Results for “Behavior Based Safety” — Page 3

DOE OSTI2022

Reactor Performance and Safety Characteristics of Beryllium-Based Composite Moderators as Replacements for Graphite in mHTGRs

Here, this study evaluates beryllium-based two-phase composite moderators as an alternative to graphite in an evaluation of reactor performance and safety characteristics. Historically, modular high-temperature gas-cooled reactors (mHTGRs) use graphite as a moderator because of its high moderating ratio and reasonable thermal properties; however, graphite has unfavorable properties under irradiation, which can require component replacement and a significant radioactive waste burden. In this assessment, we explore advanced moderators comprised of magnesium oxide (MgO) as the host matrix and beryllium metal and/or beryllium oxide (Be and/or BeO) as the entrained moderating phase. For the reactor performance and thermal-hydraulic safety analysis, the core design model of the General Atomics mHTGR-350 was used to demonstrate the feasibility of a “drop-in” replacement of graphite using the beryllium-based moderators. We employed the neutronics code Serpent to analyze the moderating behavior of the composite moderators with comparisons drawn to graphite. We performed a scoping analysis of accidents for mHTGRs using RELAP to show that these moderators do not present impediments to safety and are expected to stay within temperature limits. Measured thermophysical properties of the composite moderators are used in the thermal-hydraulic assessments. Our analysis reveals that the two-phase composite MgO-matrix beryllium-based moderators are a suitable replacement for graphite.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

DOE OSTI2018

Hydrogen Quantitative Risk Assessment

DOE has identified consistent safety, codes, and standards as a critical need for the deployment of hydrogen technologies, with key barriers related to the availability and implementation of technical information in the development of regulations, codes, and standards. Advances in codes and standards have been enabled by risk-informed approaches to create and implement revisions to codes, such as National Fire Protection Association (NFPA) 2, NFPA 55, and International Organization for Standardization (ISO) Technical Specification (TS)-19880-1. This project provides the technical basis for these revisions, enabling the assessment of the safety of hydrogen fuel cell systems and infrastructure using QRA and physics-based models of hydrogen behavior. The risk and behavior tools that are developed in this project are motivated by, shared directly with, and used by the committees revising relevant codes and standards, thus forming the scientific basis to ensure that code requirements are consistent, logical, and defensible.

08 HYDROGEN↗

DOE OSTI2019

Hydrogen Quantitative Risk Assessment (Annual Progress Report)

DOE has identified consistent safety, codes, and standards as a critical need for the deployment of hydrogen technologies, with key barriers related to the availability and implementation of technical information in the development of regulations, codes, and standards. Advances in codes and standards have been enabled by risk-informed approaches to create and implement revisions to codes, such as National Fire Protection Association (NFPA) 2, NFPA 55, and International Organization for Standardization (ISO) Technical Specification (TS)-19880-1. This project provides the technical basis for these revisions, enabling the assessment of the safety of hydrogen fuel cell systems and infrastructure using QRA and physics-based models of hydrogen behavior. The risk and behavior tools that are developed in this project are motivated by, shared directly with, and used by the committees revising relevant codes and standards, thus forming the scientific basis to ensure that code requirements are consistent, logical, and defensible.

08 HYDROGEN↗

NASA NTRSDate not supplied

Physics-Guided Deep Learning for Complex System Health Management and Decision Making

