SEARCH · Engineering Papers

Results for “Computer Security”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 1,441 records · Page 80

All sources NASA NTRS DOE OSTI

NASA NTRSDate not supplied

In-Depth Modeling and Simulation Analysis of Artemis Missions Using the Impact Probabilistic Risk Assessment Tool

BACKGROUND The Artemis campaign is a Moon exploration program with a series of six planned missions, five of which will be crewed. These five crewed missions will contain a single mission segment (space flight), or multiple mission segments involving space flight (Orion), lunar landing (LTV) and/or space habitat (Gateway). Each crewed segment faces the risk of unique medical conditions, necessitating medical sets/kits tailored to those specificities. To support and enable a data-driven and evidence-based decision-making process through out a mission’s life cycle, a software tool called IMPACT was developed. Using probabilistic risk assessment (PRA) methodologies, IMPACT (Informing Mission Planning via Analysis of Complex Tradespaces) is a novel tool built for analyzing the possibility of encountering complex medical risks during space flight, and for identifying the medical resources and capabilities needed to treat those potential at-risk medical conditions. IMPACT achieves this by performing hundreds of thousands of Monte Carlo simulations of missions to build aggregate pictures of medical risk. During an extended simulation modeling phase, IMPACT generated analytical results for medical risks, and the medical resources and capabilities to address those risks, for every segment of every crewed Artemis mission. This presentation will highlight the reliability, consistency and validity of IMPACT’s computational modeling techniques and will showcase the library of analytical outcomes generated for the Artemis missions. OVERVIEW During the early stages of IMPACT’s design, architecture and technical requirements collection, “scenarios” (use cases) - achievement goals required for acceptance testing, were identified by stakeholders. IMPACT successfully completed the scenario testing requirements and undertook an extensive operational run phase utilizing a wide range of input combinations with a goal of delivering a cohesive, trustworthy, reliable, vast, and diverse body of evidence. The intent of these modeling runs was to validate consistency in output, ensure solidity of executable operations and to streamline processes by identifying areas requiring efficiency improvements. Using the many missions of Artemis, IMPACT ran variations of operational runs to assess the output for acceptable, as well as unusual characteristics. This rigorous long-term “shakedown” analysis was implemented to help build a collective body of evidence to aid in securing a high level of confidence, reliability, and validity in the output, whether from the applicational components of IMPACT, or the entirety of the operational process. ANTICIPATED ANALYSIS AND CONCLUSION This presentation will discuss the various categories of input criteria; the comparisons in the application of these input criteria to various Artemis missions; the preparation and collection of the body of evidence, and reliability of the computational modeling techniques. This paper serves as an initial analytical overview of IMPACT’s probabilistic risk assessment (PRA) medical risk outputs covering Artemis missions and is not intended to be deemed the official medical response for the Artemis campaign.

Crew Composition↗

DOE OSTI2025

Enabling Seamless Transitions from Experimental to Production HPC for Interactive Workflows

The evolving landscape of scientific computing requires seamless transitions from experimental to production HPC environments for interactive workflows. This paper presents a structured transition pathway developed at OLCF that bridges the gap between development testbeds and production systems. We address both technological and policy challenges, introducing frameworks for data streaming architectures, secure service interfaces, and adaptive resource scheduling for time-sensitive workloads and improved HPC interactivity. Our approach transforms traditional batch-oriented HPC into a more dynamic ecosystem capable of supporting modern scientific workflows that require near real-time data analysis, experimental steering, and cross-facility integration.

Etz, Brian [ORNL] (ORCID:0000000208554863)↗

DOE OSTI2013

Bio-Inspired Cyber Security for Smart Grid Deployments

mart grid technologies are transforming the electric power grid into a grid with bi-directional flows of both power and information. Operating millions of new smart meters and smart appliances will significantly impact electric distribution systems resulting in greater efficiency. However, the scale of the grid and the new types of information transmitted will potentially introduce several security risks that cannot be addressed by traditional, centralized security techniques. We propose a new bio-inspired cyber security approach. Social insects, such as ants and bees, have developed complex-adaptive systems that emerge from the collective application of simple, light-weight behaviors. The Digital Ants framework is a bio-inspired framework that uses mobile light-weight agents. Sensors within the framework use digital pheromones to communicate with each other and to alert each other of possible cyber security issues. All communication and coordination is both localized and decentralized thereby allowing the framework to scale across the large numbers of devices that will exist in the smart grid. Furthermore, the sensors are light-weight and therefore suitable for implementation on devices with limited computational resources. This paper will provide a brief overview of the Digital Ants framework and then present results from test bed-based demonstrations that show that Digital Ants can identify a cyber attack scenario against smart meter deployments.

