Results for “Software Safety” — Page 36

DOE OSTI2024

Root Cause Correlation Analysis of Software Failures via Orthogonal Defect Classification and Natural Language Processing

Systems theoretic process analysis (STPA) is becoming an increasingly popular technique to assess how complex digital software systems can fail. Rather than defining failures by their observable failure events, which may be sparse especially for safety rated nuclear digital instrumentation and control systems (DI&C), failures are defined as postulated unsafe actions under specific contextual conditions. This permits a top-down analysis of system hazards and identifies whether imposed constraints and requirements can sufficiently address undesirable hazards. However, STPA is a qualitative approach at identifying inadequacies in the development process and cannot currently be used to quantify unsafe action likelihoods for probabilistic risk assessment. Therefore, in this work, we examine the root causes of software failure and explore whether a consistent correlation can be linked to specific unsafe action classes. We implement Lbl2Vec, an unsupervised document classification and retrieval algorithm, on a database of 4,096 software defect reports acquired from various open-source software systems. By analyzing sentence structure, embedded labels, and word vectors, we show that certain defect types positively correlate to specific unsafe action classes over others. The correlations developed can be used to estimate the failure probability of safety intended DI&C systems which provides a licensing basis for nuclear plant modernization efforts.

22 - GENERAL STUDIES OF NUCLEAR REACTORS↗

NASA NTRS2010

The Wettzell System Monitoring Concept and First Realizations

Automated monitoring of operational system parameters for the geodetic space techniques is becoming more important in order to improve the geodetic data and to ensure the safety and stability of automatic and remote-controlled observations. Therefore, the Wettzell group has developed the system monitoring software, SysMon, which is based on a reliable, remotely-controllable hardware/software realization. A multi-layered data logging system based on a fanless, robust industrial PC with an internal database system is used to collect data from several external, serial, bus, or PCI-based sensors. The internal communication is realized with Remote Procedure Calls (RPC) and uses generative programming with the interface software generator idl2rpc.pl developed at Wettzell. Each data monitoring stream can be configured individually via configuration files to define the logging rates or analog-digital-conversion parameters. First realizations are currently installed at the new laser ranging system at Wettzell to address safety issues and at the VLBI station O Higgins as a meteorological data logger. The system monitoring concept should be realized for the Wettzell radio telescope in the near future.

Ettl, Martin↗

DOE OSTI2024

Root Cause Correlation Analysis of Software Failures via Orthogonal Defect Classification and Natural Language Processing

Systems theoretic process analysis (STPA) is becoming an increasingly popular technique to assess how complex digital software systems can fail. Rather than defining failures by their observable failure events, which may be sparse especially for safety rated nuclear digital instrumentation and control systems (DI&C), failures are defined as postulated unsafe actions under specific contextual conditions. This permits a top-down analysis of system hazards and identifies whether imposed constraints and requirements can sufficiently address undesirable hazards. However, STPA is a qualitative approach at identifying inadequacies in the development process and cannot currently be used to quantify unsafe action likelihoods for probabilistic risk assessment. Therefore, in this work, we examine the root causes of software failure and explore whether a consistent correlation can be linked to specific unsafe action classes. We implement Lbl2Vec, an unsupervised document classification and retrieval algorithm, on a database of 4,096 software defect reports acquired from various open-source software systems. By analyzing sentence structure, embedded labels, and word vectors, we show that certain defect types positively correlate to specific unsafe action classes over others. The correlations developed can be used to estimate the failure probability of safety intended DI&C systems which provides a licensing basis for nuclear plant modernization efforts.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

NASA NTRS2005

Software Architecture of the NASA Shuttle Ground Operations Simulator - SGOS

The SGOS executive and its subsystems have been an integral component of the Shuttle Launch Safety Program for almost thirty years. It is usable (via the LAN) by over 2000 NASA employees at the Kennedy Space Center and 11,000 contractors. SGOS supports over 800 models comprised of several hundred thousand lines of code and over 1,000 MCP procedures. Yet neither language has a for loop!! The simulation software described in this paper is used to train ground controllers and to certify launch countdown readiness.

