Software Safety Analysis Research Articles

Development of thermo-physical property database and code of fusion materials for CFETR blankets

The conceptual design of China Fusion Engineering Test Reactor (CFETR) has been completed and is currently in the engineering design phase. In this paper, focusing on three categories of candidate blanket designs and divertor designs, the selection schemes for materials of plasma-facing components, solid structure, tritium breeding materials, neutron multiplier, coolant, and divertor were extracted. Thermo-physical property data was compiled to form a material thermo-physical property database, named Thermo-physical Property Database (ThePD), which is the first advanced thermo-physical database for materials of CFETR blankets. Besides, the callable code was generated, which can be directly applied in the system code for the blanket. Based on internationally available database from National Institute of Standards and Technology (NIST) and similar software AP1700, the correctness of the data and the transitional analysis of regions designed by International Association for the Properties of Water and Steam (IAPWS) were verified. Using the thermal-hydraulic system analysis code, integrated validation was performed for the validated thermo-physical property data and code, demonstrating the applicability and accuracy of the data. ThePD is conducive to addressing the issue of incomplete thermo-physical property data faced by blanket design and safety analysis software for CFETR, and it can fill this gap.

Status and Assessment Method of Nuclear Safety Analysis Software in China

In recent years, China’s nuclear power industry has enjoyed a good momentum of development, and related companies have also developed many nuclear analysis software applications. However, as the National Nuclear Safety Administration (NNSA, Chinese nuclear regulatory institution) did not approve any software before 2018, all these software applications were not evaluated formally, so they have not yet been used in reactor safety analysis. In order to solve this problem, in 2018, the National Nuclear Safety Administration started to carry out an engineering applicability evaluation for software developed by Chinese companies. After several years of review, as the first approved Chinese domestic software, core physics analysis software PCM developed by the China General Nuclear Power Group officially passed the software safety evaluation of the China Nuclear Safety Administration. This study will present the basic situation of the development of China’s nuclear power engineering software and introduce the framework, methods, procedures, requirements, and other aspects of China’s software safety evaluation work. The evaluation process and evaluation key issues of PCM software will also be illustrated.

Research on Influence Factors of Leakage and Diffusion of 5 m3 High Pressure Hydrogen Cylinder

According to the characteristics of 5m3 hydrogen cylinder in a hydrogenation station, the influence factors of high-pressure hydrogen leakage and diffusion under different leakage aperture, cylinder pressure and wind speed were studied by using the safety analysis software PHAST. The results show that the area of downstream dangerous cloud cluster and diffusion isolation area increases with the increase of leakage diameter, cylinder pressure and wind speed. The aperture has a great influence on the mass leakage rate and the distribution range of cloud clusters, while the cylinder pressure mainly affects the distribution of cloud clusters. The influence of pressure on mass leakage rate is not as obvious as the influence of aperture. The wind speed has no effect on the mass leakage rate, and has only a slight impact on the downstream cloud cluster distribution.

Software Safety Analysis to Support ISO 26262-6 Compliance in Agile Development

In the literature, there are clear-cut techniques for system safety analysis but little support for software-specific safety evaluation. This article provides a software safety analysis method to help practitioners comply with ISO 26262-6 in Agile software development.

Kairos power thermal hydraulics research and development

The Kairos Power Fluoride salt-cooled High temperature Reactor (KP-FHR) is a new, U.S.-developed advanced reactor technology. In order to meet its development schedule and objectives, Kairos Power is adopting an innovative thermal hydraulics R&D strategy. The strategy is centered around design and testing at different scales and complexity levels, with modeling, simulations, and resulting analysis serving to integrate these design and test efforts. Kairos Power’s approach to rapid and predictable design, development, commercialization and deployment includes engineering design activities along with development activities, such as testing, fabrication, and the qualification necessary to successfully license and deploy the KP-FHR. Licensing and quality assurance considerations are integrated with testing and design activities. This approach reduces development risk through a “rapid iteration” product development process that leverages modern tools and methods used in aerospace, automotive, and biotech industries. Kairos Power’s testing program and safety analysis software development are rooted in the application of the U.S. Nuclear Regulatory Commission’s Regulatory Guide 1.203 for evaluation model development and assessment. This paper presents a high-level overview of the KP-FHR design, thermal hydraulics R&D strategy, test program, and modeling and simulation activities, including the reactor systems code KP-SAM and applications of computational fluid dynamics methods in design and analysis. Selected examples are shown to demonstrate current status and progress.

