Results for “Criticality Safety” — Page 44

NASA NTRS2014

Bayesian Statistics and Uncertainty Quantification for Safety Boundary Analysis in Complex Systems

The analysis of a safety-critical system often requires detailed knowledge of safe regions and their highdimensional non-linear boundaries. We present a statistical approach to iteratively detect and characterize the boundaries, which are provided as parameterized shape candidates. Using methods from uncertainty quantification and active learning, we incrementally construct a statistical model from only few simulation runs and obtain statistically sound estimates of the shape parameters for safety boundaries.

Active Learning↗

NASA NTRSDate not supplied

Systems Health Management and Prognostics Approaches for Electric Aircrafts

As more and more electric vehicles emerge in our daily operation progressively, a very critical challenge lies in the prediction of remaining driving flying time/distance for the flying vehicles. This information is important, particularly in the case of auto vehicles, because such vehicles can become self-aware, autonomously compute its own capabilities, and identify how to best plan and successfully complete vehicular missions safely. In case of electric aircrafts, computing the remaining flying time is also safety-critical, since an aircraft that runs out of power (battery charge) while in the air will eventually lose control leading to catastrophe. To facilitate and solve the prediction problem, awareness of the current health state of the system is key, since it is necessary to perform condition-based predictions. To accurately predict the future state of any system, it is required to possess knowledge of its current health state and future operational conditions. Latest achievements of data-driven algorithms in regression of complex nonlinear functions and classification tasks have generated a growing interest in artificial intelligence for industrial applications. Complex multi-physics models as well as digital twins, once purely built on physics and corresponding simplified lumped parameter iterations, can now benefit from machine learning algorithms to mitigate the lack of understanding of some complex behavior. Given models of the current and future system behavior, a general approach of model-based prognostics can solve the prediction problem and further decision-making. A systematic prediction framework is implemented to identify all possible sources of uncertainty, quantify each of them individually, and mathematically estimate their combined effect on the system-level quantity of interest, in this case, the remaining flying time/distance of the unmanned aircraft. Note - This presentation contains all previously published information.

Systems Health Managent↗

NASA NTRSDate not supplied

Health Monitoring and Prognostics for Electric Aircrafts

As more and more electric vehicles emerge in our daily operation progressively, a very critical challenge lies in the prediction of remaining driving flying time/distance for the flying vehicles. This information is important, particularly in the case of auto vehicles, because such vehicles can become self-aware, autonomously compute its own capabilities, and identify how to best plan and successfully complete vehicular missions safely. In case of electric aircrafts, computing the remaining flying time is also safety-critical, since an aircraft that runs out of power (battery charge) while in the air will eventually lose control leading to catastrophe. To facilitate and solve the prediction problem, awareness of the current health state of the system is key, since it is necessary to perform condition-based predictions. To accurately predict the future state of any system, it is required to possess knowledge of its current health state and future operational conditions. Latest achievements of data-driven algorithms in regression of complex nonlinear functions and classification tasks have generated a growing interest in artificial intelligence for industrial applications. Complex multi-physics models as well as digital twins, once purely built on physics and corresponding simplified lumped parameter iterations, can now benefit from machine learning algorithms to mitigate the lack of understanding of some complex behavior. Given models of the current and future system behavior, a general approach of model-based prognostics can solve the prediction problem and further decision-making. A systematic prediction framework is implemented to identify all possible sources of uncertainty, quantify each of them individually, and mathematically estimate their combined effect on the system-level quantity of interest, in this case, the remaining flying time/distance of the unmanned aircraft. Note - This presentation contains all previously approved and published information.

