Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Criticality Safety”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 703 records · Page 39
All sourcesNASA NTRSDOE OSTI
NASA NTRS2005

Mitigating Motion Base Safety Issues: The NASA LaRC CMF Implementation

The NASA Langley Research Center (LaRC), Cockpit Motion Facility (CMF) motion base design has taken advantage of inherent hydraulic characteristics to implement safety features using hardware solutions only. Motion system safety has always been a concern and its implementation is addressed differently by each organization. Some approaches rely heavily on software safety features. Software which performs safety functions is subject to more scrutiny making its approval, modification, and development time consuming and expensive. The NASA LaRC's CMF motion system is used for research and, as such, requires that the software be updated or modified frequently. The CMF's customers need the ability to update the simulation software frequently without the associated cost incurred with safety critical software. This paper describes the CMF engineering team's approach to achieving motion base safety by designing and implementing all safety features in hardware, resulting in applications software (including motion cueing and actuator dynamic control) being completely independent of the safety devices. This allows the CMF safety systems to remain intact and unaffected by frequent research system modifications.

Bryant, Richard B., Jr.↗
DOE OSTI2023

Application of the ANSI/ANS-8.3-2022 Minimum Accident to Tube Vault Storage

In support of planned site activities, the existing basis for criticality safety in nuclear facilities is being revisited. One such technical basis is the demonstration of Criticality Accident Alarm System (CAAS) coverage in tube vaults at Y-12 National Security Complex. The configuration of the vaults places significant shielding between the source and the detector stations and is dissimilar to drum storage or other processes. This paper describes tube vault storage at Y-12, describes the basis for the application of the 2022 minimum accident for system design (MASD) to the analysis, and presents how the accident is implemented in the analysis.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
DOE OSTI2026

Expanded Intercomparison of Nuclear Data Libraries Using Jupiter and Jupiter High-240 Experiments

There is a limited availability of plutonium experiments with sensitivity to lead in the ICSBEP (International Handbook of Evaluated Criticality Safety Benchmark Experiments) Handbook. The Jupiter and Jupiter High-240 experiments were performed at the National Criticality Experiments Research Center as a collaborative effort between Los Alamos National Laboratory and the Japan Atomic Energy Agency to assess lead void coefficients in a plutonium-lead system containing weapons- and reactor-grade plutonium, respectively. Concurrent with benchmark development, an intercomparison of calculations using different nuclear data libraries has been performed to assess the usability of the experimental data for nuclear data adjustment in a “softer-that-fast” neutron energy spectrum. Eigenvalue calculations using MCNP with the ENDF/B-VIII.0 and TENDL-2021 nuclear data libraries calculate closest to the benchmark values for Jupiter. Calculations using JENDL-5 and ENDF/B-VIII.1 match best with the Jupiter High-240 values. Lead void worth calculations using the various nuclear data libraries are all within 3σ of their respective measured values. Perturbation studies between ENDF/B-VIII.0 and ENDF/B-VIII.1 demonstrate an approximate increase in calculated eigenvalues for the Jupiter series experiments by ~240 pcm for plutonium (mostly 239 Pu) and ~120 pcm for lead accompanied by a decrease contributed by ~113 pcm for copper and ~13 pcm for stainless steel. Nuclear data sensitivities and uncertainties investigated using Whisper show slightly lower sensitivity to scatter than a lead-reflected plutonium sphere but greater sensitivity to neutron capture. The sensitivities between Jupiter and Jupiter High-240 for lead are very similar for both ENDF/B-VIII.0 and ENDF/B-VIII.1 nuclear data. These benchmarks are more sensitive to neutron capture in lead than other plutonium benchmark experiments and would be useful for both lead and 240 Pu validation. In conclusion, with the high degree of compensating effects between copper, lead, and plutonium cross sections, additional isolated Pb-Pu and Cu-Pu benchmarks would be beneficial in improving these nuclear data.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗
DOE OSTI2026

