SEARCH · Search NASA

Results for “Safety cases”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 73 records · Page 4

All sources NASA NTRS DOE OSTI

DOE OSTI2025

Progress on the US-Japan Source Term Benchmark Analysis Collaboration

There has been a resurgence in global interest in advanced reactor technology, with a variety of innovative concepts being proposed and developed. Sodium-cooled Fast Reactors (SFRs) have garnered considerable attention given their beneficial characteristics and extensive historical development programs and operating experience. Central to the licensing of non-light water reactor (non-LWR) technology is the characterization of the safety case. At its basics, reactor safety focuses on the prevention and mitigation of the release of radioactive material to the environment.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

NASA NTRS2018

Towards a Rigorous Basis for Specific Operations Risk Assessment of UAS

The Specific Operations Risk Assessment (SORA) guidance represents the consensus of various national aviation authorities on a common process to identify, qualitatively assess, and manage the safety risk posed by unmanned aircraft systems (UAS), when preparing the safety case required for regulatory approval to conduct certain types of operations. As such, it can be considered a de facto standard, being increasingly adopted by various relevant stakeholders. This paper first gives an overview of the SORA process and associated methods, identifying a number of inconsistencies in risk identification and assessment, also discussing plausible strategies to close the associated gaps. Then, we give a well-founded basis for the applicable concepts, such as barrier integrity, assurance, and robustness, following which we present a preliminary and simple probabilistic formalization of the underpinning barrier-based safety model. We illustrate our overall approach through a worked example, also discussing how a Bayesian framework can facilitate extending and enhancing our initial formalization. We conclude with a discussion of the opportunities afforded by our approach, such as a well-founded basis for barrier selection, whilst addressing the associated challenges. The main objective of this work is to complement the current SORA guidance through a principled, mathematicallybased approach to risk assessment, particularly when it is applied to higher-risk operational concepts that warrant greater rigor in safety assessment and assurance.

Safety Cases↗

DOE OSTI2023

Damage tolerance in the graphite cores of UK power reactors and implications for new build

The United Kingdom has been operating graphite-moderated gas-cooled commercial nuclear power reactors for more than 60 years. Both Generation I Magnox reactors and Generation II Advanced Gas-cooled Reactors have operated beyond their nominal design lifetimes and the safety cases for continued operation have had to address the issue of damage tolerance of the graphite cores. This review describes the designs of the reactors and the methodologies employed for their assessment. Emerging issues arising from extended operation and ageing of the cores are discussed together with the evolution of assessment methodologies to address predicted and observed damage. The UK nuclear regulator perspective is summarised and some conclusions are drawn on the implications for new build.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗

NASA NTRS2015

"Evidence" Under a Magnifying Glass: Thoughts on Safety Argument Epistemology

Common definitions of "safety case" emphasize that evidence is the basis of a safety argument, yet few widely referenced works explicitly define "evidence". Their examples suggest that similar things can be regarded as evidence. But the category evidence seems to contain (1) processes for finding things out, (2) information resulting from such processes, and (3) relevant documents. Moreover, any item of evidence could be replaced by further argument. Normative models of informal argumentation do not offer clear guidance on when a safety argument should cite evidence rather than appeal to a more detailed argument. Disciplines such as the law address the problem with a practical, domain-specific epistemology. In this paper, we explore these problems associated with evidence citations in safety arguments, identify goals for a theory of safety argument evidence and a practical safety argument epistemology, propose a model of safety evidence citation that advances the identified goals, and present a related extension to the Goal Structuring Notation (GSN).