Cook, Robert P.↗

NASA NTRS2005

Software Architecture of the NASA Shuttle Ground Operations Simulator--SGOS

The SGOS executive and its subsystems have been an integral component of the Shuttle Launch Safety Program for almost thirty years. it is usable (via the LAN) by over 2000 NASA employees at the Kennedy Space Center and 11,000 contractors. SGOS supports over 800 models comprised of several hundred thousand lines of code and over 1,00 MCP procedures. Yet neither language has a for loop!! The simulation software described in this paper is used to train ground controllers and to certify launch countdown readiness.

Cook Robert P.↗

NASA NTRS1996

SEDSAT 1 Technologies

The original goals of this project were to support the development of SEDSAT 1 for a tethered launch in July of 1997. This specifically required: (1) Monitoring development progress against a comprehensive delivery plan; (2) Incremental development and release of CDS and SEASIS software; (3) Supporting the integration of version 1.0 SEASIS software that will allow minimal autonomous operation without a software reload. These algorithms would include image quality evaluation, attitude determination, and autonomous earth imaging; and (4) Developing software requirements and design for ground segment software, concentrating on command and data download capability; and interface to external development efforts for a more comprehensive software suite to be used after the initial mission. Because of an unfavorable space shuttle safety review of the SEDS-3 tether deployer, and cost and schedule problems in upgrading the deployer, the mission was changed to an independent launch of SEDSAT. The original plan was to do a tether-less deployment from the space shuttle. Since this would have resulted in an unacceptable orbital lifetime, the mission was changed again to a tethered launch from a Delta II in June 1998. As a result of Marshall Space Flight Center's redirection of the SEDS-3 mission away from a tether launch, the whole question of a tether endmass had to be reconsidered. The net result of these multiple changes was twofold. First, we completed work needed to define some aspects of ground software on SEDSAT 1 that would remain constant no matter the launch mode. Second, we developed a set of concepts for using SEDSAT 1 technology to support alternative endmass missions on SEDS-3. Both of these are included.

Maier, Mark W.↗

NASA NTRS2004

Evaluation of Open-Source Hard Real Time Software Packages

Reliable software is, at times, hard to find. No piece of software can be guaranteed to work in every situation that may arise during its use here at Glenn Research Center or in space. The job of the Software Assurance (SA) group in the Risk Management Office is to rigorously test the software in an effort to ensure it matches the contract specifications. In some cases the SA team also researches new alternatives for selected software packages. This testing and research is an integral part of the department of Safety and Mission Assurance. Real Time operation in reference to a computer system is a particular style of handing the timing and manner with which inputs and outputs are handled. A real time system executes these commands and appropriate processing within a defined timing constraint. Within this definition there are two other classifications of real time systems: hard and soft. A soft real time system is one in which if the particular timing constraints are not rigidly met there will be no critical results. On the other hand, a hard real time system is one in which if the timing constraints are not met the results could be catastrophic. An example of a soft real time system is a DVD decoder. If the particular piece of data from the input is not decoded and displayed to the screen at exactly the correct moment nothing critical will become of it, the user may not even notice it. However, a hard real time system is needed to control the timing of fuel injections or steering on the Space Shuttle; a delay of even a fraction of a second could be catastrophic in such a complex system. The current real time system employed by most NASA projects is Wind River's VxWorks operating system. This is a proprietary operating system that can be configured to work with many of NASA s needs and it provides very accurate and reliable hard real time performance. The down side is that since it is a proprietary operating system it is also costly to implement. The prospect of replacing this somewhat costly implementation is the focus of one of the SA group s current research projects. The explosion of open source software in the last ten years has led to the development of a multitude of software solutions which were once only produced by major corporations. The benefits of these open projects include faster release and bug patching cycles as well as inexpensive if not free software solutions. The main packages for hard real time solutions under Linux are Real Time Application Interface (RTAI) and two varieties of Real Time Linux (RTL), RTLFree and RTLPro. During my time here at NASA I have been testing various hard real time solutions operating as layers on the Linux Operating System. All testing is being run on an Intel SBC 2590 which is a common embedded hardware platform. The test plan was provided to me by the Software Assurance group at the start of my internship and my job has been to test the systems by developing and executing the test cases on the hardware. These tests are constructed so that the Software Assurance group can get hard test data for a comparison between the open source and proprietary implementations of hard real time solutions.