The landscape of complex engineered systems is rapidly evolving, from smart manufacturing facilities to next-generation transportation vehicles. As these systems become increasingly sophisticated and interconnected, the need for advanced health management systems grows ever more critical. These systems must go beyond simple monitoring, actively predicting potential failures before they occur. This paradigm shift from fixed maintenance schedules to condition-based predictions is key to optimizing system performance, enhancing safety, and paving the way for autonomous decision-making across various industries. Whether in industrial processes, energy systems, or advanced transportation, the ability to anticipate and prevent failures is becoming a cornerstone of operational excellence. To accurately predict the future health of any complex system, knowledge of its current health state and future operational conditions is essential. Recent advancements in data-driven algorithms have generated growing interest in artificial intelligence for industrial applications. However, the limitations of pure data-driven methods, particularly in industries where data acquisition is costly and limited, have become apparent. This has led to a focus on blending physics with data-driven algorithms, mitigating the drawbacks of both approaches while emphasizing their respective advantages. This research proposes a novel framework for integrating physics-based performance models with deep learning algorithms for the prognostics of complex safety-critical systems. In this approach, physics-based models serve as a blueprint, capturing fundamental system behaviors, while deep learning algorithms, leveraging real-world sensor data, fill in gaps and identify subtle patterns indicative of potential problems. This hybrid methodology, utilizing techniques such as Physics-Informed Neural Networks (PINNs), offers a powerful solution for predicting system health. By fusing domain knowledge with data-driven insights, this approach promises more accurate, adaptable, and reliable models for health prediction. The resulting framework is versatile, applicable across various sectors including aerospace, manufacturing, and energy systems, ultimately contributing to safer, more efficient operations in our increasingly complex technological landscape.

Diagnostics↗

DOE OSTI2023

Light Water Sustainability Program: Optimizing Information Automation Using a New Method Based on System-Theoretic Process Analysis

This report describes the interim progress for research supporting the design and optimization of information automation systems for nuclear power plants. Much of the domestic nuclear fleet is currently focused on modernizing technologies and processes, including transitioning toward digitalization in the control room and elsewhere throughout the plant, along with a greater use of automation, artificial intelligence, robotics, and other emerging technologies. While there are significant opportunities to apply these technologies toward greater plant safety, efficiency, and overall cost-effectiveness, optimizing their design and avoiding potential safety and performance risks depends on ensuring that human-performance-related organizational and technical design issues are identified and addressed. This report describes modeling tools and techniques, based on sociotechnical system theory, to support these design goals and their application in the current research effort. The report is intended for senior nuclear energy stakeholders, including regulators, corporate management, and senior plant management. We have developed and employed a method to design an optimized information automation ecosystem (IAE) based on the systems-theoretic constructs underlying sociotechnical systems theory in general and the Systems-Theoretic Accident Modeling and Processes (STAMP) approach in particular. We argue that an IAE can be modeled as an interactive information control system whose behavior can be understood in terms of dynamic control and feedback relationships amongst the system’s technical and organizational components. Up to this point, we have employed a Causal Analysis based on STAMP (CAST) technique to examine a performance- and safety-related incident at an industry partner’s plant that involved the unintentional activation of an emergency diesel generator. This analysis provided insight into the behavior of the plant’s current information control structure within the context of a specific, significant event. Our ongoing analysis is focused on identifying near-term process improvements and longer-term design requirements for an optimized IAE system. The latter analyses will employ a second STAMP-derived technique, System-Theoretic Process Analysis (STPA). STPA is a useful modeling tool for generating and analyzing actual or potential information control structures. Finally, we have begun modeling plantwide organizational relationships and processes. Organizational system modeling will supplement our CAST and STPA findings and provide a basis for mapping out a plantwide information control architecture. CAST analysis findings indicate an important underlying contributor to the incident under investigation, and a significant risk to information automation system performance, was perceived schedule pressure, which exposed weaknesses in interdepartmental coordination between and within responsible plant organizations and challenged the resilience of established plant processes, until a human caused the initiating event. These findings are discussed in terms of their risk to overall system performance and their implications for information automation system resilience and brittleness. We present two preliminary information automation models. The proactive issue resolution model is a test case of an information automation concept with significant near-term potential for application and subsequent reduction in significant plant events. The IAE model is a more general representation of a broader, plantwide information automation system. From our results, we have generated a set of preliminary system-level requirements and safety constraints. These requirements will be further developed over the remainder of our project in collaboration with nuclear industry subject matter experts and specialists in the technical systems under consideration. Additionally, we will continue to pursue the system analyses initiated in the first part of our effort, with a particular emphasis on STPA as the main tool to identify weak or weakening control structures that affect the resilience of organizations and programs. Our intent is to broaden the scope of the analysis from an individual use case to a related set of use cases (e.g., maintenance tasks, compliance tasks) with similar human-system performance challenges. This will enable more generalized findings to refine the Proactive Issue Resolution and IAE models, as well as their system-level requirements and safety constraints. We will use organizational system modeling analyses to supplement STPA findings and model development. We conclude the report with a set of summary recommendations and an initial draft list of system-level requirements and safety constraints for optimized information automation systems.