McKinnon, Archibald D.↗

DOE OSTI2017

Stochastic Multi-Timescale Power System Operations With Variable Wind Generation

This paper describes a novel set of stochastic unit commitment and economic dispatch models that consider stochastic loads and variable generation at multiple operational timescales. The stochastic model includes four distinct stages: stochastic day-ahead security-constrained unit commitment (SCUC), stochastic real-time SCUC, stochastic real-time security-constrained economic dispatch (SCED), and deterministic automatic generation control (AGC). These sub-models are integrated together such that they are continually updated with decisions passed from one to another. The progressive hedging algorithm (PHA) is applied to solve the stochastic models to maintain the computational tractability of the proposed models. Comparative case studies with deterministic approaches are conducted in low wind and high wind penetration scenarios to highlight the advantages of the proposed methodology, one with perfect forecasts and the other with current state-of-the-art but imperfect deterministic forecasts. The effectiveness of the proposed method is evaluated with sensitivity tests using both economic and reliability metrics to provide a broader view of its impact.

17 WIND ENERGY↗

DOE OSTI2017

AMPS: An Augmented Matrix Formulation for Principal Submatrix Updates with Application to Power Grids

We present an augmented matrix approach to update the solution to a linear system of equations when the coefficient matrix is modified by a few elements within a principal submatrix. This problem arises in the dynamic security analysis of a power grid, where operators need to perform $N-x$ contingency analysis, i.e., determine the state of the system when up to $x$ links from $N$ fail. Our algorithms augment the coefficient matrix to account for the changes in it, and then compute the solution to the augmented system without refactoring the modified matrix. We provide two algorithms, a direct method, and a hybrid direct-iterative method for solving the augmented system. We also exploit the sparsity of the matrices and vectors to accelerate the overall computation. Our algorithms are compared on three power grids with PARDISO, a parallel direct solver, and CHOLMOD, a direct solver with the ability to modify the Cholesky factors of the coefficient matrix. We show that our augmented algorithms outperform PARDISO (by two orders of magnitude), and CHOLMOD (by a factor of up to 5). Further, our algorithms scale better than CHOLMOD as the number of elements updated increases. The solutions are computed with high accuracy. Our algorithms are capable of computing $N-x$ contingency analysis on a $778K$ bus grid, updating a solution with $x=20$ elements in $1.6 \times 10^{-2}$ seconds on an Intel Xeon processor.

Yeung, Yu-Hong↗

DOE OSTI2021

Limbo

SAND2021-15055 O Limbo provides a programmatic interface for accessing computer vision training data. It is organized in the Limbo format. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.

Shead, Timothy↗

DOE OSTI2015

FY15 Report on Thermomechanical Testing

Sandia is participating in the third phase of a United States (US)-German Joint Project that compares constitutive models and simulation procedures on the basis of model calculations of the thermomechanical behavior and healing of rock salt (Salzer et al. 2015). The first goal of the project is to evaluate the ability of numerical modeling tools to correctly describe the relevant deformation phenomena in rock salt under various influences. Among the numerical modeling tools required to address this are constitutive models that are used in computer simulations for the description of the thermal, mechanical, and hydraulic behavior of the host rock under various influences and for the long-term prediction of this behavior. Achieving this goal will lead to increased confidence in the results of numerical simulations related to the secure disposal of radioactive wastes in rock salt. Results of the Joint Project may ultimately be used to make various assertions regarding stability analysis of an underground repository in salt during the operating phase as well as long-term integrity of the geological barrier in the post-operating phase A primary evaluation of constitutive model capabilities comes by way of predicting large-scale field tests. The Joint Project partners decided to model Waste Isolation Pilot Plant (WIPP) Rooms B & D which are full-scale rooms having the same dimensions. Room D deformed under natural, ambient conditions while Room B was thermally driven by an array of waste-simulating heaters (Munson et al. 1988; 1990). Existing laboratory test data for WIPP salt were carefully scrutinized and the partners decided that additional testing would be needed to help evaluate advanced features of the constitutive models. The German partners performed over 140 laboratory tests on WIPP salt at no charge to the US Department of Energy (DOE).

