reported suboptimality in Figure 1(a) is obtained after subtracting this
optimal error value from the algorithms’ error, followed by dividing this
excess error with the optimal value.

Experiment 1 (a). As described in the body of the paper, each sub-plot in
Figure 1(a) shows the performance of the different algorithms and their
variants (as discussed above) on logistic regression for getting the best
possible unregularized training loss. We train FedAc on an appropriately
regularized RERM problem on the training set. All other variants minimize an
ERM problem on the dataset. This is achieved through the internal
regularization parameter for FedAc as discussed above. We vary $M$ and $R$
while keeping the parallel runtime $KR$ to be fixed. Our hyperparameter tuning
and repetitions are similar to the description for experiment 2 above, though
we additionally tune the regularization strength $\lambda$ in the RERM problem
for FedAc. All the algorithms do sampling with replacement on the training
set, and can make multiple passes on the dataset. The optimal training loss is
again obtained using 100 iterations of the Newton method.

Experiment 1 (b). As described in the body of the paper, each sub-plot in
Figure 1(b) shows the performance of the different algorithms and their
variants (as discussed above) on logistic regression for getting the best
possible validation loss. We train FedAc on an appropriately regularized RERM
problem on the training set. All other variants minimize an ERM problem on the
training set. This is achieved through the internal regularization parameter
for FedAc as discussed above. We vary $M$ and $R$ while keeping the parallel
runtime $KR$ to be fixed. Our hyperparameter tuning and repetitions are
similar to the description for experiment 2 above, though we additionally tune
the regularization strength $\lambda$ in the RERM problem for FedAc. We use
the same split of training and validation datasets across the multiple
repetitions. All the algorithms do sampling without replacement on the
training set, and can make at most one pass on the dataset.

Hardware details. All the experiments were performed on a personal computer,
Dell XPS 7390. The total compute time (CPU) on the machine was about $200$
hours. No GPUs were used in any of the experiments in this paper.

###  E.3 Computational cost of a Hessian-vector product oracle

Consider minimizing the function $F(x)=\mathbb{E}_{z}[f(x;z)]$ given access to
various stochastic oracles. Note that FedAc, Minibatch SGD, and Local SGD are
all first-order algorithms, in that they use a first-order stochastic oracle.
Thus, each time they observe a stochastic gradient (as per Assumption 1), the
oracle uses a single unit of randomness (e.g., a single data point, when
thinking in terms of a finite training dataset).

In contrast, our main theoretical method FedSN proceeds via two possible
options: for Case 1 as established in Algorithm 4, the algorithm queries both
a stochastic gradient and a stochastic Hessian-vector product oracle at two
independent samples, while in Case 2, we consider a different setting which
allows the algorithm to observe, for any $x,u$, both a stochastic gradient and
stochastic Hessian-vector product using the _same_ random sample $z$. We may
note that the final theoretical guarantee for Case 1 differs by only a small
constant factor from that of Case 2, and our results as presented in Theorem 1
apply to both cases.

Thus, in order to maintain a fair comparison between these first-order methods
and our practical method FedSN-Lite, we have implemented FedSN-Lite so that it
also uses a single random sample (single data point), as outlined via Case 2
(Same-Sample) in Algorithm 4.

In addition to keeping the number of samples consistent, it is important to
understand how both oracle models compare computationally. Clearly every
oracle call for FedSN-Lite is at least as expensive as a first-order
stochastic oracle, as it subsumes the latter. Moreover, it is unclear a priori
if the Hessian-vector product can be computed efficiently (say, in as much
time as vector addition or multiplication). However, it turns out that the
Hessian-vector product for logistic regression can be efficiently computed,
since the Hessian matrix for a given sample is actually rank one (i.e., an
outer product of known vectors). This is generally true for loss functions
which belong to the family of generalized linear models. To see this, note
that for loss functions of the form
$F(x)=\sum_{i=1}^{N}\phi(b_{i}x^{\top}a_{i})$, we have by a simple calculation
that

$\nabla_{x}F(x)=\sum_{i=1}^{N}\phi^{\prime}(b_{i}x^{\top}a_{i})b_{i}\cdot
a_{i}\quad\textrm{and}\quad\nabla_{x}^{2}F(x):=\nabla_{x}(\nabla_{x}F(x))=\sum_{i=1}^{N}\phi^{\prime\prime}(b_{i}x^{\top}a_{i})b_{i}^{2}\cdot
a_{i}a_{i}^{\top},$

and so for any $v\in\mathbb{R}^{d}$,

$\nabla_{x}^{2}F(x)v=\sum_{i=1}^{N}\phi^{\prime\prime}(b_{i}x^{\top}a_{i})b_{i}^{2}\cdot
a_{i}\cdot(a_{i}^{\top}v),$

which means each summand can be calculated in $\mathcal{O}(d)$ time. When
maximizing the log-likelihood in the logistic regression model with labels in
$\\{-1,1\\}$, we need to minimize the following function,

$F(x)=\sum_{i=1}^{N}\left(-b_{i}x^{\top}a_{i}+\ln\left(1+\exp\left(b_{i}x^{\top}a_{i}\right)\right)\right),$

which is an instance of the generalized linear models as considered above.
Thus, in terms of vector operations, the Hessian-vector product oracle and the
stochastic gradient oracle are asymptotically similar in the logistic
regression model. We also note that for a general class of differentiable
functions, Pearlmutter (1994) provides a technique to compute the Hessian-
vector product using two passes of backpropagation (in the context of neural
networks). For instance, we may consider a twice-differentiable function
$F:\mathbb{R}^{d}\mapsto\mathbb{R}$ and note that for a vector
$v\in\mathbb{R}^{d}$,

$\displaystyle\nabla^{2}_{x}F(x)v=\nabla_{x}\left(\nabla_{x}F(x)^{\top}v\right),$

which can be obtained using two passes of backpropagation.

