Abstraction carrying code and resource-awareness

Proof-Carrying Code (PCC) is a general approach to mobile code safety in which the code supplier augments the program with a certifícate (or proof). The intended benefit is that the program consumer can locally validate the certifícate w.r.t. the "untrusted" program by means of a certifícate checker—a process which should be much simpler, eíñcient, and automatic than generating the original proof. Abstraction Carrying Code (ACC) is an enabling technology for PCC in which an abstract model of the program plays the role of certifícate. The generation of the certifícate, Le., the abstraction, is automatically carried out by an abstract interpretation-based analysis engine, which is parametric w.r.t. different abstract domains. While the analyzer on the producer side typically has to compute a semantic fixpoint in a complex, iterative process, on the receiver it is only necessary to check that the certifícate is indeed a fixpoint of the abstract semantics equations representing the program. This is done in a single pass in a much more efficient process. ACC addresses the fundamental issues in PCC and opens the door to the applicability of the large body of frameworks and domains based on abstract interpretation as enabling technology for PCC. We present an overview of ACC and we describe in a tutorial fashion an application to the problem of resource-aware security in mobile code. Essentially the information computed by a cost analyzer is used to genérate cost certificates which attest a safe and efficient use of a mobile code. A receiving side can then reject code which brings cost certificates (which it cannot validate or) which have too large cost requirements in terms of computing resources (in time and/or space) and accept mobile code which meets the established requirements.

Reduced certificates for abstraction-carrying code

Abstraction-Carrying Code (ACC) has recently been proposed as a framework for mobile code safety in which the code supplier provides a program together with an abstraction (or abstract model of the program) whose validity entails compliance with a predefined safety policy. The abstraction plays thus the role of safety certifícate and its generation is carried out automatically by a fixed-point analyzer. The advantage of providing a (fixed-point) abstraction to the code consumer is that its validity is checked in a single pass (i.e., one iteration) of an abstract interpretation-based checker. A main challenge to make ACC useful in practice is to reduce the size of certificates as much as possible while at the same time not increasing checking time. The intuitive idea is to only include in the certifícate information that the checker is unable to reproduce without iterating. We introduce the notion of reduced certifícate which characterizes the subset of the abstraction which a checker needs in order to validate (and re-construct) the full certifícate in a single pass. Based on this notion, we instrument a generic analysis algorithm with the necessary extensions in order to identify information which can be reconstructed by the single-pass checker. Finally, we study what the effects of reduced certificates are on the correctness and completeness of the checking process. We provide a correct checking algorithm together with sufficient conditions for ensuring its completeness. Our ideas are illustrated through a running example, implemented in the context of constraint logic programs, which shows that our approach improves state-of-the-art techniques for reducing the size of certificates.

Certificate size reduction in abstraction-carrying code

Abstraction-Carrying Code (ACC) has recently been proposed as a framework for mobile code safety in which the code supplier provides a program together with an abstraction (or abstract model of the program) whose validity entails compliance with a predefined safety policy. The abstraction plays thus the role of safety certificate and its generation is carried out automatically by a fixpoint analyzer. The advantage of providing a (fixpoint) abstraction to the code consumer is that its validity is checked in a single pass (i.e., one iteration) of an abstract interpretation-based checker. A main challenge to make ACC useful in practice is to reduce the size of certificates as much as possible while at the same time not increasing checking time. The intuitive idea is to only include in the certificate information that the checker is unable to reproduce without iterating. We introduce the notion of reduced certificate which characterizes the subset of the abstraction which a checker needs in order to validate (and re-construct) the fall certificate in a single pass. Based on this notion, we instrument a generic analysis algorithm with the necessary extensions in order to identify the information relevant to the checker. Interestingly, the fact that the reduced certificate omits (parts of) the abstraction has implications in the design of the checker. We provide the sufficient conditions which allow us to ensure that 1) if the checker succeeds in validating the certificate, then the certificate is valid for the program (correctness) and 2) the checker will succeed for any reduced certificate which is valid (completeness). Our approach has been implemented and benchmarked within the CiaoPP system. The experimental results show t h a t our proposal is able to greatly reduce the size of certificates in practice. To appear in Theory and Practice of Logic Programming (TPLP).