Enhancing Operational Safety via Agentic Dialogue Hazard Identification Analysis

Operational safety in high-stakes domains such as industrial process control, autonomous, and safety-critical systems demand reliable hazard identification. While large language models (LLMs) have shown promise in automating safety analysis tasks, single-turn, monolithic inference is brittle: it lacks the self-correction, deliberation, and contextual refinement that safety engineers apply iteratively. In this paper, we introduce HAZDIAL, a framework that investigates whether structured agentic dialogue (multi-agent, multi-turn interactions) improves the quality of NLP-based hazard identification over single-pass baselines. We systematically compare two dialogue modalities: adversarial debate and constructive discussion, and propose an genetic algorithm-based agentic interaction optimization. We evaluate all configurations against a curated golden dataset using standard classification metrics (accuracy, precision, recall, F1) and a novel dialogue metrics. This work advances the intersection of dialogue systems, multi-agent reasoning, and AI safety, providing empirical evidence for dialogue-driven hazard analysis.

Das, Sanjay [ORNL] (ORCID:0009000542591915)↗
DOE OSTI2025

Phenomena Identification and Ranking Table (PIRT) for heat pipes

Heat pipes are advanced passive thermal management devices that utilize phase change and capillary action to achieve efficient heat transfer. However, due to the complexity of the phenomena coupled in heat pipes, including capillary, phase change, turbulence, and compressibility effects, there are high uncertainties in the predictability of their operational regimes and performance. This PIRT exercise, conducted as a collaborative effort involving the Department of Energy (DOE) Microreactor Program (MRP), the Nuclear Regulatory Commission (NRC), and university partners systematically identifies, reviews, and prioritizes critical phenomena affecting the operation of heat pipes based on their importance and knowledge levels. Additional analyses and discussion are provided for phenomena with high importance and low knowledge, such as wick de-wetting, critical heat flux, contact angles, and pressure dynamics. The discussions included the recognizing challenges and proposing future research directions for both modeling and simulation and experimental efforts. Additionally, the report addresses phenomena with medium importance and low knowledge that could impact heat pipe operation during non-normal or transient operation, including frozen startup, laminar to turbulent transition, geyser boiling, wick priming, underfilling conditions, surface roughness of the wick, NCGs trapped in the wick, and the timescales of startup and shutdown. In conclusion, this comprehensive evaluation serves as a valuable resource for guiding future research and development efforts, supporting the successful integration of heat pipes into critical applications such as nuclear reactors, and contributing to the advancement of heat pipe technologies in safety-critical industries.

21 - SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLAN↗
DOE OSTI1992

Nuclear Safety [Vol. 33, No. 4, October-December 1992]