For the scale of our problem, it turns out that the difference in the number
of vector operations is outweighed by other implementational overhead (for,
e.g., loops, memory operations, etc.). In Table 4 we show the average per-step
runtimes (over $250$ runs) for three different algorithms for
$M=1,R=1,K=100000$.

Algorithm |  Avg. Runtime/Step (in $10^{-5}$ sec.) |  Std. Dev. of Runtime/Step (in $10^{-5}$ sec.)
---|---|---
FedSN-Lite | 6.67 | 1.42
Local SGD | 6.39 | 1.37
FedAc | 7.48 | 1.58
Table 4: Comparing the wall-clock runtimes of different algorithms in our
implementation. We run every repetition of each algorithm as an individual
job, so that the runs are independent, i.e., we don’t introduce extraneous
biases for any one algorithm (e.g., thermal throttling affecting the runtimes
for a single algorithm). We run each algorithm $1700$ times so that the $95\%$
error margins for the average runtime/step estimate are within $1\%$ of its
value. Specifically, we calculate the empirical standard deviation $\sigma$ of
our average runtime/step estimate $\bar{x}$ by running it for $n=1700$ runs.
Then we report the error margin $\delta=z\sigma/\sqrt{n}$, where $z=1.96$, is
the z*-value from the standard normal distribution for a $95\%$ confidence
level. We ensure that $n=1700$ is large enough, so that $\delta/\bar{x}\leq
0.01$. Finally we round $\bar{x}$ to two significant digits, respecting the
$1\%$ error margin. We also report the standard deviation estimate of the
runtime/step so that its $95\%$ error margins are within $4\%$ of its value.

###  E.4 Additional experiments

In this section we present more comprehensive versions of the experiments
presented in Section 5.

Figure 3: The same experiment as in fig. 1(a) but with a broader range of
values of $M,\mu$. All optimization runs were repeated $70$ times. Figure 4:
The same experiment as in fig. 1(b) but with a broader range of values of
$M,\mu$. All optimization runs were repeated $20$ times. Figure 5: The same
experiment as in fig. 2 but with a broader range of values of $M,\mu$. All
optimization runs were repeated $70$ times. Figure 6: The same experiment as
in fig. 2 with $T=1000$ and a broader range of values of $M,\mu$. All
optimization runs were repeated $20$ times.


# Anticipating Accidents through Reasoned Simulation

Craig Innes  School of Informatics, University of EdinburghEdinburghScotlandUK
,  Andrew Ireland  School of Mathematical and Computer Sciences, Heriot-Watt
University1 Thørväld CircleEdinburghScotlandUK ,  Yuhui Lin  School of
Mathematical and Computer Sciences, Heriot-Watt University1 Thørväld
CircleEdinburghScotlandUK and  Subramanian Ramamoorthy  School of Informatics,
University of EdinburghEdinburghScotlandUK

(2023)

###### Abstract.

A key goal of the System-Theoretic Process Analysis (STPA) hazard analysis
technique is the identification of loss scenarios – causal factors that could
potentially lead to an accident. We propose an approach that aims to assist
engineers in identifying potential loss scenarios that are associated with
flawed assumptions about a system’s intended operational environment. Our
approach combines aspects of STPA with formal modelling and simulation.
Currently, we are at a proof-of-concept stage and illustrate the approach
using a case study based upon a simple car door locking system. In terms of
the formal modelling, we use Extended Logic Programming (ELP) and on the
simulation side, we use the CARLA simulator for autonomous driving. We make
use of the problem frames approach to requirements engineering to bridge
between the informal aspects of STPA and our formal modelling.

Autonomous systems, Hazard analysis, Formal modelling, Simulation.

††journalyear: 2023††copyright: rightsretained††conference: First
International Symposium on Trustworthy Autonomous Systems; July 11–12, 2023;
Edinburgh, United Kingdom††booktitle: First International Symposium on
Trustworthy Autonomous Systems (TAS ’23), July 11–12, 2023, Edinburgh, United
Kingdom††doi: 10.1145/3597512.3599698††isbn: 979-8-4007-0734-6/23/07††ccs:
Theory of computation Logic and verification††ccs: Theory of computation
Automated reasoning††ccs: Computing methodologies Model verification and
validation

##  1\. Introduction

System-Theoretic Process Analysis (STPA) (Leveson, 2016) extends traditional
hazard analysis techniques to include a range of causal factors that can
affect system safety. A key goal of STPA is the identification of causal
factors that give rise to unsafe control actions, which in turn could lead to
hazards and ultimately an accident –- what Nancy Leveson calls a loss
scenario.

While STPA is systematic, it represents a relatively informal style of
analysis. As a consequence, STPA provides no mechanized support to prevent
errors such as inconsistencies and invalid assumptions entering into the
analysis. Given that loss scenarios often arise because of invalid environment
assumptions (Leveson, 2016), we believe that mechanized support for STPA is
well motivated111 Such flaws can occur at design-time but can also arise as a
consequence of changes to a system’s operational environment..

s We propose a mechanized approach that uses formal modelling to verify the
consistency between safety related constraints and assumptions. Such a
verification relies upon the validity of the safety assumptions. To check
validity we use simulation. Specifically, we search for environment conditions
under which the safety assumptions are violated. Such violations represent
loss scenarios. So while formal modelling ensures consistency of the analysis,
we rely upon simulation to identify the concrete loss scenarios.

Our proposed approach is at the proof-of-concept stage. We illustrate it using
a case study based upon a simple car door locking system. To bridge between
STPA and formal modelling we use the notion of a problem frame (Jackson, 2001)
combined with Extended Logic Programming (ELP) (Gelfond and Lifschitz, 1991),
while on the simulation side, we use the CARLA (Car Learning to Act) simulator
(Dosovitskiy et al., 2017) for autonomous driving. In section 2, we provide
background on STPA and the aspects of ELP and problem frames that we make use
of in this paper. We also provide an overview of the CARLA simulator and the
features that we rely upon in this paper.

