Search NASA⌕ Search

SEARCH · Search NASA

Results for “Safety cases”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 145 records · Page 8

Development of a Software Safety Process and a Case Study of Its Use

Research in the year covered by this reporting period has been primarily directed toward: continued development of mock-ups of computer screens for operator of a digital reactor control system; development of a reactor simulation to permit testing of various elements of the control system; formal specification of user interfaces; fault-tree analysis including software; evaluation of formal verification techniques; and continued development of a software documentation system. Technical results relating to this grant and the remainder of the principal investigator's research program are contained in various reports and papers.

Knight, J. C.↗

Development of a Software Safety Process and a Case Study of Its Use

Research in the year covered by this reporting period has been primarily directed toward the following areas: (1) Formal specification of user interfaces; (2) Fault-tree analysis including software; (3) Evaluation of formal specification notations; (4) Evaluation of formal verification techniques; (5) Expanded analysis of the shell architecture concept; (6) Development of techniques to address the problem of information survivability; and (7) Development of a sophisticated tool for the manipulation of formal specifications written in Z. This report summarizes activities under the grant. The technical results relating to this grant and the remainder of the principal investigator's research program are contained in various reports and papers. The remainder of this report is organized as follows. In the next section, an overview of the project is given. This is followed by a summary of accomplishments during the reporting period and details of students funded. Seminars presented describing work under this grant are listed in the following section, and the final section lists publications resulting from this grant.

Knight, J. C.↗

Business Case Analysis for Digital Safety-Related Instrumentation & Control System Modernizations

This LWRS research seeks to assist in breaking the impasse which has precluded digital safety system upgrades by generating and demonstrating a process and related business case tool to enable a Business Case Analysis (BCA). The purpose of a BCA is to show such upgrades can be economically justified. This BCA methodology first systematically establishes a forecast of expected lifecycle costs for I&C identified for upgrade by: • Definitively bounding the scope of current I&C systems envisioned for upgrade. • Collecting historical labor and material usage data that bound cost contributors related to the systems to be upgraded. • Synthesizing and analyzing the data to establish lifecycle cost forecasts for the current systems. In collaboration with engineers familiar with the attributes of the digital equipment to be used in the upgrade and how it is envisioned to be applied, cost savings categories and expected savings in those categories are then identified and applied using the analysis tools developed for this purpose. The result is an estimate NPV of savings enabled by the upgrade. This includes both direct cost savings (e.g., surveillance labor costs) as well as cost avoidance items (e.g., inventory carrying costs). Finally, when utility-provided digital upgrade costs estimates are included, the resultant BCA provides an NPV for the upgrade project. Development of a useful BCA methodology requires a real-world basis. With the cooperation of Exelon Generation (“Owner”), an Exelon-owned 2-Unit BWR Station (“Station”) was used as the foundation for this research. Exelon is pursuing a digital upgrade of current, first-echelon, safety-related I&C systems at these units, including the following: • Reactor Protection System (RPS) • Nuclear Steam Supply Shutoff System (N4S) • Emergency Core Cooling Systems (ECCS) • Anticipated Transient Without Scram (ATWS) Mitigation System

