Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Safety Case”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records
All sourcesNASA NTRSDOE OSTI
NASA NTRS2015

Formal Foundations for Hierarchical Safety Cases

Safety cases are increasingly being required in many safety-critical domains to assure, using structured argumentation and evidence, that a system is acceptably safe. However, comprehensive system-wide safety arguments present appreciable challenges to develop, understand, evaluate, and manage, partly due to the volume of information that they aggregate, such as the results of hazard analysis, requirements analysis, testing, formal verification, and other engineering activities. Previously, we have proposed hierarchical safety cases, hicases, to aid the comprehension of safety case argument structures. In this paper, we build on a formal notion of safety case to formalise the use of hierarchy as a structuring technique, and show that hicases satisfy several desirable properties. Our aim is to provide a formal, theoretical foundation for safety cases. In particular, we believe that tools for high assurance systems should be granted similar assurance to the systems to which they are applied. To this end, we formally specify and prove the correctness of key operations for constructing and managing hicases, which gives the specification for implementing hicases in AdvoCATE, our toolset for safety case automation. We motivate and explain the theory with the help of a simple running example, extracted from a real safety case and developed using AdvoCATE.

Hierarchy↗
NASA NTRS2015

Towards a Formal Basis for Modular Safety Cases

Safety assurance using argument-based safety cases is an accepted best-practice in many safety-critical sectors. Goal Structuring Notation (GSN), which is widely used for presenting safety arguments graphically, provides a notion of modular arguments to support the goal of incremental certification. Despite the efforts at standardization, GSN remains an informal notation whereas the GSN standard contains appreciable ambiguity especially concerning modular extensions. This, in turn, presents challenges when developing tools and methods to intelligently manipulate modular GSN arguments. This paper develops the elements of a theory of modular safety cases, leveraging our previous work on formalizing GSN arguments. Using example argument structures we highlight some ambiguities arising through the existing guidance, present the intuition underlying the theory, clarify syntax, and address modular arguments, contracts, well-formedness and well-scopedness of modules. Based on this theory, we have a preliminary implementation of modular arguments in our toolset, AdvoCATE.

Safety↗
NASA NTRS2007

A Software Safety Risk Taxonomy for Use in Retrospective Safety Cases

Safety standards contain technical and process-oriented safely requirements. The best time to include these requirements is early in the development lifecycle of the system. When software safety requirements are levied on a legacy system after the fact, a retrospective safety case will need to be constructed for the software in the system. This can be a difficult task because there may be few to no art facts available to show compliance to the software safely requirements. The risks associated with not meeting safely requirements in a legacy safely-critical computer system must be addressed to give confidence for reuse. This paper introduces a proposal for a software safely risk taxonomy for legacy safely-critical computer systems, by specializing the Software Engineering Institute's 'Software Development Risk Taxonomy' with safely elements and attributes.

Hill, Janice L.↗
DOE OSTI2019

Deep Borehole Disposal Safety Case

The safety case for deep borehole disposal of nuclear wastes contains a safety strategy, an assessment basis, and a safety assessment. The safety strategy includes strategies for management, siting and design, and assessment. The assessment basis considers site selection, pre-closure, and post-closure, which includes waste and engineered barriers, the geosphere/natural barriers, and the biosphere and surface environment. The safety assessment entails a pre-closure safety analysis, a post-closure performance assessment, and confidence enhancement analyses. This work outlines the assessment basis and safety assessment aspects of a deep borehole disposal safety case. The safety case presented here is specific to deep borehole disposal of Cs and Sr capsules, but is generally applicable to other waste forms, such as spent nuclear fuel. The safety assessments for pre-closure and post-closure are briefly summarized from other sources; key issues for confidence enhancement are described in greater detail. These confidence enhancement analyses require building the technical basis for geologically old, reducing, highly saline brines at the depth of waste emplacement, and using reactive-transport codes to predict their movement in post-closure. The development and emplacement of borehole seals above the waste emplacement zone is also important to confidence enhancement.