##  2\. Background

We follow the 4-step description of STPA given in (Ladkin, [n.d.]). The first
step involves identifying the potential losses (L), system-level hazards (H)
and system-level constraints (SC). A hazard denotes a system state coupled
with environmental conditions that lead to a potential loss. The role of the
system-level constraints is to guard against the identified hazards from
occurring. Step 2 focuses on the achievement of the system-level constraints.
First, it involves defining a control structure – a diagrammatic description
of a system’s controllers and controlled processes, together with how they
interact, i.e., control actions and feedback. Second, the responsibilities for
each controller are defined, where a responsibility (R) represents a
refinement of a system-level constraint. Each responsibility is identified
with part of a controller’s process model and control logic, which are
informed by feedback from the processes that it controls. Finally, a control
action is associated with each responsibility. Step 3 identifies how
inadequate control could lead to a hazard by considering the following cases:

  1. (1)

A control action that when not applied causes a hazard.

  2. (2)

A control action that when applied causes a hazard.

  3. (3)

A control action that when applied too early, too late or out of sequence
causes a hazard.

  4. (4)

A control action that is stopped too soon or applied too long causes a hazard.

Note that the final case is applicable to non-discrete control actions. For
each unsafe control action, a corresponding control constraint is defined,
which specifies a property that must be satisfied in order to prevent the
controller exhibiting the unsafe control actions. Figure 1 summarises the
first 3-steps of STPA. Despite design-level verification, the fourth step
focuses on identifying how unsafe control actions could occur and lead to the
violation of system-level constraints. As noted above, these are referred to
as loss scenarios. In (Leveson, 2016), the process of identifying a loss
scenario is described as ‘the usual “magic” one that creates the contents of a
fault tree.’ There are many ways in which unsafe control actions could occur.
In section 4.4, we focus on flawed assumptions as the source of loss
scenarios.

> The diagram above shows the first 3 steps of the STPA hazard analysis
> process – from the definition of losses and hazards through to defining
> control actions and identifying how unsafe control actions can lead to
> hazards. Step 4, which is not shown in the diagram, focuses on the
> identification of loss scenarios (see section 4.4).

Figure 1. Summary of steps 1-3 of STPA.

As mentioned above, we use the notion of a problem frame (Jackson, 2001) to
bridge between the informal and the formal. A problem frame provides a way of
verifying the consistency between a system-wide requirement (i.e., system-
level constraint) and the specification of a software component (i.e., control
constraint). The problem frame representation has both graphical and logical
elements. Substituting the STPA control structure with a problem frame
involves formalizing the domain assumptions associated with the system and its
operational environment. An informal verification is represented by means of
an informal argument diagram (Seater et al., 2007) which will be illustrated
in sections 4.3 and 4.4

In terms of formal logic, the problem frames approach is relatively agnostic.
Our case study is quite simple, so we opt for classical propositional logic –
specifically we use Extended Logic Programming (ELP) (Gelfond and Lifschitz,
1991). As a consequence, we ignore delays between observations and actions.
More expressive formalisms could be used. ELP represents an extension of logic
programming, e.g., Prolog (Giannesini et al., 1986; Clocksin and Mellish,
2003). Logic programming is a declarative programming paradigm that is based
upon formal logic. A program is defined in terms of a collection of clauses,
where a clause is either a fact or a rule. This clausal form, which is a
subset of first-order logic, takes the following general form:

(1) $L\verb+:-+\,A_{1},\;\ldots\;A_{m},\;not\;B_{1},\;\ldots\;not\;B_{n}$

where $A_{i}$ is a positive predicate and $B_{j}$ is a negated one. Program
execution is based upon the resolution inference mechanism. From a reasoning
perspective, logic programming is non-monotonic. That is, the fact that
$\Gamma\vdash C$ holds does not guarantee that $\Gamma,A\vdash C$ also holds.
This is because negation (i.e., $not$) is evaluated by a non-monotonic rule
called negation-as-failure (a form of the closed-world assumption). This means
that if a statement cannot be derived then it is assumed to be false. ELP
extends logic programming with a classical (or explicit) form of negation.
While $not\;P$ denotes negation-as-failure, $-P$ denotes classical negation.
To conclude $-P$ it is not sufficient to have failed to derive $P$; explicit
evidence for the negation of $P$ is required.

Formal modelling is suited to relatively abstract models where the state space
is small and can be exhaustively explored. In contrast, simulation allows one
to selectively explore large state spaces. In terms of simulations, we have
used CARLA (Dosovitskiy et al., 2017), which is a simulation platform for
testing the performance of automated vehicle systems. It provides a rich set
of features for capturing the many complex interactions between the many
integrated modules within a modern Autonomous Vehicle (AV) pipeline. In terms
of physical dynamics and control, CARLA can simulate vehicles that are
affected by a highly granular set of parameters. This can be as broad as
overall mass, all the way down to gear ratio, drag coefficient of the chassis,
tyre friction, and wheel stiffness. Also, CARLA provides libraries, e.g.,
Python API, to specify/program scenarios for both local control and global
route planning of large numbers of vehicles on the road simultaneously. A
simulator provides a way to efficiently generate many thousands of example
rollouts/scenarios of the AV system given a user-specified starting
specification. So, while symbolic domain knowledge may provide heuristics
about which configuration parameters are likely to be relevant to safety,
testing variants of those parameters out in simulation allows us to see how
they affect behaviour in practice, and thus search for falsifying examples.

##  3\. Related work

As illustrated above, the problem frame approach provides a technique for
verifying the correctness of a system-wide requirement with respect to a
specification and domain assumptions. In (Seater et al., 2007) Alloy (Jackson,
2012) is used to formalize and verify problem frame instances. Alloy uses
first-order relational logic. Moreover, they use a technique called
requirements progression to mechanically derive a specification from a given
system-wide requirement and its associated domain assumptions. Here this would
correspond to deriving control constraints from the system-level constraints
and associated domain assumptions. In section 4.4, we use the notion of an
anti-system-level constraint. This is similar to the notion of an anti-
requirement introduced in (Lin et al., 2003) to represent the intentions of a
malicious user.

