Search NASA⌕ Search

SEARCH · Search NASA

Results for “Software and System Safety”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2025

The SAS4A/SASSYS-1 Version 5.8 Safety Analysis Code System

SAS4A/SASSYS-1 is a software simulation tool used to perform deterministic analysis of anticipated events as well as design basis and beyond design basis accidents for advanced nuclear reactors. Detailed, mechanistic models of steady-state and transient thermal, hydraulic, kinetic, and mechanical phenomena are employed to describe the response of the reactor core, the reactor primary and secondary coolant loops, the reactor control and protection systems, and the balance-of-plant to accidents caused by changes in coolant flow, loss of heat rejection, or reactivity insertion. The consequences of single and double-fault accidents can be modeled, including fuel and coolant heating, fuel and cladding mechanical behavior, core reactivity feedbacks, coolant loop performance including natural circulation, and decay heat removal. Analyses are typically terminated upon demonstration of reactor and plant shutdown to permanently coolable conditions, or upon violation of design basis margins. The objective of the analysis is to quantify accident consequences as measured by the transient behavior of system performance parameters, such as fuel and cladding temperatures, reactivity, and cladding strain. Originally developed for analysis of sodium cooled reactors with oxide fuel clad by stainless steel, the models were subsequently extended and specialized to metallic fuel clad with advanced alloys and to several other coolant options, including lead, LBE, and water.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2024

ORNL Package Testing Program Software Quality Assurance Plan

The Oak Ridge National Laboratory (ORNL) Package Testing Program (PTP) uses commercial off-the-shelf (COTS) software in performing data collection of thermal test results for package designs that contain radioactive materials. Specifically, this software is used to collect temperature data from the furnace, packages, and ambient air to prepare and execute the thermal test specified in 10 CFR 71.73, “Thermal Test.” This software quality assurance (SQA) plan sets forth the guidelines, standards, and procedures that shall be used to provide SQA for PTP software applications. This is a living document that will be maintained for the lifecycle of the PTP program. The SQA plan follows the requirements set forth in ORNL Standards Based Management System (SBMS): Information Technology; Subject Area: Software Quality Assurance. When applicable to the requirements as described in ORNL SBMS, Software Quality Assurance, the software shall be listed in the ORNL Software Registration System (SRS). Exemptions to this SBMS are COTS and firmware that are not modified; spreadsheet applications and personal productivity tools that do not have a utility or safety application, research applications, legacy software, system software, vendor-supplied software used to interface with the vendor’s services, software used within the organization to facilitate processing or management of information, and software developed for applications not specific to the US Department of Energy (DOE).

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

Towards Provable Security in Industrial Control Systems Via Dynamic Protocol Attestation

Industrial control systems (ICSs) increasingly rely on digital technologies vulnerable to cyber attacks. Cyber attackers can infiltrate ICSs and execute malicious actions. Individually, each action seems innocuous. But taken together, they cause the system to enter an unsafe state. These attacks have resulted in dramatic consequences such as physical damage, economic loss, and environmental catastrophes. This paper introduces a methodology that restricts actions using protocols. These protocols only allow safe actions to execute. Protocols are written in a domain specific language we have embedded in an interactive theorem prover (ITP). The ITP enables formal, machine-checked proofs to ensure protocols maintain safety properties. We use dynamic attestation to ensure ICSs conform to their protocol even if an adversary compromises a component. Since protocol conformance prevents unsafe actions, the previously mentioned cyber attacks become impossible. We demonstrate the effectiveness of our methodology using an example from the Fischertechnik Industry 4.0 platform. We measure dynamic attestation's impact on latency and throughput. Our approach is a starting point for studying how to combine formal methods and protocol design to thwart attacks intended to cripple ICSs.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

Safety Assurance of Software and Machine Learning Development for Nuclear Instrumentation and Controls

Digital instrumentation and control (DI&C) systems monitor and control parameters in nuclear power plants. Ensuring their safety is a critical part of ensuring overall plant safety. Nuclear power plant licensing generates thousands of safety documents that could be organized more effectively using a safety assurance case (SAC). We conducted a literature survey of SACs and created a SAC framework for DI&C software using Goal Structuring Notation (GSN). This framework focuses on four software development processes: management & assurance, pre-developed software (PDS) qualification, the Software Development Life Cycle (SDLC), and the Machine Learning Development Life Cycle (MLDLC). We organized our framework using a novel level structure that can be applied to other SACs to improve their clarity. Finally, we demonstrate how our framework can be incorporated as part of a SAC for a larger reactor system.

