Search NASA⌕ Search

SEARCH · Search NASA

Results for “Safety cases”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 181 records · Page 10
All sourcesNASA NTRSDOE OSTI
DOE OSTI2020

MASTODON: An Open-Source Software for Seismic Analysis and Risk Assessment of Critical Infrastructure

Seismic analysis and risk assessment of safety-critical infrastructure like hospitals, nuclear power plants, dams, and facilities handling radioactive materials involve computationally intensive numerical models and coupled multiphysics scenarios. They are also performed in a strict regulatory environment that requires high software quality assurance standards, and in the case of safety-related nuclear facilities, a conformance to the American Society of Mechanical Engineers Nuclear Quality Assurance (NQA-1) standard. This paper introduces the open-source finite-element software, MASTODON (Multi-hazard Analysis of Stochastic Time-Domain Phenomena), which implements state-of-the-art seismic analysis and risk assessment tools in a quality-controlled environment. MASTODON is built on MOOSE (Multi-physics Object-Oriented Simulation Environment), which is a highly parallelizable, NQA-1 conforming, coupled multiphysics, finite-element framework developed at Idaho National Laboratory. MASTODON is capable of fault rupture and source-to-site wave propagation using the domain reduction method, nonlinear site response, and soil-structure interaction analysis, implicit and explicit time integration, automated stochastic simulations, and seismic probabilistic risk assessment. When coupled with other MOOSE applications, MASTODON can also solve strongly and weakly coupled multiphysics problems. This paper presents a summary of the capabilities of MASTODON and some demonstrative examples.

42 ENGINEERING↗
NASA NTRS2005

ESTIMATING THE BENEFIT OF TRMM TROPICAL CYCLONE DATA IN SAVING LIVES

The Tropical Rainfall Measuring Mission (TRMM) is a joint NASA/JAXA research mission launched in late 1997 to improve our knowledge of tropical rainfall processes and climatology (Kummerow et ai., 2000; Adler et ai., 2003). In addition to being a highly successful research mission, its data are available in real time and operational weather agencies in the U.S. and internationally are using TRMM data and images to monitor and forecast hazardous weather (tropical cyclones, floods, etc.). For example, in 2004 TRMM data were used 669 times for determining tropical cyclone location fixes (National Research Council, 2004). TRMM flies at a relatively low altitude, 400 km, and requires orbit adjustment maneuvers to maintain altitude against the small drag of the atmosphere. There is enough fuel used for these maneuvers remaining on TRMM for the satellite to continue flying until 2011-12. However, most of the remaining fuel may be used to perform a controlled re-entry of the satellite into the Pacific Ocean. The fuel threshold for this operation will be reached in the summer of 2005, although the maneuver would actually occur in late 2006 or 2007. The full science mission would end in 2005 under the controlled re-entry option. This re-entry option is related to the estimated probability of injury (1/5,000) that might occur during an uncontrolled re-entry of the satellite. If the estimated probability of injury exceeds 1/10,000 a satellite is a candidate for a possible controlled re-entry. In the TRMM case the NASA Safety Office examined the related issues and concluded that, although TRMM exceeded the formal threshold, the use of TRMM data in the monitoring and forecasting of hazardous weather gave a public safety benefit that compensated for TRMM slightly exceeding the orbital debris threshold (Martin, 2002). This conclusion was based in part on results of an independent panel during a workshop on benefits of TRMM data in concluded that the benefit of TRMM data in saving lives through its use in operational forecasting could not be quantified. The objective of this paper is to describe a possible technique to estimate the number of lives saved per year and apply it to the TRMM case and the use of its data in monitoring and forecasting tropical cyclones.