As a logic-based declarative language, ELP has been used as a formal modelling
and problem-solving tool. ELP is supported by a knowledge representation and
reasoning framework called Answer Set Programming (ASP) (Marek and
Truszczyński, 1999; Gebser et al., 2012). ASP has been applied to decision-
making, planning, diagnostic reasoning and configuration optimisation, e.g.,
decision support systems (Nogueira et al., 2001), configuration optimisation
in railway safety systems (Aschinger et al., 2011), action planning in the
setting of multiple robot collaboration tasks (Erdem et al., 2012), and
diagnosing failures of an automatic whitelisting system (Brik and Remmel,
2015).

Combining formal reasoning and simulation is explored in (Gelman et al.,
2014), where the SAL model checker is used to guide the use of agent-based
simulation via WMC (Sierhuis and Clancey, 2002) Specifically, the SAL model
checker was used to model a known automation surprise associated with the
Airbus A320 autopilot, which was then subsequently explored via WMC. They
found that WMC provided psychological plausibility to the counterexample
generated by SAL. Moreover, WMC provided multiple refinements to the given SAL
counterexample. With the growth in autonomous systems that rely upon human
interaction, e.g., self-driving cars, then tools that assist in the early
identification of automation surprises will have an important role to play
within the assurance process. The use of formal methods in conjunction with
STPA is not new. In (Howard et al., 2019; Colley and Butler, 2013) a
methodology for incorporating the first three steps of STPA within the Event-B
(Abrial, 2010) formal modelling tool is described. What distinguishes our
proposal is the focus on identifying loss scenarios. Specifically, the use of
formal modelling to identify abstract loss scenarios which are then elaborated
via simulation.

Simulating autonomous vehicle behaviour requires coordinating multiple
related, high-fidelity (computationally expensive) components. This includes
sensor models (e.g., Cameras, Lidar, Radar), multibody vehicle dynamics,
traffic flows, and pedestrian behavioural patterns (Yang et al., 2021). In
particular, such platforms distinguish between simulating the environment
itself, and the environment as seen by the vehicle’s perception systems.
Discrepancies between these views can be dangerous (Hoss et al., 2022). Such
simulators constitute a core component in many verification tasks such as
falsification and failure probability estimation (Corso et al., 2021). AV
Simulators allow us to efficiently replicate a given safety scenario with high
fidelity, but it is impossible to test all possible road scenarios. Thus, the
primary challenge is to identify which scenarios are worth simulating.
Existing approaches to scenario selection involve either hand-crafted
databases of safety-critical situations or data-driven scenario generators
trained on large amounts of passively collected real-world traffic data
(Stellet et al., 2020).

##  4\. Adding Formal Modelling and Simulation to STPA

To illustrate our proposal, we use an automatic car door locking example that
involves a simple interlock mechanism. The example is inspired by Michael
Jackson’s aircraft braking system example (Jackson, [n.d.]), and is strongly
related to an accident involving a fly-by-wire aircraft (Ladkin, 1994). In our
example, we are concerned with ensuring that while a car is moving its doors
should be automatically locked and while the car is stationary, the doors
should be automatically unlocked. The task is to construct a Door Lock Control
Unit (DLCU) that ensures the locking and unlocking of the doors occurs at the
right time. A fundamental design assumption will be that when the car is
moving the wheels will be turning. From the perspective of STPA, the
controlled process involves the locking mechanism for the car’s doors and the
car’s wheel sensors. The DLCU receives feedback in the form of wheel-pulse
signals from the sensors when the wheels are turning. In terms of control, the
DLCU will be able to send lockDoors and unlockDoors signals to the doors.
Below we follow the first three steps of the STPA hazard analysis technique as
described above. We use the following propositions to bridge between the
informal and formal:

WT::

true when car wheels are turning, otherwise false.

DL::

true when car doors are locked, otherwise false.

WP::

true when there exists a wheel-pulse signal, otherwise false.

DS::

true when there exists a door-lock signal, otherwise false.

MV::

true when the car is moving, otherwise false.

MVpm::

true when the process model indicates the car is moving, otherwise false.

More realistically, these definitions would be developed hand-in-hand with the
application of STPA.

###  4.1. Define purpose and scope of the analysis (step 1)

From the perspective of people travelling in a car, clearly, the loss of their
lives or injuries due to safety failings would be personally
catastrophic/devastating. In addition, the manufacturer would experience loss
through the legal consequences of such safety failings, as well as potentially
suffering reputational loss. For the purposes of the example, we will focus
solely on the human perspective, i.e.,

L-1: | loss of life or injury.
---|---

We have associated the following two hazards to L-1:

H-1: |  a passenger opens their door while the car is moving.
---|---
H-2: |  a passenger is unable to open their door while the car is not moving.

H-1 may result in a person falling from a moving car leading to loss of life
or injury, while H-2 may prevent a person from leaving a stationary car when
their safety is in jeopardy, e.g., the car is on fire. Following STPA, each
hazard should be associated with a system-level constraint, i.e.

SC-1: |  if the car is moving then the doors must be locked $(MV\Rightarrow\ DL)$. [H-1]
---|---
SC-2: |  if the car is not moving then the doors must be unlocked $(\neg MV\Rightarrow\neg DL)$. [H-2]

Note that composing the above two system-level constraints gives:
SC-3: the car is moving if and only if the doors are locked
$(MV\Leftrightarrow\ DL)$. [H-1, H-2] Note that we will use SC-3 for the
purposes of verification and the identification of loss scenarios.

###  4.2. Model the control structure (step 2)

As noted in section 2, we use the notation of a problem frame rather than a
control structure in order to bridge between the informal and the formal.
Figure 2 provides a problem frame for DLCU. Note that the problem frame makes
explicit the domain assumptions and shared phenomena that logically link the
system-level constraint with the control constraint. Note in particular that
the design assumption that the movement of the car is equivalent to its wheels
turning is explicitly represented.