46 - INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AN↗
DOE OSTI2025

Safety Assurance Framework for Nuclear Digital Instrumentation and Control Software

Software in digital instrumentation and control (D&C) systems poses unique challenges for the safety assurance of nuclear power plants. Through a literature survey of 21 sources, we analyzed various claims, arguments, and evidence used in safety assurance cases across industries. These were organized into a Goal Structuring Notation (GSN) safety assurance case framework to organize and visualize the various arguments for DI&C safety. We developed a classification for the levels of the framework, which can be used in other safety assurance cases to improve clarity.

46 - INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AN↗
DOE OSTI2025

HyRAM+ (Hydrogen Plus Other Alternative Fuels Risk Assessment Models) v.6.1

SAND2025-11565O HyRAM+ (Hydrogen Plus Other Alternative Fuels Risk Assessment Models) is a tool for conducting quantitative risk assessment (QRA) in transportation systems. HyRAM+ contains validated, simplified release behavior models, engineering models, and generic data relevant to hydrogen installations. HyRAM+’s platform integrates models and data to conduct QRA on user-defined hydrogen or other alternative fuel systems. The software will enable the international safety research community to add validated models to the HyRAM+ platform for use in QRAs. HyRAM (hydrogen-only) versions 1.0 to 3.1 were developed by Sandia for the Department of Energy (DOE) Hydrogen and Fuel Cell Technologies Office. The following agencies contributed to the development of HyRAM+ version 4.0 regarding the addition of methane (natural gas) and propane models: the DOE Vehicle Technologies Office and the Department of Transportation Pipeline and Hazardous Material Safety Administration. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.

Groth, Katrina [Sandia National Lab. (SNL-NM), Alb↗
DOE OSTI2024

ECAR-7300 Rev 1 Verification and Validation of MCNP6.2 for MARVEL Neutronic Analysis

This report documents the verification and validation (V&V) efforts of the Monte Carlo N-Particle transport code (MCNP) version 6.2 on the Sawtooth supercomputer for the Microreactor Applications Research Validation and Evaluation (MARVEL) microreactor required for the preliminary documented safety analysis. This document records V&V for a safety, hazards, analysis, and design software used for design and analysis of safety class structures, system and components (SSC)s.

21 - SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLAN↗
DOE OSTI2023

Risk Analysis of Various Design Architectures for High Safety-significant Safety-related Digital Instrumentation and Control Systems of Nuclear Power Plants during Accident Scenarios

This report documents the plus-up activities performed by Idaho National Laboratory (INL) during Fiscal Year (FY) 2022 for the U.S. Department of Energy (DOE) Light Water Reactor Sustainability (LWRS) Program, Risk Informed Systems Analysis (RISA) Pathway, digital instrumentation and control (DI&C) risk assessment project. In FY 2019, the RISA Pathway initiated a project to develop a risk assessment strategy for delivering a strong technical basis to support effective, licensable, and secure DI&C technologies for digital upgrades/designs. An integrated risk assessment technology for the DI&C systems was proposed for this strategy, which aims to (1) provide a best-estimate, risk-informed capability to quantitatively and accurately estimate the safety margin obtained from plant modernization, especially for the high safety-significant safety-related (HSSSR) DI&C systems, (2) support and supplement existing advanced risk-informed DI&C design guides by providing quantitative risk information and evidence, (3) offer a capability of design architecture evaluation of various DI&C systems to support system design decisions and diversity and redundancy applications, (4) assure the long-term safety and reliability of HSSSR DI&C systems, and (5) reduce uncertainty in costs and support integration of DI&C systems in the plant. To achieve these technical goals and deal with the expensive licensing justifications from regulatory insights, the LWRS-developed framework instructs nuclear vendors and utilities on how to effectively lower the costs associated with digital compliance and speed industry advances by: (1) defining an integrated risk-informed analysis process for DI&C upgrade, including hazard analysis, reliability analysis, and consequence analysis, (2) applying systematic and risk-informed tools to address common cause failures (CCFs) and quantify corresponding failure probabilities for DI&C technologies, particularly software CCFs, (3) evaluating the impact of digital failures at the component level, system level, and plant level, and (4) providing insights and suggestions on designs to manage the risks, thus to support the development, licensing, and deployment of advanced DI&C technologies on nuclear power plant (NPPs). Adding diversity within system or components is the main means to eliminate and mitigate CCFs, but diversity also increases plant complexity and errors and may not address all sources of systematic failures. How to optimize the diversity and redundancy applications for the safety-critical DI&C systems remains a challenge. To deal with the technical issues in addressing potential software CCFs in HSSSR DI&C systems of NPPs and supporting relevant design optimization, the framework provides: ? An integrated best-estimate, risk-informed capability to address new technical digital issues quantitatively, accurately, and efficiently in plan modernization progress, such as software CCFs in HSSSR DI&C systems of NPPs ? A common and a modularized platform for DI&C designers, software developers, cybersecurity analysts, and plant engineers to efficiently predict and prevent risk in the early design stage of DI&C systems ? Technical bases and risk-informed insights to assist U.S. Nuclear Regulatory Commission (NRC) and industry to address and fulfill the risk-informed alternatives for evaluation of CCFs in HSSSR DI&C systems of NPPs ? An integrated risk-informed tool that offers a capability of design architecture evaluation of various DI&C systems to support system design decisions in diversity and redundancy applications. The plus-up research and development efforts of this project in FY 2022 are focused on methodology improvement of software CCF modeling and estimation, prevention analysis, importance analysis and risk analysis of various design architectures of HSSSR DI&C systems. This work greatly enhances the capability of the LWRS-developed framework for the risk assessment and design optimization of safety-critical DI&C systems. It should be noted that all the analyses are performed for the demonstration of the LWRS-developed framework, not for the evaluation of relevant systems. Results are obtained based on very limited design information and testing data.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2025

