Search NASA⌕ Search

SEARCH · Search NASA

Results for “Risk-Informed Performance-Based”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2024

Regulatory Treatment of Low Frequency External Events under a Risk-Informed Performance-Based Licensing Pathway: Safety Criteria Evaluation

There has been recent progress in the development of risk-informed performance-based (RIPB) design and licensing approaches, which leverage the insights gained from detailed risk assessments and utilize performance-based metrics to permit flexibility and innovation. The RIPB approaches have included the probabilistic treatment of external hazards, including low frequency events that are beyond the design basis. A preceding study conducted in FY21 noted that there are certain challenges to the probabilistic treatment of low frequency external events, which are primarily the result of uncertainty in the hazard curve and the associated plant response to rare, severe events. The current work expands on the previous study by examining the regulatory safety criteria contained within draft 10 CFR Part 53 and associated draft RIPB seismic design guidance. The evaluation identified potential challenges in demonstrating satisfaction of the safety criteria for low frequency external events, with specific difficulties associated with demonstrating compliance with cumulative safety criteria metrics, such as the quantitative health objectives (QHOs). Non-LWRs are expected to utilize the direct calculation of offsite consequence, rather than use surrogates, for comparison to the QHOs, which can be particularly challenging as the previously identified uncertainties are compounded by uncertainties in the response of the neighboring population. The current work details this evaluation and key findings. The central recommendation from this effort is that it is necessary to develop an approach for demonstrating compliance with the safety criteria in draft Part 53 that addresses the key challenges while providing flexibility to applicants.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2024

Regulatory Treatment of Low Frequency External Events under a Risk-Informed Performance-Based Licensing Pathway: Enhanced SPRA-based Margins Assessment

Recently there has been development in the field of risk-informed performance-based (RIPB) design and licensing approaches, which leverage detailed risk assessments and performance-based metrics to allow flexibility and innovation. These RIPB approaches include the probabilistic treatment of external hazards, including low frequency events that are beyond the design basis. However, there are certain challenges that have been identified to the probabilistic treatment of low frequency external events, primarily due to uncertainty in the hazard curve and the associated plant response to rare, severe events. The NRC is currently developing 10 CFR Part 53 that would establish a technology-inclusive regulatory framework for use by applicants for new commercial advanced nuclear reactors. By examining the regulatory safety criteria contained within draft 10 CFR Part 53 and associated draft RIPB seismic design guidance, potential challenges were identified in demonstrating satisfaction of the safety criteria for low frequency external events, with specific difficulties associated with demonstrating compliance with the quantitative health objectives (QHOs). Non-LWRs are expected to utilize the direct calculation of offsite consequence, rather than use surrogates, for comparison to the QHOs, which can be particularly challenging as the previously identified uncertainties are compounded by uncertainties in the response of the neighboring population. The central recommendation from this effort is that it is necessary to develop an approach for demonstrating compliance with the safety criteria in draft Part 53 that addresses the key challenges while providing flexibility to applicants. This paper summarizes key findings, establishes a series of high-level goals, and reviews a newly developed approach to address the major challenges associated with assessing compliance with QHOs, with avenues to demonstrate compliance based on either the estimated consequence or the available margin to event occurrence, while also building on existing experience of seismic margins assessments. The paper also provides examples to demonstrate the application of the approach, as well as recommendations and potential future work.

external hazards↗
DOE OSTI2025

Security Licensing Basis Framework Development

This report summarizes a technology-inclusive and performance-based method to determine the physical security licensing basis for a commercial nuclear reactor under the proposed 10 CFR 73.100 for Part 53 licensees. The method focuses on the identification of security functions, the contributing security systems and programs to meet those functions, the identification of security events that will provide the foundation for the security licensing basis and includes a risk-informed performance-based defense in depth adequacy method. The method can also be employed to justify performance-based alternative measures to traditional security requirements found in 10 CFR 73.55.