Analysis of a Spanish energy scenario with Generation IV nuclear reactors

The advantages of fast-spectrum reactors consist not only of an efficient use of fuel through the breeding of fissile material and the use of natural or depleted uranium, but also of the potential reduction of the amount of actinides such as americium and neptunium contained in the irradiated fuel. The first aspect means a guaranteed future nuclear fuel supply. The second fact is key for high-level radioactive waste management, because these elements are the main responsible for the radioactivity of the irradiated fuel in the long term. The present study aims to analyze the hypothetical deployment of a Gen-IV Sodium Fast Reactor (SFR) fleet in Spain. A nuclear fleet of fast reactors would enable a fuel cycle strategy different than the open cycle, currently adopted by most of the countries with nuclear power. A transition from the current Gen-II to Gen-IV fleet is envisaged through an intermediate deployment of Gen-III reactors. Fuel reprocessing from the Gen-II and Gen-III Light Water Reactors (LWR) has been considered. In the so-called advanced fuel cycle, the reprocessed fuel used to produce energy will breed new fissile fuel and transmute minor actinides at the same time. A reference case scenario has been postulated and further sensitivity studies have been performed to analyze the impact of the different parameters on the required reactor fleet. The potential capability of Spain to supply the required fleet for the reference scenario using national resources has been verified. Finally, some consequences on irradiated final fuel inventory are assessed. Calculations are performed with the Monte Carlo transport-coupled depletion code SERPENT together with post-processing tools.

Core physics and safety analysis of Generation-IV Sodium Fast Reactors using existing and newly developed computational tools