Mattei, Nicholas S.↗

DOE OSTI2019

Reactivity Feedback Modeling in SAM

System Analysis Module (SAM) is being developed at Argonne National Laboratory as a modern system-level modeling and simulation tool for advanced non-light water reactor safety analyses. It utilizes the object-oriented application framework MOOSE to leverage the modern software environment and advanced numerical methods. The capabilities of SAM are being extended to enable the transient modeling, analysis, and design of various advanced nuclear reactor systems. This report presents the development of Point-Kinetics modeling and reactivity feedback mechanisms in SAM. It also presents a new capability for predicting the thermal expansion in various structural components by coupling SAM with an external thermomechanics module (Tensor Mechanics) from the MOOSE framework. The analysis of the transient behavior of a nuclear reactor requires the coupled simulation of reactor kinetics and thermal-hydraulics of the reactor core, especially for those unprotected transients where the reactor scram system may not function properly. The point kinetics model has been widely used for reactor safety analysis due to its simplicity to capture the transient behavior of the reactor. Various reactivity feedback models have been developed and integrated with the Point-Kinetics module, including fuel axial expansion, core radial expansion, fuel Doppler, and coolant density reactivity. The reactivity feedback models in SAM are similar to the respective models used in SAS4A/SASSYS-1. This report first presents the brief theory of the Point-Kinetics module and reactivity feedback models. A number of verification tests have been performed where the code simulations are compared to the analytical model results. The reactivity feedback due to the thermal deformation, such as the fuel axial expansion and core radial expansion, is important for SFR transient analysis. Simplified thermal expansion models for the fuel pin and reactor constrain system (e.g. grid plate) are developed and verified in SAM. Additionally, a coupling interface is developed to couple SAM with external thermomechanical analysis modules for more accurate predictions of the thermal expansion of different components during the transients. The current coupling interface has been tested with the Tensor Mechanics module from MOOSE. These point kinetics and reactivity feedback modeling capabilities have also been demonstrated by simulating the early stage of the unprotected loss-of-flow (ULOF) accident in the Advanced Burner Test Reactor (ABTR). Both the stand-alone SAM and coupled SAM and Tensor Mechanics simulations are performed. It is confirmed that the major physics phenomena in the heat transport system of the ABTR reactor are captured by SAM, and the point kinetics model, reactivity feedback models, and the coupling schemes are working well as expected.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

DOE OSTI2019

Dry Cask Shipments of ATR Spent Nuclear Fuel at INL

The High Load Charger (HLC) cask will be replacing the Advanced Test Reactor (ATR) spent fuel transfer cask that has been used at Idaho National Laboratory (INL) to wet-transfer spent ATR fuel elements from ATR to Idaho Nuclear Technology and Engineering Center (INTEC) in order to support future plans at both facilities. INTEC intends to discontinue use of the CPP-666 storage pools in compliance with the Idaho Settlement Agreement and the basins will no longer be available to store spent ATR fuel elements. In order to support the core-internals change out in 2021 for ATR, spent ATR fuel elements must be removed from the canal and shipped to INTEC. INL contractors will use the HLC cask for safe, dry transfer of spent Advanced Test Reactor (ATR) fuel elements between the ATR Complex managed by Battelle Energy Alliance, LLC and the Idaho Nuclear Technology and Engineering Center (INTEC) managed by Fluor Idaho, LLC. The HLC cask (also known as the High Load Charging Cask or High Load Charger) is a lead-shielded, stainless steel transfer container originally designed in 1954 by the Idaho Nuclear Corporation to meet the radiation and contamination controls requirements of the time for shipment of spent nuclear fuel. The cask has been modified over the years and is currently used for wet-to-dry transfers at INTEC. It is approved only for out-of-commerce transfers. The cask will arrive at the ATR where eight spent ATR fuel elements will be loaded into two, newly-designed buckets. Each bucket is a quarter section, right-cylinder shape that has four compartments. The cask will be lifted out of the ATR canal allowing most of the water to drain from the cask. Processing the 12,500 kg cask will be completed in ATR and then transported on a tractor trailer to INTEC where the loaded buckets will be removed from the cask. The loaded buckets will undergo a drying process before placing the four buckets into a canister for long-term storage in the Irradiated Fuel Storage Facility (IFSF) at INTEC. A new transportation plan that was submitted to, and approved by, the U.S. Department of Energy to provide the cask safety basis, which describes the hazard analysis and accident analysis for the cask during transport. Supporting accident analysis include criticality, thermal, dose, and drop analyses. Of particular interest for this cask was the drop analysis from which was derived the speed limit for the transport. The drop analysis addressed drops in air onto an unyielding surface and in water onto an energy-absorbing pad for the cask in the ATR facility. These analyses are typically applied as the bounding drop scenarios during transport; however, this resulted in a safety basis speed limit of 12.9 kph. In order to more accurately represent the in-transit accident scenario, LS-DYNA software was procured and the model was updated to more closely represent the potential drop heights and impact surfaces of asphalt and soil for the cask while in transit. This analysis resulted in a safety basis speed limit of 48 kph. This safety basis speed limit is more practical to implement and control.