98 - NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL↗
DOE OSTI2025

Consequence analyses of sabotage-induced radiological releases in sodium-cooled fast microreactors

Analysis of three sodium-cooled fast microreactors (SFMs) with thermal powers of 10, 30, and 50 MWt showed that smaller reactors result in lower radiological consequences during a postulated sabotage-induced event because of their reduced core inventory. All SFMs used U-10Zr metal fuel enriched to 15 wt% high-assay low-enriched uranium and operated until their respective effective multiplication factor (k eff ) reduced to less than 1 or until the end of their operational lifespan. Sabotage scenarios were simulated at this point, when the fuel inventory within the core contains the highest-level of radioactivity. Radionuclide core inventories were calculated using the SCALE code at shutdown and 3 days post-shutdown. Dose consequence analyses were performed for three sabotage scenarios using the RASCAL tool. As microreactor developers plan for minimal on-site or complete off-site emergency response, it remains essential to evaluate their physical protection needs and potential hazards, including assessing postulated sabotage-induced events that could become more relevant. SFM licensees should identify a credible worst-case, major accident, estimate release source terms, and perform dose consequence analyses to evaluate site-specific physical protection measures. In conclusion, this recommendation supports a risk-informed, performance-based approach, aligning with applicable regulatory requirements, i.e., 10 CFR Parts 100 and 53 rulemaking in the United States.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗
DOE OSTI2025

Consequence analyses of sabotage-induced radiological releases in high-temperature helium-cooled prismatic microreactors

Here, this study analyzes the radiological dose consequences of sabotage-induced accidents at three high-temperature helium-cooled prismatic microreactors (HTPMs) with thermal power ratings of 1, 10, and 50 MWt. Each HTPM employs uranium oxycarbide tristructural isotropic fuel enriched to 19.75 wt% high-assay low-enriched uranium. Simulations were conducted to estimate reactor core inventory at the point of fuel discharge––when the effective multiplication factor reduced to less than 1––representing peak radionuclide inventory. Postulated sabotage scenarios leading to reactor shutdown were analyzed at two intervals: immediately post-shutdown (0 h) and 3 days after shutdown using the SCALE code for radionuclide inventories and the RASCAL tool for dose consequences. Results show that although HTPMs benefit from inherent safety features and robust fuel design, radiological consequences scale with reactor power because of increased source term inventories. Smaller microreactors exhibited proportionally lower dose consequences. To support the economic and regulatory feasibility of microreactor deployment, this study emphasizes the value of a risk-informed, performance-based approach, as supported by regulations like 10 CFR Parts 100 and 53 in the United States. Microreactor developers should perform site-specific assessments of potential sabotage or low-probability, high-consequence events, especially when considering minimal on-site or full off-site emergency response.

Consequence↗
DOE OSTI2025

Defensive Cybersecurity Architecture Design Using Force-on-Force Cyber-Physical Modeling

Currently, nuclear power plant physical security systems are highly dependent on air-gaps as a protective measure against cyber-threats. Cyber-physical threats become more likely as advanced cyber-threat capabilities to jump air-gaps transition into common use. Defending against the emerging threat of cyber-enabled physical intrusions is poorly understood. The consequence of these cyber-physical attacks has no quantitative analysis method to inform risk-informed, performance-based cybersecurity approaches. By modifying the physical security simulation tool Dante, cyber-physical threat consequence was able to be analyzed on a notional facility. The results of this analysis are used to design a Defensive Cybersecurity Architecture (DCSA) for the physical security system to produce example resilience measures for this notional facility. A DCSA defines security levels to provide a graded approach for defending plant functions, and security zones for trusted communication between systems. This approach can be applied to real world systems to produce physical protection systems and response measures that are resilient to cyber-physical threats.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2026

Radiological Releases from Novel Fuel Forms in Advanced Reactors During Severe Accidents for Consequence Analyses