Systems Health Managent↗

DOE OSTI2024

Synthesis of Correct Digital Controller Models from Specifications by Model Transformation (21-0320)

The design of high consequence controllers (in weapons systems, autonomy, etc.) that do what they are supposed to do is a significant challenge. Testing simply does not come close to meeting the requirements for assurance. Today circuit designers at Sandia (and elsewhere) typically capture the core behavior of their components using state models in tools such as STATEFLOW. They then check that their models meet certain requirements (e.g. “The system bus must not deadlock” or “both traffic lights at an intersection must not be green at the same time”) using tools called model checkers. If the model checker returns “yes” then the property is guaranteed to be satisfied by the model. However, there are several drawbacks to this industry practice: (1) there is a lot of detail to get right, this is particularly challenging when there are multiple components requiring complex coordination (2) any errors returned by the model checker have to be traced back through the design and fixed, necessitating rework, (3) there are severe scalability problems with this approach, particularly when dealing with concurrency. All this places high demands on the designers who now face not only an accelerated schedule but also controllers of increasing complexity. This report describes a new and fundamentally different approach to the construction of safety-critical digital controllers. Instead of directly constructing a complete model and then trying to verify it, the designer can start with an initial abstract (think “sketch”) model plus the requirements, from which a correct concrete model is automatically synthesized. There is no need for post-hoc verification of required functional properties. Having tool to carry this out will significantly impact the nation’s ability to ensure the safety of high-consequence digital systems. The approach has been implemented in a prototype tool, along with a suite of examples, including ones that reflect actual problems faced by designers. Our approach operates on a variant of Statecharts developed at Sandia called Qspecs. Statecharts are a widely used formalism for developing concurrent reactive systems, supporting scalability through allowing state models containing composite states, which are the serial or parallel composition of substates which can themselves contain statecharts. Statecharts enable an incremental style of development, in which states are progressively refined to incorporate greater detail in an incremental model of software development. Our approach formulates a set of constraints from the structure of the models and the requirements and propagates these constraints to a fixpoint. The solution to the constraints is an inductive invariant along with guards on the transitions. We also show how our approach extends to implementation refinement, decomposition, composition, and elaboration. We currently handle safety requirements written in LTL (Linear Temporal Logic)

42 ENGINEERING↗

NASA NTRS2019

Prognostics and Health Monitoring: Application to Electric Vehicles

As more and more electric vehicles emerge in our daily operation progressively, a very critical challenge lies in the prediction of remaining driving-time distance (for cars) or flying time-distance (for aircraft). This information is important, particularly in the case of unmanned vehicles, because such vehicles can become self-aware, autonomously compute its own capabilities, and identify how to best plan and successfully complete vehicular missions safely. In case of electric aircrafts, computing remaining flying time is also safety-critical, since an aircraft that runs out of power (battery charge) while in the air will eventually lose control leading to catastrophe. In order to tackle and solve the prediction problem, it is essential to have awareness of the current state and health of the system, especially since it is necessary to perform condition-based predictions. To be able to predict the future state of the system, it is also required to possess knowledge of the current and future operations of the vehicle.

Electric Vehicles↗

NASA NTRS1993

Development of a software safety process and a case study of its use

The goal of this research is to continue the development of a comprehensive approach to software safety and to evaluate the approach with a case study. The case study is a major part of the project, and it involves the analysis of a specific safety-critical system from the medical equipment domain. The particular application being used was selected because of the availability of a suitable candidate system. We consider the results to be generally applicable and in no way particularly limited by the domain. The research is concentrating on issues raised by the specification and verification phases of the software lifecycle since they are central to our previously-developed rigorous definitions of software safety. The theoretical research is based on our framework of definitions for software safety. In the area of specification, the main topics being investigated are the development of techniques for building system fault trees that correctly incorporate software issues and the development of rigorous techniques for the preparation of software safety specifications. The research results are documented. Another area of theoretical investigation is the development of verification methods tailored to the characteristics of safety requirements. Verification of the correct implementation of the safety specification is central to the goal of establishing safe software. The empirical component of this research is focusing on a case study in order to provide detailed characterizations of the issues as they appear in practice, and to provide a testbed for the evaluation of various existing and new theoretical results, tools, and techniques. The Magnetic Stereotaxis System is summarized.