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗

NASA NTRS1990

Computer-Access-Code Matrices

Authorized users respond to changing challenges with changing passwords. Scheme for controlling access to computers defeats eavesdroppers and "hackers". Based on password system of challenge and password or sign, challenge, and countersign correlated with random alphanumeric codes in matrices of two or more dimensions. Codes stored on floppy disk or plug-in card and changed frequently. For even higher security, matrices of four or more dimensions used, just as cubes compounded into hypercubes in concurrent processing.

Collins, Earl R., Jr.↗

NASA NTRS2003

Space-based Operations Grid Prototype

The Space based Operations Grid is intended to integrate the "high end" network services and compute resources that a remote payload investigator needs. This includes integrating and enhancing existing services such as access to telemetry, payload commanding, payload planning and internet voice distribution as well as the addition of services such as video conferencing, collaborative design, modeling or visualization, text messaging, application sharing, and access to existing compute or data grids. Grid technology addresses some of the greatest challenges and opportunities presented by the current trends in technology, i.e. how to take advantage of ever increasing bandwidth, how to manage virtual organizations and how to deal with the increasing threats to information technology security. We will discuss the pros and cons of using grid technology in space-based operations and share current plans for the prototype. It is hoped that early on the prototype can incorporate many of the existing as well as future services that are discussed in the first paragraph above to cooperating International Space Station Principle Investigators both nationally and internationally.

Bradford, Robert N.↗

NASA NTRS2017

Smashing the Stovepipe: Leveraging the GMSEC Open Architecture and Advanced IT Automation to Rapidly Prototype, Develop and Deploy Next-Generation Multi-Mission Ground Systems

Satellite/Payload Ground Systems - Typically highly-customized to a specific mission's use cases - Utilize hundreds (or thousands!) of specialized point-to-point interfaces for data flows / file transfers Documentation and tracking of these complex interfaces requires extensive time to develop and extremely high staffing costs Implementation and testing of these interfaces are even more cost-prohibitive, and documentation often lags behind implementation resulting in inconsistencies down the road With expanding threat vectors, IT Security, Information Assurance and Operational Security have become key Ground System architecture drivers New Federal security-related directives are generated on a daily basis, imposing new requirements on current / existing ground systems - These mandated activities and data calls typically carry little or no additional funding for implementation As a result, Ground System Sustaining Engineering groups and Information Technology staff continually struggle to keep up with the rolling tide of security Advancing security concerns and shrinking budgets are pushing these large stove-piped ground systems to begin sharing resources - I.e. Operational / SysAdmin staff, IT security baselines, architecture decisions or even networks / hosting infrastructure Refactoring these existing ground systems into multi-mission assets proves extremely challenging due to what is typically very tight coupling between legacy components As a result, many "Multi-Mission" ops. environments end up simply sharing compute resources and networks due to the difficulty of refactoring into true multi-mission systems Utilizing continuous integration / rapid system deployment technologies in conjunction with an open architecture messaging approach allows System Engineers and Architects to worry less about the low-level details of interfaces between components and configuration of systems GMSEC messaging is inherently designed to support multi-mission requirements, and allows components to aggregate data across multiple homogeneous or heterogeneous satellites or payloads - The highly-successful Goddard Science and Planetary Operations Control Center (SPOCC) utilizes GMSEC as the hub for it's automation and situational awareness capability Shifts focus towards getting GS to a final configuration-managed baseline, as well as multi-mission / big-picture capabilities that help increase situational awareness, promote cross-mission sharing and establish enhanced fleet management capabilities across all levels of the enterprise.