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗
NASA NTRS2012

Automating the Generation of Heterogeneous Aviation Safety Cases

A safety case is a structured argument, supported by a body of evidence, which provides a convincing and valid justification that a system is acceptably safe for a given application in a given operating environment. This report describes the development of a fragment of a preliminary safety case for the Swift Unmanned Aircraft System. The construction of the safety case fragment consists of two parts: a manually constructed system-level case, and an automatically constructed lower-level case, generated from formal proof of safety-relevant correctness properties. We provide a detailed discussion of the safety considerations for the target system, emphasizing the heterogeneity of sources of safety-relevant information, and use a hazard analysis to derive safety requirements, including formal requirements. We evaluate the safety case using three classes of metrics for measuring degrees of coverage, automation, and understandability. We then present our preliminary conclusions and make suggestions for future work.

Denney, Ewen W.↗
NASA NTRS2009

Deriving Safety Cases for the Formal Safety Certification of Automatically Generated Code

We present an approach to systematically derive safety cases for automatically generated code from information collected during a formal, Hoare-style safety certification of the code. This safety case makes explicit the formal and informal reasoning principles, and reveals the top-level assumptions and external dependencies that must be taken into account; however, the evidence still comes from the formal safety proofs. It uses a generic goal-based argument that is instantiated with respect to the certified safety property (i.e., safety claims) and the program. This will be combined with a complementary safety case that argues the safety of the framework itself, in particular the correctness of the Hoare rules with respect to the safety property and the trustworthiness of the certification system and its individual components. Keywords: Automated code generation, Hoare logic, formal code certification, safety case, Goal Structuring Notation.

Basir, Nurlida↗
NASA NTRS2014

Querying Safety Cases

Querying a safety case to show how the various stakeholders' concerns about system safety are addressed has been put forth as one of the benefits of argument-based assurance (in a recent study by the Health Foundation, UK, which reviewed the use of safety cases in safety-critical industries). However, neither the literature nor current practice offer much guidance on querying mechanisms appropriate for, or available within, a safety case paradigm. This paper presents a preliminary approach that uses a formal basis for querying safety cases, specifically Goal Structuring Notation (GSN) argument structures. Our approach semantically enriches GSN arguments with domain-specific metadata that the query language leverages, along with its inherent structure, to produce views. We have implemented the approach in our toolset AdvoCATE, and illustrate it by application to a fragment of the safety argument for an Unmanned Aircraft System (UAS) being developed at NASA Ames. We also discuss the potential practical utility of our query mechanism within the context of the existing framework for UAS safety assurance.

Safety Case↗
NASA NTRS2011

Towards Measurement of Confidence in Safety Cases

Arguments in safety cases are predominantly qualitative. This is partly attributed to the lack of sufficient design and operational data necessary to measure the achievement of high-dependability targets, particularly for safety-critical functions implemented in software. The subjective nature of many forms of evidence, such as expert judgment and process maturity, also contributes to the overwhelming dependence on qualitative arguments. However, where data for quantitative measurements is systematically collected, quantitative arguments provide far more benefits over qualitative arguments, in assessing confidence in the safety case. In this paper, we propose a basis for developing and evaluating integrated qualitative and quantitative safety arguments based on the Goal Structuring Notation (GSN) and Bayesian Networks (BN). The approach we propose identifies structures within GSN-based arguments where uncertainties can be quantified. BN are then used to provide a means to reason about confidence in a probabilistic way. We illustrate our approach using a fragment of a safety case for an unmanned aerial system and conclude with some preliminary observations

Denney, Ewen↗
NASA NTRS2015

Dynamic Safety Cases for Through-Life Safety Assurance

We describe dynamic safety cases, a novel operationalization of the concept of through-life safety assurance, whose goal is to enable proactive safety management. Using an example from the aviation systems domain, we motivate our approach, its underlying principles, and a lifecycle. We then identify the key elements required to move towards a formalization of the associated framework.