Adler, Robert F.↗
DOE OSTI2021

A Risk-Informed Performance-Based Methodology to Manage Fire Protection Systems in Nuclear Facilities

Fire protection systems (FPSs) and features are installed in U.S. Department of Energy (DOE) Hazard Category 1, 2, or 3 nuclear facilities to protect property (maximum possible fire loss thresholds), life, and nuclear safety (i.e., structures, systems, and components). These FPSs and features are designed and maintained in accordance with the prescriptive guidance provided in applicable building codes and National Fire Protection Association codes and standards. Management, operations, and maintenance activities of FPSs involve significant effort. A DOE facility’s documented safety analysis or other safety basis document could also rely on FPSs to provide either a safety significant or safety class function to mitigate fire hazards and minimize radiological consequences. In some cases, the designation of safety significant or safety class may be determined to provide a layer of defense-in-depth to minimize nuclear safety risks independent of the fire risk. DOE standards allow the use of performance-based design alternatives developed by the fire industry but do not consider the defense-in-depth layers of protection provided in DOE facilities to prevent or mitigate the risks associated with unintended release of radioactive materials into the environment. Pacific Northwest National Laboratory developed a decision-making methodology tailored for DOE non-reactor nuclear facilities to manage FPSs and features by integrating nuclear safety risk insights into a performance-based analysis. This risk-informed, performance-based (RIPB) methodology can be used to provide the technical basis for classifying an FPS as safety class and safety significant, tailoring administrative controls (e.g., technical safety requirements), and ranking the importance of FPSs to prioritize maintenance, upgrades, and replacement activities. The RIPB methodology is a graded approach to inform DOE facility owners and Fire Protection Program managers of the most risk-significant FPSs and equipment, and those systems would be cost-beneficial to relax rigor if there is a need to re-design the FPS coverage or deviate from DOE and National Fire Protection Association standards for those systems that would be less significant. This paper describes the framework used to develop the RIPB methodology and the outcome of implementing this methodology in a use-case nuclear facility. This paper also discusses the impact to DOE policies and standards and the safety margins and defense-in-depth measures credited in nuclear safety assessments in a facility’s documented safety analysis and the benefits of implementing an RIPB methodology in lieu of a prescriptive method to comply with fire protection requirements.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
NASA NTRS2017

Real Time Safety Monitoring: Concept for Supporting Safe Flight Operations

A number of organizations are working on processes, procedures, regulations, and technologies to maintain or improve the safety of the National Airspace System (NAS). In this paper, we describe a Real Time Safety Monitoring (RTSM) system that benefits from these efforts to define a set of safety metrics that are automatically monitored in real-time. In addition to providing information about current potentially adverse conditions to a variety of users, from those who need a broad overview of a day's flight operations to those who need to decide on a control tactic to employ in the next five minutes, the RTSM system predicts conditions within a specified prediction horizon. Its intelligent interface alerts the user, presenting the information as appropriate considering the current context and circumstances. We illustrate the system concept with five conceptual use cases, describing which safety metrics may be of the most interest to five user groups and suggesting a multi-modal display format. We posit that having access to information about adverse conditions in time to make efficient preemptive decisions without sacrificing safety will improve the already high level of safety and aid in the expansion planned for the NAS under the Next Generation Air Transportation System (NextGen).

safety↗
NASA NTRS2010

Obtaining Valid Safety Data for Software Safety Measurement and Process Improvement

We report on a preliminary case study to examine software safety risk in the early design phase of the NASA Constellation spaceflight program. Our goal is to provide NASA quality assurance managers with information regarding the ongoing state of software safety across the program. We examined 154 hazard reports created during the preliminary design phase of three major flight hardware systems within the Constellation program. Our purpose was two-fold: 1) to quantify the relative importance of software with respect to system safety; and 2) to identify potential risks due to incorrect application of the safety process, deficiencies in the safety process, or the lack of a defined process. One early outcome of this work was to show that there are structural deficiencies in collecting valid safety data that make software safety different from hardware safety. In our conclusions we present some of these deficiencies.