GMSEC↗

NASA NTRS2023

Investigating the Impact of X-Ray Computed Tomography Imaging on Soluble Organic Matter in the Murchison Meteorite: Implications for Bennu Sample Analyses

X-ray computed tomography (XCT) is a valuable reconnaissance tool for three-dimensional imaging and identification of distinct lithologies in extraterrestrial samples. It will be used as part of the preliminary examination of samples returned from asteroid (101955) Bennu by the Origins, Spectral Interpretation, Resource Identification, and Security–Regolith Explorer (OSIRIS-REx) mission. However, it must first be established whether x-rays generated during XCT could degrade or alter the organic composition of the returned samples by radiolysis. To test this, we split a crushed sample of the Murchison CM2 meteorite, kept one portion as a control, and irradiated the other portion up to the maximum x-ray dosage (~180 Gy) that a Bennu sample would experience during an XCT imaging experiment. We then extracted organic compounds from both splits and conducted (i) nontargeted soluble organic analyses to compare the chemical distributions of C-, H-, O-, N-, and S-bearing species and (ii) targeted measurements to quantify the abundances of 96 individual soluble organic molecules that included protein amino acids, amines, carboxylic acids, hydroxy acids, carbonyl compounds, polycyclic aromatic hydrocarbons, alcohols, sugars, and N-heterocycles. We found that XCT imaging of the Murchison meteorite had no measurable impact on the relative abundances or enantiomeric compositions of most of the soluble organic compounds targeted in this study. Elevated total abundances of several soluble organic compound classes were observed in the XCT-scanned Murchison sample relative to the control. This is likely related to particle size heterogeneity and specific surface area differences between the sample aliquots used for the extractions, rather than a result of the x-ray exposure. Assuming the samples returned from asteroid Bennu by OSIRIS-REx have a similar composition to carbonaceous chondrites, these data provide confidence that XCT will not significantly alter their soluble organic compositions.

Daniel P Glavin↗

DOE OSTI2021

hydro-hifem v.1.0

SAND2021-3180 O The hydro-hifem 1.0 software is used to simulate transient physical processes in large geologic environments consisting of complex fractures and man-made infrastructures with affordable computational cost and mesh refinement. The Earth models with such complex model features can be designed by considering the reduction of insignificant dimensions of fractures/infrastructures and embracing their corresponding hierarchical material properties, and their computational meshes are generated by using Cubit. The finite element solutions are automatically distributed across nodes of parallel cluster for efficient computation of transient fluid flow or heat conduction in geologic media. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.

Beskardes, GungorDidem↗

DOE OSTI2020

Learning to Solve Large-Scale Security-Constrained Unit Commitment Problems

Security-constrained unit commitment (SCUC) is a fundamental problem in power systems and electricity markets. In practical settings, SCUC is repeatedly solved via mixed-integer linear programming (MIP), sometimes multiple times per day, with only minor changes in input data. In this work, we propose a number of machine learning techniques to effectively extract information from previously solved instances in order to significantly improve the computational performance of MIP solvers when solving similar instances in the future. Based on statistical data, we predict redundant constraints in the formulation, good initial feasible solutions, and affine subspaces where the optimal solution is likely to lie, leading to a significant reduction in problem size. Computational results on a diverse set of realistic and large-scale instances show that using the proposed techniques, SCUC can be solved on average 4.3 times faster with optimality guarantees and 10.2 times faster without optimality guarantees, with no observed reduction in solution quality. Out-of-distribution experiments provide evidence that the method is somewhat robust against data-set shift. Summary of Contribution. The paper describes a novel computational method, based on a combination of mixed-integer linear programming (MILP) and machine learning (ML), to solve a challenging and fundamental optimization problem in the energy sector. The method advances the state-of-the-art, not only for this particular problem, but also, more generally, in solving discrete optimization problems via ML. We expect that the techniques presented can be readily used by practitioners in the energy sector and adapted, by researchers in other fields, to other challenging operations research problems that are solved routinely.