99 GENERAL AND MISCELLANEOUS↗

DOE OSTI2019

Decoupling of heat generated from ejected and non-ejected contents of 18650-format lithium-ion cells using statistical methods

Effective thermal management systems, designed to handle the impacts of thermal runaway (TR) and to prevent cell-to-cell propagation, are key to safe operation of lithium-ion (Li-ion) battery assemblies. Critical factors for optimizing these systems include the total energy released during a single cell TR event and the fraction of the total energy that is released through the cell casing versus through the ejecta material. A unique fractional thermal runaway calorimeter (FTRC), designed to characterize said critical factors, was utilized to examine the TR behavior of 18650-format Li-ion cells representing a variety of manufacturers, chemistries, capacities, and safety features. Primarily, the impacts of bottom vent (BV) safety features, varied cell casing thickness, and Dreamweaver cellulose based separators were assessed for select cell types. A subset of cells also had an imbedded internal short circuiting (ISC) device to allow examination of TR behavior initiated at lower temperatures (i.e. closer to field failure conditions). The impact of bottom rupture on TR behavior was also examined for experiments that resulted in this non-standard failure mechanism. Statistical analysis of the results for each cell configuration reveals that a lognormal distribution effectively characterizes the variation of total TR energy release. Typically 20%-30% of the total energy yield is released through the cell casing with the remainder through the ejecta material. Higher energy cells tend to exhibit more violent ejections and less predictable TR events. Inclusion of a BV feature reduces the overall severity of the TR event and can increase the predictability. Results also suggest that the magnitude of the TR event may not be directly proportional to the stored electrical energy, but rather has additional dependence on other design and failure mode factors.

25 ENERGY STORAGE↗

DOE OSTI2025

Development of a Digital Twin for Hydrogen Dispersion and Safety Assessment in an Electrolyzer Based Hydrogen Production Facility

Digital twin models are virtual representations of physical systems that use real-time data to simulate and optimize performance. This study presents the development and initial implementation of a digital twin (DT) for the electrolyzer-based hydrogen production facility at NREL's Advanced Research on Integrated Energy Systems (ARIES), focused on enhancing safety and optimizing sensor placement through physics-based simulations and metadata integration. The DT incorporates detailed facility-specific information, including component layout, leak locations, and controlled release parameters, to model hydrogen dispersion under varying environmental conditions. Using steady-state computational fluid dynamics (CFD) simulations informed by real meteorological data, such as wind speed, direction, and vertical wind profiles, the DT enables visualization of hydrogen plume behavior and spatial concentration distributions. Comparative analysis between high and low wind speed scenarios illustrates the significant influence of wind dynamics on plume shape and extent, with horizontal momentum dominating dispersion at higher speeds, while buoyancy effects become more prominent under low wind conditions. These simulations generate a rich dataset embedded within the DT, allowing users to assess potential leak outcomes and identify optimal sensor locations based on concentration thresholds. The model supports scenario-based analysis to guide safety strategies and equipment deployment for open-area hydrogen infrastructure. The digital twin thus serves as a dynamic platform for virtual prototyping, providing predictive insight into hydrogen behavior and enhancing risk-informed decision-making. This initial phase establishes a validated foundation for future integration of transient, uncontrolled leak scenarios and real-time sensor feedback, positioning the DT as a critical tool for safety design, operational planning, and adaptive monitoring in hydrogen systems. Overall, the approach demonstrates the value of combining environmental data with digital simulations to inform safer and more efficient deployment of hydrogen technologies.