Software Safety Analysis with UML-Based SRBD and Fuzzy VIKOR- Based FMEA

Software often controls the behavior of mechanical and electrical systems, as well as interactions among their components in cyber-physical systems (CPS). The risks in CPS systems could result in losing tools, features, performance, and even life. Therefore, safety analysis for software in these systems is a highly critical and serious issue. The use of reliability block diagram is a method for checking the safety and reliability of systems. A reliability block diagram is a diagrammatic method for showing how component reliability contributes to the success or failure of a complex system. In this paper, a method for generating RBDs is presented analysis and demonstration of this method capability to evaluation of a software safety by use-case analysis, use-case diagram review, and use-case specification. Then, a Fuzzy VIKOR-based FMEA is used for further evaluation due to the presence of uncertain data. Finally, it is applied to a real CPS.

Method Based on SEFT-to-Petri for Safety Analysis of Software

System safety is a vital non-functional requirement whose satisfaction is essential for system software. However, modern aerospace system software is more and more complicated, which results in a high complexity of analyzing system faults. With the increased acceptance of Model-based Systems Engineering as a new method for systems engineering, Model-based Safety Analysis is also proposed to formalize the task of safety analysis and automate the safety calculations. Our work is grounded on State/Event Fault Tree to analyze system faults and build functional model. Firstly, we can translate SEFT to state machine based on SysML with fault syntactic messages and match elements together with translating logic gates; after which, transforming state machine into Petri Net model by means of rigorous semantic relations to extract preliminary analytical model is deduced theoretically in this paper; finally, we can derive analyses of causes and results of faults from Petri Net model by adopting a set of mathematical and statistical analysis. Practically, we have also validated our work by a case study of an aeronautic control system to support this paper.

President's Message

The recent International System Safety Conference (ISSC) in Albuquerque, New Mexico was a thought-provoking event.
 Professor Edward Gibson gave the first keynote address. He described the engineering programs at Arizona State University (ASU) and some possible relations with the system safety discipline. Members of the Executive Council (EC) had additional meetings with Dr. Gibson to explore including system safety concepts in the school’s engineering curriculum, as well as the relationship between ASU and the ISSS.
 One of the most venerable members of our Society, John Rankin, gave several presentations on hazard analysis. He also provided a viewing of the movie Fate is the Hunter and explained how it helped inspire him to invent Sneak Circuit Analysis.
 The Conference featured many excellent papers and tutorials. One that received a good deal of positive commentary was on the topic of “gamification” in teaching software safety analysis. The authors, Brian Connell and David Musgrave, have developed an entertaining and effective way to train on this topic.

Detecting safety‐related components in statecharts through traceability and model slicing

SummaryWith rapid development in software technology, more and more safety‐critical systems are software intensive. Safety issues become important when software is used to control such systems. However, there are 2 important problems in software safety analysis: (1) there is often a significant traceability gap between safety requirements and software design, resulting in safety analysis and software design are often conducted separately; and (2) the growing complexity of safety‐critical software makes it difficult to determine whether software design fulfills safety requirements. In this paper, we propose a technique to address the above 2 important problems on the model level. The technique is based on statecharts, which are used to model the behavior of software, and fault tree safety analysis. This technique contains the following 2 parts, which are corresponding to the 2 problems, respectively. The first part is to build a metamodel of traceability between fault trees and statecharts, which is to bridge their traceability gap. A collection of rules for the creation and maintenance of traceability links is provided. The second part is a model slicing technique to reduce the complexity of statecharts with respect to the traceability information. The slicing technique can deal with the characteristics of hierarchy, concurrency, and synchronization of statecharts. The reduced statecharts are much smaller than their original statecharts, which are helpful to successive safety analysis. Finally, we illustrate the effectiveness and the importance of the method by a case study of slats and flaps control units in flight control systems.

SFTA-Based Approach for Safety/Reliability Analysis of Operational Use-Cases in Cyber-Physical Systems

The software is often responsible for controlling the behavior of mechanical and electrical components, as well as interactions among these components in cyber-physical systems (CPS). The risks in CPS systems could result in losing tools, features, performance and even life. Therefore, safety analysis for software in these systems is a highly critical and serious issue. In general, safety and reliability approaches play a major role in a risk management process in CPS. In this paper, after reviewing the major techniques of software reliability and safety in CPS, an software fault tree analysis (SFTA)-based approach is presented for analysis of operational use-cases (UC) in a CPS system. In our approach, the events related to use-cases are extracted, and the related SFTA is then obtained using the proposed algorithm. Moreover, a semi-automatic method is presented in this paper to produce software failure mode and effects analysis (SFMEA) from SFTA. The results of our approach are applicable for software safety analysis in a real CPS system, including the control system of Iranian National Observatory telescope. Assessment of the suggested method is performed through numerous safety/reliability criteria and the qualitative/quantitative analysis based on these criteria.