Machine Learning↗

DOE OSTI2019

DOE Data Day 2019 Report

The Department of Energy (DOE) has joined the larger scientific community in the promotion of data management as a means to higher quality, more efficient research and analysis, and as a critical component of data science. Tools and platforms to support data management and analysis are rapidly evolving and provide enormous opportunities. They also pose challenges that can be specific to DOE but are common across DOE mission areas and organizations. The DOE Data Day (D3) workshop was held on September 25–26, 2019, and organized by a team at Lawrence Livermore National Laboratory (LLNL) in an effort to gather the data management practitioners at the DOE labs together to share their work and results, facilitating knowledge transfers and best practices across project teams. Over 100 attendees participated from multiple national labs—LLNL, Sandia (SNL), Lawrence Berkeley (LBNL), Los Alamos (LANL), Oak Ridge (ORNL), Argonne (ANL), Pacific Northwest (PNNL), Stanford Linear Accelerator (SLAC)—along with Mission Support and Test Services (MSTS), National Energy Technology Laboratory (NETL), Pantex, National Security Complex (Y-12), National Nuclear Security Administration (NNSA), the DOE Office of Scientific and Technical Information (OSTI), and elsewhere in the DOE complex.

96 KNOWLEDGE MANAGEMENT AND PRESERVATION↗

DOE OSTI2018

Intrinsic use control for system and use controlled component security

An Initialization Unit (IU) initiates an initial secure connection with an Intrinsic Use Control (IUC) Chip based on very large random numbers (VLRNs). The IUC Chip in turn initiates a secondary secure connection between it and one or more Use Controlled Components (UCCs). Polling by the IU allows confirmation of an ongoing secure connection, and also allows the IUC Chip to confirm the secondary secure connection to the UCCs. Removal or improper polling response from one of the UCCs results in a response from the IUC Chip that may include notification of tampering, or temporary or permanent discontinued operation of the offending UCC. Permanent discontinued operation may include destruction of the offending UCC, and cascaded discontinued operation of all other UCCs secured by the IUC Chip. A UCC may in turn be another nested layer of IUC Chips, controlling a corresponding layer of UCCs, ad infinitum.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2018

Intrinsic use control for system and use controlled component security

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2016

Probabilistic Risk Assessment of Spent Fuel Pool Cooling System Failure Considering Safety and Security Initiating Events

In order to quantify the probable risk associated with a safety system, nuclear safety risk evaluation process is applied which is generally performed in three steps. The first step is to calculate the damage frequency of a critical system. This step is followed by the radioactive source term estimation due to the potential system damage. The final step is the assessment of off-site consequences. The safety risk formula is shown by Eq. (1). P{sub F} is the probability of safety system failure (the probability used describes a random, independent event), and C is the consequence value. R{sub SAF} = P{sub F} * C (1) The security risk associated with an attack on critical infrastructure and/or special nuclear materials theft is usually evaluated using three- term risk equation (probability of attack, probability of adversary success, and consequence). A security threat and the related initiating events are not considered in a pure safety risk analysis. The vulnerability of the physical protection system is performed independently even though the consequence resulting from a security initiating event can be similar to a safety related initiating event and thus gets double counted. The security risk can be calculated using Eq. (2) R{sub SEC} = P{sub A} * P{sub S} * C (2) PA is the probability of attack, P{sub S} is the probability of adversary success (P{sub S} = 1 - P{sub I} P{sub N}). P{sub I} being the probability of interruption which accounts for the probabilities of detection of all timely detection elements along an adversary path. PN being the probability of neutralization: the result of engagement of the response force with the adversaries after the interruption has occurred. C is the consequence magnitude from a successful attack. The two security probabilities do not describe random, independent events. As a result, because of the differences in the randomness and independence of the respective safety and security probabilities, the safety and the security risks are currently calculated separately. The consequence term in nuclear safety and security risk evaluation have the same definition. An effort is made here to study the effect on the overall risk by considering security initiating events along with the subsequent failure of the intermediate safety element. The target selected is a spent fuel storage pool for analyzing the public risk arising from the interplay between nuclear security and safety initiating events. EASI (Estimate of Adversary Sequence Interruption) model is used to calculate the probability of interruption related to a security system that leads to the calculation of the security initiating event frequency. Further progression of this initiating security event to a top event is analyzed using a Probabilistic Safety Assessment (PSA) tool, SAPHIRE (version 8) to obtain a joint pool damage frequency. For the progression of events leading to a top event, the failure of the intermediate safety elements is assumed to be external random events such as heavy load drop and fire events. The objectives of this study is to (1) determine the double accounting of frequency of failure, risk and allocated resources in the scenario of a non-random security initiating event leading to a safety random event chain (2) compare the damage frequency from pure security with the frequency of combined security-safety failure event and pure safety failure events. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