> The above problem frame contains 3 domains, i.e., DLCU, Car and Road, where
> the Car domain has 2 subdomains, Wheels and Doors. The Road domain captures
> a key design assumption, i.e., $(WT\Leftrightarrow MV)$. Domains interact
> via shared phenomena, e.g., DLCU and Wheels share wheel-pulse signals (WP).
> The DLCU is a special domain; it represents the software controller, where
> its intended behaviour is specified via the control constraint CC-3. The
> dashed ellipse denotes the required system-level constraint, i.e., SC-3. The
> dashed lines indicate that the system-level constraint relates to the Road
> and Doors domains.

Figure 2. A Problem Frame for DLCU.

In terms of responsibilities, DLCU has two; each represents a refinement of a
system-level constraint, i.e.

R-1: | enable door locks when the car is moving. [SC-1]
---|---
R-2: | disable door locks when the car is not moving. [SC-2]

As described in section 2, each responsibility is associated with elements of
a controller’s process model and control logic. These associations for DLCU
are given below. They include both the STPA informal descriptions as well as a
logical counterpart:

Responsibility: |  R-1
---|---
Process model: |  the car is moving ($MV_{pm}$).
Control logic: |  if wheel-pulse signal then process model indicates car is moving $(WP\Rightarrow\ \mbox{MV${}_{\\!\\!pm}$})$.
|  if process model indicates car is moving then lockDoors control action is
applied $(\mbox{MV${}_{\\!\\!pm}$}\Rightarrow\ DS)$.
Feedback: |  wheel-pulse signal (WP).

Responsibility: |  R-2
---|---
Process model: |  the car is not moving ($\neg\mbox{MV${}_{\\!\\!pm}$}$).
Control logic: |  if no wheel-pulse signal then process model indicates the car is not moving $(\neg WP\Rightarrow\neg\mbox{MV${}_{\\!\\!pm}$})$.
|  if process model indicates car is not moving then unlockDoors control
action is applied
|  $(\neg\mbox{MV${}_{\\!\\!pm}$}\Rightarrow\neg DS)$.
Feedback: |  no wheel-pulse signal $(\neg WP)$.

The final part of step 2 involves defining the control actions that are
intended to achieve a controller’s responsibilities. In the case of DLCU there
are two:

CA-1: |  lockDoors (when door-lock signal then DS is true). [R-1]
---|---
CA-2: |  unlockDoors (when no door-lock signal $\neg DS$ is true). [R-2]

###  4.3. Identifying unsafe control actions (step 3)

A STPA style hazard analysis for the two control actions associated with DLCU
is shown in Table 1. From the hazard analysis control constraints can be
derived. The hazard analysis gives rise to the following two control
constraints:
CC-1: if wheel-pulse feedback then door-lock signal $(WP\Rightarrow\ DS)$.
[CA-1] CC-2: if no wheel-pulse feedback then no door-lock signal $(\neg
WP\Rightarrow\neg DS)$. [CA-2]

Control | Not applied | Applied | Applied too early, | Stopped too soon
---|---|---|---|---
action | causes a hazard | causes a hazard | too late or out of | or applied too long
|  |  | sequence causes a hazard | causes a hazard
lockDoors | Doors not locked | Doors locked when | Doors locked too late | N/A
(CA-1) | when car moving (H1) | car stationary (H2) | (H1) |
unlockDoors | Doors locked when | Doors unlocked | Doors unlocked too soon | N/A
(CA-2) | car stationary (H2) | when car moving (H1) | (H1) |
Table 1. Identifying Hazardous System Behaviour for DLCU.

Note that composing the above two control constraints gives:  CC-3: wheel-
pulse feedback if and only if door-lock signal $(WP\Leftrightarrow\ DS)$.
[CA-1, CA-2]

The STPA Handbook emphasizes the need for verification, i.e.

> “STPA generates the safety requirements (e.g., SC-3) and constraints for the
> automated control algorithm (e.g., CC-3). These must, of course, be verified
> to be correct.”

As mentioned above in section 2, problem frames allow us to informally and
formally verify the consistency between control constraints and system-level
constraints. With regards to the consistency of CC-3 and SC-3, Figure 3
provides an informal argument diagram, as well as a sequent style proof tree
representation and our ELP representation.

> Clauses C1 and C2 define how SC-3 can be violated. Note that the
> satisfaction of –dl and –mv requires explicit evidence for the negated
> propositions, i.e. failure to satisfy dl and mv is not sufficient to
> conclude that their negations hold. Clause C3 defines an explicit violation
> in terms of the failure satisfy violation. Clause C4 encodes the top-level
> proof: explicit evidence that there are no violation implies SC-3 it true.
> The Extended Logic Programming demos are available at (Paper resource,
> 2023a).

Figure 3. Proving consistency between CC-3 and SC-3.

###  4.4. Identifying loss scenarios (step 4)

As mentioned in section 2, we focus here on how loss scenarios could occur as
a result of flawed assumptions. Specifically, we will focus on assumptions
relating the environment in which a controller (i.e., DLCU) operates. Recall
that a loss scenario results in the violation of a system-level constraint. In
the case of our car example, the following proposition is equivalent to the
violation of system-level constraint SC-3:

(2) $\displaystyle\left(MV\ \land\ \lnot DL\right)\vee\left(\lnot MV\ \land\
DL\right)$

Note that the left disjunct of (2) relates to H-1, a passenger opens their
door while the car is moving, while the right disjunction relates to H-2, a
passenger is unable to open their door while the car in stationary. Here we
focus on the left disjunct, i.e.

(3) $\displaystyle\left(MV\ \land\ \lnot DL\right)$

The verification proof given in Figure 3 relies upon three assumptions. The
violation of each assumption gives rise to a distinct loss scenario that
satisfies (3). Two of the scenarios correspond to component accidents, i.e., a
wheel-pulse signal failure and a door-lock signal failure. Below we focus on
the third assumption, i.e.