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

DOE OSTI2019

Dry Cask Shipments of ATR Spent Nuclear Fuel at INL - 19600

The High Load Charger (HLC) cask will be replacing the Advanced Test Reactor (ATR) spent fuel transfer cask that has been used at Idaho National Laboratory (INL) to wet-transfer spent ATR fuel elements from ATR to Idaho Nuclear Technology and Engineering Center (INTEC) in order to support future plans at both facilities. INTEC intends to discontinue use of the CPP-666 storage pools in compliance with the Idaho Settlement Agreement and the basins will no longer be available to store spent ATR fuel elements. In order to support the core-internals change out in 2021 for ATR, spent ATR fuel elements must be removed from the canal and shipped to INTEC. INL contractors will use the HLC cask for safe, dry transfer of spent Advanced Test Reactor (ATR) fuel elements between the ATR Complex managed by Battelle Energy Alliance, LLC and the Idaho Nuclear Technology and Engineering Center (INTEC) managed by Fluor Idaho, LLC. The HLC cask (also known as the High Load Charging Cask or High Load Charger) is a lead-shielded, stainless steel transfer container originally designed in 1954 by the Idaho Nuclear Corporation to meet the radiation and contamination controls requirements of the time for shipment of spent nuclear fuel. The cask has been modified over the years and is currently used for wet-to-dry transfers at INTEC. It is approved only for out-of-commerce transfers. The cask will arrive at the ATR where eight spent ATR fuel elements will be loaded into two, newly-designed buckets. Each bucket is a quarter section, right-cylinder shape that has four compartments. The cask will be lifted out of the ATR canal allowing most of the water to drain from the cask. Processing the 12,500 kg cask will be completed in ATR and then transported on a tractor trailer to INTEC where the loaded buckets will be removed from the cask. The loaded buckets will undergo a drying process before placing the four buckets into a canister for long-term storage in the Irradiated Fuel Storage Facility (IFSF) at INTEC. A new transportation plan that was submitted to, and approved by, the U.S. Department of Energy to provide the cask safety basis, which describes the hazard analysis and accident analysis for the cask during transport. Supporting accident analysis include criticality, thermal, dose, and drop analyses. Of particular interest for this cask was the drop analysis from which was derived the speed limit for the transport. The drop analysis addressed drops in air onto an unyielding surface and in water onto an energy-absorbing pad for the cask in the ATR facility. These analyses are typically applied as the bounding drop scenarios during transport; however, this resulted in a safety basis speed limit of 12.9 kph. In order to more accurately represent the in-transit accident scenario, LS-DYNA software was procured and the model was updated to more closely represent the potential drop heights and impact surfaces of asphalt and soil for the cask while in transit. This analysis resulted in a safety basis speed limit of 48 kph. This safety basis speed limit is more practical to implement and control. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

NASA NTRS2008

Integrated Software Systems for Crew Management During Extravehicular Activity in Planetary Terrain Exploration