08 HYDROGEN↗

DOE OSTI2026

Development of a Digital Twin for Hydrogen Dispersion and Safety Assessment in an Electrolyzer-Based Hydrogen Production Facility: Preprint

Digital twin models are virtual representations of physical systems that use real-time data to simulate and optimize performance. This study presents the development and initial implementation of a digital twin (DT) for the electrolyzer-based hydrogen production facility at the National Renewable Energy Laboratory (NREL)'s Advanced Research on Integrated Energy Systems (ARIES), focused on enhancing safety and optimizing sensor placement through physics-based simulations and metadata integration. The DT incorporates detailed facility-specific information, including component layout, leak locations, and controlled release parameters, to model hydrogen dispersion under varying environmental conditions. Using steady-state computational fluid dynamics (CFD) simulations informed by real meteorological data, such as wind speed, direction, and vertical wind profiles, the DT enables visualization of hydrogen plume behavior and spatial concentration distributions. Comparative analysis between high and low wind speed scenarios illustrates the significant influence of wind dynamics on plume shape and extent, with horizontal momentum dominating dispersion at higher speeds, while buoyancy effects become more prominent under low wind conditions. These simulations generate a rich dataset embedded within the DT, allowing users to assess potential leak outcomes and identify optimal sensor locations based on concentration thresholds. The model supports scenario-based analysis to guide safety strategies and equipment deployment for open-area hydrogen infrastructure. The digital twin thus serves as a dynamic platform for virtual prototyping, providing predictive insight into hydrogen behavior and enhancing risk-informed decision-making. This initial phase establishes a validated foundation for future integration of transient, uncontrolled leak scenarios and real-time sensor feedback, positioning the DT as a critical tool for safety design, operational planning, and adaptive monitoring in hydrogen systems. Overall, the approach demonstrates the value of combining environmental data with digital simulations to inform safer and more efficient deployment of hydrogen technologies.

08 HYDROGEN↗

DOE OSTI2022

Understanding the Effect of Cathode Composition on the Interface and Crosstalk in NMC/Si Full Cells

Crosstalk between the cathode and the anode in lithium-ion batteries has a great impact on performance, safety, and cycle lifetime. Still, no report exists for a systematic investigation on crosstalk behavior in silicon (Si)-based cells as a function of transition metal composition in cathodes. We studied the effect of crosstalk on degradation of Si-rich anodes in full cells with different cathodes having the same crystal structure but different transition metal compositions, such as LiNi 1/3 Mn 1/3 Co 1/3 O 2 (NM111), LiNi 0.5 Mn 0.3 Co 0.2 O 2 (NMC532), and LiNi 0.8 Mn 0.1 Co 0.1 O 2 (NMC811). We found that the transition metal composition in cathodes, especially Mn ion concentration, significantly affects electrolyte decomposition reactions, even from very early cycles. This change causes differences in the solid electrolyte interphase (SEI) chemistry of each aged Si sample. As a result, each of the aged Si samples has a different electrochemistry, in terms of initial Coulombic efficiency and the mechanism of capacity fade.

25 ENERGY STORAGE↗

NASA NTRSDate not supplied

Opposed-flow Spreading Flames: Effect of Sub-atmospheric Pressure on Spread and Burning Rates

Flame spread over solid fuels is a canonical problem in fire science, due to its direct implications on material flammability and importance in fire development. Flames in a microgravity environment can behave very differently than on Earth, posing additional risks for spaceflight life safety. Sub-atmospheric pressures in ground-based experiments have been proposed to approximately replicate the burning behavior of solid fuels in reduced gravity conditions because of similar effects on heat and mass transfer mechanisms from the flame to the solid. In opposed-flow flame spread, the solid fuel is heated by the flame ahead of its leading edge, and this process is strongly affected by the ambient conditions. In this work, we consider flames spreading over flat thin acrylic samples exposed to a forced flow of 20 cm/s, and pressures between 30 and 100 kPa. When radiation losses and chemical kinetic effects are neglected, experimental and theoretical results suggest an independence of the spread rate on pressure. However, the spread rate shows a decreasing trend with lower pressure in the range 30-60 kPa. The mass burning rate, calculated from the samples weight measured before and after the experiments, shows a similar trend. The flame length, on the other hand, shows a non-monotonic behavior, reaching a maximum at 60 kPa. Additionally, gas emissions measured during the experiments are used to estimate the heat release rate of the spreading flames. The comparison of the heat release rate obtained from the measured emissions and the estimated mass burning rates, suggests that chemical kinetics is not driving the decrease in flame spread observed at low pressures, whereas radiation losses could be responsible in analogy to what has been observed in micro and partial gravity studies. These results could provide more information to guide future Earth-based material flammability testing for spacecraft applications.

