Sandia?s Uncertainty Calculator: A Case Study in the Graded Approach to Software Quality Assurance.
Abstract not provided.
Delker, Collin James↗
SEARCH · Search NASA
Results for “Assurance Cases”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
MASTODON: An Open-Source Software for Seismic Analysis and Risk Assessment of Critical Infrastructure
Seismic analysis and risk assessment of safety-critical infrastructure like hospitals, nuclear power plants, dams, and facilities handling radioactive materials involve computationally intensive numerical models and coupled multiphysics scenarios. They are also performed in a strict regulatory environment that requires high software quality assurance standards, and in the case of safety-related nuclear facilities, a conformance to the American Society of Mechanical Engineers Nuclear Quality Assurance (NQA-1) standard. This paper introduces the open-source finite-element software, MASTODON (Multi-hazard Analysis of Stochastic Time-Domain Phenomena), which implements state-of-the-art seismic analysis and risk assessment tools in a quality-controlled environment. MASTODON is built on MOOSE (Multi-physics Object-Oriented Simulation Environment), which is a highly parallelizable, NQA-1 conforming, coupled multiphysics, finite-element framework developed at Idaho National Laboratory. MASTODON is capable of fault rupture and source-to-site wave propagation using the domain reduction method, nonlinear site response, and soil-structure interaction analysis, implicit and explicit time integration, automated stochastic simulations, and seismic probabilistic risk assessment. When coupled with other MOOSE applications, MASTODON can also solve strongly and weakly coupled multiphysics problems. This paper presents a summary of the capabilities of MASTODON and some demonstrative examples.
42 ENGINEERING↗
Design of MARCO, the New Solenoidal Detector Magnet for the ePIC Experiment at BNL
MARCO is the new superconducting solenoid for ePIC, the general-purpose detector capable of delivering the full scientific scope of the Electron-Ion Collider at Brookhaven National Laboratory. Here, this 3.84 m long solenoid, with a bore diameter of 2.84 m, will provide a magnetic field of 2.0 T at the center with a nominal current of 4 kA at 4.5 K, for a total stored energy of 45 MJ. Its conductor is a NbTi Rutherford in Copper Channel (RICC), specially designed to stand the high mechanical loads induced by the magnetic field. Its copper stabilizer will assure the protection in case of quench. The coils are wound into six layers inside a thin external mandrel in brass, with a triple role of mechanical reinforcement, cryogenic support for the thermosiphon circuit and quench-back propagator. With a cold mass average radial thickness of just 7 cm, the magnet fulfills all the criterions of transparency for the particles directed to the hadronic calorimeter forecast around the cryostat. In this paper, the design of MARCO is presented, with a specific focus on the magnetic and quench analysis.
Calvelli, Valerio [Commissariat a l'Energie Atomiq↗
Preliminary Thermal-Hydraulic Analysis of the UTA–2 Subcritical Linear Accelerator–Driven System
The National Nuclear Security Administration’s mission includes establishing a reliable supply of 99 Mo without highly enriched uranium. Oak Ridge National Laboratory (ORNL) supports this objective through collaborative research and development with industrial partners. Niowave Inc., a current partner, is currently designing a subcritical linear accelerator-driven system (ADS) and preparing for the US Nuclear Regulatory Commission’s licensing process. Niowave’s system has the potential to efficiently supply medical radioisotopes. The technology includes a superconducting electron accelerator and a pile of both natural and low-enriched uranium (LEU) targets. The process fissions uranium and many valuable isotopes can then be extracted from the targets. Niowave is currently iterating through conceptual and detailed design processes for several system sizes. This report discusses UTA–2, which is at the demonstration stage. UTA–2 will validate numerical modeling results with experimental measurements before progressing to the detailed design of UTA–3, the commercial-sized ADS. The thermal-hydraulic behavior of the UTA–2 core design was numerically investigated using STAR-CCM+, as described in this report. STAR-CCM+, a state-of-the-art computational fluid dynamics (CFD) software that was commercially developed by Siemens, has an extensive user base and a set of validation studies. It