Knight, John C.↗

NASA NTRS2015

Ethernet for Aerospace Applications - Ethernet Heads for the Skies

One of the goals of aerospace applications is to reduce the cost and complexity of avionic systems. Ethernet is a highly scalable, flexible, and popular protocol. The aerospace market is large, with a forecasted production of over 50,000 turbine-powered aircraft valued at $1.7 trillion between 2012 and 2022. Boeing estimates demand for commercial aircraft by 2033 to total over 36,000 with a value of over $5 trillion. In 2014 US airlines served over 750 million passengers and this is growing over 2% yearly. Electronic fly-by-wire is now used for all airliners and high performance aircraft. Although Ethernet has been widely used for four decades, its use in aerospace applications is just beginning to become common. Ethernet is the universal solution in commercial networks because of its high bandwidths, lower cost, openness, reliability, maintainability, flexibility, and interoperability. However, when Ethernet was designed applications with time-critical, safety relevant and deterministic requirements were not given much consideration. Many aerospace applications use a variety of communication architectures that add cost and complexity. Some of them are SpaceWire, MIL-STD-1553, Avionics Full Duplex Switched Ethernet (AFDX), and Time-Triggered Ethernet (TTE). Aerospace network designers desire to decrease the number of networks to reduce cost and effort while improving scalability, flexibility, openness, maintainability, and reliability. AFDX and TTE are being considered more for critical aerospace systems because they provide redundancy, failover protection, guaranteed timing, and frame priority and are based on Ethernet IEEE 802.3. This paper explores the use of AFDX and TTE for aerospace applications.

Ethernet↗

DOE OSTI2026

Morgana Overview – NCERC Support for Dynamic Subcritical Experiments

The LANL Subcritical Experiments Program (SCE) recently executed the Morgana Subcritical Experiment at the NNSS. This was the first subcritical experiment executed by LANL for several years (since 2021). It was also notably the first that required SCE personnel to have FMH qualifications for a portion of the work conducted under nuclear criticality safety limits.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

NASA NTRS2015

Body of Knowledge (BOK) for Copper Wire Bonds

Copper wire bonds have replaced gold wire bonds in the majority of commercial semiconductor devices for the latest technology nodes. Although economics has been the driving mechanism to lower semiconductor packaging costs for a savings of about 20% by replacing gold wire bonds with copper, copper also has materials property advantages over gold. When compared to gold, copper has approximately: 25% lower electrical resistivity, 30% higher thermal conductivity, 75% higher tensile strength and 45% higher modulus of elasticity. Copper wire bonds on aluminum bond pads are also more mechanically robust over time and elevated temperature due to the slower intermetallic formation rate - approximately 1/100th that of the gold to aluminum intermetallic formation rate. However, there are significant tradeoffs with copper wire bonding - copper has twice the hardness of gold which results in a narrower bonding manufacturing process window and requires that the semiconductor companies design more mechanically rigid bonding pads to prevent cratering to both the bond pad and underlying chip structure. Furthermore, copper is significantly more prone to corrosion issues. The semiconductor packaging industry has responded to this corrosion concern by creating a palladium coated copper bonding wire, which is more corrosion resistant than pure copper bonding wire. Also, the selection of the device molding compound is critical because use of environmentally friendly green compounds can result in internal CTE (Coefficient of Thermal Expansion) mismatches with the copper wire bonds that can eventually lead to device failures during thermal cycling. Despite the difficult problems associated with the changeover to copper bonding wire, there are billions of copper wire bonded devices delivered annually to customers. It is noteworthy that Texas Instruments announced in October of 2014 that they are shipping microcircuits containing copper wire bonds for safety critical automotive applications. An evaluation of copper wire bond technology for applicability to spaceflight hardware may be warranted along with concurrently compiling a comprehensive understanding of the failure mechanisms involved with copper wire bonded semiconductor devices.