DOE OSTI2016

Final Technical Report on Quantifying Dependability Attributes of Software Based Safety Critical Instrumentation and Control Systems in Nuclear Power Plants

With the current transition from analog to digital instrumentation and control systems in nuclear power plants, the number and variety of software-based systems have significantly increased. The sophisticated nature and increasing complexity of software raises trust in these systems as a significant challenge. The trust placed in a software system is typically termed software dependability. Software dependability analysis faces uncommon challenges since software systems’ characteristics differ from those of hardware systems. The lack of systematic science-based methods for quantifying the dependability attributes in software-based instrumentation as well as control systems in safety critical applications has proved itself to be a significant inhibitor to the expanded use of modern digital technology in the nuclear industry. Dependability refers to the ability of a system to deliver a service that can be trusted. Dependability is commonly considered as a general concept that encompasses different attributes, e.g., reliability, safety, security, availability and maintainability. Dependability research has progressed significantly over the last few decades. For example, various assessment models and/or design approaches have been proposed for software reliability, software availability and software maintainability. Advances have also been made to integrate multiple dependability attributes, e.g., integrating security with other dependability attributes, measuring availability and maintainability, modeling reliability and availability, quantifying reliability and security, exploring the dependencies between security and safety and developing integrated analysis models. However, there is still a lack of understanding of the dependencies between various dependability attributes as a whole and of how such dependencies are formed. To address the need for quantification and give a more objective basis to the review process -- therefore reducing regulatory uncertainty -- measures and methods are needed to assess dependability attributes early on, as well as throughout the life-cycle process of software development. In this research, extensive expert opinion elicitation is used to identify the measures and methods for assessing software dependability. Semi-structured questionnaires were designed to elicit expert knowledge. A new notation system, Causal Mechanism Graphing, was developed to extract and represent such knowledge. The Causal Mechanism Graphs were merged, thus, obtaining the consensus knowledge shared by the domain experts. In this report, we focus on how software contributes to dependability. However, software dependability is not discussed separately from the context of systems or socio-technical systems. Specifically, this report focuses on software dependability, reliability, safety, security, availability, and maintainability. Our research was conducted in the sequence of stages found below. Each stage is further examined in its corresponding chapter. Stage 1 (Chapter 2): Elicitation of causal maps describing the dependencies between dependability attributes. These causal maps were constructed using expert opinion elicitation. This chapter describes the expert opinion elicitation process, the questionnaire design, the causal map construction method and the causal maps obtained. Stage 2 (Chapter 3): Elicitation of the causal map describing the occurrence of the event of interest for each dependability attribute. The causal mechanisms for the “event of interest” were extracted for each of the software dependability attributes. The “event of interest” for a dependability attribute is generally considered to be the “attribute failure”, e.g. security failure. The extraction was based on the analysis of expert elicitation results obtained in Stage 1. Stage 3 (Chapter 4): Identification of relevant measurements. Measures for the “events of interest” and their causal mechanisms were obtained from expert opinion elicitation for each of the software dependability attributes. The measures extracted are presented in this chapter. Stage 4 (Chapter 5): Assessment of the coverage of the causal maps via measures. Coverage was assessed to determine whether the measures obtained were sufficient to quantify software dependability, and what measures are further required. Stage 5 (Chapter 6): Identification of “missing” measures and measurement approaches for concepts not covered. New measures, for concepts that had not been covered sufficiently as determined in Stage 4, were identified using supplementary expert opinion elicitation as well as literature reviews. Stage 6 (Chapter 7): Building of a detailed quantification model based on the causal maps and measurements obtained. Ability to derive such a quantification model shows that the causal models and measurements derived from the previous stages (Stage 1 to Stage 5) can form the technical basis for developing dependability quantification models. Scope restrictions have led us to prioritize this demonstration effort. The demonstration was focused on a critical system, i.e. the reactor protection system. For this system, a ranking of the software dependability attributes by nuclear stakeholders was developed. As expected for this application, the stakeholder ranking identified safety as the most critical attribute to be quantified. A safety quantification model limited to the requirements phase of development was built. Two case studies were conducted for verification. A preliminary control gate for software safety for the requirements stage was proposed and applied to the first case study. The control gate allows a cost effective selection of the duration of the requirements phase.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