward the 'dead end' portion of the repository; 2) mitigation of seismic hazards by orienting repositories parallel to local and regional fault structures. In this paper we explore and discuss some of the key technologic, geologic and hydrologic elements that support the deep horizontal borehole safety case. The stalemate seen across the globe on the disposal of spent nuclear fuel and high-level waste can be broken. Deep Isolation offers a novel option for safe, secure, and permanent deep geological disposal of nuclear waste that can be developed as centralized repositories or adapted to smaller regional or site-specific repositories located near waste sources. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