Basili, Victor r.↗
NASA NTRS1985

Testing Ceramics for Diesel Engines

Adaptation of diesel engine allows prestressed ceramic materials evaluated under realistic pressure, temperature, and stress without introducing extraneous stress. Ceramic specimen part of prechamber of research engine. Specimen held in place by clamp, introduces required axial compressive stress. Specimen -- cylindrical shell -- surrounded by chamber vented or pressurized to introduce requisite radial stress in ceramic. Pressure chamber also serves as safety shield in case speimen disintegrates. Materials under consideration as cylinder liners for diesel engines.

Schneider, H. W.↗
NASA NTRS1993

An in-depth probabilistic study of external tank attach ring

This report deals with conducting a probabilistic study of the external tank attach ring (ETA) used as an interface between the external tank attach struts and the solid rocket booster. The ideas were to use probabilistic distributions for material, geometric, and load properties; to calculate probabilistic margins of safety; and then to compare results against the deterministic factors of safety that were used in the actual design process. The report describes how this was done and discusses some of the road blocks and data problems that were encountered during the study and provides some conclusions. A further refinement of this study is being considered for future work which would make more direct use of finite element analysis data coupled with Monte Carlo simulation. The basic conclusion herein indicates that the probabilistic margins of safety for the cases analyzed (by use of existing data) appear to support deterministic results and actually indicate higher reliabilities.

Pizzano, Frank↗
NASA NTRS2009

Proceedings of the Third International Workshop on Proof-Carrying Code and Software Certification

This NASA conference publication contains the proceedings of the Third International Workshop on Proof-Carrying Code and Software Certification, held as part of LICS in Los Angeles, CA, USA, on August 15, 2009. Software certification demonstrates the reliability, safety, or security of software systems in such a way that it can be checked by an independent authority with minimal trust in the techniques and tools used in the certification process itself. It can build on existing validation and verification (V&V) techniques but introduces the notion of explicit software certificates, Vvilich contain all the information necessary for an independent assessment of the demonstrated properties. One such example is proof-carrying code (PCC) which is an important and distinctive approach to enhancing trust in programs. It provides a practical framework for independent assurance of program behavior; especially where source code is not available, or the code author and user are unknown to each other. The workshop wiII address theoretical foundations of logic-based software certification as well as practical examples and work on alternative application domains. Here "certificate" is construed broadly, to include not just mathematical derivations and proofs but also safety and assurance cases, or any fonnal evidence that supports the semantic analysis of programs: that is, evidence about an intrinsic property of code and its behaviour that can be independently checked by any user, intermediary, or third party. These guarantees mean that software certificates raise trust in the code itself, distinct from and complementary to any existing trust in the creator of the code, the process used to produce it, or its distributor. In addition to the contributed talks, the workshop featured two invited talks, by Kelly Hayhurst and Andrew Appel. The PCC 2009 website can be found at http://ti.arc.nasa.gov /event/pcc 091.

Ewen, Denney, W.↗
NASA NTRS2020

The Friendly Argument Notation (FAN)

This document defines and explains through examples the Friendly Argument Notation (FAN). FAN builds on previous work investigating text-based ways to express arguments [2, 3]. Its primary intended use is for creating and evaluating arguments about safety-critical systems, especially the types of arguments common within safety and assurance cases [4], but nothing in its design constrains its use to that domain. Compared to existing notations commonly used within this domain (for example [6]), FAN corresponds more closely to traditional argument concepts (for example [1]), allows greater flexibility in expression, provides for including counter-arguments, and requires less knowledge of computer-science-specific concepts. Only time and use will determine how beneficial these differences are in practice. This paper concentrates on showing how FAN looks to someone who is using it manually to develop or assess arguments. A later document will concentrate on providing the information necessary for software tools to be created for FAN.

arugment↗
DOE OSTI2022

Work Smarter, Not Harder: Improving Energy Efficiency and Safety through Smarter Ventilation: Preprint