Dynamic Safety Case↗
NASA NTRS2012

Hierarchical Safety Cases

We introduce hierarchical safety cases (or hicases) as a technique to overcome some of the difficulties that arise creating and maintaining industrial-size safety cases. Our approach extends the existing Goal Structuring Notation with abstraction structures, which allow the safety case to be viewed at different levels of detail. We motivate hicases and give a mathematical account of them as well as an intuition, relating them to other related concepts. We give a second definition which corresponds closely to our implementation of hicases in the AdvoCATE Assurance Case Editor and prove the correspondence between the two. Finally, we suggest areas of future enhancement, both theoretically and practically.

Denney, Ewen W.↗
DOE OSTI2013

Continuous Improvement and the Safety Case for the Waste Isolation Pilot Plant Geologic Repository - 13467

The Waste Isolation Pilot Plant (WIPP) is a geologic repository 2150 feet (650 m) below the surface of the Chihuahuan desert near Carlsbad, New Mexico. WIPP permanently disposes of transuranic waste from national defense programs. Every five years, the U.S. Department of Energy (DOE) submits an application to the U.S. Environmental Protection Agency (EPA) to request regulatory-compliance re-certification of the facility for another five years. Every ten years, DOE submits an application to the New Mexico Environment Department (NMED) for the renewal of its hazardous waste disposal permit. The content of the applications made by DOE to the EPA for re-certification, and to the NMED for permit-renewal, reflect any optimization changes made to the facility, with regulatory concurrence if warranted by the nature of the change. DOE points to such changes as evidence for its having taken seriously its 'continuous improvement' operations and management philosophy. Another opportunity for continuous improvement is to look at any delta that may exist between the re-certification and re-permitting cases for system safety and the consensus advice on the nature and content of a safety case as being developed and published by the Nuclear Energy Agency's Integration Group for the Safety Case (IGSC) expert group. DOE at WIPP, with the aid of its Science Advisor and teammate, Sandia National Laboratories, is in the process of discerning what can be done, in a reasonably paced and cost-conscious manner, to continually improve the case for repository safety that is being made to the two primary regulators on a recurring basis. This paper will discuss some aspects of that delta and potential paths forward to addressing them. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗
DOE OSTI2014

Safety Case for Service Contracts

Safety cases developed for the Facilities Management and Operations Center (FMOC) are based on the requirements in MN471021, Work Planning and Control Criteria for Safe Design and Operations. The FMOC performs maintenance activities in various locations at Sandia National Laboratories, New Mexico (SNL/NM). SNL/NM consists of more than 6,000,000 square feet of buildings, structures, and site infrastructure on approximately 13,000 acres of land. The FMOC performs approximately 7500 service contract work orders a year to assist with operations and maintenance at the SNL/NM site and facilities. As part of the continual improvement process, this Safety Case will be reviewed and updated, as needed, or at a minimum every three years. People tend to underestimate the probability of an accident if none have occurred previously or if the person performing the work is skilled, and they tend to trust each other’s competence. Human error within systems must be identified and considered. The FMOC uses failure mode analysis (FMA) to determine how a system might fail and cause accidents, as well as the amount and types of controls needed. The FMOC includes interconnected elements, such as people, environment, procedures, facilities, equipment, and the hazards identified in the work analysis. A daily pre-task plan is required prior to any work activity. Changes in work practices will be communicated clearly to all service contractors and personnel by way of contractor pre-task planning, activity-specific plans, contract amendments, and/or training. The FMOC has created a safe-by-design intent approach for service contract execution starting at the planning stage and extending through the execution phase. The Safety Program (see Figure 2) summarizes how the FMOC connects work analysis elements with service contracts.