El futuro de la energía nuclear de fisión dependerá, entre otros factores, de la capacidad que las nuevas tecnologías demuestren para solventar los principales retos a largo plazo que se plantean. Los principales retos se pueden resumir en los siguientes aspectos: la capacidad de proporcionar una solución final, segura y fiable a los residuos radiactivos; así como dar solución a la limitación de recursos naturales necesarios para alimentar los reactores nucleares; y por último, una mejora robusta en la seguridad de las centrales que en definitiva evite cualquier daño potencial tanto en la población como en el medio ambiente como consecuencia de cualquier escenario imaginable o más allá de lo imaginable. Siguiendo estas motivaciones, la Generación IV de reactores nucleares surge con el compromiso de proporcionar electricidad de forma sostenible, segura, económica y evitando la proliferación de material fisible. Entre los sistemas conceptuales que se consideran para la Gen IV, los reactores rápidos destacan por su capacidad potencial de transmutar actínidos a la vez que permiten una utilización óptima de los recursos naturales. Entre los refrigerantes que se plantean, el sodio parece una de las soluciones más prometedoras. Como consecuencia, esta tesis surgió dentro del marco del proyecto europeo CP-ESFR con el principal objetivo de evaluar la física de núcleo y seguridad de los reactores rápidos refrigerados por sodio, al tiempo que se desarrollaron herramientas apropiadas para dichos análisis. Efectivamente, en una primera parte de la tesis, se abarca el estudio de la física del núcleo de un reactor rápido representativo, incluyendo el análisis detallado de la capacidad de transmutar actínidos minoritarios. Como resultado de dichos análisis, se publicó un artículo en la revista Annals of Nuclear Energy [96]. Por otra parte, a través de un análisis de un hipotético escenario nuclear español, se evalúo la disponibilidad de recursos naturales necesarios en el caso particular de España para alimentar una flota específica de reactores rápidos, siguiendo varios escenarios de demanda, y teniendo en cuenta la capacidad de reproducción de plutonio que tienen estos sistemas. Como resultado de este trabajo también surgió una publicación en otra revista científica de prestigio internacional como es Energy Conversion and Management [97]. Con objeto de realizar esos y otros análisis, se desarrollaron diversos modelos del núcleo del ESFR siguiendo varias configuraciones, y para diferentes códigos. Por otro lado, con objeto de poder realizar análisis de seguridad de reactores rápidos, son necesarias herramientas multidimensionales de alta fidelidad específicas para reactores rápidos. Dichas herramientas deben integrar fenómenos relacionados con la neutrónica y con la termo-hidráulica, entre otros, mediante una aproximación multi-física. Siguiendo este objetivo, se evalúo el código de difusión neutrónica ANDES para su aplicación a reactores rápidos. ANDES es un código de resolución nodal que se encuentra implementado dentro del sistema COBAYA3 y está basado en el método ACMFD. Por lo tanto, el método ACMFD fue sometido a una revisión en profundidad para evaluar su aptitud para la aplicación a reactores rápidos. Durante ese proceso, se identificaron determinadas limitaciones que se discutirán a lo largo de este trabajo, junto con los desarrollos que se han elaborado e implementado para la resolución de dichas dificultades. Por otra parte, se desarrolló satisfactoriamente el acomplamiento del código neutrónico ANDES con un código termo-hidráulico de subcanales llamado SUBCHANFLOW, desarrollado recientemente en el KIT. Como conclusión de esta parte, todos los desarrollos implementados son evaluados y verificados. En paralelo con esos desarrollos, se calcularon para el núcleo del ESFR las secciones eficaces en multigrupos homogeneizadas a nivel nodal, así como otros parámetros neutrónicos, mediante los códigos ERANOS, primero, y SERPENT, después. Dichos parámetros se utilizaron más adelante para realizar cálculos estacionarios con ANDES. Además, como consecuencia de la contribución de la UPM al paquete de seguridad del proyecto CP-ESFR, se calcularon mediante el código SERPENT los parámetros de cinética puntual que se necesitan introducir en los típicos códigos termo-hidráulicos de planta, para estudios de seguridad. En concreto, dichos parámetros sirvieron para el análisis del impacto que tienen los actínidos minoritarios en el comportamiento de transitorios. Concluyendo, la tesis presenta una aproximación sistemática y multidisciplinar aplicada al análisis de seguridad y comportamiento neutrónico de los reactores rápidos de sodio de la Gen-IV, usando herramientas de cálculo existentes y recién desarrolladas ad' hoc para tal aplicación. Se ha empleado una cantidad importante de tiempo en identificar limitaciones de los métodos nodales analíticos en su aplicación en multigrupos a reactores rápidos, y se proponen interesantes soluciones para abordarlas. ABSTRACT The future of nuclear reactors will depend, among other aspects, on the capability to solve the long-term challenges linked to this technology. These are the capability to provide a definite, safe and reliable solution to the nuclear wastes; the limitation of natural resources, needed to fuel the reactors; and last but not least, the improved safety, which would avoid any potential damage on the public and or environment as a consequence of any imaginable and beyond imaginable circumstance. Following these motivations, the IV Generation of nuclear reactors arises, with the aim to provide sustainable, safe, economic and proliferationresistant electricity. Among the systems considered for the Gen IV, fast reactors have a representative role thanks to their potential capacity to transmute actinides together with the optimal usage of natural resources, being the sodium fast reactors the most promising concept. As a consequence, this thesis was born in the framework of the CP-ESFR project with the generic aim of evaluating the core physics and safety of sodium fast reactors, as well as the development of the approppriated tools to perform such analyses. Indeed, in a first part of this thesis work, the main core physics of the representative sodium fast reactor are assessed, including a detailed analysis of the capability to transmute minor actinides. A part of the results obtained have been published in Annals of Nuclear Energy [96]. Moreover, by means of the analysis of a hypothetical Spanish nuclear scenario, the availability of natural resources required to deploy an specific fleet of fast reactor is assessed, taking into account the breeding properties of such systems. This work also led to a publication in Energy Conversion and Management [97]. In order to perform those and other analyses, several models of the ESFR core were created for different codes. On the other hand, in order to perform safety studies of sodium fast reactors, high fidelity multidimensional analysis tools for sodium fast reactors are required. Such tools should integrate neutronic and thermal-hydraulic phenomena in a multi-physics approach. Following this motivation, the neutron diffusion code ANDES is assessed for sodium fast reactor applications. ANDES is the nodal solver implemented inside the multigroup pin-by-pin diffusion COBAYA3 code, and is based on the analytical method ACMFD. Thus, the ACMFD was verified for SFR applications and while doing so, some limitations were encountered, which are discussed through this work. In order to solve those, some new developments are proposed and implemented in ANDES. Moreover, the code was satisfactorily coupled with the thermal-hydraulic code SUBCHANFLOW, recently developed at KIT. Finally, the different implementations are verified. In addition to those developments, the node homogenized multigroup cross sections and other neutron parameters were obtained for the ESFR core using ERANOS and SERPENT codes, and employed afterwards by ANDES to perform steady state calculations. Moreover, as a result of the UPM contribution to the safety package of the CP-ESFR project, the point kinetic parameters required by the typical plant thermal-hydraulic codes were computed for the ESFR core using SERPENT, which final aim was the assessment of the impact of minor actinides in transient behaviour. All in all, the thesis provides a systematic and multi-purpose approach applied to the assessment of safety and performance parameters of Generation-IV SFR, using existing and newly developed analytical tools. An important amount of time was employed in identifying the limitations that the analytical nodal diffusion methods present when applied to fast reactors following a multigroup approach, and interesting solutions are proposed in order to overcome them.