Graydon, P. J.↗

NASA NTRS2018

FUELEAP Model-Based System Safety Analysis

NASA researchers, in a partnership with Boeing, are investigating a fuel-cell powered variant of the X-57 “Maxwell” Mod-II electric propulsion aircraft, which is itself derived from a stock Tecnam P2006T. The “Fostering Ultra-Efficient Low-Emitting Aviation Power” (FUELEAP) project will replace the X-57 power subsystem with a hybrid Solid-Oxide Fuel Cell (SOFC) system to increase the potential range of the electric-propulsion aircraft while dramatically improving efficiency and emissions over stock internal-combustion engines. Our FUELEAP safety analysis faces two primary challenges. First, the Part 23 certificated Tecnam P2006T is undergoing significant modifications to host the hybrid electric-propulsion system, and the challenge is to assure that the safety inherent in the stock aircraft (and subsequently in X-57 Mod-II) is not compromised by changes in avionics, aircraft structural loading, weight and balance, or other considerations. Secondly, because the SOFC power system has little (if any) relevant in-service precedent, our challenge is to assure that we identify and mitigate all reasonably plausible hazards introduced by unique FUELEAP equipage. We are investigating and utilizing Model-Based Safety Analysis (MBSA) methods to help us address these FUELEAP safety challenges. We captured aircraft-level system hazard conditions using instances of a SysML hazard block via aircraft-level Functional Hazard Analysis (FHA). Then, using SysML models of the FUELEAP architecture, we related the hazard conditions to initiating system events and possible mitigations, such as design architecture modifications or operational constraints. We are continuing to define our approach to MBSA by developing a component-by-component inventory of local failure modes and tracing their possible contribution to hazard conditions. Finally, we are applying an argument-based approach to FUELEAP assurance. Through a FUELEAP “safety case,” we are providing an explicit argument for FUELEAP safety by associating assurance evidence with overarching safety claims through a structured argument.

Woodham, Kurt P.↗

DOE OSTI2022

Accelerated Materials Deployment in Advanced Nuclear Power Plants

The purpose of this report is to begin the development of a maximally efficient process for licensing and deploying new materials in Advanced Non-Light-Water Reactors (ANLWRs). Some new materials that are to be used in some new plants are seen as possibly introducing risks, because our understanding of those new materials’ behavior in the conditions generated by some novel plant designs is less complete than our understanding of the behavior of materials with long use histories in existing designs. In these cases, an approved code/standard or a code case to support the use of these materials in the novel design’s safety case may not exist for the regulator to utilize as part of the licensing determination. This circumstance creates the potential for an extremely long licensing process for new designs using new materials. The present strategy is to show how to manage these risks proactively, in such a way as to permit licensing decisions to be made in a timely manner, based on this risk management process. The present report outlines the gaps in the current codes to support deployment and use of novel materials and begins the development of the necessary risk management framework that is focused on the subject materials issues; it is based on risk-informed in-service surveillance practices, carried out in such a way as to compensate for current limitations in our state of knowledge. This development will enable licensing and deployment of the subject materials, conditional on the proactive surveillance process to be established. While this report is occasioned by limitations in our knowledge of certain materials issues that may arise in advanced designs, in-service surveillance is always done in order to compensate for a lack of knowledge: if we knew that components were not already failed and not trending toward failure, we would not perform surveillance, even in current-generation plants (except that prescriptive requirements would force us to do so). What is different about the surveillance program discussed here is that the issues are newer and the relevant experience base is less complete, so the surveillance presently contemplated may need to measure new things and/or measure them more often than has been traditional for surveillance coupons. The present report is devoted to the risk management framework and applies American Society of Mechanical Engineers Boiler and Pressure Vessel Code Section XI, Division [1] to establish the structure of a protocol for carrying out the necessary surveillance. These documents are generic: they do not tell us how often to surveille, or what to surveille, or what to measure, but rather how to determine those things, given certain technical inputs. The Regulatory Development R&D Program [2] is currently developing the companion supporting technical basis for the materials surveillance technology that, when completed and validated, can be used by owner/operator and NRC to implement a materials degradation management program for ANLWRs. This report also outlines salient points of discussion, positive potential outcomes, and potential concerns from industry and the USNRC. These aspects of the report intend to inform future work to develop a proposed technical process for adoption by the industry and endorsement by the USNRC to allow developers to propose a risk informed and conservative approach for the use of materials where operating experience/data and codes and standards may not exist for use of a novel material in an operating reactor environment. Additionally, such a technology could be leveraged to potentially reduce part of the upfront materials data requirements from ongoing long-term materials testing so that early action on license application could be undertaken by NRC, in parallel with the continuation of long-term data collection. This could accelerate the schedule for a first-of-a-kind ANLWR deployment or a nth-of-a-kind new materials insertion for established ANLWR designs.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

DOE OSTI2024

Uncertainty Propagation from Experiment Measurements to Modeling Approaches: A Case for SMR Steam Entrainment Testing