96 KNOWLEDGE MANAGEMENT AND PRESERVATION↗
DOE OSTI2019

Deep Borehole Disposal Safety Case

This report describes the current status of the safety case for the deep borehole disposal (DBD) concept. It builds on the safety case presented in Freeze et al. (2016), presenting new information and identifying additional information needs for specific safety case elements. At this preliminary phase of development, the DBD safety case focuses on the generic feasibility of the DBD concept. It is based on potential system designs, waste forms, engineering, and geologic conditions; however, no specific site or regulatory framework exists. Updated information is provided for the following safety case elements: (1) pre-closure basis and safety analysis, (2) post-closure basis and performance assessment, and (3) confidence enhancement. This research was performed as part of the deep borehole field test (DBFT). Based on revised U.S. Department of Energy (DOE) priorities in mid-2017, the DBFT and other research related to a DBD option was discontinued; ongoing work and documentation were closed out by the end of fiscal year (FY) 2017. This report was initiated as part of the DBFT and documented as an incomplete draft at the end of FY 2017. The report was finalized by Sandia National Laboratories in FY2018 without DOE funding, subsequent to the termination of the DBFT, and published in FY2019.

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗
NASA NTRS2013

A Formal Basis for Safety Case Patterns

By capturing common structures of successful arguments, safety case patterns provide an approach for reusing strategies for reasoning about safety. In the current state of the practice, patterns exist as descriptive specifications with informal semantics, which not only offer little opportunity for more sophisticated usage such as automated instantiation, composition and manipulation, but also impede standardization efforts and tool interoperability. To address these concerns, this paper gives (i) a formal definition for safety case patterns, clarifying both restrictions on the usage of multiplicity and well-founded recursion in structural abstraction, (ii) formal semantics to patterns, and (iii) a generic data model and algorithm for pattern instantiation. We illustrate our contributions by application to a new pattern, the requirements breakdown pattern, which builds upon our previous work

Formal Methods↗
DOE OSTI2013

A Safety Case Approach for Deep Geologic Disposal of DOE HLW and DOE SNF in Bedded Salt - 13350

The primary objective of this study is to investigate the feasibility and utility of developing a defensible safety case for disposal of United States Department of Energy (U.S. DOE) high-level waste (HLW) and DOE spent nuclear fuel (SNF) in a conceptual deep geologic repository that is assumed to be located in a bedded salt formation of the Delaware Basin [1]. A safety case is a formal compilation of evidence, analyses, and arguments that substantiate and demonstrate the safety of a proposed or conceptual repository. We conclude that a strong initial safety case for potential licensing can be readily compiled by capitalizing on the extensive technical basis that exists from prior work on the Waste Isolation Pilot Plant (WIPP), other U.S. repository development programs, and the work published through international efforts in salt repository programs such as in Germany. The potential benefits of developing a safety case include leveraging previous investments in WIPP to reduce future new repository costs, enhancing the ability to effectively plan for a repository and its licensing, and possibly expediting a schedule for a repository. A safety case will provide the necessary structure for organizing and synthesizing existing salt repository science and identifying any issues and gaps pertaining to safe disposal of DOE HLW and DOE SNF in bedded salt. The safety case synthesis will help DOE to plan its future R and D activities for investigating salt disposal using a risk-informed approach that prioritizes test activities that include laboratory, field, and underground investigations. It should be emphasized that the DOE has not made any decisions regarding the disposition of DOE HLW and DOE SNF. Furthermore, the safety case discussed herein is not intended to either site a repository in the Delaware Basin or preclude siting in other media at other locations. Rather, this study simply presents an approach for accelerated development of a safety case for a potential DOE HLW and DOE SNF repository using the currently available technical basis for bedded salt. This approach includes a summary of the regulatory environment relevant to disposal of DOE HLW and DOE SNF in a deep geologic repository, the key elements of a safety case, the evolution of the safety case through the successive phases of repository development and licensing, and the existing technical basis that could be used to substantiate the safety of a geologic repository if it were to be sited in the Delaware Basin. We also discuss the potential role of an underground research laboratory (URL). (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗
DOE OSTI2016