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

NASA Accident Precursor Analysis Handbook, Version 1.0

Catastrophic accidents are usually preceded by precursory events that, although observable, are not recognized as harbingers of a tragedy until after the fact. In the nuclear industry, the Three Mile Island accident was preceded by at least two events portending the potential for severe consequences from an underappreciated causal mechanism. Anomalies whose failure mechanisms were integral to the losses of Space Transportation Systems (STS) Challenger and Columbia had been occurring within the STS fleet prior to those accidents. Both the Rogers Commission Report and the Columbia Accident Investigation Board report found that processes in place at the time did not respond to the prior anomalies in a way that shed light on their true risk implications. This includes the concern that, in the words of the NASA Aerospace Safety Advisory Panel (ASAP), "no process addresses the need to update a hazard analysis when anomalies occur" At a broader level, the ASAP noted in 2007 that NASA "could better gauge the likelihood of losses by developing leading indicators, rather than continue to depend on lagging indicators". These observations suggest a need to revalidate prior assumptions and conclusions of existing safety (and reliability) analyses, as well as to consider the potential for previously unrecognized accident scenarios, when unexpected or otherwise undesired behaviors of the system are observed. This need is also discussed in NASA's system safety handbook, which advocates a view of safety assurance as driving a program to take steps that are necessary to establish and maintain a valid and credible argument for the safety of its missions. It is the premise of this handbook that making cases for safety more experience-based allows NASA to be better informed about the safety performance of its systems, and will ultimately help it to manage safety in a more effective manner. The APA process described in this handbook provides a systematic means of analyzing candidate accident precursors by evaluating anomaly occurrences for their system safety implications and, through both analytical and deliberative methods used to project to other circumstances, identifying those that portend more serious consequences to come if effective corrective action is not taken. APA builds upon existing safety analysis processes currently in practice within NASA, leveraging their results to provide an improved understanding of overall system risk. As such, APA represents an important dimension of safety evaluation; as operational experience is acquired, precursor information is generated such that it can be fed back into system safety analyses to risk-inform safety improvements. Importantly, APA utilizes anomaly data to predict risk whereas standard reliability and PRA approaches utilize failure data which often is limited and rare.

Groen, Frank↗

Safety Assurance of Software and Machine Learning Development for Nuclear Instrumentation and Controls

Digital instrumentation and control (DI&C) systems monitor and control parameters in nuclear power plants. Ensuring their safety is a critical part of ensuring overall plant safety. Nuclear power plant licensing generates thousands of safety documents that could be organized more effectively using a safety assurance case (SAC). We conducted a literature survey of SACs and created a SAC framework for DI&C software using Goal Structuring Notation (GSN). This framework focuses on four software development processes: management & assurance, pre-developed software (PDS) qualification, the Software Development Life Cycle (SDLC), and the Machine Learning Development Life Cycle (MLDLC). We organized our framework using a novel level structure that can be applied to other SACs to improve their clarity. Finally, we demonstrate how our framework can be incorporated as part of a SAC for a larger reactor system.

46 - INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AN↗

Modernizing NASA’s Space Flight Safety and Mission Success (S&MS) Assurance Framework In Line With Evolving Acquisition Strategies and Systems Engineering Practices

This paper presents the objectives-driven, case-based safety and mission success (S&MS) assurance framework being developed by the NASA Office of Safety and Mission Assurance (OSMA), including its motivations and its implementation via a S&MS Assurance Standard that is under development, supplemented by supporting standards including an S&MS Analysis Management Standard that is also under development. A need to evolve NASA’s S&MS assurance framework has emerged in recent years, resulting from the need to accommodate new acquisition models; the need to accommodate evolving systems engineering (SE) practices; the need to stipulate acceptable levels of S&MS risk; the need for improved integration of S&MS into SE; and the need for clearer risk acceptance accountability. The objectives-driven, case-based S&MS assurance framework proposed here is responsive to that need. Its key features include: • The establishment, by NASA Acquirers, of fundamental S&MS performance objectives that define limits of acceptability for the likelihoods that mission technical objectives will be accomplished and that people, assets, and environments put at risk by the mission will not be adversely affected; • The development and approval of Providers’ S&MS plans for meeting Acquirers’ S&MS performance objectives, including commitments to support Acquirer audit, investigation, and reporting needs; • The development, by Providers, of S&MS assurance cases that argue, supported by evidence, that the Provider has met, or is on track to meeting, the fundamental S&MS objectives; • The evaluation, throughout the program/project life cycle, of Provider S&MS assurance cases as the primary S&MS-related technical basis for Acquirer risk acceptance and the granting to the Provider of authority to proceed through the program/project life cycle. This proposed S&MS assurance framework is notable for its lack of prescription of traditional S&MS requirements and strategies such as defined failure tolerances, margins, or analysis requirements. Instead, Providers are given latitude to propose their own strategies for meeting the fundamental S&MS performance objectives, subject to independent review and Acquirer approval. The result is a framework for S&MS assurance that is at once both rigorous and flexible.