SAM Theory Manual

The System Analysis Module (SAM) is an advanced and modern system analysis tool under development at Argonne National Laboratory for advanced non-LWR reactor safety analysis. It aims to provide fast-running, modest-fidelity, whole-plant transient analyses capabilities, which are essential for fast turnaround design scoping and engineering analyses of advanced reactor concepts. While SAM is being developed as a system-level modeling and simulation tool, advanced modeling techniques being implemented include a reduced-order three-dimensional module, pseudo 3-D conjugate heat transfer modeling in reactor core, flexible and multi-scale modeling of heat transfer between fluid and structures, in addition to the advances in software environments and design, and numerical methods. SAM aims to be a generic system-level safety analysis tool for advanced non-LWRs, including Liquid-Metal-cooled fast Reactors (LMR), Molten Salt Reactors (MSR), Fluoride-salt-cooled High-temperature Reactors (FHR), and High-Temperature Gas-cooled Reactors (HTGR). SAM takes advantage of advances in physical modeling, numerical methods, and software engineering to enhance its user experience and usability. It utilizes an object-oriented computational framework (MOOSE), and its underlying meshing and finite-element library and linear and non-linear solvers, to leverage the modern advanced software environments and numerical methods. This document provides the theoretical and technical basis of the code to help users understand the underlying physical models (such as governing equations, closure models, and component models), system modeling approaches, numerical discretization and solution methods, and the overall capabilities in SAM. As new code capabilities and features are added, the SAM Theory Manual will be updated periodically to keep it consistent with the state of the development.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2024

Evaluating Methods of Software Bill of Materials Generation to Enhance Nuclear Power Plant Cybersecurity

Instrumentation and control (I&C) systems in nuclear power plants (NPPs) are potential targets of cyberattacks and can prove deleterious for the safety of the NPPs. A Software Bill of Materials (SBOM) provides a detailed list of the various components and their dependencies in software, which helps in vulnerability and risk assessment for cyber hygiene and situational awareness. For an NPP, the process of generating an accurate SBOM report can be complex due to the legacy systems and firmware binaries involved. While most current SBOM tools are focused more on modern internet technology software, this research provides insights and guidelines for an NPP to generate an accurate and efficient SBOM. Here, the paper proposes a new methodology to help NPPs categorize software and use appropriate tools to generate SBOMs for their digital I&C systems.

SBOM↗
DOE OSTI2026

ARCH Technology Snapshot Autonomous Robot Control Hierarchy (ARCH): A universal software system that removes the need to rebuild robotic software for every new platform or task

Robots are increasingly used to perform repetitive, hazardous, and time-sensitive tasks, improving safety and operational efficiency. However, most robotic systems remain difficult to adapt because they are tightly tied to specific hardware and require extensive reprogramming for each new configuration.

42 ENGINEERING↗
DOE OSTI2026

MARVEL Instrumentation, Control, and Software Considerations

This paper details the various I&C considerations and design decisions made throughout the MARVEL (Micro-reactor Applications Research Validation and Evaluation) project, including sensor and actuator selection, safety-related functionality, digital control hardware and software, and testing methodologies. Key challenges such as managing radiation, temperature, and space constraints are discussed, along with the trade-offs between using standard equipment and custom solutions. The successful integration of off-the-shelf components, the emphasis on minimizing safety-related instrumentation, and the lessons learned from prototyping and testing are highlighted. The authors aim to provide insights that can benefit future micro-reactor designs and emphasize the importance of real-world testing in advancing reactor technology.