Nuclear Safety is a review journal that covers significant developments in the field of nuclear safety. Its scope includes the analysis and control of hazards associated with nuclear energy, operations involving fissionable materials, and the products of nuclear fission and their effects on the environment. Primary emphasis is on safety in reactor design, construction, and operation; however, the safety aspects of the entire fuel cycle, including fuel fabrication, spent-fuel processing, nuclear waste disposal, handling of radioisotopes, and environmental effects of these operations, are also treated. Table of Contents for this issue follows. GENERAL SAFETY CONSIDERATIONS: 499 Technical Note: Nuclear Regulatory Commission’s Examination Question Bank System, C. L Jensen and N. L. Skinner; 506 Report on the Specialists’ Meeting on Passive and Active Safety Features of Liquid-Metal Fast Breeder Reactors Organized by the International Atomic Energy Agency at Oarai Engineering Centre of Power Reactor and Nuclear Development Corporation, Japan, November 5-7,1991, S. R. Paranjpe; ACCIDENT ANALYSIS: 514 A Review of Hydrogen Production During Melt/Water Interaction in LWRs, D. F. Fletcher, B. D. Turland, and S. P. A. Lawrence; 535 A Review of the U 3 0 8 -Al Reaction as a Potential Heat Source in Research and Test Reactor Accidents, J. L. Snelgrove; CONTROL AND INSTRUMENTATION: 543 Multilevel Interfaces for Power Plant Control Rooms II: A Preliminary Design Space, K. J. Vicente; DESIGN FEATURES: 549 Twenty-Second DOE/NRC Nuclear Air Cleaning and Treatment Conference, R. R. Bellamy, D. W. Moeller, and M. W. First; 562 Book Review: Safety Assessment of Unit 5 (WWER-440/W-213) of the Greifswald Nuclear Power Station, M. H. Fontana; WASTE AND SPENT FUEL MANAGEMENT: 576 Activities Related to Waste and Spent Fuel Management, M. D. Muhlheim and E. G. Silver; OPERATING EXPERIENCES: 586 Analysis of Corrective Actions Applied to Nuclear Power Plant Operations, A. E. Cross; 593 Reactor Shutdown Experience, Compiled by J. W. Cletcher; 596 Operating U.S. Power Reactors, Compiled by M. D. Muhlheim and E. G. Silver; 609 Non-Commercial Power Operating Experience; 614 World Nuclear Performance, Compiled by M. D. Muhlheim; RECENT DEVELOPMENTS: 623 General Administrative Activities, Compiled by M. D. Muhlheim and E. G. Silver; 635 Reports, Standards, and Safety Guides, D. S. Queener; 639 Proposed Rule Changes as of June 30, 1992; ANNOUNCEMENTS: 513 Fourth International Conference on Nuclear Fuel Reprocessing and Waste Management RECOD '94; 585 International Topical Meeting on Advanced Reactors Safety; 622 International Workshop on Implementation of ALARA at Nuclear Power Plants; 648 Short Course on Nuclear Criticality Safety; 648 8th Topical Meeting on Problems in Reactor Physics MEPhi-VOLGA-93; 643 The Authors; 646 Reviewers of Nuclear Safety, Vol. 33

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗
NASA NTRS2001

Adapting safety requirements analysis to intrusion detection

Several requirements analysis techniques widely used in safety-critical systems are being adapted to support the analysis of secure systems. Perhaps the most relevant system safety techique for Intrusion Detection Systems is hazard analysis.

requirements analysis safety intrusion detection↗
DOE OSTI2025

Phenomena Identification and Ranking Table (PIRT) for Heat Pipes

This Phenomena Identification and Ranking Table (PIRT) report provides an evaluation of key phenomena affecting the performance and operational regimes of heat pipes, particularly in the context of heat pipe microreactors (HPMRs). Heat pipes are advanced passive thermal management devices that utilize phase change and capillary action to achieve efficient heat transfer. However, due to the complexity of the phenomena coupled in the heat pipe, including phase change, turbulent transition, and compressibility effects, among others, there is high uncertainty in identifying and ranking the important phenomena affecting the operation of heat pipes and the current knowledge for their modeling and simulation and experimental measurements and instrumentation. This PIRT exercise, conducted as a collaborative effort involving the Department of Energy (DOE) Microreactor Program (MRP), the Nuclear Regulatory Commission (NRC), and university partners systematically identifies, reviews, and prioritizes critical phenomena affecting the operation of heat pipes based on their importance and knowledge levels. The report analyzes phenomena with high importance and low knowledge, such as wick de-wetting, critical heat flux, contact angles, and pressure dynamics, discussing challenges and future research directions for improving their modeling and simulation and experimental measurements. Additionally, the report addresses phenomena with low knowledge that could impact heat pipe operation during non-normal or transient operation, including frozen startup, laminar to turbulent transition, geysering, wick priming, underfilling conditions, surface roughness of the wick, NCGs trapped in the wick, and the timescales of startup and shutdown. This comprehensive evaluation serves as a valuable resource for guiding future research and development efforts, supporting the successful integration of heat pipes into critical applications such as nuclear reactors, and contributing to the advancement of heat pipe technologies in safety-critical industries.