Body of Knowledge (BOK)↗

NASA NTRS2008

Impact of Pilot Delay and Non-Responsiveness on the Safety Performance of Airborne Separation

Assessing the safety effects of prediction errors and uncertainty on automationsupported functions in the Next Generation Air Transportation System concept of operations is of foremost importance, particularly safety critical functions such as separation that involve human decision-making. Both ground-based and airborne, the automation of separation functions must be designed to account for, and mitigate the impact of, information uncertainty and varying human response. This paper describes an experiment that addresses the potential impact of operator delay when interacting with separation support systems. In this study, we evaluated an airborne separation capability operated by a simulated pilot. The experimental runs are part of the Safety Performance of Airborne Separation (SPAS) experiment suite that examines the safety implications of prediction errors and system uncertainties on airborne separation assistance systems. Pilot actions required by the airborne separation automation to resolve traffic conflicts were delayed within a wide range, varying from five to 240 seconds while a percentage of randomly selected pilots were programmed to completely miss the conflict alerts and therefore take no action. Results indicate that the strategicAirborne Separation Assistance System (ASAS) functions exercised in the experiment can sustain pilot response delays of up to 90 seconds and more, depending on the traffic density. However, when pilots or operators fail to respond to conflict alerts the safety effects are substantial, particularly at higher traffic densities.

Consiglio, Maria↗

NASA NTRSDate not supplied

Establishing the Assurance Efficacy of Automated Risk Mitigation Strategies

Verification and validation of increasingly autonomous aviation systems is a major challenge. Traditional techniques for the assurance of high-confidence, safety-critical systems are not equipped to handle the complexity, uncertainty, and lack of predictability inherent in non-deterministic systems. Techniques such as run time monitoring, formal methods, and testing and simulation have been applied to some effect, but it is difficult to properly assess the success of such measures. The authors propose the concept of Assurance Efficacy to address this gap. Assurance Efficacy is seen as a parameter, criteria, or perspective by which to evaluate, identify and explore safety risk mitigation strategies and operational assurance architectures. Validation of the utility of this concept through flight testing is a first step in determining its potential role in assessing the overall safety of complex, increasingly autonomous systems that cannot be fully assured in the design phase.

system safety↗

DOE OSTI2025

Success Path Method: Introduction to the Success Path Method Software Tool©

As part of its commitment to advancing safety and reliability assessment methodologies, Argonne National Laboratory pioneered the use of an evaluation method called the Success Path Method (SPM) to improve risk management for offshore oil and gas operations. The development of the SPM at Argonne has been driven by the need to improve existing risk assessment methodologies by focusing on the steps necessary for success rather than failure modes alone. This is particularly important for industrial environments like offshore facilities that perform multiple functions under a continuously evolving set of operational conditions – such as water depth and temperature, currents, and weather conditions. In these dynamic environments, the traditional Probabilistic Risk Assessment (PRA) approach is far too complex as it focuses on what can go wrong – which comprises an infinite failure space that must be fully explored and understood. By shifting the focus to a finite space of success paths, the SPM enables operators and decision makers to prioritize a manageable number of steps that must go right to ensure success. Building on its five decades of experience in safety assessments for the nuclear industry, Argonne made major adaptations to existing risk assessment methods utilizing features similar to fault trees that are traditionally used in PRA to map all pathways in which the system can malfunction. In contrast, SPM identifies the components and processes that must function correctly to achieve specific outcomes – such as preventing the uncontrolled release of hydrocarbons during drilling operations. The SPM framework integrates equipment, procedures, software, processes, and human actions to ensure that physical barriers meet critical safety functions in dynamic operational conditions. This approach helps identify failure modes and improve operational risk management by narrowing the focus to key success elements, which in turn reduces uncertainty and helps users understand, manage, and respond to failures.

97 MATHEMATICS AND COMPUTING↗

NASA NTRS2004

Verification and Validation Methodology of Real-Time Adaptive Neural Networks for Aerospace Applications

Recent research has shown that adaptive neural based control systems are very effective in restoring stability and control of an aircraft in the presence of damage or failures. The application of an adaptive neural network with a flight critical control system requires a thorough and proven process to ensure safe and proper flight operation. Unique testing tools have been developed as part of a process to perform verification and validation (V&V) of real time adaptive neural networks used in recent adaptive flight control system, to evaluate the performance of the on line trained neural networks. The tools will help in certification from FAA and will help in the successful deployment of neural network based adaptive controllers in safety-critical applications. The process to perform verification and validation is evaluated against a typical neural adaptive controller and the results are discussed.