Assurance Case↗

System Safety in Early Manned Space Program: A Case Study of NASA and Project Mercury

This case study provides a review of National Aeronautics and Space Administration s (NASA's) involvement in system safety during research and evolution from air breathing to exo-atmospheric capable flight systems culminating in the successful Project Mercury. Although NASA has been philosophically committed to the principals of system safety, this case study points out that budget and manpower constraints-as well as a variety of internal and external pressures can jeopardize even a well-designed system safety program. This study begins with a review of the evolution and early years of NASA's rise as a project lead agency and ends with the lessons learned from Project Mercury.

Hansen, Frederick D.↗

Technology and Tool Development to Support Safety and Mission Assurance

The Assurance Case approach is being adopted in a number of safety-mission-critical application domains in the U.S., e.g., medical devices, defense aviation, automotive systems, and, lately, civil aviation. This paradigm refocuses traditional, process-based approaches to assurance on demonstrating explicitly stated assurance goals, emphasizing the use of structured rationale, and concrete product-based evidence as the means for providing justified confidence that systems and software are fit for purpose in safely achieving mission objectives. NASA has also been embracing assurance cases through the concepts of Risk Informed Safety Cases (RISCs), as documented in the NASA System Safety Handbook, and Objective Hierarchies (OHs) as put forth by the Agency's Office of Safety and Mission Assurance (OSMA). This talk will give an overview of the work being performed by the SGT team located at NASA Ames Research Center, in developing technologies and tools to engineer and apply assurance cases in customer projects pertaining to aviation safety. We elaborate how our Assurance Case Automation Toolset (AdvoCATE) has not only extended the state-of-the-art in assurance case research, but also demonstrated its practical utility. We have successfully developed safety assurance cases for a number of Unmanned Aircraft Systems (UAS) operations, which underwent, and passed, scrutiny both by the aviation regulator, i.e., the FAA, as well as the applicable NASA boards for airworthiness and flight safety, flight readiness, and mission readiness. We discuss our efforts in expanding AdvoCATE capabilities to support RISCs and OHs under a project recently funded by OSMA under its Software Assurance Research Program. Finally, we speculate on the applicability of our innovations beyond aviation safety to such endeavors as robotic, and human spaceflight.

Mission Assuranc↗

Reliability-Based Design of a Safety-Critical Automation System: A Case Study

In 1986, NASA funded a project to modernize the NASA Ames Research Center Unitary Plan Wind Tunnels, including the replacement of obsolescent controls with a modern, automated distributed control system (DCS). The project effort on this system included an independent safety analysis (ISA) of the automation system. The purpose of the ISA was to evaluate the completeness of the hazard analyses which had already been performed on the Modernization Project. The ISA approach followed a tailoring of the risk assessment approach widely used on existing nuclear power plants. The tailoring of the nuclear industry oriented risk assessment approach to the automation system and its role in reliability-based design of the automation system is the subject of this paper.

Carroll, Carol W.↗

How Safe Is Control Software

Paper examines issue of software safety. Presents four case histories of software-safety analysis. Concludes that, to be safe, software, for all practical purposes, must be free of errors. Backup systems still needed to prevent catastrophic software failures.

Dunn, William R.↗

Wildfire-fighting Use Case Requirements to Monitor

In this technical report, we provide requirements for a wildfire-fighting use-case, towards the Safety Demonstrator 1. The use case will incorporate ground and airborne assets operating in a coordinated fashion, and will comprise five activities, from detection to the execution of the initial attack. Depending on the activity and the data involved, the requirements identified may be non-probabilistic or probabilistic. In both cases, we first identify some of the requirements we wish to monitor, and then present a formalization using the language of requirements of the NASA requirements elicitation tool FRET. To formalize probabilistic requirements, we use a novel extension to FRET’s requirements language that incorporates notions of probability, and discuss how requirements can be translated into existing probabilistic temporal logics like PCTL. We exemplify how some of the requirements presented can be monitored using the existing tools Ogma and Copilot. We close with a summary and future directions.