46 - INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AN↗
DOE OSTI2024

Root Cause Correlation Analysis of Software Failures via Orthogonal Defect Classification and Natural Language Processing

Systems theoretic process analysis (STPA) is becoming an increasingly popular technique to assess how complex digital software systems can fail. Rather than defining failures by their observable failure events, which may be sparse especially for safety rated nuclear digital instrumentation and control systems (DI&C), failures are defined as postulated unsafe actions under specific contextual conditions. This permits a top-down analysis of system hazards and identifies whether imposed constraints and requirements can sufficiently address undesirable hazards. However, STPA is a qualitative approach at identifying inadequacies in the development process and cannot currently be used to quantify unsafe action likelihoods for probabilistic risk assessment. Therefore, in this work, we examine the root causes of software failure and explore whether a consistent correlation can be linked to specific unsafe action classes. We implement Lbl2Vec, an unsupervised document classification and retrieval algorithm, on a database of 4,096 software defect reports acquired from various open-source software systems. By analyzing sentence structure, embedded labels, and word vectors, we show that certain defect types positively correlate to specific unsafe action classes over others. The correlations developed can be used to estimate the failure probability of safety intended DI&C systems which provides a licensing basis for nuclear plant modernization efforts.

22 - GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2024

Root Cause Correlation Analysis of Software Failures via Orthogonal Defect Classification and Natural Language Processing

Systems theoretic process analysis (STPA) is becoming an increasingly popular technique to assess how complex digital software systems can fail. Rather than defining failures by their observable failure events, which may be sparse especially for safety rated nuclear digital instrumentation and control systems (DI&C), failures are defined as postulated unsafe actions under specific contextual conditions. This permits a top-down analysis of system hazards and identifies whether imposed constraints and requirements can sufficiently address undesirable hazards. However, STPA is a qualitative approach at identifying inadequacies in the development process and cannot currently be used to quantify unsafe action likelihoods for probabilistic risk assessment. Therefore, in this work, we examine the root causes of software failure and explore whether a consistent correlation can be linked to specific unsafe action classes. We implement Lbl2Vec, an unsupervised document classification and retrieval algorithm, on a database of 4,096 software defect reports acquired from various open-source software systems. By analyzing sentence structure, embedded labels, and word vectors, we show that certain defect types positively correlate to specific unsafe action classes over others. The correlations developed can be used to estimate the failure probability of safety intended DI&C systems which provides a licensing basis for nuclear plant modernization efforts.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2024

Improving Cost and Efficiency of the Scalable Solid Oxide Fuel Cells Power System

The objective of this project was to design and develop a 20kW range small-scale solid oxide fuel cells (SOFC) power system for applications such as data centers and commercial buildings. The original plan included a 5,000 hours demonstration and a Techno-Economic Analysis (TEA) which were dropped as part of project termination. The original project plan was to use a stack with a cross-flow cell design which had previously been tested for 500 hours at a community college in Malta, NY. However, it was decided to move to the advanced R-SOFC co-flow cell developed under Department of Energy Award DE-FE0031971. The advanced cell design has the advantage of a larger active area for the same manufacturing footprint which results in fewer required cells for the same stack power, hence a higher volumetric power density (kW/L) and lower cost per kW than the original cross-flow cell design. A full SOFC system Simulink model was developed and calibrated with testing data from a fuel cell stack and BOP (balance of plant) components. The simulation results from the calibrated model showed an acceptable match with the experimental data. A structural analysis conducted for various load scenarios indicated no high stress areas for all spatial directions. Major electrical system components were acquired, built and successfully tested. System sensors were verified and validated against controls. Safety checks, a diagnostic check, PID tuning, and control software commissioning tasks were also conducted. The power electronics prototype was delivered and trial testing completed. Balance of Plant component testing and simulation work was conducted to characterize Reformer-Heat Exchanger heat transfer and backpressure and reformer catalyst methane conversion and product selectivity. Simulations were conducted to design the Anode and Cathode fluid passages and size the air-air and fuel-fuel heat exchangers. A Burner operation map was created from test data and the Anode Gas Recirculation blower was tested to evaluate its durability. The SOFC system used a horizontal style design where components sit directly on a casting with a direct connection to the skid. This design has efficient packaging and a small footprint with approximate dimensions of 750 mm x 700 mm x 1700 mm. An SOFC system was built and successfully tested at the Malta, NY facility The system for over 500 hours under load of which over 300 hours was at full load of 20 kW.

