DID FinderBack
Source
DI-NUOR-82402

Nuclear Safety Software Verification Plan

The Nuclear Safety Software Verification Plan describes the purpose, methods, and procedures used by the Independent Verification Organization to perform nuclear safety design certification verification of nuclear weapon system software.

Approval DateFebruary 3, 2023
AMSC NumberF10377
Preparing Activity37 (AFSEC/SEWN)
Project NumberNUOR-2022-002
OPR—
DTIC ApplicableNo
GIDEP ApplicableNo
Limitation—
Applicable Forms—
Approval Limitation—
Form Version—
DID Formatfree_text
963C CompliantYes
DISTRIBUTION STATEMENT A: Approved for public release; distribution is unlimited.
Supersedes
—
Related
—

Description & Purpose

—

Application & Interrelationship

—

Use & Relationship

The Nuclear Safety Software Verification Plan (NSSVP) describes the purpose, methods, and procedures for the verification effort performed by the Independent Verification Organization (IVO) as part of Nuclear Safety Design Certification (NSDC). Headquarters Air Force Safety Center Nuclear Weapons Safety Branch (AFSEC/SEWN) provides NSDC to system program offices for specific nuclear weapon systems and nuclear weapon system modifications.

The NSSVP is described in Chapter 4 of Department of the Air Force Manual (DAFMAN) 91-119, Safety Design and Evaluation Criteria for Nuclear Weapon Systems Software. DAFMAN 91-119 implements Department of the Air Force Instruction (DAFI) 91-101, Air Force Nuclear Weapons Surety Program. DAFI 91-101 explains the process for NSDC. Both DAFMAN 91-119 and DAFI 91-101 are available without restriction on the Air Force E-Publishing website, https://www.e-publishing.af.mil/.

a. This DID is applicable to the acquisition of software for nuclear weapon systems that must be nuclear safety design certified per DAFI 91-101. Per Chapter 2 of DAFMAN 91-119, software is "...application software that executes sequentially and reconfigurable logic implementations that use a hardware description language for development."

b. Information required to implement this DID is defined in DAFMAN 91-119 and DAFI 91-101. This information includes procedures and plans to assure independence between the Development Organization (DO) and the IVO, compensatory measures to account for concerns in that independence, methods and procedures used to perform the verification effort, Nuclear Safety Objectives (NSO) and Nuclear Safety Requirements (NSR), and traceability between NSOs, NSRs, DAFMAN 91-119 requirements, and verification procedures, tools, and methodologies.

c. This DID contains the content and intended use information for the data deliverable resulting from the work task described in the solicitation and defined in Chapter 4 of DAFMAN 91-119.

d. The U.S. Navy is excluded from requirements set forth in this DID.