Generación de Casos de Prueba en Programación Orientada a Objetos = Test Case Generation in Object-Oriented Programming

Las pruebas de software (Testing) son en la actualidad la técnica más utilizada para la validación y la evaluación de la calidad de un programa. El testing está integrado en todas las metodologías prácticas de desarrollo de software y juega un papel crucial en el éxito de cualquier proyecto de software. Desde las unidades de código más pequeñas a los componentes más complejos, su integración en un sistema de software y su despliegue a producción, todas las piezas de un producto de software deben ser probadas a fondo antes de que el producto de software pueda ser liberado a un entorno de producción. La mayor limitación del testing de software es que continúa siendo un conjunto de tareas manuales, representando una buena parte del coste total de desarrollo. En este escenario, la automatización resulta fundamental para aliviar estos altos costes. La generación automática de casos de pruebas (TCG, del inglés test case generation) es el proceso de generar automáticamente casos de prueba que logren un alto recubrimiento del programa. Entre la gran variedad de enfoques hacia la TCG, esta tesis se centra en un enfoque estructural de caja blanca, y más concretamente en una de las técnicas más utilizadas actualmente, la ejecución simbólica. En ejecución simbólica, el programa bajo pruebas es ejecutado con expresiones simbólicas como argumentos de entrada en lugar de valores concretos. Esta tesis se basa en un marco general para la generación automática de casos de prueba dirigido a programas imperativos orientados a objetos (Java, por ejemplo) y basado en programación lógica con restricciones (CLP, del inglés constraint logic programming). En este marco general, el programa imperativo bajo pruebas es primeramente traducido a un programa CLP equivalente, y luego dicho programa CLP es ejecutado simbólicamente utilizando los mecanismos de evaluación estándar de CLP, extendidos con operaciones especiales para el tratamiento de estructuras de datos dinámicas. Mejorar la escalabilidad y la eficiencia de la ejecución simbólica constituye un reto muy importante. Es bien sabido que la ejecución simbólica resulta impracticable debido al gran número de caminos de ejecución que deben ser explorados y a tamaño de las restricciones que se deben manipular. Además, la generación de casos de prueba mediante ejecución simbólica tiende a producir un número innecesariamente grande de casos de prueba cuando es aplicada a programas de tamaño medio o grande. Las contribuciones de esta tesis pueden ser resumidas como sigue. (1) Se desarrolla un enfoque composicional basado en CLP para la generación de casos de prueba, el cual busca aliviar el problema de la explosión de caminos interprocedimiento analizando de forma separada cada componente (p.ej. método) del programa bajo pruebas, almacenando los resultados y reutilizándolos incrementalmente hasta obtener resultados para el programa completo. También se ha desarrollado un enfoque composicional basado en especialización de programas (evaluación parcial) para la herramienta de ejecución simbólica Symbolic PathFinder (SPF). (2) Se propone una metodología para usar información del consumo de recursos del programa bajo pruebas para guiar la ejecución simbólica hacia aquellas partes del programa que satisfacen una determinada política de recursos, evitando la exploración de aquellas partes del programa que violan dicha política. (3) Se propone una metodología genérica para guiar la ejecución simbólica hacia las partes más interesantes del programa, la cual utiliza abstracciones como generadores de trazas para guiar la ejecución de acuerdo a criterios de selección estructurales. (4) Se propone un nuevo resolutor de restricciones, el cual maneja eficientemente restricciones sobre el uso de la memoria dinámica global (heap) durante ejecución simbólica, el cual mejora considerablemente el rendimiento de la técnica estándar utilizada para este propósito, la \lazy initialization". (5) Todas las técnicas propuestas han sido implementadas en el sistema PET (el enfoque composicional ha sido también implementado en la herramienta SPF). Mediante evaluación experimental se ha confirmado que todas ellas mejoran considerablemente la escalabilidad y eficiencia de la ejecución simbólica y la generación de casos de prueba. ABSTRACT Testing is nowadays the most used technique to validate software and assess its quality. It is integrated into all practical software development methodologies and plays a crucial role towards the success of any software project. From the smallest units of code to the most complex components and their integration into a software system and later deployment; all pieces of a software product must be tested thoroughly