Ventilation is a key component to maintaining healthy, safe indoor air quality. Especially important in laboratories, ventilation is the first line of defense against airborne hazards produced during research activities. Though a vital component, laboratory ventilation systems are often victim to ineffective operation, posing a risk to the most important asset - the researchers. Furthermore, system inefficiencies can lead to up to 50% wasted energy. To improve both energy efficiency and safety in laboratories, we present the Smart Labs Toolkit - a resource developed by the U.S. Department of Energy Federal Energy Management Program and the International Institute for Sustainable Laboratories that guides laboratory stakeholders through a straight-forward, holistic approach to achieve dynamic, high-performance laboratories. Smart Labs enable safe and efficient world class science to occur in laboratories through high-performance methods. A Smart Labs program employs a combination of physical, administrative, and management techniques to assess, optimize, and manage high performance laboratories. We will focus on a central component of the Smart Labs approach - the Laboratory Ventilation Risk Assessment, a systematic process for identifying risk due to airborne hazards to inform the operation of dynamic ventilation that optimizes safety and efficiency. Case studies of organizations who have successfully implemented Smart Labs ventilation management programs will also be shared. In learning ventilation strategies successful in critical laboratory environments, learn the tools and resources needed to successfully manage energy in any building through smarter, safer ventilation.

buildings↗
NASA NTRS1979

Implementation Procedure for STS Payloads, System Safety Requirements

Guidelines and instructions for the implementation of the SP&R system safety requirements applicable to STS payloads are provided. The initial contact meeting with the payload organization and the subsequent safety reviews necessary to comply with the system safety requirements of the SP&R document are described. Waiver instructions are included for the cases in which a safety requirement cannot be met.

Source record↗
DOE OSTI2021

Mechanical Loads on Spent Nuclear Fuel in the General 30 cm Package Drop Scenario

The U.S. Department of Energy Office of Nuclear Energy (DOE-NE) Spent Fuel and Waste Science & Technology (SFWST) research program is guided by the high-level goal of closing prioritized knowledge gaps related to spent nuclear fuel (SNF) storage and transportation, which are summarized by Saltzstein et al. (2020). One of the high-priority knowledge gaps is the identification and quantification of mechanical loads that are expected to affect SNF during normal conditions of transportation and storage to inform the range of physical SNF test programs. This report uses modeling and analysis methods to estimate the mechanical loads on spent nuclear fuel (SNF) in the general 30 cm package drop scenario. The drop scenario assumes impact limiters are in place in the transportation configuration and the impact surface is perfectly rigid. The goal of this analysis is to consider the universe of potential mechanical loading conditions that can happen to SNF and present the results in a manner that is useful for materials testing, decision making, and regulatory rule making purposes. This study uses validated finite element models and methods to perform a broad parametric study of key variables that can affect the mechanical loads on SNF during a hypothetical package free drop scenario. Physical drop test data from a cask and fuel assembly drop test campaign is the basis for model validation. Additionally, the results of the parametric study are used to inform a damage model, which uses multiple nonlinear regression to estimate the relationships between input variables and output response. The parametric finite element analyses consider thousands of input variable combinations, while the damage model estimates millions of combinations. The breadth of this study provides confidence that the potential range of mechanical loads that SNF might experience during the general 30 cm package drop scenario are characterized well enough to consider this knowledge gap closed. While this report documents the overall peak values calculated in this study, the 95 th percentile values, the histograms, and the observed trends are equally important. This study covered a large range of SNF temperatures, room temperature to 300°C, and burnups, 10 GWd/MTU to 62 GWd/MTU. Each temperature and burnup combination has a different cladding yield strain, so it is more meaningful to summarize the calculated cladding strain response as its factor of safety, which is defined relative to the yield strain. The factor of safety is calculated as the yield strain divided by the peak cladding strain. A factor of safety greater than unity indicates that the cladding remains below yield, whereas a value less than unity is indicative of plastic deformation. In all cases of this study a safety factor over 1.0 was calculated, although in the most limiting case at 300°C the safety factor was only 1.01, which suggests that yielding could occur when additional loads like rod internal pressure are included. When the temperature is restricted to 200°C the limiting safety factor increases to 1.28, which has significant margin to accommodate internal pressure and potential local cladding defects that could cause a local stress concentration. An important trend in the calculated fuel rod mechanical loads is that the 2 nd highest loaded fuel rod in an assembly tends to be significantly lower than the highest loaded rod. The implication is that even if one rod in an assembly experiences a failure the loads would have to be significantly higher to cause two or more rods to fail.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗
NASA NTRS2022