Initial planetary explorations with the Apollo program had a veritable ground support army monitoring the safety and health of the 12 astronauts who performed lunar surface extravehicular activities (EVAs). Given the distances involved, this will not be possible on Mars. A spacesuit for Mars must be smart enough to replace that army. The next generation suits can do so using 2 software systems serving as virtual companions, LEGACI (Life support, Exploration Guidance Algorithm and Consumable Interrogator) and VIOLET (Voice Initiated Operator for Life support and Exploration Tracking). The system presented in this study integrates data inputs from a suite of sensors into the MIII suit s communications, avionics and informatics hardware for distribution to remote managers and data analysis. If successful, the system has application not only for Mars but for nearer term missions to the Moon, and the next generation suits used on ISS as well. Field tests are conducted to assess capabilities for next generation spacesuits at Johnson Space Center (JSC) as well as the Mars and Lunar analog (Devon Island, Canada). LEGACI integrates data inputs from a suite of noninvasive biosensors in the suit and the astronaut (heart rate, suit inlet/outlet lcg temperature and flowrate, suit outlet gas and dewpoint temperature, pCO2, suit O2 pressure, state vector (accelerometry) and others). In the Integrated Walkback Suit Tests held at NASA-JSC and the HMP tests at Devon Island, communication and informatics capabilities were tested (including routing by satellite from the suit at Devon Island to JSC in Houston via secure servers at VCU in Richmond, VA). Results. The input from all the sensors enable LEGACI to compute multiple independent assessments of metabolic rate, from which a "best" met rate is chosen based on statistical methods. This rate can compute detailed information about the suit, crew and EVA performance using test-derived algorithms. VIOLET gives LEGACI voice activation capability, allowing the crew to query the suit, and receive feedback and alerts that will lead to corrective action. LEGACI and VIOLET can also automatically control the astronaut's cooling and consumable use rate without crew input if desired. These findings suggest that non-invasive physiological and environmental sensors supported with data analysis can allow for more effective management of mission task performance during EVA. Integrated remote and local view of data metrics allow crewmember to receive real time feedback in synch with mission control in preventing performance shortcomings for EVA in exploration missions.

Kuznetz, Lawrence↗

NASA NTRS1990

Improving system reliability through formal analysis and use of checks in software

Software is playing increasingly important roles in avionics systems. It is widely used in navigation and, in some cases, in control loops that maintain aircraft stability. To guarantee the safety of flight systems, the FAA requires that critical components have a probability of failure no greater than 10(exp -9) per hour of flight. Software is being used to diagnose system components for failure. SIFT (Software Implemented Fault Tolerance) was a computer system developed to study the use of software to check for failure and manage processor reconfiguration. To guarantee that software satisfies its specifications, formal verification can be used. With this a program and its specification are viewed as mathematical objects, and a mathematical proof is used to show that the program and its specification are equivalent. In previous research, a theory of checking was developed to offer assistance in analyzing specifications and designing run-time checks. In the theory, checking is considered abstractly in terms of n-ary relations much like those of relational database theory. Within the theory check are categorized, checks on input and checks on results are considered, and formal attention is given to the minimization and logical combination of checks. The focus is upon input checks and the obstacles in checking input to critical systems. A central concern is with a property referred to as independence. The concern is with circumstances under which it is possible to apply isolated, independent checks to separate sensor inputs and be assure that all illegal input will be properly detected. Presently, independence is being investigated and checked in the context of the GCS (Guidance and Control System). The GCS simulator is intended for testing software that implements control laws for landing spacecraft. The large number of inputs and their complex interrelationships provide an exciting context in which to investigate independence and the difficulties of supplying input checks.

Staknis, Mark E.↗

DOE OSTI2021

Uniformly Ordered Binary Decision Algorithm for Benchmark Experiment Correlations in Whisper Validation