Requirements↗

Business Case Analysis for Digital Safety-Related Instrumentation & Control System Modernizations

The commercial nuclear sector faces unprecedented financial challenges driven by low natural gas prices and subsidized renewables in a marketplace that does not reward carbon-free baseload capacity. These circumstances, along with increasingly antiquated labor-centric operating models and analog technology, have forced the premature closure of multiple nuclear facilities and placed a much larger population of nuclear power stations at risk. Nuclear plant economic survival in current and forecasted market conditions requires an efficient and technology-centric operating model that harvests the native efficiencies of advanced technology. This is analogous to transformations in nearly every other industry. In light of previous industry experience in modernizing safety Instrumentation and Controls (I&C) systems, nuclear utilities are reluctant to pursue these upgrades due to uncertainty in licensing and cost.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

A Reference Governor for Plasma-Shape Control in Tokamaks

Tokamaks are torus-shaped devices where a high-temperature, ionized gas (i.e. a plasma) is confined by means of helical magnetic fields. The ultimate goal of tokamaks is producing net electrical energy by means of nuclear-fusion reactions within the plasma. The shape of the plasma inside the tokamak is closely related with its confinement characteristics and, therefore, with the produced fusion power. In order to achieve and maintain plasma shapes that maximize the fusion yield, feedback controllers have been successfully developed during the years. However, machine-protection and plasma-stability requirements impose hard constraints on the plasma-shape targets that can be safely achieved by a feedback controller. In this work, a reference governor is proposed to provide, in real time, plasma-shape targets that fulfill the aforementioned safety requirements. The reference governor calculates such plasma-shape targets in response to changes in the state of the closed-loop system, as well as disturbances in the plasma energy and current. Here, the reference-governor design is based on a dynamical model of the plasma electromagnetic response. Simulation tests of the reference governor have been carried out for different plasma scenarios in the DIII-D tokamak to emulate realistic cases where safety may be compromised.

70 PLASMA PHYSICS AND FUSION TECHNOLOGY↗

A methodology of MSL breakup analysis for Earth accidental reentry and its application to breakup analysis for Mars off-nominal entry

Vehicle breakup analysis has been performed for missions that may carry nuclear fuel for heating or power purposes to assess nuclear safety in case of launch failure leading to atmospheric reentry. Also, failure scenarios exist which could lead to breakup during Entry / Descent / Landing (EDL) at Mars due to off-nominal entries, with implications for planetary protection requirements. Since the Mars Science Laboratory (MSL) spacecraft may include a Multi-Mission Radioisotope Thermoelectric Generator (MMRTG), an analysis of breakup in case of launch failure is required. Also, breakup during Mars EDL due to off-nominal entries could release the RTG heat source that has implications for planetary protection requirements. This paper presents a methodology of MSL breakup analysis for launch failure with application to Mars off-nominal entry.

nuclear safety↗

Urban Air Mobility Conflict Resolution: Centralized or Decentralized?

This work begins to address one of the critical questions in the urban air mobility and small unmanned aircraft communities: Should the en-route conflict resolution function in an urban air mobility traffic system be centralized or decentralized? Three conflict resolution architectures are modeled and analyzed: centralized, decentralized with uniform rules, and decentralized with mixed rules. This study compares these architectures and investigates their robustness to communication and state information errors in terms of safety and efficiency metrics. Experiments are conducted using a high-fidelity Monte Carlo traffic simulator and a generic set of traffic scenarios with increasing traffic density. When no errors were modeled, the centralized architecture marginally outperformed the decentralized architecture. However, performance of the centralized architecture was found to be adversely affected by the modeled input errors to a greater degree than was the decentralized architecture. Performance of the centralized architecture also was degraded significantly by the modeled transmission errors of the centralized resolution maneuvers. In the decentralized architecture, uniform rules outperformed mixed rules because, in the mixed rules case, system safety performance was undermined and dominated by the poor performers.