Various advanced reactor developers are exploring the potential for reductions in the size of physical security forces and emergency planning zones. These reductions are based on robust fuel forms and inherently safe reactor designs. However, such reductions in physical protection measures could increase the risk of sabotage. To assess the possibility of reducing these measures, sabotage-induced radiological consequence analyses were carried out. These analyses considered accident scenarios that were beyond design basis accidents and overly conservative (Shah, 2025a; Shah, 2025b; Shah and Hartanto, 2026), yielding very large release fractions. These fractions, which can be used to evaluate physical protection and emergency planning requirements, have been crudely determined and applied as demonstrations for a sodium-cooled fast reactor (SFR) (Shah and Hartanto, 2025a), a high-temperature gas-cooled reactor (HTGR) (Shah and Hartanto, 2025b), a heat pipe–cooled reactor (HPR) (Shah and Hartanto, 2025c), and a molten salt–cooled reactor (MSR) (Shah et al., 2026). A Sandia National Laboratories (SNL) team used MELCOR—a fully integrated severe accident analysis code—to demonstrate the code’s capability to analyze advanced (i.e., not light water–cooled) reactors (including a fluoride salt–cooled high-temperature reactor [FHR]) and calculate radiological releases to the environment during severe accidents (Wagner et al., 2022a, 2022b, 2022c, 2023a, and 2023b). Although the analyses were carried out to demonstrate MELCOR’s growing capability, the release source terms were estimated for advanced reactors, providing valuable insights into the accident progression and radiological releases. These findings from prior SNL studies, including estimated source terms and related sensitivity studies, were leveraged to derive source terms for postulated sabotage-induced accidents. Insights from these sensitivity studies informed the scaling of SNL’s estimated source terms for the defined accident scenarios. The derived release fractions for the severe accident scenarios for the respective reactor designs can be used to perform more nuanced dose consequence analyses to evaluate the reactors’ physical protection and emergency planning zone requirements. These analyses are in accordance with the risk-informed, performance-based approach proposed under 10 CFR Part 53. This study builds on the prior source term analyses and associated sensitivity studies by SNL to derive time-dependent and design-informed release fractions. Section 2 describes the diverse advanced reactor designs analyzed by the SNL team. Section 3 discusses the severe accident analyses, the release fractions calculated, and the limitations and assumptions of the demonstration project. Section 4 presents the release percentages derived for the hypothetical sabotage-induced severe accidents at the advanced reactors. Section 5 summarizes the study’s findings and conclusions.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2024

ECAR-6440 Rev 2 MARVEL Hazard Evaluation

This hazard evaluation supports the Microreactor Applications Research, Validation, and Evaluation (MARVEL) Project’s design effort and the development of the preliminary documented safety analysis (PDSA) (addendum to safety analysis report [SAR]-420, “Transient Reactor Test [TREAT] Facility FSAR”) (SAR-420-ADD-1). The hazard evaluation process for the MARVEL project for compliance with the requirements in 10 CFR 830, “Nuclear Safety Management,” follows a process similar to the Licensing Modernization Project (LMP) as outlined in Nuclear Energy Institute (NEI)-18-04, “Risk-Informed Performance-Based Guidance for Non-Light Water Reactor Licensing Basis Development,” and supporting documents. The LMP process is adapted to fit Department of Energy (DOE) reactor regulatory requirements as applicable and appropriate using a graded approach based on the MARVEL microreactor design. This approach provides reasonable assurance of meeting the requirements of 10 CFR 830 for protection of the public, workers, and environment.

21 - SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLAN↗
DOE OSTI2025

Basis for Dose and Reactor Safety Design Criteria for Army Regulation AR 50–7 and DA Pamphlet