is also compliant with the American Society of Mechanical Engineers’ Nuclear Quality Assurance 1 standard. Three cases are investigated in this report. Case 1 quantified the temperature field within the UTA–2 assembly and water tank using only conduction as the method of thermal energy transport. This simplified approach was overly conservative and yielded wetted cladding temperatures above the coolant saturation temperature. In this case, the maximum temperature of the wetted cladding surface of the highest power rod exceeded the saturation temperature of water by 63.8°C. Because of the overly conservative approach taken in Case 1 and its negative subcooled margin, buoyancy-driven natural circulation flow physics were implemented in Case 2. Adding coolant motion significantly distributed the thermal energy of the system through convective heat transfer. This relatively small amount of convective heat transfer significantly reduced system temperatures and increased the subcooled margin from –63.8 to 61.3°C. This margin confirmed that no boiling was expected during normal operation of UTA–2 at 230 W. Case 3 had no additional physics models but considered an overpower event during which the power of each LEU and natural uranium rod was at its respective peak values. This resulted in a study with the total assembly power equal to 176% of the nominal power of 230 W considered in Cases 1 and 2. The resulting natural circulation flows were slightly enhanced. The subcooled margin decreased slightly to 46.3°C, which is still a significant margin to local boiling of the water within the tank. This margin confirmed that no boiling was expected during an abnormal operation of UTA–2 at 406 W.
07 ISOTOPE AND RADIATION SOURCES↗
Comprehensive Forced Response Analysis of J2X Turbine Bladed-Discs with 360 Degree Variation in CFD Loading
The temporal frequency content of the dynamic pressure predicted by a 360 degree computational fluid dynamics (CFD) analysis of a turbine flow field provides indicators of forcing function excitation frequencies (e.g., multiples of blade pass frequency) for turbine components. For the Pratt and Whitney Rocketdyne J-2X engine turbopumps, Campbell diagrams generated using these forcing function frequencies and the results of NASTRAN modal analyses show a number of components with modes in the engine operating range. As a consequence, forced response and static analyses are required for the prediction of combined stress, high cycle fatigue safety factors (HCFSF). Cyclically symmetric structural models have been used to analyze turbine vane and blade rows, not only in modal analyses, but also in forced response and static analyses. Due to the tortuous flow pattern in the turbine, dynamic pressure loading is not cyclically symmetric. Furthermore, CFD analyses predict dynamic pressure waves caused by adjacent and non-adjacent blade/vane rows upstream and downstream of the row analyzed. A MATLAB script has been written to calculate displacements due to the complex cyclically asymmetric dynamic pressure components predicted by CFD analysis, for all grids in a blade/vane row, at a chosen turbopump running speed. The MATLAB displacements are then read into NASTRAN, and dynamic stresses are calculated, including an adjustment for possible mistuning. In a cyclically symmetric NASTRAN static analysis, static stresses due to centrifugal, thermal, and pressure loading at the mode running speed are calculated. MATLAB is used to generate the HCFSF at each grid in the blade/vane row. When compared to an approach assuming cyclic symmetry in the dynamic flow field, the current approach provides better assurance that the worst case safety factor has been identified. An extended example for a J-2X turbopump component is provided.
Elrod, David↗
Lunar Entry Downmode Options for Orion
For Exploration Missions 1 and 2, the Orion capsules will be entering the Earth's atmosphere with speeds in excess of 11 km/s. In the event of a degraded Guidance, Navigation, and Control system, attempting the nominal guided entry may be inadvisable due to the potential for failures that result in a loss of vehicle (or crew, when crew are aboard). In such a case, a method of assuring Earth capture, water landing, and observence of trajectory constraints (heating, loads) is desired. Such a method should also be robust to large state uncertainty and variations in entry interface states. This document will explore four approaches evaluated and their performance in ensuring a safe return of the Orion capsule in the event of onboard system degradation.