21 - SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLAN↗
NASA NTRS2010

Reference Avionics Architecture for Lunar Surface Systems

Developing and delivering infrastructure capable of supporting long-term manned operations to the lunar surface has been a primary objective of the Constellation Program in the Exploration Systems Mission Directorate. Several concepts have been developed related to development and deployment lunar exploration vehicles and assets that provide critical functionality such as transportation, habitation, and communication, to name a few. Together, these systems perform complex safety-critical functions, largely dependent on avionics for control and behavior of system functions. These functions are implemented using interchangeable, modular avionics designed for lunar transit and lunar surface deployment. Systems are optimized towards reuse and commonality of form and interface and can be configured via software or component integration for special purpose applications. There are two core concepts in the reference avionics architecture described in this report. The first concept uses distributed, smart systems to manage complexity, simplify integration, and facilitate commonality. The second core concept is to employ extensive commonality between elements and subsystems. These two concepts are used in the context of developing reference designs for many lunar surface exploration vehicles and elements. These concepts are repeated constantly as architectural patterns in a conceptual architectural framework. This report describes the use of these architectural patterns in a reference avionics architecture for Lunar surface systems elements.

Somervill, Kevin M.↗
DOE OSTI1991

Nuclear Safety [Vol. 32, No. 1, January-March 1991]

Nuclear Safety is a review journal that covers significant developments in the field of nuclear safety. Its scope includes the analysis and control of hazards associated with nuclear energy, operations involving fissionable materials, and the products of nuclear fission and their effects on the environment. Primary emphasis is on safety in reactor design, construction, and operation; however, the safety aspects of the entire fuel cycle, including fuel fabrication, spent-fuel processing, nuclear waste disposal, handling of radioisotopes, and environmental effects of these operations, are also treated. Table of Contents for this issue follows. GENERAL SAFETY CONSIDERATIONS: 1 The Safety Review and Approval Process for Space Nuclear Power Sources, G. L. Bennett; 19 Report on the American Nuclear Society International Topical Meeting: "The Safety, Status, and Future of Non-Commercial Reactors and Irradiation Facilities", E. G. Silver; 35 Book Review: Fission Product Transport Processes in Reactor Accidents, Proceedings to the International Centre tor Heat and Mass Processes T. S. Kress; 38 Fast Reactor Technology in the 1990s: A Summary of the 1990 International Fast Reactor Safety Meeting, A. E. Levin; ACCIDENT ANALYSIS: 56 Effects of Chemical Phenomena on LWR Severe Accident Fission Product Behavior, A. P. Malinauskas and T. S. Kress; CONTROL AND INSTRUMENTATION: 65 Technical Note: Safety Parameter Display Systems—10 Years Later, R. J. Eckenrode; 68 Potential Application of Neural Networks to the Operation of Nuclear Power Plants, R. E. Uhrig; DESIGN FEATURES: 80 Twenty-First DOE/NRC Nuclear Air-Cleaning Conference, R. R. Bellamy, D. W. Moeller, and M. W. First; 91 Impact of an Apparent Radiation Embrittlement Rate on the Life Expectancy of PWR Vessel Supports, R. D. Cheverton, G. C. Robinson, W. E. Pennell, and R. K. Nanstad; ENVIRONMENTAL EFFECTS: 103 Technical Note: The Impact of Offsite Factors on the Safety Performance of Small Nuclear Power Plants, Yu. D. Baranaev and A. N. Viktorov; WASTE AND SPENT FUEL MANAGEMENT: 109 Activities Related to Waste Management, Compiled by E. G. Silver; OPERATING EXPERIENCES: 118 Reactor Shutdown Experience, Compiled by J. W. Cletcher; 121 Selected Safety-Related Events, Compiled by G. A. Murphy; 123 Operating U.S. Power Reactors, Compiled by E. G. Silver; RECENT DEVELOPMENTS: 140 General Administrative Activities, Compiled by E. G. Silver; 150 Reports, Standards, and Safety Guides, D. S. Queener; 155 Status of Power-Reactor Licensing Activities, Compiled by E. G. Silver; 157 Proposed Rule Changes as of Sept. 30, 1990; ANNOUNCEMENTS: 79 MIT Offers Summer Program on Nuclear Power Reactor Safety; 108 Harvard School of Public Health Offers Several Short Courses; 139 Short Course and Workshop on Nuclear Criticality Safety at University of New Mexico; 160 SCK/CEN Announces Training Course on Emergency Planning and Response; 161 The Authors; 164 Indexes to Nuclear Safety, Volume 31