This report describes the basis used to develop the radiological dose acceptance and design criteria contained in the draft updates to Army Regulation 50–7 (AR 50–7) Army Reactor Program and its accompanying draft Department of the Army (DA) Pamphlet (PAM), Army Reactor Program Procedures. These criteria will apply to Army nuclear reactors that fall under AR 50–7 and its accompanying DA PAM and ensure alignment with the overall objectives of the Army Reactor Program. The development basis for the radiological dose and design criteria supports a modern, technology-neutral, risk-informed, and performance-based approach to Army regulation of reactors and the demonstration of “adequate protection of the public.” To establish these criteria that support the Army’s unique operational requirements, multiple well-known and well-established standards and their supporting documentation were reviewed to ensure consistency with existing regulatory safety levels, including guidance from U.S. and international sources. These include the U.S. Nuclear Regulatory Commission’s (NRC’s) regulations and policy, the Canadian Nuclear Safety Commission’s (CNSC’s) regulatory documents, the International Atomic Energy Agency’s (IAEA’s) safety standards, as well as industry input that is tailored specifically to advanced microreactors. This report walks through the key definitions and associated references used for these criteria, which are outlined in Section 2.0. Based on these definitions, the dose acceptance criteria were established for various receptors for routine reactor operations (Section 3.2), design basis accidents (Section 3.3), and beyond design basis accidents (Section 3.4). Comparisons of multiple national and international dose limits are provided in these sections. Lastly, Section 4.0 outlines the reactor safety design criteria contained in the draft DA PAM and their associated bases.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2025

Diversion Path Analysis: A Proposed Methodology to Develop an MC&A Approach for Liquid-Fueled Molten Salt Reactors

Nuclear material control and accounting (MC&A) is a critical element of both the US Nuclear Regulatory Commission (NRC) and US Department of Energy (DOE)’s domestic safeguards and security requirements. NRC licensees are required, under Title 10 of the Code of Federal Regulations (10 CFR) Part 74 to establish and maintain an MC&A program that captures and records the quantities and locations of special nuclear material (SNM) at the facility. Along with physical protection, MC&A is a key element of domestic nuclear material safeguards that enables the NRC to ensure that SNM is controlled and accounted for. SNM, per 10 CFR Part 74, refers to plutonium, 233 U, and uranium enriched in the isotope 233 U or 235 U, but does not include source material. Periodic physical inventories, coupled with material balance evaluations, are effective and demonstrated tools to account for and detect theft or diversion of SNM in facilities containing SNM in bulk material form (i.e., not in discrete, countable items). Historically in the United States, these types of facilities have included fuel fabrication, conversion, and enrichment facilities. In comparison, reactors have relied on item counting of assemblies and control of SNM while in containment (e.g., a sealed reactor pressure vessel) because, to date, reactor fuel has been in item form. In liquid-fueled molten salt reactors (MSRs), unlike traditional light water reactors (LWRs) or bulk facilities, bulk SNM quantities can change significantly during operation as a result of depletion and transmutation. This introduces challenges to the use of traditional periodic physical inventories and material balance evaluations to detect theft or diversion of SNM in reactors that use SNM in bulk material form. Liquid-fueled (i.e., salt-fueled) MSR facilities are MSRs that use SNM within a salt eutectic as the fuel. The SNM is in a bulk material form any time it is outside of fresh or spent fuel storage containers. Some examples of when SNM will be in bulk form in the facility are during addition of fuel to the reactor system, while fuel is circulating in operation, and while fuel is in a drain tank. Periodic physical inventories and material balance evaluations can likely be effectively applied to many portions of an MSR facility, including all areas where depletion and transmutation are not significantly changing the quantities of SNM within the control area. Within an MSR facility, this would include fresh fuel receipt and loading, waste streams that may contain SNM, irradiated fuel storage outside of the reactor core, and any irradiated fuel processing that may happen after SNM has been removed from the reactor. All of these process steps could rely on measurements of SNM quantities compared with documented inventories. Any discrepancies from predicted (i.e., book) inventories and measured inventories could be quantified as inventory differences, consistent with traditional MC&A guidance from the NRC (e.g., in NUREG-1065 Revision 2, NUREG-2159 Revision 1, and RG 5.29 Revision 2). Within the reactor system, additions and removals to the book inventory include depletion of the SNM (e.g., fission of 235 U), which complicates the use of physical inventories. SNM control, however, can also likely be effectively applied to detect theft of SNM throughout a liquid-fueled MSR facility. To complement these approaches, prior technical reports have identified that a diversion path analysis may be a useful, risk-informed, and performance-based tool to determine suitable elements of an MC&A approach for the reactor system within a liquid-fueled MSR facility.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
NASA NTRSDate not supplied