NuDE 2.0: A Formal Method-based Software Development, Verification and Safety Analysis Environment for Digital I&Cs in NPPs

NuDE 2.0 (Nuclear Development Environment 2.0) is a formal-method-based software development, verification and safety analysis environment for safety-critical digital I&Cs implemented with programmable logic controller (PLC) and field-programmable gate array (FPGA). It simultaneously develops PLC/FPGA software implementations from one requirement/design specification and also helps most of the development, verification, and safety analysis to be performed mechanically and in sequence. The NuDE 2.0 now consists of 25 CASE tools and also includes an in-depth solution for indirect commercial off-the-shelf (COTS) software dedication of new FPGA-based digital I&Cs. We expect that the NuDE 2.0 will be widely used as a means of diversifying software design/implementation and model-based software development methodology.

Thermal hydraulic characteristics analysis of direct residual heat removal system for China pressurized reactor

An innovative Direct Residual Heat Removal System (DRHRS) is proposed for Pressurized Water Reactor (PWR) in this paper. The new designed parallel DRHRS is different from traditional Passive Residual Heat Removal System (PRHRS), which is connected to steam generation. The thermal hydraulic transient analysis of the new designed DRHRS for CPR1000 has been carried out using the widely accepted safety analysis software RELAP5. The new designed DRHRS is directly connected to the primary loop, which consists of three independent parallel loops, three intermediate cooling circuits and an air loop. The transient behaviors of passive safety system are studied, and design parameter sensitivity analysis is carried out. Results show that during Station Black_Out (SBO) accident, natural circulations are established stably in passive safety system so that core decay is continuously removed from primary loop. And the new designed DRHRS has the capability of removing residual heat to the atmosphere without any external energy input at different surrounding environmental temperature. In emergency, the DRHRS directly remove core decay heat from reactor outlet, and efficiency of residual heat removal is improved. Moreover, reactor power plant maintains safe even if double-ended rupture of a single tube during SBO accident occurs. Thus, the designed DRHRS has great significance for increasing the degree of inherent safety features of CPR1000.

Software Safety Analysis Based on Multiple State Transition

At present, existing methods are difficult to analyze the Safety of Multitasking and complex timing sequence software. In order to overcome this difficulty, a new analysis method of multiple state transfer and real-time logic analysis method (MSTRT-TPN ) is proposed. This method extends the time Petri net analysis rules and proposes the concept of synchronous synthesis and sharing synthesis. It combines temporal logic and state transition, establishes software failure model. Through the model, the possibility of high-risk state of software can be analyzed. The effectiveness of the proposed method is verified through application in three protection device software which is typical safety-critical military software.

Software FMEA analysis for safety-related application software

A method of a software safety analysis is described in this paper for safety-related application software. The target software system is a software code installed at an Automatic Test and Interface Processor (ATIP) in a digital reactor protection system (DRPS). For the ATIP software safety analysis, at first, an overall safety or hazard analysis is performed over the software architecture and modules, and then a detailed safety analysis based on the software FMEA (Failure Modes and Effect Analysis) method is applied to the ATIP program. For an efficient analysis, the software FMEA analysis is carried out based on the so-called failure-mode template extracted from the function blocks used in the function block diagram (FBD) for the ATIP software. The software safety analysis by the software FMEA analysis, being applied to the ATIP software code, which has been integrated and passed through a very rigorous system test procedure, is proven to be able to provide very valuable results (i.e., software defects) that could not be identified during various system tests.

Safety Analysis of Software Requirements: Model and Process

Since lots of software hazards are caused by incompleteness or omissions of requirements, safety analysis of software requirements becomes more and more important. However, there are no systematic researches and exposition on the scope and the requirements of safety analysis. Safety analysts often get confused about how to take a complete analysis of software safety requirements. In this paper, referring to the software V&V model, an analysis model is proposed to specify the scope of software requirements safety analysis. Then, a process framework of safety analysis is determined to verify those analysis requirements derived from the analysis model. Relevant software safety analysis techniques which may be used in the analysis process framework were classified. Finally, the analysis model and process were applied to the landing gear control system.