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗
DOE OSTI2025

Physics-based hybrid machine learning for critical heat flux prediction with uncertainty quantification

Critical heat flux (CHF) is a key quantity in nuclear system modeling due to its impact on heat transfer, safety margins, and reactor performance. This study develops and validates an uncertainty-aware hybrid modeling approach that combines machine learning with physics-based models to predict CHF in cases of dryout. The Biasi and Bowring empirical correlations were paired with three ML uncertainty quantification (UQ) techniques: deep neural network (DNN) ensembles, Bayesian neural networks (BNNs), and deep Gaussian processes (DGPs). A pure ML model without a base model was evaluated for comparison. Model performance was assessed under plentiful (7,350 points) and limited (9 points) training data scenarios using parity, uncertainty distributions, and calibration curves. Results show that the Biasi hybrid DNN ensemble achieved the best overall performance, with a mean absolute relative error of 1.846%, and well-calibrated uncertainty estimates. The BNN-based hybrids showed slightly higher error (2.14%) but superior uncertainty calibration. DGP models underperformed, with over 6% error and poor uncertainty calibration. All hybrid models outperformed pure machine learning configurations, demonstrating resistance against data scarcity. These findings indicate that hybrid modeling significantly improves predictive accuracy, interpretability, and resilience to data scarcity. The integration of uncertainty awareness provides actionable confidence in CHF predictions, which is vital for safety-critical decisions in nuclear applications. This hybrid approach offers a viable pathway for deploying ML models in reactor analysis tools while preserving domain knowledge and physical consistency.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
NASA NTRSDate not supplied

Understanding and Verifying Neural Networks

Deep Neural Networks (DNNs) have gained immense popularity in recent times and have widespread use in applications such as image classification, sentiment analysis, speech recognition and also in safety-critical applications such as autonomous driving. However, they suffer limitations such as lack of explainability and robustness which raise safety and security concerns in their usage. Further, the complex structure and large input spaces of DNNs act as an impediment to thorough verification and testing. The SafeDNN project at the Robust Software Engineering (RSE) group at NASA aims at exploring techniques to ensure that systems that use deep neural networks are safe, robust and interpretable. In this talk, I will be presenting our technique Prophecy that automatically infers formal properties of deep neural network models. The tool extracts patterns based on neuron activations as preconditions that imply certain desirable output properties of the model. I would be highlighting case studies that use Prophecy in obtaining explanations for network decisions, understanding correct and incorrect behavior, providing formal guarantees wrt safety and robustness, and debugging neural network models. We have applied the tool on image classification networks, neural network controllers providing turn advisories in unmanned aircrafts, regression models used for autonomous center-line tracking in aircrafts and neural network object detectors

Deep Neural Networks↗
DOE OSTI2026

A Physics-Informed Reinforcement Learning Framework for Economic-Thermal Co-Optimization of Crypto Mining Data Centers: Preprint

The rapid expansion of cryptocurrency mining has created a new class of high-density data centers characterized by extreme thermal flux and high sensitivity to volatile economic markets. Traditional thermal management strategies, typically reliant on rule-based control, maintain static setpoints that fail to account for fluctuating electricity prices and cryptocurrency values - factors critical to mining profitability. To address this, we present a physics-informed reinforcement learning (PIRL) framework for economic-thermal co-optimization in crypto mining data centers. This framework consists of a proximal policy optimization (PPO) agent, a virtual testbed powered by high-fidelity physics-based models, and an interactive frontend dashboard. The PPO agent is trained using the virtual testbed and strict hardware safety limits. This physics-informed approach allows the agent to learn a stochastic policy that dynamically balances mining revenue against operational costs by co-optimizing HVAC cooling setpoints and IT computational hashrate. The simulation results demonstrate that the integrated framework achieved an 8.62% increase in net operational profit compared to traditional baseline strategies while strictly adhering to safety-critical temperature constraints (coolant supply temperature < 32 degrees C). This work provides a scalable template for the deployment of reinforcement learning in mission critical facilities where economic volatility and physical safety must be managed simultaneously.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗
DOE OSTI2023