(4) $\displaystyle\left(WT\ \Leftrightarrow\ MV\right)$

Specifically, we consider the case where (4) is replaced by:

(5) $\displaystyle\left(WT\ \Rightarrow\ MV\right)\ \land\ \lnot\left(MV\
\Rightarrow\ WT\right)$

This violation of (4) gives rise to a loss scenario where the car wheels are
not turning but the car is moving, i.e.

(6) $\displaystyle\left(\lnot WT\ \land\ MV\right)$

> The consequences of violating the design assumption, i.e.,
> $\left(WT\Leftrightarrow MV\right)$, are shown above. Firstly, the informal
> argument diagram shows where the verification proof breaks. Secondly, the
> violation is represented as a sequent proof. Lastly, the ELP formulation of
> the violation is given.

Figure 4. A violation of the consistency between CC-3 and SC-3.

As shown in Figure 4, replacing assumption (4) by (5) (within the Road domain)
breaks the verification proof given in Figure 3. In Figure 5, we present an
alternative formal model of the loss scenario. We replace SC-3 by an anti-
system-level constraint, i.e., anti-SC-3. While a system-level constraint
specifies, ‘something bad will never happen’, an anti-system-level constraint
specifies, ‘something bad will happen’. The idea is that a scenario that
achieves an anti-system-level constraint will denote a loss scenario.

> Above the anti-system-level constraint, i.e., $(MV\Rightarrow\neg DL)$, is
> shown to be provable if the original design assumption, i.e.,
> $(WT\Leftrightarrow MV)$, is replaced by $(MV\Rightarrow\neg WT)$. The first
> proof takes the form of an informal argument diagram. In addition, a sequent
> proof is provided along with the corresponding ELP formulation.

Figure 5. Proving consistency between CC-3 and anti-SC-3.

So formal modelling provides a mechanism for generating abstract loss
scenarios. However, it provides no insight into the feasibility of the
generated loss scenarios. We use simulation to provide such insight.
Simulators are rich in terms of their knowledge about real-world phenomenon.
What we propose is to leverage this knowledge in order to elaborate an
abstract loss scenario. In so doing, we are exploiting synergies that exist
between formal modelling and simulation, and providing engineers with more
realistic and accessible loss scenarios to consider.

In our car example, (6) provides the starting point for a simulation. Bridging
the gap between the formal modelling (i.e., ELP) and simulation (i.e., CARLA)
requires mapping the propositions $MV$ and $WT$ onto the corresponding
parameters within the CARLA simulation space. Simply equating $MV$ with the
car’s velocity and WT with wheel speed is not sufficient. That is, it gives a
low-fidelity approximation of the car’s behaviour. CARLA provides various
mechanisms to assist a developer to define a simulation. In terms simulation
parameters, these are classified as follows:

Physics of a vehicle::

includes concepts such as torque, drag and friction.

Traffic behaviour::

predefined behaviours are provided, i.e., cautious, normal, aggressive, but a
developer is free to define the behaviour of the vehicles within their
simulation.

Perception::

weather conditions and the attributes of sensors, e.g., accuracy in poor
lighting.

At the level of physical parameters, the following are relevant to our
example:

  * •

Frictional coefficient of the road surface

  * •

Velocity/acceleration of the vehicle in previous time step

  * •

Tire friction

  * •

Wheel torques

  * •

Wheel speeds

  * •

Engine RPM

  * •

Drag coefficient on the vehicle body

  * •

Normalised latitudinal and longitudinal forces at the wheels

To increase the fidelity of the approximation we explore the 8-dimensional
factors listed above. Here, we combined the guidance provided by the formal
model, i.e., $\neg WT\wedge MV$, and the relevant physical parameters from
CARLA, to construct a potential loss scenario that violates (4). The violation
occurs when the velocity is greater than $0$ and the frictional coefficient of
the road surface changes from $1.0$ to be less than or equal to $0.5$, i.e.
the car is skidding.

Here the mapping was hand-crafted. To fully realize our proposal additional
guidance is required in order to constrain CARLA. That is, we need access to
domain knowledge about how stuff fits together as well as how stuff behaves in
accordance with the laws of physics. For our illustrative example the concept
of friction plays a key role in the loss scenario, i.e. wheel rotation
requires friction between the car’s tyres and the road surface. Such knowledge
could be represented in terms of an ontology.

From the perspective of the case study, our use of CARLA is summarised in
Figure 6. Note that the simulation demo and setup is available via (Paper
resource, 2023b), which includes animations generated by CARLA. In Figure 7, a
snapshot of the CARLA simulation development environment is provided.

> The inputs above on the left include, i) setup parameters for the
> simulation, and ii) template scenarios that encode the abstract loss
> scenario identified by the formal modelling. Note that while a graphical
> notation is shown, the developer uses a Python API to specify the inputs.
> The output from the simulator takes the form of i) an animation of the loss
> scenario, and ii) a log of all the relevant parameters. Note that a demo of
> the case study simulation is available via (Paper resource, 2023b), which
> includes the animations generated by CARLA.

Figure 6. Exploring loss scenarios using simulation. Figure 7. A user’s view
of the CARLA simulator.

##  5\. Future work

Two significant gaps need to be addressed in our future work. In order for our
proposed approach to be effective and accessible, assistance is needed in
bridging between STPA and ELP as well as ELP and CARLA. Tool support will be
essential in managing the details. Full automation is not feasible or
desirable. We envisage a level of dialogue between the tool and the user in
order to ensure that each step in the translation is valid. In general, we
believe that Interactive Task Learning (Laird et al., 2017; Appelgren and
Lascarides, 2020) provides a promising approach to bridging these gaps. We are
exploring mechanical analysis and vehicle models to develop hierarchical
abstractions in order to bridge the gap between formal modelling statements
and simulation variables, e.g., car moving ($MV$) and friction. As a
consequence, we envisage the need for more expressive logics. Conversely, a
less expressive simulation framework, e.g., CommonRoad (Althoff et al., 2017),
may serve our needs without the computational overheads of a simulator like
CARLA. Finally, in addition to tool support, we also need to explore our ideas
using more realistic case studies.