AdvoCATE User Guide

This tutorial gives an overview of AdvoCATE - the assurance case automation toolset - which provides a suite of features for safety risk management, including hazard analysis, the linking of hazards to requirement logs, risk modeling using bow tie diagrams, structured arguments, and evidence logs. In this tutorial we show how these related assurance artifacts can be combined with each other in an integrated assurance case.

Safety assurance↗
NASA NTRS2023

Adaptive Independent Verification and Validation (IV&V) Reduces Risk of Software Impacting Safety in Artemis Missions

The National Aeronautics and Space Administration (NASA) is asking more of its human spaceflight programs than ever before through the collective Artemis Missions. The NASA Independent Verification and Validation (IV&V) Program contributes to NASA’s human spaceflight goals by providing IV&V services for NASA’s critical spacecraft and ground software. The IV&V Program is tasked with providing assurance from both individual and integrated mission software perspectives. The Artemis IV&V organization is actively supporting six distinct development efforts: Orion, the Space Launch System (SLS), Exploration Ground Systems (EGS), Mission Control Center (MCC), the Lunar Gateway, and the Human Landing System (HLS), representing a wide diversity of developer organizations, management structures, and development approaches. With much of this extremely complex flight and ground software being essential to human safety both on the ground and in space, Artemis IV&V is likewise challenged to provide more value-added assurance to future Artemis missions within a constrained budget. To meet this challenge, Artemis IV&V employs a variety of novel and evolving “Adaptive IV&V” approaches for planning and executing IV&V analysis to increase both the efficiency and effectiveness of the IV&V Program’s assurance activities, and to address the difficulties imposed by assuring software for a large, highly integrated, multi-mission enterprise managed and executed by physically and organizationally distinct programs. Instilling agile principles like iterative planning cycles, self-organizing teams, and regular retrospectives, into IV&V planning and execution has led to a more rapid turnaround of a minimum viable assurance product and allowed for increased alignment of assurance activities with development progress. Adopting an assurance case methodology has led to greater consistency and clearer communication of assurance design and provided a foundation for long-term maintenance of assurance plans, products, and results across missions. The IV&V-developed Assurance / Safety Case Analytical Network (A-SCAN) framework and tool has enabled the quantification and tracking of system/software risk and confidence. These confidence measures provide a means to repeatedly express the impact of planned and completed assurance work and the remaining residual risk. Applied as part of a “Follow-the-Risk” organizational ethos, this allows consistent rightsizing of analysis rigor and intensity commensurate with the perceived risk of defects, as well as appropriate targeting of the highest risk areas of the software to find safety issues before they can manifest. Finally, the development of the IV&V Advanced Risk Reduction Integrated Software Test and Operations Tri-program Lightweight Environment (ARRISTOTLE), an integrated software-only simulation of Orion, SLS, and EGS systems, has made it possible to independently test integrated pad and flight scenarios and inject faults to observe how the Artemis multi-program, mission software behaves in degraded modes and in response to hazards. These adaptive IV&V investments have enabled Artemis IV&V to become more efficient and effective in IV&V planning and execution and respond more readily to changes in the risk landscape, increasing the breadth and depth of risk reduction possible within the available resources. Residual risk tracking allows IV&V to communicate more effectively with stakeholders, both internal and external at all levels, and inform key decision-making personnel. This evolving assurance design approach provides IV&V surety that work is performed in the highest risk, most value-added areas of the software, to keep our astronauts and ground crews safe and ensure mission success.