fire↗

DOE OSTI2022

A new mechanism of stabilizing SEI of Si anode driven by crosstalk behavior and its potential for developing high performance Si-based batteries

Stabilizing solid electrolyte interphase (SEI) is a key factor for determining cell performance of Silicon (Si) anode, such as safety, cycle lifetime, and calendar lifetime. Here, we found a new potential for stabilizing SEI of the Si anode, driven by crosstalk with cathode material. Here we investigated the effect of crosstalk on the chemistry of SEI of the Si anode as a function of three different, representative cathode materials: LiNi 0.5 Mn 0.3 Co 0.2 O 2 (NMC532), LiNi 0.8 Mn 0.1 Co 0.1 O 2 (NMC811), and LiFePO 4 (LFP). Specifically, we observed that crosstalk significantly affected the formation and growth mechanism of SEI layer on the Si anodes. Unexpectedly, dissolved Fe ions from the LFP cathode has a positive impact on the chemistry and electrochemical stability of the SEI layer of Si anode compared to the other cathodes, resulting in better electrochemical performance in terms of initial coulombic efficiency and capacity fade.

25 ENERGY STORAGE↗

DOE OSTI2024

MARVEL Reactor Fuel Performance Report (Rev.2)

The Microreactor Applications Research Validation and EvaLuation (MARVEL) project is producing a high temperature liquid metal-cooled nuclear test bed at Idaho National Laboratory (INL) to ultimately improve the integration of microreactors to end-user applications. This ambitious effort seeks to design, authorize, construct, test, and operate the reactor within five years. In order to construct and operate the MARVEL reactor in a timely manner, the system will utilize materials and component designs which have already been used, qualified, or licensed from previous reactors. The MARVEL reactor will be located at the INL Transient Reactor Test (TREAT) facility in the north high-bay equipment pit and will use the existing 304 stainless steel-clad U-ZrH1.6 pin-type fuel system developed by General Atomics and purchased from TRIGA International. This fuel has been previously qualified under the United States Department of Energy’s (US DOE) Reduced Enrichment for Research and Test Reactors (RERTR) Program. Even though the regulator of the MARVEL reactor is the US DOE, the standards and overall approach recommended by the Nuclear Regulatory Commission is well-defined and utilized here. Following NUREG-1537 regulatory guidance, this report documents the authorization case for the MARVEL fuel system’s application to MARVEL and establishes stable and predictable fuel performance during the most thermophysically unfavorable conditions achievable in the MARVEL reactor. To that end, this report provides a comprehensive survey of the known thermophysical properties, performance, and quantitative relationships associated with the MARVEL reactor fuel element and uses this information to determine its mechanical integrity and risk of reaching unacceptable conditions during the most extreme accident scenarios predicted for the reactor using the most conservative assumptions available. The information contained herein is compiled from a combination of historical reports and peer reviewed scientific publication manuscripts. Known mechanisms under which the fuel is susceptible to failure are highlighted and compared to conditions that could exist in the MARVEL reactor during an unanticipated transient or accident scenario. The two scenarios considered for analysis in this report are (1) an unprotected loss of flow accident and (2) a hypothetical unprotected loss of coolant accident during the loss of flow accident. Preliminary 2D steady-state analyses herein indicate that both fuel-cladding chemical interactions and fuel-cladding mechanical interactions are negligible throughout the fuel’s operational cycle under both normal and high temperature accident scenario conditions. Although higher fidelity 3D time-dependent modeling and simulations are planned, the following may be concluded presently. The MARVEL fuel element maintains its geometric stability and structural integrity during the most extreme accident scenarios predicted for the MARVEL reactor. The hoop stress during the unprotected loss of flow accident reaches about -1.27 MPa; this negative stress indicates that it is compressive rather than tensile. The compressive stress is a result of the NaK pressure on the outside of the fuel element, caused by the restricted thermal expansion of the NaK coolant, exceeding the internal pressures generated inside of the fuel element. The hoop stress generated in the cladding during the unprotected loss of coolant accident reaches a maximum of about approximately 10 MPa, which is nearly an order of magnitude less than the predicted yield strength of the cladding under high-temperature accident scenario conditions. Calculations were compared with results from high performance computational simulations using BISON and are in very close agreement. A conservative MARVEL fuel meat peak temperature limit of 900 °C is recommended presently, which is about 180 °C higher than the peak fuel temperature predicted to occur during the most extreme accident. Based on the known properties and behavior of the MARVEL fuel element, the fuel successfully meets its design and safety requirements under normal and most extreme accident conditions with a large safety margin.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗

DOE OSTI2026

MARVEL Reactor Fuel Performance Report

The Microreactor Applications Research Validation and EvaLuation (MARVEL) project is producing a high temperature liquid metal-cooled nuclear test bed at Idaho National Laboratory (INL) to ultimately improve the integration of microreactors to end-user applications. This ambitious effort seeks to design, authorize, construct, test, and operate the reactor within five years. In order to construct and operate the MARVEL reactor in a timely manner, the system will utilize materials and component designs which have already been used, qualified, or licensed from previous reactors. The MARVEL reactor will be located at the INL Transient Reactor Test (TREAT) facility in the north high-bay equipment pit and will use the existing 304 stainless steel-clad U-ZrH1.6 pin-type fuel system developed by General Atomics and purchased from TRIGA International. This fuel has been previously qualified under the United States Department of Energy’s (US DOE) Reduced Enrichment for Research and Test Reactors (RERTR) Program. Even though the regulator of the MARVEL reactor is the US DOE, the standards and overall approach recommended by the Nuclear Regulatory Commission is well-defined and utilized here. Following NUREG-1537 regulatory guidance, this report documents the authorization case for the MARVEL fuel system’s application to MARVEL and establishes stable and predictable fuel performance during the most thermophysically unfavorable conditions achievable in the MARVEL reactor. To that end, this report provides a comprehensive survey of the known thermophysical properties, performance, and quantitative relationships associated with the MARVEL reactor fuel element and uses this information to determine its mechanical integrity and risk of reaching unacceptable conditions during the most extreme accident scenarios predicted for the reactor using the most conservative assumptions available. The information contained herein is compiled from a combination of historical reports and peer reviewed scientific publication manuscripts. Known mechanisms under which the fuel is susceptible to failure are highlighted and compared to conditions that could exist in the MARVEL reactor during an unanticipated transient or accident scenario. The two scenarios considered for analysis in this report are (1) an unprotected loss of flow accident and (2) a hypothetical unprotected loss of coolant accident during the loss of flow accident. Preliminary 2D steady-state analyses herein indicate that both fuel-cladding chemical interactions and fuel-cladding mechanical interactions are negligible throughout the fuel’s operational cycle under both normal and high temperature accident scenario conditions. Although higher fidelity 3D time-dependent modeling and simulations are planned, the following may be concluded presently. The MARVEL fuel element maintains its geometric stability and structural integrity during the most extreme accident scenarios predicted for the MARVEL reactor. The hoop stress during the unprotected loss of flow accident reaches about -1.27 MPa; this negative stress indicates that it is compressive rather than tensile. The compressive stress is a result of the NaK pressure on the outside of the fuel element, caused by the restricted thermal expansion of the NaK coolant, exceeding the internal pressures generated inside of the fuel element. The hoop stress generated in the cladding during the unprotected loss of coolant accident reaches a maximum of about approximately 10 MPa, which is nearly an order of magnitude less than the predicted yield strength of the cladding under high-temperature accident scenario conditions. Calculations were compared with results from high performance computational simulations using BISON and are in very close agreement. A conservative MARVEL fuel meat peak temperature limit of 900 °C is recommended presently, which is about 180 °C higher than the peak fuel temperature predicted to occur during the most extreme accident. Based on the known properties and behavior of the MARVEL fuel element, the fuel successfully meets its design and safety requirements under normal and most extreme accident conditions with a large safety margin.