before a software product can be released. The main limitation of software testing is that it remains a mostly manual task, representing a large fraction of the total development cost. In this scenario, test automation is paramount to alleviate such high costs. Test case generation (TCG) is the process of automatically generating test inputs that achieve high coverage of the system under test. Among a wide variety of approaches to TCG, this thesis focuses on structural (white-box) TCG, where one of the most successful enabling techniques is symbolic execution. In symbolic execution, the program under test is executed with its input arguments being symbolic expressions rather than concrete values. This thesis relies on a previously developed constraint-based TCG framework for imperative object-oriented programs (e.g., Java), in which the imperative program under test is first translated into an equivalent constraint logic program, and then such translated program is symbolically executed by relying on standard evaluation mechanisms of Constraint Logic Programming (CLP), extended with special treatment for dynamically allocated data structures. Improving the scalability and efficiency of symbolic execution constitutes a major challenge. It is well known that symbolic execution quickly becomes impractical due to the large number of paths that must be explored and the size of the constraints that must be handled. Moreover, symbolic execution-based TCG tends to produce an unnecessarily large number of test cases when applied to medium or large programs. The contributions of this dissertation can be summarized as follows. (1) A compositional approach to CLP-based TCG is developed which overcomes the inter-procedural path explosion by separately analyzing each component (method) in a program under test, stowing the results as method summaries and incrementally reusing them to obtain whole-program results. A similar compositional strategy that relies on program specialization is also developed for the state-of-the-art symbolic execution tool Symbolic PathFinder (SPF). (2) Resource-driven TCG is proposed as a methodology to use resource consumption information to drive symbolic execution towards those parts of the program under test that comply with a user-provided resource policy, avoiding the exploration of those parts of the program that violate such policy. (3) A generic methodology to guide symbolic execution towards the most interesting parts of a program is proposed, which uses abstractions as oracles to steer symbolic execution through those parts of the program under test that interest the programmer/tester most. (4) A new heap-constraint solver is proposed, which efficiently handles heap-related constraints and aliasing of references during symbolic execution and greatly outperforms the state-of-the-art standard technique known as lazy initialization. (5) All techniques above have been implemented in the PET system (and some of them in the SPF tool). Experimental evaluation has confirmed that they considerably help towards a more scalable and efficient symbolic execution and TCG.

Code assessment and modelling for Design Basis Accident Analysis of the European sodium fast reactor design. Part I: System description, modelling and benchmarking

The new reactor concepts proposed in the Generation IV International Forum (GIF) are conceived to improve the use of natural resources, reduce the amount of high-level radioactive waste and excel in their reliability and safe operation. Among these novel designs sodium fast reactors (SFRs) stand out due to their technological feasibility as demonstrated in several countries during the last decades. As part of the contribution of EURATOM to GIF the CP-ESFR is a collaborative project with the objective, among others, to perform extensive analysis on safety issues involving renewed SFR demonstrator designs. The verification of computational tools able to simulate the plant behaviour under postulated accidental conditions by code-to-code comparison was identified as a key point to ensure reactor safety. In this line, several organizations employed coupled neutronic and thermal-hydraulic system codes able to simulate complex and specific phenomena involving multi-physics studies adapted to this particular fast reactor technology. In the “Introduction” of this paper the framework of this study is discussed, the second section describes the envisaged plant design and the commonly agreed upon modelling guidelines. The third section presents a comparative analysis of the calculations performed by each organisation applying their models and codes to a common agreed transient with the objective to harmonize the models as well as validating the implementation of all relevant physical phenomena in the different system codes.