An Integrated Framework for Risk Assessment of Safety-related Digital Instrumentation and Control Systems in Nuclear Power Plants: Methodology Refinement and Exploration

This report documents activities performed by Idaho National Laboratory (INL) during Fiscal Year (FY) 2023 for the U.S. Department of Energy (DOE) Light Water Reactor Sustainability (LWRS) Program, Risk Informed Systems Analysis (RISA) Pathway, digital instrumentation and control (DI&C) risk assessment project. In FY 2019, the RISA Pathway initiated a project to develop a risk assessment strategy for delivering a technical basis to support effective, and secure DI&C technologies for digital upgrades/designs. A risk assessment-informed framework was proposed for this strategy, which aims to (1) provide a best-estimate, risk informed capability to quantitatively estimate the safety margin obtained from plant modernization, especially for safety-related DI&C systems, (2) support and supplement existing risk informed DI&C design guides by providing quantitative risk information and evidence, (3) offer a capability of design architecture evaluation of various DI&C systems, (4) assure the long-term safety and reliability of safety-related DI&C systems, and (5) reduce uncertainty in costs and support integration of DI&C systems in the plant. To achieve these technical goals, the LWRS-developed framework provides a means to address relevant technical issues by: (1) defining a risk informed analysis process for DI&C upgrade that integrates hazard analysis, reliability analysis, and consequence analysis, (2) applying risk informed tools to address common cause failures (CCFs) and quantify corresponding failure probabilities for DI&C technologies, particularly software CCFs, (3) evaluating the impact of digital failures at the component level, system level, and plant level, and (4) providing insights and suggestions on designs to manage the risks, thus to support the development and deployment of advanced DI&C technologies in nuclear power plants (NPPs). Adding diversity within a system or components is the primary means to eliminate and mitigate CCFs, but diversity also increases system complexity and may not address all sources of systematic failures. Optimization of diversity and redundancy applications for the safety-critical DI&C systems remains a challenge. To deal with the technical issues in addressing potential software CCFs in safety-related DI&C systems of NPPs and supporting relevant design optimization, the proposed framework provides: (a) A best-estimate, risk informed capability to address new technical digital issues quantitatively, focusing on software CCFs in safety-related DI&C systems of NPPs; (b) A common and a modularized platform for DI&C designers, software developers, cybersecurity analysts, and plant engineers to predict and prevent risk in the early design stage of DI&C systems; (c) Technical bases and risk informed insights to assist users address the risk informed alternatives for evaluation of CCFs in safety-related DI&C systems of NPPs; and (d) A risk informed tool that offers a capability of design architecture evaluation of various DI&C systems to support system design decisions in diversity and redundancy applications. The research and development efforts of this project in FY 2023 are focused on refining current methods on software CCF modeling and estimation and exploring additional innovative approaches to risk assessment of DI&C systems to enable a more comprehensive and complete assessment of various safety-related DI&C design architectures. The primary audience of this report are DI&C designers, engineers, and probabilistic risk assessment (PRA) practitioners. This includes stakeholders, such as the nuclear utilities and regulators who consider the deployment and upgrade of DI&C systems, DI&C software developers and reviewers, and cybersecurity specialists. It should be noted that all the analyses are performed for the demonstration of the methodology, not for the evaluation of an actual digital control system. Results are obtained based on limited design information and testing data.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
NASA NTRS2012