Evolution of NASA’s Nuclear Flight Safety Program to Meet Changing Needs

Over the past 4 years, the United States (U.S.) Government has issued several new National policies that fundamentally change the approach to nuclear flight safety for aerospace applications, including the complete revision of the Federal policy for handling launch of spacecraft containing space nuclear systems. In response, the National Aeronautics and Space Administration (NASA) is updating its nuclear flight safety program while still maintaining consistency with other Federal policies, international conventions, and NASA’s own policies. To achieve this evolution, NASA is factoring in an objectives-driven and assurance case mindset to develop a risk-informed and performance-based program. NASA and others have successfully applied this mindset in other disciplines and contexts and it is being pursued here via broad cooperation within NASA and with external stakeholders. This paper will briefly describe how the NASA nuclear flight safety program is evolving to meet these changing needs.

NASA↗
NASA NTRS2024

Evolution of NASA’s Nuclear Flight Safety Program to Infuse Risk Leadership and Assurance Framework Concepts

In recent years, the United States (U.S.) Government has issued several new National policies that fundamentally change the approach to nuclear flight safety for aerospace applications, including the complete revision of the Federal policy for handling launch of spacecraft containing space nuclear systems. In response, the National Aeronautics and Space Administration (NASA) is updating its nuclear flight safety program while still maintaining consistency with other Federal policies, international conventions, and NASA’s own policies. To achieve this evolution, NASA is factoring in an objectives-driven and assurance case mindset to develop a risk-informed and performance-based program. NASA and others have successfully applied this mindset in other disciplines and contexts and it is being pursued here via broad cooperation within NASA and with external stakeholders. This paper will briefly describe how the NASA nuclear flight safety program is evolving to meet these changing needs.

Matthew J. Forsbacka↗
DOE OSTI2025

Advancing Multi-Hazard Risk and Safety Considerations for Aging Nuclear Facilities

While probabilistic risk assessment (PRA) of nuclear facilities is expected to include internal and external hazards for a risk-informed and performance-based design, the current state of practice treats each hazard independently. However, such an independent treatment of hazards may not account for the correlations between different hazards and their response of and damage to the structures, systems, and components (SSCs) in a plant resulting in underestimating the overall risk. This project proposes to advance the multi-hazard PRA of nuclear facilities to more adequately evaluate concurrent hazards and contribute to an increased safety of nuclear plants. A framework for multi-hazard PRA will be developed by identifying concurrent hazard events (both internal and external) and event sequences that include interdependencies through the response of SSCs. An example application of the multi-hazard PRA framework will be demonstrated by considering a generic pressurized water reactor (PWR) subjected to seismic and internal flooding hazards. Computational models for the response of components will be developed to generated multi-hazard fragility surfaces under seismic and flooding loads. A PRA model consisting of event and fault trees will also be developed to quantify the multi-hazard risk profile and compare it with the independent hazard risk profile. Overall, by advancing the multi-hazard PRA of nuclear facilities, this project enhances nuclear safety and reduces costs by mitigating unforeseen consequences caused by correlations between concurrent hazards.