To license new and advanced reactor designs, regulators must be convinced that their unique safety cases—relative to existing large scale reactors—have been adequately addressed by the designed reactor protection systems. In water cooled small modular reactors (SMRs), droplet entrainment in steam flow has significant implications on the progression of accident scenarios due to its compact design features, which requires representative test data applicable to SMR designs. Computer code, modeling and simulation (M&S) tools and models require adequate verification, assessment, and qualification. This includes M&S results validation against scaled empirical data within allowable uncertainty bands to gain regulatory approvals during the various stages of reactor system design, demonstration, and commercialization. However, measurement uncertainty within the empirical datasets and test data applicability ranges requires careful consideration of M&S inputs (i.e., boundary conditions, and initial conditions), and verification and validation efforts. This study focuses on uncertainty quantification in designing scaled test facilities for SMR applications with appropriate measurements and a standard data-reduction method to estimate thermal hydraulics characteristics parameters that incorporate physics phenomena of interest. In addition, this study supports the evaluation model development and assessment process using M&S that interfaces with advanced computing tools and digital twin capabilities. This will allow synchronization between experiment and modeling approaches for droplet entrainment testing and analysis, improving diagnostics, prognostics, and decision-making to accelerate regulatory approval.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗

DOE OSTI2020

Review of the Safety Analyses of the Konrad Repository - 20530

The Bundesgesellschaft fuer Endlagerung (BGE) is the license holder of all geological repository sites in Germany since 2017. Besides the construction of the Konrad repository for the emplacement of low- and intermediate-level waste (LILW), the operation of the Asse II mine including the retrieval of the emplaced waste, and the preparation for the closure of the Morsleben repository, BGE is responsible to carry out the operative tasks of selecting a site for a high-level waste (HLW) repository. The Konrad repository is Germany's first repository for radioactive waste with negligible heat generation, which was fully licensed under atomic law within the scope of a plan approval procedure from the original application in 1982 until the license was granted in 2002 and finally confirmed by the Federal Administrative Court in 2007. The emplacement of LILW was licensed up to a volume of 303,000 m{sup 3} with a total β/γ-activity of 5 x 10{sup 18} Bq and a total α-activity of 1.5 x 10{sup 17} Bq. Currently, the former iron ore mine Konrad is being converted to a repository and is expected to come into operation in 2027. But what if there is no safety case in place nor a regulatory framework tailored for a change of documents in order to ensure the safety according to the state-of-the-art of science and technology during the evolution of a long-term project such as a geological repository? In this presentation, a review procedure of the safety analyses, that have been the basis of the plan approval decision for the Konrad repository at that time, will be described. Furthermore, the first results of this graduated review procedure for updating the safety analyses will be presented. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

NASA NTRS2015

Characteristics of a Well Clear Definition and Alerting Criteria for Encounters Between UAS and Manned Aircraft in Class E Airspace

Unmanned aircraft systems (UAS) will be required to equip with a detect-and-avoid (DAA) system in order to satisfy the federal aviation regulations to remain well clear of other aircraft. For a DAA system to satisfy the requirement to stay well clear of other airborne traffic, a quantitative definition of well clear needs to be defined and evaluated. This study investigates the implications of UAS using proposed well clear definitions as a separation standard for conducting operations in the National Airspace System (NAS). The first analysis considers three well clear definitions and presents the relative state conditions of intruder aircraft as they encroach upon the well clear boundary. The second analysis focuses on the definition of the alerting criteria needed to inform the UAS operator of a potential loss of well clear. All analyses are conducted in a NAS-wide fast-time simulation environment using UAS aircraft models, proposed UAS missions, and historical air defense radar data to populate the background traffic operating under visual flight rules. The results presented in this study inform the safety case, requirements development, and the operational environment for DAA minimum operational performance standards.

Safety↗

NASA NTRSDate not supplied

A Systems Approach to AI Model Integration and Performance Evaluation for the Generic UAM Simulation Framework

This paper introduces py-guam, an open-source experimentation framework developed for the NASA Generic Urban Air Mobility simulation (GUAM) environment, facilitating the integration and evaluation of advanced artificial intelligence (AI) algorithms. We present a systems approach which enables the seamless incorporation of data-driven models, including off-nominal and failure state detection, into the GUAM’s Cognitive Architecture (CA). The framework supports customizable experimentation parameters, derives Safety Performance Indicators (SPIs) from UL 4600 safety case analyses, and employs rapid UAM simulations to assess AI impacts on flight performance across diverse scenarios. Through comprehensive testing and validation experiments, we demonstrate GUAM’s capability to enhance safety and efficiency in urban air mobility operations. Additionally, the open-source nature of py-guam fosters community collaboration, ensuring continuous improvement and adaptability to evolving technological advancements. This work establishes a robust tool for developing and testing AI-driven urban air mobility (UAM) systems, advancing the safety and reliability of autonomous urban air vehicles.