When performing a validation exercise for determining the upper subcritical limit of a nuclear criticality safety application, an analyst should select and perform a statistical analysis on a population of benchmark experiments that are neutronically similar to the application. The size of this population should be sufficiently large such that the statistical analysis has a high degree of confidence that the bias plus bias uncertainty (calculational margin) has been accurately quantified. A complication arises because many benchmark experiments share common components, leading to correlations in their measured effective multiplication factors. Correlations between benchmark experiments within the population reduces its predictive power. This motivates the need for methods that consider benchmark experiment correlations and ensure adequate statistical significance of results. The Whisper code is a statistical analysis pack- age that incorporates nuclear data sensitivity coefficients from MCNP to assess benchmark experiment similarity and then performs an extreme-value analysis to estimate the bias plus bias uncertainty. The original methodology in Whisper does not consider the effect of benchmark experiment correlations when making this estimation, and this summary proposes the uniformly ordered binary decision algorithm to address this shortcoming. The original methodology in Whisper computes similarity coefficients ck for an application compared to all benchmark experiments in its library and develops weighting factors for a selected population proportional to the ck values. The methodology can be interpreted as statistically emulating a validation exercise for a particular application where the weighting factors may be viewed as the likelihood that an analyst would include a particular benchmark experiment within the population. The effective sample size of the population is the expected or mean number of benchmark experiments in the population. The uniformly ordered binary decision algorithm identifies clusters of correlated benchmark experiments within the population and then computes adjusted weighting factors based on the magnitude of the correlation coefficients within the cluster to compute a reduced effective sample size accounting for the lower information content because of correlations. Benchmark experiments within the cluster are ordered randomly with equal probability and probabilistic decisions are made as to whether a benchmark. experiment within the cluster should treated as redundant with a previous one; if two redundant benchmark experiments are included, then the conservative worst case bias plus bias uncertainty is used and the pair is counted as a single benchmark experiment in the population. Results are provided for HEU solutions in a research version of the Whisper software using benchmark experiment correlations provided by DICE, the Database for the International Criticality Safety Benchmark Evaluation Project (ICSBEP). These show that there can be a significant increase in the bias plus bias uncertainty because the effective sample size is reduced, and therefore the algorithm, needing to meet sample size requirements, expands the benchmark experiment population by accepting less similar benchmark experiments that would have otherwise not been included.

73 NUCLEAR PHYSICS AND RADIATION PHYSICS↗

DOE OSTI2023

Methodology and Tool for the Physical Security Analysis of Micro and Advanced Reactors

This work proposes a dynamic evaluation methodology to relax the conservatism in physical security evaluation, by leveraging an ongoing work in the Light Water Reactor Sustainability pathway. This methodology is implemented in a dynamic risk assessment tool named Event Modeling Risk Assessment using Linked Diagrams (EMRALD). The work extends EMRALD’s capability to support a sandbox feature where analysts can easily create attack scenarios and modify advanced/small modular reactor (A/SMR) security and safety features using templates. This approach saves time and cost since the analysis does not require creating detailed computer-aided design models, as is commonly required in commercial force-on-force software tools. EMRALD is completely free to use at https://emraldapp.inl.gov. We have developed basic templates including physical barriers, intrusion sensors, physical areas, and safety actions, that can be downloaded from EMRALD’s GitHub site: https://github.com/idaholab/EMRALD. These templates use generic data commonly used for training purposes, which do not reflect any actual operating nuclear reactor. Users may adjust the data in the templates with their own dataset and/or create new templates in EMRALD. The proposed methodology combines security and safety by assessing sabotage effects up to the radiological consequence to the public instead of merely the core damage state. This practice follows the industry standard for advanced non-light-water reactors currently proposed for endorsement by the Nuclear Regulatory Commission. The combination of security and safety is expressed in an achievability-consequence chart. EMRALD can be used to generate data for this chart. A hypothetical case study using a representative sodium-cooled fast reactor (SFR) facility is presented in this report to demonstrate this methodology. This case study does not contain any actual nuclear plant information. This work will benefit A/SMR vendors and utilities to implement security by design during the reactor design iteration phase, such that they do not have to perform upgrades and retrofits to the reactor after it is installed to improve its physical protection system. The tool may also be used to analyze domestic or foreign reactor designs to support the International Nuclear Security Techniques for Advanced Reactors (INSTAR) bilateral missions. Future works are planned to implement the methodology on a reference SFR reactor and a reference high-temperature gas-cooled reactor to obtain insights and lessons-learned for the A/SMR community.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2024