Hazard analysis of Unified Modelling Language sequence and state charts using software fault tree analysis

Software fault tree analysis (SFTA) is a well known software safety analysis technique for identifying those software related erroneous events which can force the system into a hazardous state. Over the years, the effective strengths of SFTA approach have been demonstrated by applying it practically at every phase of software development such as coding, design and requirement analysis. The focus of SFTA application research efforts at the software design phase is the automatic or semi-automatic construction of a software fault tree for the selected hazardous state of the system directly from the given Unified Modelling Language (UML) models such as sequence and state charts. But programmed application of SFTA has been successfully carried out so far only in the coding phase whereas at other phases especially at design and requirement analysis its application remains a manual process so far. This paper presents a semi-automated approach to construct a software fault tree from the UML sequence and state charts drawn for a particular functional scenario. The effective strength(s) of the proposed approach have been demonstrated by applying it on two use-case scenarios selected from an elevator controller application.

Model checking Trampoline OS: a case study on safety analysis for automotive software

SUMMARY Model checking is an effective technique used to identify subtle problems in software safety using a comprehensive search algorithm. However, this comprehensiveness requires a large number of resources and is often too expensive to be applied in practice. This work strives to find a practical solution to model-checking automotive operating systems for the purpose of safety analysis, with minimum requirements and a systematic engineering approach for applying the technique in practice. The paper presents methods for converting the Trampoline kernel code into formal models for the model checker SPIN, a series of experiments using an incremental verification approach, and the use of embedded C constructs for performance improvement. The conversion methods include functional modularization and treatment for hardware-dependent code, such as memory access for context switching. The incremental verification approach aims at increasing the level of confidence in the verification even when comprehensiveness cannot be provided because of the limitations of the hardware resource. We also report on potential safety issues found in the Trampoline operating system during the experiments and present experimental evidence of the performance improvement using the embedded C constructs in SPIN. Copyright © 2012 John Wiley & Sons, Ltd.

Software safety analysis application of safety-related I&C systems in installation phase

This work performed a software safety analysis (SSA) in the installation phase of the Lungmen nuclear power plant (LMNPP) in Taiwan, under the cooperation of INER and TPC. The US Nuclear Regulatory Commission (USNRC) requests licensee to perform software safety analysis (SSA) and software verification and validation (SV&V) in each phase of software development life cycle with Branch Technical Position (BTP) 14. In this work, 37 safety grade digital instrumentation and control (I&C) systems were analyzed by Failure Mode and Effects Analysis (FMEA), which is suggested by IEEE Standard 7-4.3.2 (2003). During the installation phase, skew tests for safety grade network and point to point tests were performed. The FMEA showed all the single failure modes can be resolved by the redundant architecture. The common mode failures can be resolved by operator manual actions via the diverse displays.

Experience with fault injection experiments for FMEA

AbstractFailure Modes and Effects Analysis (FMEA) is a widely used system and software safety analysis technique that systematically identifies failure modes of system components and explores whether these failure modes might lead to potential hazards. In practice, FMEA is typically a labor‐intensive team‐based exercise, with little tool support. This article presents our experience with automating parts of the FMEA process, using a model checker to automate the search for system‐level consequences of component failures. The idea is to inject runtime faults into a model based on the system specification and check if the resulting model violates safety requirements, specified as temporal logical formulas. This enables the safety engineer to identify if a component failure, or combination of multiple failures, can lead to a specified hazard condition. If so, the model checker produces an example of the events leading up to the hazard occurrence which the analyst can use to identify the relevant failure propagation pathways and co‐effectors. The process is applied on three medium‐sized case studies modeled with Behavior Trees. Performance metrics for SAL model checking are presented. Copyright © 2011 John Wiley & Sons, Ltd.

Integrated safety analysis of software-controlled critical systems

Software for safety-critical systems must deal with the hazards identified by safety analysis in order to make the system safe, risk-free and fail-safe. Certain faults in critical systems can result in catastrophic consequences such as death, injury or environmental harm. The focus of this paper is an integrated approach to software safety analysis based on a combination of two existing fault removal techniques, and implementation of software safety in developing a small prototype safety-critical system. A comprehensive software safety analysis involving a combination of Failure Modes and Effects Analysis (FMEA) and Fault Tree Analysis (FTA) techniques is conducted on the software functions of the critical system to identify potentially hazardous software faults. A prototype safety-critical system - Railroad Crossing Control System (RCCS), incorporating a microcontroller and software to operate the train on a track circuit is described. We also briefly compare safety-specific and non-safety specific techniques at developing RCCS.