Artificial Intelligence↗

DOE OSTI2024

"Source Term Modeling for Advanced Gas Micro-Reactors"

Maintaining the safety of the public, environment, and operating personnel is the most important factor in designing, operating, maintaining, and decommissioning nuclear reactors. In recent years, there has been a growing interest in the development of micro-reactors employing TRi-structural ISOtropic (TRISO)-coated particle fuel. In gas reactors, TRISO fuel plays an important role in the safety case for high temperature reactors because of the fission product retention properties of the fuel. This ability enables the use of a functional containment strategy for the reactor where multiple barriers are used to prevent fission product release to the environment. Part of the safety analysis of these advanced reactors is the assessment of radionuclide releases under normal and accident conditions through the multiple credited safety barriers. Using conservative assumptions, a mechanistic analysis can be performed to quantify these releases that combines the probabilistic assessment of failure with analytic solutions to radionuclide transport equations. Source term modeling for TRISO fuel has been performed for previous reactor designs; however, these models are outdated, in many cases proprietary, and need updates to be applied to the current state of TRISO fuel technology and alternative gas reactor core configurations [1]. Currently, the only publicly available source term assessment for gas reactors is an expert-based Monte Carlo simulation based on the effectiveness of the fuel kernel, coating layers, and graphite block in a modular high temperature gas reactor [2]. Thus, there is a need to develop a simple, versatile, and mechanistic model of fission product release and transport in gas reactor cores that could be applied to a variety of reactors through user inputs and reactor-specific radionuclide inventories. The release is calculated by the diffusion of the key safety important fission products through the kernel, silicon carbide (SiC), graphite for both intact and defective TRISO particles based on fuel and graphite temperatures in the reactor under normal operation. These releases from the fuel enter the coolant where they can plate-out on cooler surfaces. A clean-up model is included for designs with a coolant purification system to remove fission gases. This initial distribution of fission products in the reactor serves as an initial condition for potential releases under postulated accident conditions. The model then can calculate the fission product release for any transient temperature profile and fission product releases can then be used to assess radiological dose to the workers and the public using conventional dose tools. Data on the diffusion of fission products is based on historic German TRISO experiments and the more current Department of Energy (DOE) Advanced Gas Reactor (AGR) TRISO fuel development program. The model is coded in python with inputs and outputs in excel spreadsheets, as well as python plotting utilities to aid in the interpretation of the results. References: [1] INL, NGNP Mechanistic Source Term White Paper, INL-10-17997, July 2010. [2] David A. Petti, Richard R. Hobbins, Peter Lowry, Hans Gougar, “Representative Source Terms and The Influence of Reactor Attributes on Functional Containment in Modular High Temperature Gas-cooled Reactors,” Nuclear Technology, Vol. 184, p. 181-197, Nov. 2013.

07 ISOTOPE AND RADIATION SOURCES↗

DOE OSTI2024

HTO and selenate diffusion through compacted Na-, Na–Ca-, and Ca-montmorillonite

Radionuclide transport in smectite clay barrier systems used for nuclear waste disposal is controlled by diffusion, with adsorption significantly retarding transport rates. While a relatively minor component of spent nuclear fuel, 79 Se is a major driver of the safety case for spent fuel disposal due to its long half-life (3.3×10 5 yr) and its low adsorption to clay (K D < 10 L/kg), thus a thorough understanding of Se diffusion through clay is critical for understanding the long-term safety of spent fuel disposal systems. Through-diffusion experiments with tritiated water (HTO, conservative tracer) and Se(VI) were conducted with a well-characterized, purified montmorillonite source clay (SWy-2) under a constant ionic strength (0.1 M) and three different electrolyte compositions: Na + , Ca 2+ , and a Na + -Ca 2+ mixture at pH 6.5 in order to probe the effects of electrolyte composition and interlayer cation composition on clay microstructure, Se(VI) aqueous speciation, and ultimately diffusion. Further, the results were modeled using a reactive transport modeling approach to determine values of porosity (ε), D e (effective diffusion coefficient), and K D (distribution coefficient for adsorption). HTO diffusive flux was higher in Ca-montmorillonite (D e =1.68×10 -10 m 2 s -1 ) compared to Na-montmorillonite (De=7.83×10 -11 m 2 s -1 ). This increase in flux is likely due to a greater degree of clay layer stacking in the presence of Ca 2+ compared to Na + , which leads to larger inter-particle pores. Overall, the Se(VI) flux was much lower than the HTO flux due to anion exclusion, with Se(VI) flux following the order Ca (D e = 1.03×10 -11 m 2 s -1 ) > Na–Ca (D e = 2.12×10 -12 m 2 s -1 ) > Na (D e = 1.28×10 -12 m 2 s -1 ). These differences in Se(VI) flux are due to a combination of factors, including (1) larger accessible porosity in Ca-montmorillonite due to clay layer stacking and smaller electrostatic effects compared to Na-montmorillonite, (2) larger accessible porosity for neutral-charge CaSeO4 species which makes up 32% of aqueous Se(VI) in the pure Ca system, and (3) possibly higher Se(VI) adsorption for Ca-montmorillonite. Through a combination of experimental and modeling work, this study highlights the compounding effects that electrolyte and counterion compositions can have on radionuclide transport through clay. Diffusion models that neglect these effects are not transferable from laboratory experimental conditions to in situ repository conditions.