Code assessment and modelling for Design Basis Accident analysis of the European Sodium Fast Reactor design. Part II: Optimised core and representative transients analysis

The new reactor concepts proposed in the Generation IV International Forum require the development and validation of computational tools able to assess their safety performance. In the first part of this paper the models of the ESFR design developed by several organisations in the framework of the CP-ESFR project were presented and their reliability validated via a benchmarking exercise. This second part of the paper includes the application of those tools for the analysis of design basis accident (DBC) scenarios of the reference design. Further, this paper also introduces the main features of the core optimisation process carried out within the project with the objective to enhance the core safety performance through the reduction of the positive coolant density reactivity effect. The influence of this optimised core design on the reactor safety performance during the previously analysed transients is also discussed. The conclusion provides an overview of the work performed by the partners involved in the project towards the development and enhancement of computational tools specifically tailored to the evaluation of the safety performance of the Generation IV innovative nuclear reactor designs.

A code for direct numerical simulation of turbulent boundary layers at high Reynolds numbers in BG/P supercomputers

A new high-resolution code for the direct numerical simulation of a zero pressure gradient turbulent boundary layers over a flat plate has been developed. Its purpose is to simulate a wide range of Reynolds numbers from Reθ = 300 to 6800 while showing a linear weak scaling up to 32,768 cores in the BG/P architecture. Special attention has been paid to the generation of proper inflow boundary conditions. The results are in good agreement with existing numerical and experimental data sets.

Particle Swarm Optimization Based Reactive Power Dispatch for Power Networks with Distributed Generation

Reactive power is critical to the operation of the power networks on both safety aspects and economic aspects. Unreasonable distribution of the reactive power would severely affect the power quality of the power networks and increases the transmission loss. Currently, the most economical and practical approach to minimizing the real power loss remains using reactive power dispatch method. Reactive power dispatch problem is nonlinear and has both equality constraints and inequality constraints. In this thesis, PSO algorithm and MATPOWER 5.1 toolbox are applied to solve the reactive power dispatch problem. PSO is a global optimization technique that is equipped with excellent searching capability. The biggest advantage of PSO is that the efficiency of PSO is less sensitive to the complexity of the objective function. MATPOWER 5.1 is an open source MATLAB toolbox focusing on solving the power flow problems. The benefit of MATPOWER is that its code can be easily used and modified. The proposed method in this thesis minimizes the real power loss in a practical power system and determines the optimal placement of a new installed DG. IEEE 14 bus system is used to evaluate the performance. Test results show the effectiveness of the proposed method.

Onsite Wastewater Model Performance Code Implementation Plan

As the population of Colorado continues to grow, the impacts from individual sewage disposal systems, or onsite wastewater systems (OWS), are becoming more apparent. Increased use of OWS impacts not only water quality but land use and development as well. These impacts have led to the need for a new generation of wastewater regulations in the state, a transition from the historic prescriptive requirements to a more progressive, performance-based system. A performance-based system will allow smarter growth, improved water quality, and cost savings for both the regulatory agencies and the OWS industry in Colorado. This project outlines the challenges and essential elements required to make this transition, and provides guidance on how to meet the challenges and overcome barriers to implementing a performance code in Colorado.

Human factors design of automated highway systems: first generation scenarios. Final report.

Federal Highway Administration, Office of Safety and Traffic Operations Research and Development, McLean, Va.

An experimental and analytical investigation of the vibration noise generation mechanism in truck tires. Interim report.

National Highway Traffic Safety Administration, Office of Heavy Duty Vehicle Research, Washington, D.C.

UTCS - functional description - enhanced first generation software.

Federal Highway Administration, Implementation Division, Washington, D.C.

Innovative concepts and technology for railroad-highway grade crossing motorist warning systems. Vol. I: overview and concept generation and analysis. Final report.

Transportation Systems Center, Cambridge, Mass.