30 DIRECT ENERGY CONVERSION↗
DOE OSTI2026

Programmable Digital Devices used in Advanced Reactors

This paper introduces the concepts of common cause failure, diversity, and defense-in-depth used by the nuclear industry to analyze resilience in reactors. A survey of publicly traded and private companies building advanced reactors and their licensing status is presented. Safety and non-safety systems found in the NuScale Power design are summarized and the likely hardware and software categories used by those systems are enumerated. The importance of industry partners is highlighted. This paper also identifies an alternate path forward without industry partners to advance the knowledge needed to use artificial intelligence to analyze HBOMs and SBOMs to better understand reactor resiliency.

cybersecurity↗
DOE OSTI2026

Firmware Tampering Detection in Heavy-Duty Vehicles through J1939 CAN Analysis

Modern heavy-duty vehicles rely on complex networks of Electronic Control Units (ECUs) that communicate using the J1939 protocol. While this system makes it easier to update and configure vehicle components, it also opens the door to serious cybersecurity risks if not properly secured. This work investigates the potential for firmware tampering through the J1939 communication protocol, which enables ECU configuration and reprogramming over the Controller Area Network (CAN) bus. By monitoring CAN traffic during legitimate maintenance operations and reverse-engineering OEM diagnostic software, we identified common and proprietary J1939 message identifiers, authentication patterns, and vulnerabilities within Unified Diagnostic Services (UDS). These findings demonstrate that inadequate authentication mechanisms can allow malicious actors to alter ECU firmware or disable safety functions, posing severe operational and safety risks. Our analysis contributes to the development of vehicle intrusion detection systems capable of recognizing abnormal reprogramming activity and future firmware fingerprinting methods to verify software integrity across ECUs. This work highlights the importance of standardizing secure firmware authentication across manufacturers to strengthen cyber resilience in heavy-duty vehicle systems.

33 ADVANCED PROPULSION SYSTEMS↗
DOE OSTI2024

Assessment of Condition Monitoring Methods and Technologies for Inservice Inspection and Testing of Nuclear Power Plant Components

This report was prepared for the U.S. Nuclear Regulatory Commission (NRC) to explore the application of advanced technologies toward meeting the current and future regulatory requirements for maintenance and condition monitoring of structures, systems, and components. The advanced technologies considered in this work are advanced sensors and instrumentation, data analytics, machine learning and artificial intelligence (ML/AI), physics-based models, and digital twins (DT). The interest in the application of advanced technologies for condition monitoring in nuclear power plants continues to grow, and current and future licensees are expected to implement advanced technologies as part of their inservice inspection (ISI) and inservice testing (IST) programs. This report delineates the outcomes of an exploratory investigation into the implementation of advanced condition monitoring technologies to address ISI and IST requirements. A thorough review was conducted of the existing regulatory requirements for ISI and IST, along with an analysis of associated industry practices. Additionally, a state-of-the-art assessment was performed on advanced condition monitoring technologies frequently employed in non-nuclear sectors. This research incorporated two nuclear-specific case studies to illustrate the application of these technologies within the current nuclear fleet. The report provides an exhaustive discussion on the technical challenges, considerations, and opportunities associated with the deployment of advanced condition monitoring technologies. The following are key considerations in the application of advanced technologies for the ISI and IST of nuclear power plant components: • Developing adequate verification and validation procedures to confirm the functional and non-functional requirements, • Developing technical capabilities to conduct real-time asset condition monitoring, • Establishing guidance and protocol for modeling and simulation tools to continuously meet regulatory requirements, • Addressing trustworthiness, explainability, and interpretability of ML/AI methods, • Evaluating maintenance activities to maintain an adequate safety margin and avoid undesirable conditions, • Establishing cybersecure condition monitoring programs associated with a computer-based software system, and • Establishing standardized evaluation metrics for advanced condition monitoring programs. Interest in the use of advanced technologies for condition monitoring in ISI and IST programs continues to grow, and the technology is expected to experience rapid and wide industry adoption in the near future. Adoption of advanced technologies for condition monitoring could have novel and unique impacts on regulatory activities associated with ISI and IST programs. The NRC is continuing to explore the regulatory aspects of advanced technologies as part of ISI and IST programs by pursuing additional research in this technical area.

22 - GENERAL STUDIES OF NUCLEAR REACTORS↗