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

NASA NTRS2016

An Investigation of Proposed Techniques for Quantifying Confidence in Assurance Arguments

The use of safety cases in certification raises the question of assurance argument sufficiency and the issue of confidence (or uncertainty) in the argument's claims. Some researchers propose to model confidence quantitatively and to calculate confidence in argument conclusions. We know of little evidence to suggest that any proposed technique would deliver trustworthy results when implemented by system safety practitioners. Proponents do not usually assess the efficacy of their techniques through controlled experiment or historical study. Instead, they present an illustrative example where the calculation delivers a plausible result. In this paper, we review current proposals, claims made about them, and evidence advanced in favor of them. We then show that proposed techniques can deliver implausible results in some cases. We conclude that quantitative confidence techniques require further validation before they should be recommended as part of the basis for deciding whether an assurance argument justifies fielding a critical system.

Graydon, Patrick J.↗

NASA NTRS2008

Product Engineering Class in the Software Safety Risk Taxonomy for Building Safety-Critical Systems

When software safety requirements are imposed on legacy safety-critical systems, retrospective safety cases need to be formulated as part of recertifying the systems for further use and risks must be documented and managed to give confidence for reusing the systems. The SEJ Software Development Risk Taxonomy [4] focuses on general software development issues. It does not, however, cover all the safety risks. The Software Safety Risk Taxonomy [8] was developed which provides a construct for eliciting and categorizing software safety risks in a straightforward manner. In this paper, we present extended work on the taxonomy for safety that incorporates the additional issues inherent in the development and maintenance of safety-critical systems with software. An instrument called a Software Safety Risk Taxonomy Based Questionnaire (TBQ) is generated containing questions addressing each safety attribute in the Software Safety Risk Taxonomy. Software safety risks are surfaced using the new TBQ and then analyzed. In this paper we give the definitions for the specialized Product Engineering Class within the Software Safety Risk Taxonomy. At the end of the paper, we present the tool known as the 'Legacy Systems Risk Database Tool' that is used to collect and analyze the data required to show traceability to a particular safety standard

Hill, Janice↗

DOE OSTI2025

Building confidence in models for complex barrier systems for radionuclides

The modeling and simulation of the Cement-clay Interaction-Diffusion field (CI-D) experiment at the Mont Terri site in Switzerland presented here demonstrates that it is possible to capture the multiscale physical and chemical features of natural and engineered barrier systems for radionuclides. The simulations are successfully carried out with the newly developed CrunchODiTi high-performance computing software that accounts for multiple continua, including a continuum representing the electrical double layer (EDL) developed along negatively charged clay particles in clay rock. The simulation also accounts for both the complex three-dimensional (3D) geometry, expected as the norm in a geological waste repository, and the anisotropy of the geological formation. In addition, the high resolution of the model makes it possible to include "skin effects" developed at the interface between highly reactive materials, in this case between the high pH cement and the circumneutral but electrostatic Opalinus Clay. The successful history matching with the field experiment demonstrates that the distinct geochemical and physical properties of the cement and the Opalinus Clay in the CI-D experiment can be accounted for. Such analyses are essential for developing a defensible safety case for the underground storage of radioactive waste.