Urban Air Mobility (UAM) traffic system↗

Thermal analyses of high-power advanced thermoacoustic radioisotope power system for future space exploration missions

This paper presents the results of 3-D thermal analyses of the heat source assembly of a 440 We advanced radioisotope power system (RPS) for future space exploration missions. This high thermal efficiency RPS employs a heat source assembly of eight Step 2 General Purpose Heat Source (GPHS) modules and four Thermoacoustic Power Converter (TAPC) units. Each unit is thermally coupled to two GPHS modules. Here, the analyses investigated the temperatures of the Iridium (Ir) alloy cladding of the 238 PuO 2 fuel pellets and the surface of the Fine Weave Pierced Fabric (FWPF) aeroshell in the GPHS modules to ensure reliable operation and safety in case of an unlikely reentry. Conductive coupling of the GPHS modules to the heater heads of the TAPC units produces relatively uniform axial and azimuthal distributions of heat flux and temperature. However, for this case the temperature of the Ir alloy cladding is lower than the desired values of 1173 K to maintain sufficient ductility. Adding a 5 mm wide He filled gap and decreasing the thickness of the graphite sleeve to 10 mm increased Ir cladding temperature to 1197–1174 K, which are in the desired range. The maximum surface temperatures of the FWPF graphite aeroshell of 1022–1131 K is well below the NASA specified limit of 1373 K. In addition, the total mass of the heat source assembly decreased by 19.6 kg, ~43% saving compared to original design.

42 ENGINEERING↗

Scenario development for safety assessment in deep geologic disposal of high-level radioactive waste and spent nuclear fuel: A review

Radiation and radioactive substances result in the production of radioactive wastes which require safe management and disposal to avoid risks to human health and the environment. To ensure permanent safe disposal, the performance of a deep geological repository for radioactive waste is assessed against internationally agreed risk-based standards. Assessing postclosure safety of the future system's evolution includes screening of features, events, and processes (FEPs) relevant to the situation, their subsequent development into scenarios, and finally the development and execution of safety assessment (SA) models. Global FEP catalogs describe important natural and man-made repository system features and identify events and processes that may affect these features into the future. By combining FEPs, many of which are uncertain, different possible future system evolution scenarios are derived. Repository licensing should consider both the reference or “base” evolution as well as alternative futures that may lead to radiation release, pollution, or exposures. Scenarios are used to derive and consider both base and alternative evolutions, often through production of scenario-specific SA models and the recombination of their results into an assessment of the risk of harm. Furthermore, while the FEP-based scenario development process outlined here has evolved somewhat since its development in the 1980s, the fundamental ideas remain unchanged. A spectrum of common approaches is given here (e.g., bottom–up vs. top–down scenario development, probabilistic vs. bounding handling of uncertainty), related to how individual numerical models for possible futures are converted into a determination as to whether the system is safe (i.e., how aleatoric uncertainty and scenarios are integrated through bounding or Monte Carlo approaches).

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

The RF Protection Interlock System Prototype Verification

The Radio Frequency Protection Interlock system plays vital role in the LLRF related/dependent accelerator sections Protection. It’s main role is to collect information from number different sensors and indicators around nearest cavities and cryomodule and provide instant RF signal termination in case of safety thresholds violation. This submission describes newly designed RFPI system tailored to the Proton Improvement Plan II (PIP-II) requirements. The proof of concept prototype of this system has been build. The paper includes also the CMTF environment evaluation tests results and findings as an input to the next full-scope prototype design.

43 PARTICLE ACCELERATORS↗