Actinide Containment Safety Case in a TRU/HLW Repository in Salt - 16369

The safety case for the permanent isolation of actinides in a salt nuclear repository is discussed. The need for actinide and brine chemistry research is driven by the regulatory process that requires an accounting of low-probability 'worst case' scenarios to show that the release criteria are met under these unexpected conditions. An overview of the WIPP approach to establish the actinide source term, which is defined by the oxidation state distribution, solubility and tendency to form colloidal species, is presented for the key actinides. This approach is then discussed in the context of extending the salt repository concept to defense high level waste (HLW) and possibly spent fuel (SF) to identify key needs and gaps. It is an overall conclusion of this review that the WIPP serves as a good template for the HLW/SF case and the safety case can be readily extended to this repository concept with proper repository design and supporting experimental results. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗
DOE OSTI2016

Evaluation of Current Knowledge for Building the Dutch Salt Safety Case - 16024

This paper provides an overview of an evaluation for building the Safety Case of geological disposal of radioactive waste in rock salt in the Netherlands. The evaluation comprises the present knowledge about the safety and feasibility of geological disposal designs considered in the past, thereby classifying the information taking into account the methodology and structure of a Safety Case. The evaluation is performed as part of the Dutch research programme OPERA (OnderzoeksProgramma Eindberging Radioactief Afval - Dutch acronym for Research Programme into Geological Disposal of Radioactive Waste) by a consortium consisting of GRS from Germany, and TNO and NRG from the Netherlands. Basis of the evaluation is the available Dutch and international scientific-technical information about geological disposal in rock salt, especially from the German and US programmes. The evaluations have shown that although much knowledge on the topic exists, the available information need to be integrated in order to develop a Dutch Safety Case on rock salt. For example, the characteristics of the Dutch radioactive waste investigated for disposal have changed considerably since the last Dutch research programme ended in 2000. This implies that the previously considered Dutch facility concepts for geological disposal in rock salt need to be adapted to the newly regarded waste types such as spent fuel from research reactors and large amounts of LLW, including depleted uranium. Introducing these aspects into the iteration towards a salt Safety Case would also require an update of the post-closure safety assessment. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗
DOE OSTI2016

Safety Case Considerations for Deep Borehole Disposal of Cs/Sr Capsules - 16294

The U.S. Department of Energy Office of Nuclear Energy (DOE-NE) performed an assessment of disposal options that recommended the consideration of deep borehole disposal of smaller DOE-managed waste forms, such as cesium (Cs) and strontium (Sr) capsules. To assess the feasibility of the deep borehole disposal concept for Cs/Sr capsules, safety case considerations are identified and examined. A safety case includes quantitative (e.g., safety assessments) and qualitative information related to both pre-closure (operational) and post-closure safety. For deep borehole disposal of Cs/Sr capsules, pre-closure safety considers potential hazards associated with waste package surface handling and downhole emplacement activities; post-closure safety considers scenarios for long-term radionuclide transport to the biosphere. A preliminary list of qualitative indicators of pre-closure and post-closure safety is presented. Research, development, and demonstration (RD and D) activities that can provide a quantitative basis for these indicators are discussed. In particular, DOE-NE has initiated a Deep Borehole Field Test, using surrogate test packages without radioactive waste, to further investigate various aspects of site characterization, deep drilling, and waste package handling and emplacement that would be needed for a full-scale disposal facility for Cs/Sr capsules or other DOE-managed waste forms. Finally, preliminary results from pre-closure hazard analyses and post-closure performance assessment (PA) calculations are presented as examples of supporting information for the quantitative safety case considerations. These preliminary results suggest that a favorable safety case can be developed for deep borehole disposal of Cs/Sr capsules. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