Smith, Kelly M.↗
Identifying Where Mission Assurance Can Benefit from Model Based Systems Engineering
Model Based Systems Engineering (MBSE) is being introduced and used to support many aspects of the engineering of complex systems. Our focus is on space systems, with a particular interest in Mission Assurance of those systems. We seek to identify where Mission Assurance can potentially benefit when a space system is developed using an MBSE approach. To do so we consider how MBSE can help provide the evidence that Mission Assurance needs, using the recently developed NASA Reliability and Maintainability Objective Hierarchy as the exposition of those needs. We illustrate this MBSE’s potential contributions using examples drawn from our prior survey of the MBSE literature addressing space mission assurance concerns. The overall conclusion we draw from this is that there are numerous ways in which MBSE may, and in some cases already does, support Mission Assurance.
Feather, Martin S.↗
Advanced Transmission Technologies – GETs and HPCs Session 2: Advanced Power Flow Control and Transmission Topology Optimization
The INL TADA GETs Cohort Session 2, held on November 7, 2025, conducted in collaboration with ScottMadden, focused on two core Advanced Transmission Technologies (ATTs): Advanced Power Flow Control (APFC) and Transmission Topology Optimization (TTO). These technologies are pivotal in enhancing grid flexibility, reliability, and cybersecurity resilience. APFC, particularly through modular FACTS devices like Modular Static Synchronous Series Compensators (M-SSSCs), enables dynamic voltage injection to reroute power flows. The session highlighted the deployment benefits of APFC, such as rapid installation, minimal civil works, and re-deployability. Regulatory drivers like FERC Order 2023 mandate the inclusion of Grid-Enhancing Technologies (GETs) in interconnection studies. Case studies from Central Hudson, CAISO, and National Grid (UK) demonstrated APFC’s effectiveness in congestion relief and cost savings. The session also addressed cybersecurity concerns, including firmware vulnerabilities, SCADA integration risks, and supply chain dependencies. Participants engaged in interactive exercises to rank cybersecurity and supply chain risks, emphasizing the need for robust digital assurance strategies. TTO involves software-based reconfiguration of transmission networks to optimize power flow without new infrastructure. The session showcased its operational value, with examples from SPP, PJM, and MISO showing significant congestion cost reductions. Cybersecurity vulnerabilities were discussed, particularly in API security and software supply chains, referencing incidents like SolarWinds and attacks on Danish utilities. Digital assurance exercises explored worst-case scenarios, attack paths, and mitigation responsibilities between vendors and utilities. Reliability challenges such as algorithm stability, vendor dependency, and operator trust were also examined. Cross-cutting themes emphasized the importance of digital assurance tools, including Software Bills of Materials (SBOMs) and hardware-in-loop testing. Human performance, training, and operational confidence were identified as critical enablers of technology adoption. The session concluded with a preview of Session 3, which will focus on High Performance Conductors (HPCs) and risk-based cybersecurity tools. Session 2 of 3.
24 - POWER TRANSMISSION AND DISTRIBUTION↗
Safety of hydrogen pressure gauges.
Study of the relative safety afforded an operator by various hydrogen-pressure gauge case designs. It is shown that assurance of personnel safety, should a failure occur, requires careful selection of available gauge designs, together with proper mounting. Specific gauge case features and mounting requirements are recommended.
Voth, R. O.↗
On wave stability in relativistic cosmic-ray hydrodynamics
Wave stability of a two-fluid hydrodynamical model describing the acceleration of cosmic rays by the first-order Fermi mechanism in relativistic, cosmic-ray-modified shocks is investigated. For a uniform background state, the short- and long-wavelength wave speeds are shown to interlace, thus assuring wave stability in this case. A JWKB analysis is performed to investigate the stability of short-wavelength thermal gas sound waves in the smooth, decelerating supersonic flow upstream of a relativistic, cosmic-ray-modified shock. The stability of the waves is assessed both in terms of the fluid velocity and density perturbations, as well as in terms of the wave action. The stability and interaction of the short-wavelength cosmic-ray coherent mode with the background flow is also studied.