11 - NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗

DOE OSTI2025

Contrasting Chemical Kinetic Parameters for Near In‐Service‐Temperature Aging and High‐Temperature Thermal Decomposition of Triaminotrinitrobenzene Formulations

Triaminotrinitrobenzene-based high explosives such as LX-17 offer high energy density and exceptional safety, yet their long-term aging behavior at low temperatures remains poorly understood. In this study, several legacy and new production lots of LX-17 were subjected to accelerated aging experiments below 100°C, during which the formation rate of the initial degradation product, monofurazan (F1), was monitored. Kinetic analysis was performed using a sample-age-aware computational approach, yielding activation energy estimates of 82–91 kJ mol −1 for the low-temperature initiation step—markedly lower than the ∼200 kJ mol −1 associated with high-temperature thermal decomposition. Extrapolation from established cookoff models supports the conclusion that the dominant degradation mechanism at low temperatures differs from that at high temperatures. In conclusion, our results provide a unified kinetic framework that bridges the gap between in-service conditions and high-temperature damage.

Chemistry - Chemical explosives↗

NASA NTRS2005

Formal Safety Certification of Aerospace Software

In principle, formal methods offer many advantages for aerospace software development: they can help to achieve ultra-high reliability, and they can be used to provide evidence of the reliability claims which can then be subjected to external scrutiny. However, despite years of research and many advances in the underlying formalisms of specification, semantics, and logic, formal methods are not much used in practice. In our opinion this is related to three major shortcomings. First, the application of formal methods is still expensive because they are labor- and knowledge-intensive. Second, they are difficult to scale up to complex systems because they are based on deep mathematical insights about the behavior of the systems (t.e., they rely on the "heroic proof"). Third, the proofs can be difficult to interpret, and typically stand in isolation from the original code. In this paper, we describe a tool for formally demonstrating safety-relevant aspects of aerospace software, which largely circumvents these problems. We focus on safely properties because it has been observed that safety violations such as out-of-bounds memory accesses or use of uninitialized variables constitute the majority of the errors found in the aerospace domain. In our approach, safety means that the program will not violate a set of rules that can range for the simple memory access rules to high-level flight rules. These different safety properties are formalized as different safety policies in Hoare logic, which are then used by a verification condition generator along with the code and logical annotations in order to derive formal safety conditions; these are then proven using an automated theorem prover. Our certification system is currently integrated into a model-based code generation toolset that generates the annotations together with the code. However, this automated formal certification technology is not exclusively constrained to our code generator and could, in principle, also be integrated with other code generators such as RealTime Workshop or even applied to legacy code. Our approach circumvents the historical problems with formal methods by increasing the degree of automation on all levels. The restriction to safety policies (as opposed to arbitrary functional behavior) results in simpler proof problems that can generally be solved by fully automatic theorem proves. An automated linking mechanism between the safety conditions and the code provides some of the traceability mandated by process standards such as DO-178B. An automated explanation mechanism uses semantic markup added by the verification condition generator to produce natural-language explanations of the safety conditions and thus supports their interpretation in relation to the code. It shows an automatically generated certification browser that lets users inspect the (generated) code along with the safety conditions (including textual explanations), and uses hyperlinks to automate tracing between the two levels. Here, the explanations reflect the logical structure of the safety obligation but the mechanism can in principle be customized using different sets of domain concepts. The interface also provides some limited control over the certification process itself. Our long-term goal is a seamless integration of certification, code generation, and manual coding that results in a "certified pipeline" in which specifications are automatically transformed into executable code, together with the supporting artifacts necessary for achieving and demonstrating the high level of assurance needed in the aerospace domain.

Denney, Ewen↗

NASA NTRS2012

Damage Tolerance Behavior of Friction Stir Welds in Aluminum Alloys

Friction stir welding is a solid state welding process used in the fabrication of various aerospace structures. Self-reacting and conventional friction stir welding are variations of the friction stir weld process employed in the fabrication of cryogenic propellant tanks which are classified as pressurized structure in many spaceflight vehicle architectures. In order to address damage tolerance behavior associated with friction stir welds in these safety critical structures, nondestructive inspection and proof testing may be required to screen hardware for mission critical defects. The efficacy of the nondestructive evaluation or the proof test is based on an assessment of the critical flaw size. Test data describing fracture behavior, residual strength capability, and cyclic mission life capability of friction stir welds at ambient and cryogenic temperatures have been generated and will be presented in this paper. Fracture behavior will include fracture toughness and tearing (R-curve) response of the friction stir welds. Residual strength behavior will include an evaluation of the effects of lack of penetration on conventional friction stir welds, the effects of internal defects (wormholes) on self-reacting friction stir welds, and an evaluation of the effects of fatigue cycled surface cracks on both conventional and selfreacting welds. Cyclic mission life capability will demonstrate the effects of surface crack defects on service load cycle capability. The fracture data will be used to evaluate nondestructive inspection and proof test requirements for the welds.