Preparation Instructions

1Reference documents.The applicable issue of the documents cited herein, including their approval dates and dates of any applicable amendments, notices, and revisions, shall be as specified in the contract.
2Format.The NSSVP shall be in contractor's format. If the contractor chooses to provide the NSSVP as a website, the contractor shall provide a static snapshot of the complete website that can be viewed locally.
2.1The NSSVP is not limited in lengthThe NSSVP is not limited in length but is limited in scope per the Content portion of this DID. If the IVO does not provide the completed NSSVP to AFSEC/SEWN before the IVO performs the finalized verification activities, AFSEC/SEWN may not accept the results of the verification activities.
2.2The items described within the Content portionThe items described within the Content portion of this DID do not need to be in the same document. The contractor may separate the NSSVP into multiple cohesive documents for ease of delivery, particularly the verification procedures described in 3.9. The contractor may make the sections available to AFSEC/SEWN for review as the contractor completes the sections.
2.3Table 4.1 of DAFMAN 91-119Table 4.1 of DAFMAN 91-119 provides additional information on expected content for the NSSVP, but the IVO should not treat information in Table 4.1 as a requirement.
2.4The NSSVP shall meet all requirementsThe NSSVP shall meet all requirements for NSSVPs found in DAFMAN 91-119. This includes restrictions found in DAFMAN 91-119 that the IVO cannot share the NSSVP with the DO without permission of AFSEC/SEWN.
3Content.The NSSVP shall only contain the information relevant to NSDC of the software as described in DAFMAN 91-119 and DAFI 91-101. In particular, the NSSVP shall not contain information for the development of Weapon System Safety Rules.
3.1If the NSSVP is separated into multiple documentsIf the NSSVP is separated into multiple documents to ease delivery as described in 2.2 of this DID, the NSSVP shall include an overview of the internal layout of the document. If the NSSVP is a static snapshot of a website, the overview can be a sitemap.
3.2The NSSVP shall define the nuclear weapon systemThe NSSVP shall define the nuclear weapon system that the IVO contractor is verifying as listed in 3.2.1 through 3.2.3.
3.2.1Short description of the nuclear weapon system.
3.2.2Breakdown of the nuclear weapon system into componentsfocusing on the software components. The IVO may include the Critical Signal Analysis as defined in Chapter 3 of DAFMAN 91-119 if that inclusion simplifies the definition of software components.
3.2.3Type of verification for each software componenteither Nuclear Safety Cross-Check Analysis (NSCCA) or Nuclear Safety Analysis and Technical Evaluation (NSATE).
3.3The NSSVP shall define the IVOThe NSSVP shall define the IVO, including general organization of the team and the parent organization(s) of the IVO, including all contractors that are performing verification efforts specifically for the nuclear weapon system. The NSSVP shall duplicate 3.3 and 3.4 of this DID for each organization included in the IVO. The IVO includes any organization that performs work specifically for NSDC software verification of the system described in 3.2 of this DID.
3.4The NSSVP shall define the DOThe NSSVP shall define the DO and explain connections and potential independence issues between the DO and the IVO by answering the questions listed in 3.4.1 through 3.4.3 of this DID.
3.4.1Managerial Independence.
3.4.1.1Are the DO and IVO separate organizations?If not, at what level of management is the management chain common?
3.4.1.2Are there any conflicts of interest between the management team of the DO and the management team of the IVO?
3.4.1.3If there are Managerial Independence concerns, what compensatory measures will the IVO take to ensure full Managerial Independence?
3.4.2Financial Independence.
3.4.2.1Are there any financial incentives for the IVO to be less thorough in their verification process?Does the IVO perform separate work for the DO, as an example?
3.4.2.2If there are Financial Independence concerns, what compensatory measures will the IVO take to ensure full Financial Independence?
3.4.3Technical Independence.
3.4.3.1Are there any situations where the IVO and DO must share resources, including facilities, lab equipment, or personnel such as lab personnel?
3.4.3.2What compensatory measures are in place to ensure Technical Independence when the IVO and the DO share resources?What locations and situations do the compensatory measures cover and are there additional situations that may arise?
3.4.3.3What procedures are in place to ensure that the IVO does not share verification data with the DO?What data do these procedures cover?
3.4.3.4Are there any situations protecting the verification data (processes, procedures, methods, tools, configurations, etc.) from the DO will be difficult for the IVO due to program design or restrictions?
3.4.3.5What compensatory measures are in place to ensure Technical Independence when situations arise that may provide verification data to the DO?
3.4.3.6How will the IVO independently identify, acquire, and develop as necessary the verification suite and development suite components?What components will the IVO need to acquire from the DO? How will the IVO ensure that the software tools acquired from the DO will not affect the outcomes of verification processes?
3.4.3.7What measures are in place to ensure that all members of the IVO sign a non-disclosure agreement stating that the member will not provide any verification data outside of the IVO?
3.4.3.8What general procedures are in place to ensure that the IVO maintains independence from the DO?
3.4.3.9When AFSEC/SEWN requires NSCCA, what procedures are in place to ensure the NSCCA team independently develops their own verification requirements and procedures that focus on identifying sabotage or unintended actions that could violate nuclear safety?
3.5When AFSEC/SEWN requires NSCCAWhen AFSEC/SEWN requires NSCCA, the NSSVP shall describe configuration management systems and security and control measures as listed in 3.5.1 and 3.5.2.
3.5.1Description of the configuration management systems the IVO will use for maintaining software source code, software products, verification tools, and verification proceduresand how the configuration management systems are secure and non-repudiable.
3.5.2Description of the security and control measures in place in the IVO to prevent sabotage of the NSCCA process.The description may reference the contractor standard security processes as well as additional measures that the IVO is taking.
3.6The NSSVP shall describe the development and verification software tools the IVO plans to use during the verification effortboth created and acquired by the IVO, including the information listed in 3.6.1 through 3.6.4. (see Figure 1).
3.6.1Name of software tool.
3.6.2Software tool creator or manufacturer.
3.6.3General description of how the IVO uses the software tool.
3.6.4If the software tool is provided by the DOreference to the information provided in 3.4.3.6 of this DID addressing software tools provided by the DO.
3.7The NSSVP shall describe the NSOs developed by the IVOand how the NSOs trace to DAFMAN 91-119. The definition of NSO is in Chapter 4 of DAFMAN 91-119. (see Figure 2).
3.8The NSSVP shall describe the NSRs developed by the IVOand how the NSRs trace to the NSOs. The definition of NSR is in Chapter 4 of DAFMAN 91-119. (see Figure 3).
3.9The NSSVP shall include a summary of all the verification proceduresthat includes an overview of the procedure and to which NSR the procedure traces. For NSSVPs that include fewer than 10 procedures, this paragraph may be tailored out. (see Figure 4).
3.10The NSSVP shall include the full set of verification procedureswithin the greater document or as a separate attachment. Each procedure shall reference the NSR to which the procedure traces as well as verification type(s) - Test, Demonstration, Inspection, Analysis.
3.11The NSSVP shall include a full traceability analysisflowing from the DAFMAN 91-119 requirements -> NSOs -> NSRs -> Verification procedures and the reverse trace flowing from the Verification procedures -> NSRs -> NSOs -> DAFMAN 91-119 requirements. The traceability analysis shall be easily navigable to ease the search for untraced objects within the analysis. The analysis may be a static snapshot of a website with links showing connections from one level to the next. (see Figure 5 and Figure 6).

References

available without restriction on the Air Force E-Publishing website https://www.e-publishing.af.mil/

Figures

Figure 1: Sample software tool entry.

Figure 1. Sample software tool entry.

Figure 2: Sample NSO entry.

Figure 2. Sample NSO entry.

Figure 3: Sample NSR entry.

Figure 3. Sample NSR entry.

Figure 4: Sample verification procedure summary entry.

Figure 4. Sample verification procedure summary entry.

Figure 5: Sample verification forward trace entry.

Figure 5. Sample verification forward trace entry.

Figure 6: Sample verification reverse trace entry.

Figure 6. Sample verification reverse trace entry.

Schema v3.0Community-maintained · Verify against ASSIST
Community-maintained — not an official government database.
Verify against ASSIST·GitHub·About·Disclaimer