Gupta, Pramod↗

NASA NTRS2021

Assuring Intelligent Systems: Contingency Management for UAS

Unmanned aircraft systems (UAS) collaborate with humans to operate in diverse, safety-critical applications. However, assurance technologies need to be integrated into the design process in order to guarantee safe behavior, thereby enabling UAS operations in the National Airspace System (NAS). In this paper, formal methods are integrated with learning-enabled systems representations. The generation and representation of knowledge are captured via monadic second-order logic rules in the cognitive architecture Soar. These rules are translated into timed automata, and a proof of correctness for the translation is provided so that safety and liveness properties can be checked in the formal verification environment Uppaal. This approach is agnostic to the learning mechanism used to generate the learned rules (e.g., chunking, etc.). An example of a fault-tolerant, learning-enabled UAS deciding which of four contingency procedures to execute under a lost link scenario while overflying an urban area is used to illustrate the approach.

Intelligent Systems↗

DOE OSTI2020

Dual Purpose Canister Reactivity and Groundwater Absorption Analyses

The current spent nuclear fuel (SNF) management strategy includes reliance on dry storage. Utilities are meeting their interim storage needs on an individual basis with use of large-capacity dry storage casks, with a current focus on meeting existing storage and transportation requirements, as disposal requirements are not currently available. These casks are commonly known as dual-purpose (i.e., storage and transportation) canisters (DPCs). However, a small percentage of single-purpose (storage only) systems is also being used to meet storage needs. These are included under the “DPC” heading. This report investigates the postclosure criticality safety aspects of DPCs. Placing large, heavy waste packages containing DPCs into a repository for direct disposal has not yet been implemented domestically or internationally. Therefore, direct disposal of DPCs represents new engineering and scientific challenges. Some of the engineering challenges that have already been addressed include handling and placement, use of ramps vs. shafts, use of hoists, use of transport equipment, and thermal management. Additionally, some studies have been conducted in the past regarding the feasibility of direct disposal from a criticality analysis perspective and have concluded that while possible, demonstrating subcriticality over the disposal time period is a challenge. The alternative to direct disposal of DPCs into a repository is to repackage the SNF into different canisters. The direct disposal of DPCs without cutting them open and repackaging is appealing because it could be more cost-effective, reduce the complexity of fuel management operations both in and outside reactor facilities, and result in less cumulative worker dose during interim storage and handling before eventual disposal in a deep geologic repository.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗

DOE OSTI2022

Dual Purpose Canister Reactivity and Groundwater Absorption Analyses

The current spent nuclear fuel (SNF) management strategy includes reliance on dry storage. Utilities are meeting their interim storage needs on an individual basis with use of large-capacity dry storage casks, with a current focus on meeting existing storage and transportation requirements, as disposal requirements are not currently available. These casks are commonly known as dual-purpose (i.e., storage and transportation) canisters (DPCs). However, a small percentage of single-purpose (storage only) systems is also being used to meet storage needs. These are included under the “DPC” heading. This report investigates the postclosure criticality safety aspects of DPCs. Placing large, heavy waste packages containing DPCs into a repository for direct disposal has not yet been implemented domestically or internationally. Therefore, direct disposal of DPCs represents new engineering and scientific challenges. Some of the engineering challenges that have already been addressed include handling and placement, use of ramps vs. shafts, use of hoists, use of transport equipment, and thermal management. Additionally, some studies have been conducted in the past regarding the feasibility of direct disposal from a criticality analysis perspective and have concluded that while possible, demonstrating subcriticality over the disposal time period is a challenge. The alternative to direct disposal of DPCs into a repository is to repackage the SNF into different canisters. The direct disposal of DPCs without cutting them open and repackaging is appealing because it could be more cost-effective, reduce the complexity of fuel management operations both in and outside reactor facilities, and result in less cumulative worker dose during interim storage and handling before eventual disposal in a deep geologic repository.