McGill, Preston↗

NASA NTRS2014

MARGInS: Model-Based Analysis of Realizable Goals in Systems

Under NASAs Constellation effort, the Exploration Technology Development Program funded research toward a system validation capability that applied machine learning and test-case generation techniques to the analysis of black-box system behavior. The behavior analysis capability scaled to spaces of hundreds of input parameters and tens of thousands of test cases. Aerospace systems at the vehicle level, especially those systems which contain some level of autonomy, are best described by hybrid and non-linear mathematics. Even simplified models of such systems need parameter dimensionalities in the hundreds or thousands of parameters in order to capture sufficient fidelity. The System Safety Assessments (such as those described in the SAE ARP 4761A Safety Assessment Process guidelines) for these systems are prone to errorinteractions between the vehicles subsystems are complex, and can display emergent behaviors. NASA captured this new analysis in the Model-based Analysis of Realizable Goals in Systems (MARGInS) tool and applied it to the Pad Abort 1 (PA-1) simulation as part of the independent validation and verification cycle before the PA-1 flight test in May of 2010. MARGInS evaluated the adherence of the high-fidelity simulation to its requirements, and deter- mined the margins to failure from the expected nominal input conditions. Following the PA-1 test, the capabilities within the MARGInS framework have been extended with sophisticated statistical and white-box test case generation techniques and applied to other NASA missions. The frame- work now includes a critical factors analysis that was applied to NASAs Orion simulation and design. NASAs Aeronautics Research Mission Directorate (ARMD) leveraged the existing MARGInS framework for work on aviation safety for civil transport vehicles and for research on autonomy issues. The NASA ARMD effort created a time series output prediction capability that has been used to characterize trajectories for a plane with an adaptive control system, and a safety boundary detection capability that has been applied to an air traffic control concept of operation for the Federal Aviation Administration. The statistical and machine- learning based techniques within MARGInS have been successfully combined with concolic execution to improve the coverage of a critical unit by driving system-level inputs. The use case driving the concolic execution and MARGInS integration was inspired by the Air France 447 disaster in which the loss of a critical functionality (the airspeed calculation from the pitot tubes) led to loss of the entire plane with the people aboard. To illustrate capabilities and limitations, we will highlight the analyses for the applications listed above. We will then discuss the future plans for MARGInS and its interfaces with other tools.

Validation↗

NASA NTRS1997

Control Synthesis for a Class of Hybrid Systems Subject to Configuration-Based Safety Constraints

We examine a class of hybrid systems which we call Composite Hybrid Machines (CHM's) that consists of the concurrent (and partially synchronized) operation of Elementary Hybrid Machines (EHM's). Legal behavior, specified by a set of illegal configurations that the CHM may not enter, is to be achieved by the concurrent operation of the CHM with a suitably designed legal controller. In the present paper we focus on the problem of synthesizing a legal controller, whenever such a controller exists. More specifically, we address the problem of synthesizing the minimally restrictive legal controller. A controller is minimally restrictive if, when composed to operate concurrently with another legal controller, it will never interfere with the operation of the other controller and, therefore, can be composed to operate concurrently with any other controller that may be designed to achieve liveness specifications or optimality requirements without the need to reinvestigate or reverify legality of the composite controller. We confine our attention to a special class of CHM's where system dynamics is rate-limited and legal guards are conjunctions or disjunctions of atomic formulas in the dynamic variables (of the type x less than or equal to x(sub 0), or x greater than or equal to x(sub 0)). We present an algorithm for synthesis of the minimally restrictive legal controller. We demonstrate our approach by synthesizing a minimally restrictive controller for a steam boiler (the verification of which recently received a great deal of attention).

Heymann, Michael↗