Gerek A Whitman↗
NASA NTRS2023

Adaptive Independent Verification and Validation (IV&V) Reduces Risk of Software Impacting Safety in Artemis Missions

The National Aeronautics and Space Administration (NASA) is asking more of its human spaceflight programs than ever before through the collective Artemis Missions. The NASA Independent Verification and Validation (IV&V) Program contributes to NASA’s human spaceflight goals by providing IV&V services for NASA’s critical spacecraft and ground software. The IV&V Program is tasked with providing assurance from both individual and integrated mission software perspectives. The Artemis IV&V organization is actively supporting six distinct development efforts: Orion, the Space Launch System (SLS), Exploration Ground Systems (EGS), Mission Control Center (MCC), the Lunar Gateway, and the Human Landing System (HLS), representing a wide diversity of developer organizations, management structures, and development approaches. With much of this extremely complex flight and ground software being essential to human safety both on the ground and in space, Artemis IV&V is likewise challenged to provide more value-added assurance to future Artemis missions within a constrained budget. To meet this challenge, Artemis IV&V employs a variety of novel and evolving “Adaptive IV&V” approaches for planning and executing IV&V analysis to increase both the efficiency and effectiveness of the IV&V Program’s assurance activities, and to address the difficulties imposed by assuring software for a large, highly integrated, multi-mission enterprise managed and executed by physically and organizationally distinct programs. Instilling agile principles like iterative planning cycles, self-organizing teams, and regular retrospectives, into IV&V planning and execution has led to a more rapid turnaround of a minimum viable assurance product and allowed for increased alignment of assurance activities with development progress. Adopting an assurance case methodology has led to greater consistency and clearer communication of assurance design and provided a foundation for long-term maintenance of assurance plans, products, and results across missions. The IV&V-developed Assurance / Safety Case Analytical Network (A-SCAN) framework and tool has enabled the quantification and tracking of system/software risk and confidence. These confidence measures provide a means to repeatedly express the impact of planned and completed assurance work and the remaining residual risk. Applied as part of a “Follow-the-Risk” organizational ethos, this allows consistent rightsizing of analysis rigor and intensity commensurate with the perceived risk of defects, as well as appropriate targeting of the highest risk areas of the software to find safety issues before they can manifest. Finally, the development of the IV&V Advanced Risk Reduction Integrated Software Test and Operations Tri-program Lightweight Environment (ARRISTOTLE), an integrated software-only simulation of Orion, SLS, and EGS systems, has made it possible to independently test integrated pad and flight scenarios and inject faults to observe how the Artemis multi-program, mission software behaves in degraded modes and in response to hazards. These adaptive IV&V investments have enabled Artemis IV&V to become more efficient and effective in IV&V planning and execution and respond more readily to changes in the risk landscape, increasing the breadth and depth of risk reduction possible within the available resources. Residual risk tracking allows IV&V to communicate more effectively with stakeholders, both internal and external at all levels, and inform key decision-making personnel. This evolving assurance design approach provides IV&V surety that work is performed in the highest risk, most value-added areas of the software, to keep our astronauts and ground crews safe and ensure mission success.

Gerek Whitman↗
NASA NTRS1994

Generalized implementation of software safety policies

As part of a research program in the engineering of software for safety-critical systems, we are performing two case studies. The first case study, which is well underway, is a safety-critical medical application. The second, which is just starting, is a digital control system for a nuclear research reactor. Our goal is to use these case studies to permit us to obtain a better understanding of the issues facing developers of safety-critical systems, and to provide a vehicle for the assessment of research ideas. The case studies are not based on the analysis of existing software development by others. Instead, we are attempting to create software for new and novel systems in a process that ultimately will involve all phases of the software lifecycle. In this abstract, we summarize our results to date in a small part of this project, namely the determination and classification of policies related to software safety that must be enforced to ensure safe operation. We hypothesize that this classification will permit a general approach to the implementation of a policy enforcement mechanism.

Knight, John C.↗