Virtual Test Bed (VTB): NRIC FY24 Program Review

NRIC: Deliver successful demonstration and deployment of advanced nuclear energy EBRII Test Bed (DOME) ZPPR Test Bed (LOTUS) Virtual Test Bed (VTB): Accelerate deployment of advanced reactors by leveraging state-of-the-art ModSim tools to evaluate performance and safety Ok, but what is it? Library of Reference Model: database of advanced multiphysics advanced reactor models that users can download, edit, and re-run Continuous Software QA: linking repository to software development to avoid legacy issues while enabling rapid code development Virtual models of the test bed: developing demonstration-relevant models (e.g., candidates for DOME/LOTUS) to accelerate safety evaluations

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

DOE OSTI2021

Considerations regarding the Use of Computer Vision Machine Learning in Safety-Related or Risk-Significant Applications in Nuclear Power Plants

With the advancements made to date in the field of artificial intelligence (AI), significant potential exists to utilize AI capabilities for nuclear power plant (NPP) applications. AI can replicate human decision making and it is usually faster and more accurate than humans. For implementations that impact critical NPP applications (e.g., safety-related or non-safety systems that potentially affect overall plant risk), a deeper safety analysis of the AI methods is necessary. AI applied to NPP operations could resemble the use of digital I&C (DI&C) because such applications involve digital computer hardware and custom-designed software that input plant data, execute complex software algorithms, and output the results to a system or licensed human operator to potentially provoke an action. For AI methods to be compliant with current safety requirements for DI&C, AI compatibility must be evaluated, and AI-related gaps may exist that prevent the prompt deployment of AI in NPPs. This effort aims to evaluate how example AI technologies align with the DI&C safety framework, and discusses how they could be analyzed, modeled, tested, and validated in a manner similar to typical DI&C technologies. Because AI is a broad field that encompasses areas such as machine learning (ML), natural language processing, and computer vision, this research focused on a subset of methods categorized as the computer vision ML (CVML) methods. This report explores two CVML use cases, gauge reading and fire watch, considered relevant to the DI&C standards, as they could play a safety-critical role. For the gauge reading use case, a CVML-enabled technology that can read gauges at oblique angles is utilized. For the fire watch use case, a CVML-enabled technology is utilized that migrates fire watch from a manual (human) approach to automated fire detection. These use cases are mainly intended to give context to the CVML system discussion. This effort assumes the worst-case scenario, with the CVML system being used to replace a safety-related or risk-significant system, thus requiring evaluation. Evaluating CVML against most of the relevant safety requirements for DI&C yielded several CVML-specific considerations due to the uniqueness of its characteristics in comparison with typical DI&C systems. For example, CVML models often employ commonly used (open-source) datasets, and it is not always possible to determine the level of overlap among open-source datasets. Therefore, the independence of the developed CVML models when demonstrating diversity is questionable, therefore creating vulnerability to common cause failure (CCF). The design verification process is also impacted since the data overlap could result in overestimation of the software validation and verification (V&V) performance results. Section 2 of this report evaluates a list of the identified CVML-specific characteristics and discusses the resulting considerations and potential solutions in the context of each referenced requirement. A summation is provided in Section 3. This report is not to be used as a guideline. It was developed to identify and consider issues in the implementation of ML technologies used to augment activities that may have a bearing on plant operation. The report draws parallels to the use of DI&C technologies, for which many standards are available to guide their use in nuclear plant operation. It considers the technologies and some of the potential implications of their use in safety-related applications but is not intended to address regulatory or licensing related issues.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗

NASA NTRS2005

Encryption for Remote Control via Internet or Intranet

A data-communication protocol has been devised to enable secure, reliable remote control of processes and equipment via a collision-based network, while using minimal bandwidth and computation. The network could be the Internet or an intranet. Control is made secure by use of both a password and a dynamic key, which is sent transparently to a remote user by the controlled computer (that is, the computer, located at the site of the equipment or process to be controlled, that exerts direct control over the process). The protocol functions in the presence of network latency, overcomes errors caused by missed dynamic keys, and defeats attempts by unauthorized remote users to gain control. The protocol is not suitable for real-time control, but is well suited for applications in which control latencies up to about 0.5 second are acceptable. The encryption scheme involves the use of both a dynamic and a private key, without any additional overhead that would degrade performance. The dynamic key is embedded in the equipment- or process-monitor data packets sent out by the controlled computer: in other words, the dynamic key is a subset of the data in each such data packet. The controlled computer maintains a history of the last 3 to 5 data packets for use in decrypting incoming control commands. In addition, the controlled computer records a private key (password) that is given to the remote computer. The encrypted incoming command is permuted by both the dynamic and private key. A person who records the command data in a given packet for hostile purposes cannot use that packet after the public key expires (typically within 3 seconds). Even a person in possession of an unauthorized copy of the command/remote-display software cannot use that software in the absence of the password. The use of a dynamic key embedded in the outgoing data makes the central-processing unit overhead very small. The use of a National Instruments DataSocket(TradeMark) (or equivalent) protocol or the User Datagram Protocol makes it possible to obtain reasonably short response times: Typical response times in event-driven control, using packets sized .300 bytes, are <0.2 second for commands issued from locations anywhere on Earth. The protocol requires that control commands represent absolute values of controlled parameters (e.g., a specified temperature), as distinguished from changes in values of controlled parameters (e.g., a specified increment of temperature). Each command is issued three or more times to ensure delivery in crowded networks. The use of absolute-value commands prevents additional (redundant) commands from causing trouble. Because a remote controlling computer receives "talkback" in the form of data packets from the controlled computer, typically within a time interval < or =1 s, the controlling computer can re-issue a command if network failure has occurred. The controlled computer, the process or equipment that it controls, and any human operator(s) at the site of the controlled equipment or process should be equipped with safety measures to prevent damage to equipment or injury to humans. These features could be a combination of software, external hardware, and intervention by the human operator(s). The protocol is not fail-safe, but by adopting these safety measures as part of the protocol, one makes the protocol a robust means of controlling remote processes and equipment by use of typical office computers via intranets and/or the Internet.

Lineberger, Lewis↗

DOE OSTI2019

Multi-Physics Simulations of Heat Pipe Micro Reactor

System Analysis Module (SAM) is under development at Argonne National Laboratory as a modern system-level modeling and simulation tool for advanced non-light water reactor safety analyses. It utilizes the object-oriented application framework MOOSE to leverage the modern software environment and advanced numerical methods. The capabilities of SAM are being extended to enable the transient modeling, analysis, and design of various advanced nuclear reactor systems. This report presents the development of new capabilities for modeling the heat pipe type reactor systems. The need for power at remote locations away from a reliable electrical grid is an important niche for nuclear energy. Heat pipe-cooled fast-spectrum nuclear reactors are well suited for these applications. The key feature of the heat pipe reactors is the use of heat pipes for heat removal from the reactor core. The heat pipe makes use of the phase change of the working fluid and transports a large amount of heat from the evaporator to the condensation end with very small temperature drops. In contrast to the traditional nuclear reactor system that makes use of pumped loop for extracting the thermal power, the heat pipe reactors make use of hundreds of heat pipes for removing the thermal power (including the decay heat) passively. This could potentially significantly improve the reliability and safety of the reactor systems. The essential part in the analysis of a heat pipe type reactor is the modeling of heat transport inside the heat pipe. The capability of SAM was extended to enable the modeling of the conventional heat pipe. The full suite of non-LWR codes for confirmatory analysis at NRC is known as the Comprehensive Reactor Analysis Bundle (CRAB). It makes use of existing NRC codes, and integrates them with several codes developed through the DOE-NE’s Nuclear Energy Advanced Modeling and Simulation (NEAMS) program. In this report, the heat pipe micro reactor is simulated using three submodules under CRAB. The MAMMOTH module is used to simulate the reactor kinetics behavior of the micro reactor; the SAM module is used to simulate the heat conduction in the reactor core and heat removal through the heat pipe heat exchangers and Reactor Cavity Cooling System (RCCS); and the MOOSE Tensor Mechanics module is used to simulate the thermal expansion of the reactor cores. The different sub-models are coupled together using MOOSE’s MultiApp system and executed using the BlueCrab application. The new capability has been demonstrated by a steady-state operation analysis, a failure of a single central heat pipe transient analysis, and a loss of heat sink transient analysis. The fully coupled model is shown to work well.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