##  6\. Responsible Research and Innovation

Where innovation has safety related concerns, gaining public acceptance is an
important challenge that needs to be addressed. This is particularly true in
the case of autonomous systems, such as self-driving cars. We believe that
building public confidence in the way in which a system is designed will make
a valuable contribution to addressing this challenge. Safety related defects
are often introduced because of gaps between the traditional stages of the
development process (Board, 2000). Our work seeks to reduce these gaps and
therefore reduce the risk of such defects occurring. This argument requires a
dialogue with the public, where evidence in the form of case studies will play
a crucial role.

##  7\. Conclusion

STPA is a popular technique that aims to assist engineers in analysing a
system’s control actions in relation to system-level hazards. The technique is
structured and systematic but relatively informal compared to a formal method.
Problem frames, if formalized, provides a mechanism for strengthening certain
key informal aspects of STPA, i.e., verifying the consistency between safety
related constraints and assumptions. Moreover, given such a formal
verification we suggest that it can be used to identify loss scenarios related
to invalid assumptions. Specifically, we propose the use of simulation to
search for environment conditions under which safety related assumptions are
violated. Engineers must be responsible for any safety related decisions, so
ultimately it must be an engineer that judges whether or not a given loss
scenario is feasible. What we are proposing is an approach that assists
engineers by providing them with simulated scenarios to review that are
realistic and accessible.

###### Acknowledgements.

The research reported in this paper is supported by the UKRI Trustworthy
Autonomous Systems Node in Governance and Regulation (EPSRC grant
EP/V026607/1).

## References

  * (1)
  * Abrial (2010) Jean-Raymond Abrial. 2010\.  _Modeling in Event-B: system and software engineering_.  Cambridge University Press.
  * Althoff et al. (2017) Matthias Althoff, Markus Koschi, and Stefanie Manzinger. 2017\.  CommonRoad: Composable benchmarks for motion planning on roads. In _Proc. of the IEEE Intelligent Vehicles Symposium_.
  * Appelgren and Lascarides (2020) Mattias Appelgren and Alex Lascarides. 2020.  Interactive task learning via embodied corrective feedback.  _Autonomous Agents and Multi-Agent Systems_ 34 (2020), 1–45.
  * Aschinger et al. (2011) Markus Aschinger, Conrad Drescher, Gerhard Friedrich, Georg Gottlob, Peter Jeavons, Anna Ryabokon, and Evgenij Thorstensen. 2011\.  Optimization methods for the partner units problem. In _Proceedings of the 8th International Conference, CPAIOR-11_. Springer, 4–19.
  * Board (2000) JPL Special Review Board. 2000\.  Report on the Loss of the Mars Polar Lander and Deep Space 2 Missions.  JPL D-18709.
  * Brik and Remmel (2015) Alex Brik and Jeffrey Remmel. 2015.  Diagnosing automatic whitelisting for dynamic remarketing ads using hybrid ASP. In _Logic Programming and Nonmonotonic Reasoning: 13th International Conference, LPNMR’15_. Springer, 173–185.
  * Clocksin and Mellish (2003) William F Clocksin and Christopher S Mellish. 2003.  _Programming in PROLOG_.  Springer Science & Business Media.
  * Colley and Butler (2013) John Colley and Michael Butler. 2013.  A formal, systematic approach to STPA using Event-B refinement and proof.  (2013).
  * Corso et al. (2021) Anthony Corso, Robert Moss, Mark Koren, Ritchie Lee, and Mykel Kochenderfer. 2021.  A survey of algorithms for black-box safety validation of cyber-physical systems.  _Journal of Artificial Intelligence Research_ 72 (2021), 377–428.
  * Dosovitskiy et al. (2017) Alexey Dosovitskiy, German Ros, Felipe Codevilla, Antonio Lopez, and Vladlen Koltun. 2017.  CARLA: An open urban driving simulator. In _Conference on robot learning_. PMLR, 1–16.
  * Erdem et al. (2012) Esra Erdem, Erdi Aker, and Volkan Patoglu. 2012.  Answer set programming for collaborative housekeeping robotics: representation, reasoning, and execution.  _Intelligent Service Robotics_ 5 (2012), 275–291.
  * Gebser et al. (2012) Martin Gebser, Roland Kaminski, Benjamin Kaufmann, and Torsten Schaub. 2012.  Answer set solving in practice.  _Synthesis lectures on artificial intelligence and machine learning_ 6, 3 (2012), 1–238.
  * Gelfond and Lifschitz (1991) Michael Gelfond and Vladimir Lifschitz. 1991.  Classical negation in logic programs and disjunctive databases.  _New generation computing_ 9 (1991), 365–385.
  * Gelman et al. (2014) Gabriel Gelman, Karen M Feigh, and John Rushby. 2014\.  Example of a complementary use of model checking and human performance simulation.  _IEEE Transactions on Human-Machine Systems_ 44, 5 (2014), 576–590.
  * Giannesini et al. (1986) Francis Giannesini, Henry Kanoui, Robert Pasero, and Michel Van Caneghem. 1986.  _Prolog_.  Addison-Wesley Longman Publishing Co., Inc.
  * Hoss et al. (2022) Michael Hoss, Maike Scholtes, and Lutz Eckstein. 2022\.  A review of testing object-based environment perception for safe automated driving.  _Automotive Innovation_ 5, 3 (2022), 223–250.
  * Howard et al. (2019) Giles Howard, Michael Butler, John Colley, and Vladimiro Sassone. 2019.  A methodology for assuring the safety and security of critical infrastructure based on STPA and Event-B.  _International Journal of Critical Computer-Based Systems_ 9, 1-2 (2019), 56–75.
  * Jackson (2012) Daniel Jackson. 2012\.  _Software Abstractions: logic, language, and analysis_.  MIT press.
  * Jackson ([n.d.]) M Jackson. [n.d.].  Software Requirements and Specifications-a lexicon of practice, principles and prejudices. 1995.
  * Jackson (2001) Michael Jackson. 2001\.  _Problem frames: analysing and structuring software development problems_.  Addison-Wesley.
  * Ladkin ([n.d.]) Peter B Ladkin. [n.d.].  Report on the Accident to Airbus A320-211 Aircraft in Warsaw, 1994.  http://psas.scripts.mit.edu/home/materials/
  * Ladkin (1994) Peter B. Ladkin. 1994\.  Report on the Accident to Airbus A320-211 Aircraft in Warsaw.  http://www.rvs.uni-bielefeld.de/publications/Incidents/DOCS/ComAndRep/Warsaw/warsaw-report.html.
  * Laird et al. (2017) John E Laird, Kevin Gluck, John Anderson, Kenneth D Forbus, Odest Chadwicke Jenkins, Christian Lebiere, Dario Salvucci, Matthias Scheutz, Andrea Thomaz, Greg Trafton, et al. 2017\.  Interactive task learning.  _IEEE Intelligent Systems_ 32, 4 (2017), 6–21.
  * Leveson (2016) Nancy G Leveson. 2016\.  _Engineering a safer world: Systems thinking applied to safety_.  The MIT Press.
  * Lin et al. (2003) Luncheng Lin, Bashar Nuseibeh, Darrel Ince, Michael Jackson, and Jonathan Moffett. 2003.  Introducing abuse frames for analysing security requirements. In _Proceedings. 11th IEEE International Requirements Engineering Conference_. 371–372.
  * Marek and Truszczyński (1999) Victor W Marek and Miroslaw Truszczyński. 1999\.  Stable models and an alternative logic programming paradigm.  _The Logic Programming Paradigm: a 25-Year Perspective_ (1999), 375–398.
  * Nogueira et al. (2001) Monica Nogueira, Marcello Balduccini, Michael Gelfond, Richard Watson, and Matthew Barry. 2001\.  An A-Prolog decision support system for the Space Shuttle. In _Practical Aspects of Declarative Languages: Third International Symposium, PADL’01_. Springer, 169–183.
  * Paper resource (2023a) Paper resource. 2023a.  Extended Logic Programming (ELP).  https://colab.research.google.com/drive/1rkjQwKKYLDBooo5u5BWpmQtpK2IJB3v6?usp=sharing
  * Paper resource (2023b) Paper resource. 2023b.  REASIM - CARLA Simulations.  https://github.com/craigiedon/REASIM-Carla
  * Seater et al. (2007) Robert Seater, Daniel Jackson, and Rohit Gheyi. 2007\.  Requirement progression in problem frames: deriving specifications from requirements.  _Requirements Engineering_ 12, 2 (2007), 77–102.
  * Sierhuis and Clancey (2002) Maarten Sierhuis and William J Clancey. 2002.  Modeling and simulating practices, a work method for work systems design.  _IEEE Intelligent Systems_ 17, 5 (2002), 32–41.
  * Stellet et al. (2020) Jan Erik Stellet, Matthias Woehrle, Tino Brade, Alexander Poddey, and Wolfgang Branz. 2020.  Validation of automated driving a structured analysis and survey of approaches. In _13\. Uni-DAS eV Workshop Fahrerassistenz und automatisiertes Fahren_.
  * Yang et al. (2021) Guang Yang, Yunzhi Xue, Lingzhong Meng, Pengqi Wang, Yuan Shi, Qinghong Yang, and Qian Dong. 2021.  Survey on autonomous vehicle simulation platforms. In _2021 8th International Conference on Dependable Systems and Their Applications (DSA)_. IEEE, 692–699.