Sarsenbayev, Dauren↗

DOE OSTI2020

ANDRA's Underground Research Laboratory in Bure: Major Role in the Cigeo Development - 20005

The Industrial Center for Geological Disposal, also called Cigeo, is the deep geological disposal facility project developed by Andra since 1991. It is intended for the final disposal of High-Level Waste (HLW) and Intermediate Level Waste-Long Lived (ILW-LL) generated in France by the nuclear industry. Cigeo is located in the east of France (Meuse/Haute-Marne site). The disposal will be implemented in a 140 to 160 m thick clay layer at about 500 m depth. The license application file will be submitted in 2020. If the license is granted, the construction of the pilot phase of Cigeo (ramp, shafts, drifts, initial disposal vaults) could start in 2025 at the earliest. Since 2000, the development of the safety case of Cigeo for post closure has been supported by a three-stage construction, design, and scientific and technological experiment program performed in the French Underground Research Laboratory (URL) in Bure. These stages of the URL activities supported the iterative interactions between the knowledge acquired by scientific and technological R and D program, the design process and the safety assessment. The stages focused on assessing the suitability of the disposal concept, providing the basis for safety options and construction design, and preparing for licensing using large scale demonstrations. Recently, Andra launched the fourth development stage of the URL to implement a new set of technological experiments aiming at consolidating the design options of disposal cells and galleries for the pilot phase of Cigeo and at assessing monitoring technologies. Recently, Andra launched the fourth development stage of the URL to implement a new set of technological experiments aiming at consolidating the design of the pilot phase of Cigeo and at assessing design options and monitoring technologies. Removal of a segment ring, construction of an X drift crossing, improved construction techniques for HLW vaults, and construction of an ILW-LL prototype disposal vault are example activities during the fourth phase. In the future, the URL in Bure will remain a unique location to carry out research on promising technical solutions, to reduce Cigeo's construction and operation risks and strengthen the long-term safety assessment. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

NASA NTRS2013

Evidence Arguments for Using Formal Methods in Software Certification

We describe a generic approach for automatically integrating the output generated from a formal method/tool into a software safety assurance case, as an evidence argument, by (a) encoding the underlying reasoning as a safety case pattern, and (b) instantiating it using the data produced from the method/tool. We believe this approach not only improves the trustworthiness of the evidence generated from a formal method/tool, by explicitly presenting the reasoning and mechanisms underlying its genesis, but also provides a way to gauge the suitability of the evidence in the context of the wider assurance case. We illustrate our work by application to a real example-an unmanned aircraft system- where we invoke a formal code analysis tool from its autopilot software safety case, automatically transform the verification output into an evidence argument, and then integrate it into the former.

Argumentation↗

NASA NTRS2013

Prospective Safety Analysis and the Complex Aviation System

Fatal accident rates in commercial passenger aviation are at historic lows yet have plateaued and are not showing evidence of further safety advances. Modern aircraft accidents reflect both historic causal factors and new unexpected "Black Swan" events. The ever-increasing complexity of the aviation system, along with its associated technology and organizational relationships, provides fertile ground for fresh problems. It is important to take a proactive approach to aviation safety by working to identify novel causation mechanisms for future aviation accidents before they happen. Progress has been made in using of historic data to identify the telltale signals preceding aviation accidents and incidents, using the large repositories of discrete and continuous data on aircraft and air traffic control performance and information reported by front-line personnel. Nevertheless, the aviation community is increasingly embracing predictive approaches to aviation safety. The "prospective workshop" early assessment tool described in this paper represents an approach toward this prospective mindset-one that attempts to identify the future vectors of aviation and asks the question: "What haven't we considered in our current safety assessments?" New causation mechanisms threatening aviation safety will arise in the future because new (or revised) systems and procedures will have to be used under future contextual conditions that have not been properly anticipated. Many simulation models exist for demonstrating the safety cases of new operational concepts and technologies. However the results from such models can only be as valid as the accuracy and completeness of assumptions made about the future context in which the new operational concepts and/or technologies will be immersed. Of course that future has not happened yet. What is needed is a reasonably high-confidence description of the future operational context, capturing critical contextual characteristics that modulate both the likelihood of occurrence of hazards, and the likelihood that those hazards will lead to negative safety events. Heuristics extracted from scenarios, questionnaires, and observed trends from scanning the aviation horizon may be helpful in capturing those future changes in a way conducive to safety assessment. What is also needed is a checklist of potential sources of emerging risk that arise from organizational features that are frequently overlooked. The ultimate goal is to develop a pragmatic, workable method for using descriptions of the future aviation context, to generate valid predictions of safety risks.

prospection↗