Webb, G. M.↗
Model Checking Failed Conjectures in Theorem Proving: A Case Study
Interactive mechanical theorem proving can provide high assurance of correct design, but it can also be a slow iterative process. Much time is spent determining why a proof of a conjecture is not forthcoming. In some cases, the conjecture is false and in others, the attempted proof is insufficient. In this case study, we use the SAL family of model checkers to generate a concrete counterexample to an unproven conjecture specified in the mechanical theorem prover, PVS. The focus of our case study is the ROBUS Interactive Consistency Protocol. We combine the use of a mechanical theorem prover and a model checker to expose a subtle flaw in the protocol that occurs under a particular scenario of faults and processor states. Uncovering the flaw allows us to mend the protocol and complete its general verification in PVS.
Pike, Lee↗
Toward Design Assurance of Machine-Learning Airborne Systems
In recent years, Artificial Intelligence (AI) systems, enabled by Machine Learning (ML)technology, have demonstrated impressive progress and provides historic opportunities for the aviation industry. However, several key aspects of ML technology are not compatible with existing design assurance standards and make certification problematic. In this paper, we present a case study of a visual system with a Deep Neural Network (DNN) intended to detect and identify airport runway signs. Different use cases and variants of this system exhibit different levels of criticality ranging from design assurance level (DAL) D to B. We use the case study to illustrate the challenges of certification according to the current standards, such asDO-178C. We present the system design, data generation, training, and verification in detail and describe how the design assurance objectives can be met for a DAL D variant of the system. We also discuss gaps and potential approaches for the higher design assurance levels.
Avionics↗
Assessment and Assurance of Microelectronics Packaging Technology of Microelectromechanical Systems (MEMS)
Microelectromechanical systems (MEMS) have shown a significant promise in the last decade for a variety of applications such as air-bag, pressure sensors, accelerometer, microgyro, etc. Standard semiconductor microelectronics packaging needs the integrated circuits to be protected from the harsh environment, and provide electrical communication with the other parts of the circuit, facilitate thermal dissipation efficiently, and impart mechanical strength to the silicon die. Microelectronics packaging involves wafer dicing, bonding, lead attachment, encapsulation to protect from the environment, electrical integrity, and package leak tests to assure the packaging technology. In the case of MEMS the microstructures (active elements) often interfaces with the hostile environment where packaging leak tests and testing of such devices using chemical and mechanical parameters will be very difficult and expensive. Packaging of MEMS is significantly complex as they serve to protect from the environment and microstructures interact with the same environment to measure or affect the desired physical or chemical parameters. The most of the silicon circuitry is sensitive to temperature, moisture, magnetic field, light, and electromagnetic interference. The package must then protect the on-board silicon circuitry while simultaneously exposing the microsensor to the effect it 'measures to assure the MEMS technology by lowering the risk to zero. MEMS technology has a major application in developing a microspacecraft for space systems provided assurance of MEMS technology is sufficiently addressed nondestructively. This technology would eventually miniaturize many of the components of the spacecraft to reach the NASA's safety and mission assurance goal by building faster, cheaper, better, smaller spacecraft to explore the space more effectively by teaming-up with the other NASA centers using the limited resources available. This paper discusses the latest developments in the MEMS technology and challenging issues in the packaging of hermetically sealed and non-hermetically sealed MEMS sensor devices based on silicon, poly-silicon, and other materials for microspacecraft applications considering the space environment and reliability assurance qualification guidelines in perspective. Acknowledgments: The above research work is supported by the NASA Electronics Parts and Packaging Program (NEPP) and performed by the Jet Propulsion Laboratory, California Institute of Technology, Pasadena, CA under a contract with the NASA - Code Q for the Office of Safety and Mission Assurance Program 323-79.