97 - MATHEMATICS AND COMPUTING↗
NASA NTRS2023

Robotic and Crewed Mars Missions Increasing the Demand for Planetary Protection Technology Needs

Planetary protection (PP) policy seeks to avoid harmful contamination by limiting biological and relevant organic contamination from spacecraft as well as preventing adverse changes to Earth’s biosphere when extraterrestial samples are brought back to Earth. The PP policy at NASA was updated in 2021 (NPR 8715.24) and 2022 (NASA-STD-8719.27) to enable missions by expanding the decades old prescriptive requirements to allow for an option of adopting performance-based requirements that are objectivesdriven, risk-informed and case-assured. In parallel, the final PP knowledge gap workshop was completed representing the international consensus on the key areas to be considered in developing crew PP policy. These knowledge gaps focused on key technology development areas in 1) microbial and human health monitoring, 2) technical and operations needed for contamination control and 3) natural transport of contamination on Mars. As robotic missions start to implement performance-based approaches and research and technology efforts commence to inform crew policy the demand for data quality driven verification and validation in relevant space environments. Examples of the types of testing that is envisioned includes test as you fly validation and verification of decontamination systems in a relevant on-orbit and Mars environment, developing lethality curves of terrestrial organisms to further our understanding of the biocidal impacts of Mars and the space environment, and particle transport model validation and verification. Thus, the PP discipline has identified the need for groundbased space environments to perform preliminary testing as validation and verification of flight systems and to advance the technology readiness level prior to further testing on-orbit or lunar environments to prepare for Mars.

J. Nick Benardini↗
NASA NTRSDate not supplied

Robotic and Crewed Mars Missions Increasing the Demand for Planetary Protection Technology Needs

Planetary protection (PP) policy seeks to avoid harmful contamination by limiting biological and relevant organic contamination from spacecraft as well as preventing adverse changes to Earth’s biosphere when extraterrestrial samples are brought back to Earth. The PP policy at NASA was updated in 2021 (NPR 8715.24) and 2022 (NASA-STD-8719.27) to enable missions by expanding the decades old prescriptive requirements to allow for an option of adopting performance-based requirements that are objectives-driven, risk-informed and case-assured. In parallel, the final PP knowledge gap workshop was completed representing the international consensus on the key areas to be considered in developing crew PP policy. These knowledge gaps focused on key technology development areas in 1) microbial and human health monitoring, 2) technical and operations needed for contamination control and 3) natural transport of contamination on Mars. As robotic missions start to implement performance-based approaches and research and technology efforts commence to inform crew policy the demand for data quality driven verification and validation in relevant space environments. Examples of the types of testing that is envisioned includes test as you fly validation and verification of decontamination systems in a relevant on-orbit and Mars environment, developing lethality curves of terrestrial organisms to further our understanding of the biocidal impacts of Mars and the space environment, and particle transport model validation and verification. Thus, the PP discipline has identified the need for ground-based space environments to perform preliminary testing as validation and verification of flight systems and to advance the technology readiness level prior to further testing on-orbit or lunar environments to prepare for Mars.

J Nick Benardini↗
NASA NTRS2011

NASA System Safety Handbook: System Safety Framework and Concepts for Implementation - Volume 1