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

DOE OSTI2021

Subcriticality Measurements for a Changing Concentration Uranyl Nitrate Solution Tank by Californium Source-Driven Noise Analysis

Subcritical californium source-driven noise analysis (CSDNA) measurements were performed at the Oak Ridge Critical Experiments Facility in 1983 using a stainless-steel tank with an inside diameter of 76.2 cm and a height of 91.4 cm but only filled with a uranyl (93.16 wt.% 235 U) nitrate solution to a height of 76.2 cm for all measurements. The free acid content of the uranyl nitrate solution was less than 0.01 N to minimize hazards in handling. The total available highly enriched uranium for these measurements was 5,296 g. The concentration of the solution was varied from the highest density of 14.71 grams of uranium per liter (g U/L) initially in 16 steps, lowering the concentration to 0.3492 g U/L, and finally using a tank filled with only water. The tank had a Plexiglas lid to minimize evaporation. The Cf source was contained in a re-entrant Lexan tube which could be in the solution parallel to the axis of the cylindrical tank. The detectors were 3 He proportional counters in the solution in shrink-fit tubing to isolate the counters from the fissile solution and adjacent to the outside of the tank. In some cases, the detectors were scintillators adjacent to the outside of the tank. In other cases, the source was external to the tank. Some data presented in this report are from notes and are not in the logbook. The prompt neutron decay constant was obtained from fitting the date from the CSDNA measurements. The purpose of this report is to document the experimental information for the measurements performed so that later, researchers could perform the required uncertainty and calculational analyses and documentation to use these data for an International Nuclear Criticality Safety Benchmark Program (ICSBEP) or a Nuclear Energy Agency benchmark. The prompt neutron decay measurements could be the basis of as International Reactor Physic Benchmark Program. The data from these measurements are available from the Records Management Services Department of Oak Ridge National Laboratory, and the logbook is also available from the ICSBEP at Idaho National Laboratory. Preparation of the present report is part of a larger cooperative effort between Idaho National Laboratory (INL) and Oak Ridge National Laboratory (ORNL) to document more than 15 undocumented critical and subcritical experiments enumerated in ORNL/TM-2019/18 and performed by ORNL at ORCEF and other USDOE critical experiments facilities using more than 500 operational days of critical facility time.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗

DOE OSTI2022

Reducing the Overnight Capital Cost of Advanced Reactors Using Equipment-Level Seismic Protective Systems

Consideration of the effects of earthquake shaking on the design and construction of nuclear power plants adds substantially to the overnight capital cost, with anecdotal estimates as high as 35+%, attributed to additional construction materials, need for one-off and sub-optimal designs of equipment due to conflicting design choices, the high cost of seismic qualification of equipment, and regulatory review. Safety-critical equipment in large light water reactors is designed and qualified for seismic demands imposed by the supporting reactor building, optimal mechanical designs are not possible, and designs of a given piece of equipment may vary with height above grade. Similar negative impacts are expected for advanced reactors unless the seismic design paradigm is changed. The overarching goal of this transformational MEITNER project, which involved a multidisciplinary engineering team and designers of three fundamentally different advanced reactors, was to adapt proven seismic isolation and damping technologies to operationalize modular protective systems for safety-class equipment inside advanced reactor buildings. Such seismic protective systems would be tightly integrated into design development for reactor support systems and balance-of-plant construction. The adoption of the technology, which is widely used in non-nuclear sectors, would simplify plant design, enable the use of standardized equipment and buildings, optimized for operational performance, and reduce plant size and weight. The need for site-specific equipment would be eliminated, enabling identical equipment to be used across multiple plants sited across the US and economies of scale, and catalyzing new interest and investment. The equipment-based protective systems would allow siting of advanced reactors in regions of high seismic hazard.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