Tools Ensure Reliability of Critical Software

In November 2006, after attempting to make a routine maneuver, NASA's Mars Global Surveyor (MGS) reported unexpected errors. The onboard software switched to backup resources, and a 2-day lapse in communication took place between the spacecraft and Earth. When a signal was finally received, it indicated that MGS had entered safe mode, a state of restricted activity in which the computer awaits instructions from Earth. After more than 9 years of successful operation gathering data and snapping pictures of Mars to characterize the planet's land and weather communication between MGS and Earth suddenly stopped. Months later, a report from NASA's internal review board found the spacecraft's battery failed due to an unfortunate sequence of events. Updates to the spacecraft's software, which had taken place months earlier, were written to the wrong memory address in the spacecraft's computer. In short, the mission ended because of a software defect. Over the last decade, spacecraft have become increasingly reliant on software to carry out mission operations. In fact, the next mission to Mars, the Mars Science Laboratory, will rely on more software than all earlier missions to Mars combined. According to Gerard Holzmann, manager at the Laboratory for Reliable Software (LaRS) at NASA's Jet Propulsion Laboratory (JPL), even the fault protection systems on a spacecraft are mostly software-based. For reasons like these, well-functioning software is critical for NASA. In the same year as the failure of MGS, Holzmann presented a new approach to critical software development to help reduce risk and provide consistency. He proposed The Power of 10: Rules for Developing Safety-Critical Code, which is a small set of rules that can easily be remembered, clearly relate to risk, and allow compliance to be verified. The reaction at JPL was positive, and developers in the private sector embraced Holzmann's ideas.

Source record↗
NASA NTRS2015

Formal Foundations for Hierarchical Safety Cases

Safety cases are increasingly being required in many safety-critical domains to assure, using structured argumentation and evidence, that a system is acceptably safe. However, comprehensive system-wide safety arguments present appreciable challenges to develop, understand, evaluate, and manage, partly due to the volume of information that they aggregate, such as the results of hazard analysis, requirements analysis, testing, formal verification, and other engineering activities. Previously, we have proposed hierarchical safety cases, hicases, to aid the comprehension of safety case argument structures. In this paper, we build on a formal notion of safety case to formalise the use of hierarchy as a structuring technique, and show that hicases satisfy several desirable properties. Our aim is to provide a formal, theoretical foundation for safety cases. In particular, we believe that tools for high assurance systems should be granted similar assurance to the systems to which they are applied. To this end, we formally specify and prove the correctness of key operations for constructing and managing hicases, which gives the specification for implementing hicases in AdvoCATE, our toolset for safety case automation. We motivate and explain the theory with the help of a simple running example, extracted from a real safety case and developed using AdvoCATE.

Hierarchy↗
NASA NTRSDate not supplied

Achieving Resilient In-Flight Performance for Advanced Air Mobility through Simplified Vehicle Operations

A research and development (R&D) approach is proposed for developing and validating concepts and technologies to achieve vehicle autonomy goals of Advanced Air Mobility (AAM) through Simplified Vehicle Operations (SVO). The approach applies resilience-engineering and human-automation teaming (HAT) principles to a framework for defining vehicle-based functions for the management of missions and flight trajectories, focusing initially on the en route flight domain. To achieve the SVO goal of reducing pilot training requirements and thereby increasing the pilot pool for AAM, while at the same time promoting ever-safer operations, a framework for identifying essential functions is proposed. In this framework, functions are first categorized by high-level functional purpose (mission management, flightpath management, tactical operations, and vehicle control) and then subcategorized by attributes of resilient-performing systems (abilities to monitor, respond, learn, and anticipate). The categorization by functional purpose provides structure within which HAT designs can be holistically explored and total levels of human vs. automation responsibility can be varied. The subcategorization by resilient-system attributes provides a mechanism for capturing safety-critical functions that may not be codified in current operational procedures and training curricula, particularly those where humans proactively enhance safety in currently undocumented ways. An R&D approach consisting of seven strategies is proposed in which automation engineering and human-factors communities can collaborate in the research, development, and design of an SVO roadmap to enable the ambitious objectives of AAM.

AAM↗
NASA NTRS2009

Towards A Comprehensive Consideration of Epistemic Questions in Software System Safety

For any software system upon which lives depend, the most important question one can ask about it is, 'How do we know the system is safe?' Despite the critical importance of this question, no widely accepted, generally applicable answer exists. Instead, debate continues to rage over the question, with theorists and practitioners quarrelling with each other and amongst themselves. This paper suggests a possible way forward towards quelling the quarrels, based on refining the critical safety question into additional questions, which may be more likely to have answers on which a consensus can be reached.

Holloway, C. M.↗