System safety assessment is defined in NPR 8715.3C, NASA General Safety Program Requirements as a disciplined, systematic approach to the analysis of risks resulting from hazards that can affect humans, the environment, and mission assets. Achievement of the highest practicable degree of system safety is one of NASA's highest priorities. Traditionally, system safety assessment at NASA and elsewhere has focused on the application of a set of safety analysis tools to identify safety risks and formulate effective controls.1 Familiar tools used for this purpose include various forms of hazard analyses, failure modes and effects analyses, and probabilistic safety assessment (commonly also referred to as probabilistic risk assessment (PRA)). In the past, it has been assumed that to show that a system is safe, it is sufficient to provide assurance that the process for identifying the hazards has been as comprehensive as possible and that each identified hazard has one or more associated controls. The NASA Aerospace Safety Advisory Panel (ASAP) has made several statements in its annual reports supporting a more holistic approach. In 2006, it recommended that "... a comprehensive risk assessment, communication and acceptance process be implemented to ensure that overall launch risk is considered in an integrated and consistent manner." In 2009, it advocated for "... a process for using a risk-informed design approach to produce a design that is optimally and sufficiently safe." As a rationale for the latter advocacy, it stated that "... the ASAP applauds switching to a performance-based approach because it emphasizes early risk identification to guide designs, thus enabling creative design approaches that might be more efficient, safer, or both." For purposes of this preface, it is worth mentioning three areas where the handbook emphasizes a more holistic type of thinking. First, the handbook takes the position that it is important to not just focus on risk on an individual basis but to consider measures of aggregate safety risk and to ensure wherever possible that there be quantitative measures for evaluating how effective the controls are in reducing these aggregate risks. The term aggregate risk, when used in this handbook, refers to the accumulation of risks from individual scenarios that lead to a shortfall in safety performance at a high level: e.g., an excessively high probability of loss of crew, loss of mission, planetary contamination, etc. Without aggregated quantitative measures such as these, it is not reasonable to expect that safety has been optimized with respect to other technical and programmatic objectives. At the same time, it is fully recognized that not all sources of risk are amenable to precise quantitative analysis and that the use of qualitative approaches and bounding estimates may be appropriate for those risk sources. Second, the handbook stresses the necessity of developing confidence that the controls derived for the purpose of achieving system safety not only handle risks that have been identified and properly characterized but also provide a general, more holistic means for protecting against unidentified or uncharacterized risks. For example, while it is not possible to be assured that all credible causes of risk have been identified, there are defenses that can provide protection against broad categories of risks and thereby increase the chances that individual causes are contained. Third, the handbook strives at all times to treat uncertainties as an integral aspect of risk and as a part of making decisions. The term "uncertainty" here does not refer to an actuarial type of data analysis, but rather to a characterization of our state of knowledge regarding results from logical and physical models that approximate reality. Uncertainty analysis finds how the output parameters of the models are related to plausible variations in the input parameters and in the modeling assumptions. The evaluation of unrtainties represents a method of probabilistic thinking wherein the analyst and decision makers recognize possible outcomes other than the outcome perceived to be "most likely." Without this type of analysis, it is not possible to determine the worth of an analysis product as a basis for making decisions related to safety and mission success. In line with these considerations the handbook does not take a hazard-analysis-centric approach to system safety. Hazard analysis remains a useful tool to facilitate brainstorming but does not substitute for a more holistic approach geared to a comprehensive identification and understanding of individual risk issues and their contributions to aggregate safety risks. The handbook strives to emphasize the importance of identifying the most critical scenarios that contribute to the risk of not meeting the agreed-upon safety objectives and requirements using all appropriate tools (including but not limited to hazard analysis). Thereafter, emphasis shifts to identifying the risk drivers that cause these scenarios to be critical and ensuring that there are controls directed toward preventing or mitigating the risk drivers. To address these and other areas, the handbook advocates a proactive, analytic-deliberative, risk-informed approach to system safety, enabling the integration of system safety activities with systems engineering and risk management processes. It emphasizes how one can systematically provide the necessary evidence to substantiate the claim that a system is safe to within an acceptable risk tolerance, and that safety has been achieved in a cost-effective manner. The methodology discussed in this handbook is part of a systems engineering process and is intended to be integral to the system safety practices being conducted by the NASA safety and mission assurance and systems engineering organizations. The handbook posits that to conclude that a system is adequately safe, it is necessary to consider a set of safety claims that derive from the safety objectives of the organization. The safety claims are developed from a hierarchy of safety objectives and are therefore hierarchical themselves. Assurance that all the claims are true within acceptable risk tolerance limits implies that all of the safety objectives have been satisfied, and therefore that the system is safe. The acceptable risk tolerance limits are provided by the authority who must make the decision whether or not to proceed to the next step in the life cycle. These tolerances are therefore referred to as the decision maker's risk tolerances. In general, the safety claims address two fundamental facets of safety: 1) whether required safety thresholds or goals have been achieved, and 2) whether the safety risk is as low as possible within reasonable impacts on cost, schedule, and performance. The latter facet includes consideration of controls that are collective in nature (i.e., apply generically to broad categories of risks) and thereby provide protection against unidentified or uncharacterized risks.

Dezfuli, Homayoon↗