Ramesham, Rajeshuni↗
Formal Foundations for Hierarchical Safety Cases
Safety cases are increasingly being required in many safety-critical domains to assure, using structured argumentation and evidence, that a system is acceptably safe. However, comprehensive system-wide safety arguments present appreciable challenges to develop, understand, evaluate, and manage, partly due to the volume of information that they aggregate, such as the results of hazard analysis, requirements analysis, testing, formal verification, and other engineering activities. Previously, we have proposed hierarchical safety cases, hicases, to aid the comprehension of safety case argument structures. In this paper, we build on a formal notion of safety case to formalise the use of hierarchy as a structuring technique, and show that hicases satisfy several desirable properties. Our aim is to provide a formal, theoretical foundation for safety cases. In particular, we believe that tools for high assurance systems should be granted similar assurance to the systems to which they are applied. To this end, we formally specify and prove the correctness of key operations for constructing and managing hicases, which gives the specification for implementing hicases in AdvoCATE, our toolset for safety case automation. We motivate and explain the theory with the help of a simple running example, extracted from a real safety case and developed using AdvoCATE.
Hierarchy↗
An Examination of Coarse Sun Sensor Contingencies in Attitude Determination and the Sun Vector Calculation
Satellite pointing is vital to the success of a mission. One element of that entails describing the position of the sun relative to the frame of the satellite. Coarse Sun Sensors (CSS) are typically used to provide the information to calculate the sun's position in Safe Modes or contingency operations. In the OCO-2 configuration there are 13 CSS total, which provide redundant 4 celestial coverage. Failures of the individual CSS elements can introduce holes in the celestial coverage resulting in potential loss of sun knowledge. These failures must be analyzed to determine if the contingency plan is sufficient to assure mission success. First the static case was looked at and determined that at a maximum, 3 CSS failures can be sustained on the body and 1 on the array without causing coverage holes. Also array sensors are more important to mission success. The Sun Vector calculation has been transcribed to MATLAB code and failure scenarios are being examined to determine the maximum error given a set of failure scenarios. This activity indicated that if there is a loss of the sun, the sun-searching algorithm could be modified to use XZ rotation as that is guaranteed to find it whereas the design using the YZ rotation misses the sun if it is at the + or - Y orientation.
celestial bodies↗
Defect measurement and analysis of JPL ground software: a case study
Ground software systems at JPL must meet high assurance standards while remaining on schedule due to relatively immovable launch dates for spacecraft that will be controlled by such systems. Toward this end, the Software Quality Improvement (SQI) project's Measurement and Benchmarking (M&B) team is collecting and analyzing defect data of JPL ground system software projects to build software defect prediction models. The aim of these models is to improve predictability with regard to software quality activities. Predictive models will quantitatively define typical trends for JPL ground systems as well as Critical Discriminators (CDs) to provide explanations for atypical deviations from the norm at JPL. CDs are software characteristics that can be estimated or foreseen early in a software project's planning. Thus, these CDs will assist in planning for the predicted degree to which software quality activities for a project are likely to deviation from the normal JPL ground system based on pasted experience across the lab.
defects↗
Asteroid Bennu Temperature Maps for OSIRIS-REx Spacecraft and Instrument Thermal Analyses
A thermophysical model has been developed to generate asteroid Bennu surface temperature maps for OSIRIS-REx spacecraft and instrument thermal design and analyses at the Critical Design Review (CDR). Two-dimensional temperature maps for worst hot and worst cold cases are used in Thermal Desktop to assure adequate thermal design margins. To minimize the complexity of the Bennu geometry in Thermal Desktop, it is modeled as a sphere instead of the radar shape. The post-CDR updated thermal inertia and a modified approach show that the new surface temperature predictions are more benign. Therefore the CDR Bennu surface temperature predictions are conservative.
thermal analysis↗
Comparison of a Probabilistic TID Hardness Assurance Method to Military Standards
A probabilistic TID radiation hardness assurance method is compared to worst-case, military test standards. A case study is used to demonstrate different failure assessment outcomes between the methods and the impact of incorporating environment variability.
radiation effects↗