#  EXFOR-based simultaneous evaluation for neutron-induced fission cross
section of plutonium-242

Riko Okuyama1,2 Email<EMAIL_ADDRESS>Naohiko Otuka1,3
Email<EMAIL_ADDRESS>Go Chiba2 and Osamu Iwamoto4 Email:
<EMAIL_ADDRESS><EMAIL_ADDRESS>Data
Section1Nuclear Data Section Division of Physical and Chemical Sciences
Division of Physical and Chemical Sciences Department of Nuclear Sciences and
Applications Department of Nuclear Sciences and Applications International
Atomic Energy Agency International Atomic Energy Agency A-1400 Wien A-1400
Wien Austria;
2Graduate School of Engineering Austria;
2Graduate School of Engineering Hokkaido University Hokkaido University Kita-
ku Kita-ku Sapporo 060-0813 Sapporo 060-0813 Japan;
3Nishina Center for Accelerator-Based Science Japan;
3Nishina Center for Accelerator-Based Science RIKEN RIKEN Wako 351-0198 Wako
351-0198 Japan;
4Nuclear Data Center Japan;
4Nuclear Data Center Nuclear Science and Engineering Center Nuclear Science
and Engineering Center Japan Atomic Energy Agency Japan Atomic Energy Agency
Tokai-mura Tokai-mura Naka-gun Naka-gun Ibaraki 319-1195 Ibaraki 319-1195
Japan Japan

###### Abstract

The 242Pu neutron-induced fission cross section was evaluated from 100 keV to
200 MeV. The experimental 242Pu and 235U fission cross sections and their
ratios in the EXFOR library were reviewed and analysed by the least-squares
method. Additional simultaneous evaluation was performed by including the
experimental database of the 233,238U and 239,240,241Pu fission cross sections
and their ratios developed for JENDL-5 evaluation. The 242Pu fission cross
sections from our evaluation and JENDL-5 evaluation are close to each other
below 1 MeV while systematically differ from each other above 10 MeV. The
cross section from our evaluation is systematically lower than the JENDL-4.0
cross section in the prompt fission neutron spectrum peak region ($\sim$5%
lower around 1 MeV). The newly evaluated 242Pu fission cross section was
verified against the cross section measured in the 252Cf spontaneous fission
neutron field and criticalities of small-sized LANL fast systems, and
demonstrated better performance than the JENDL-4.0 cross section on the same
level with the JENDL-5 cross section.

plutonium-242, fission, simultaneous evaluation, JENDL, EXFOR

##  1 Introduction

Development of innovative nuclear systems for spent reactor fuel management
such as the accelerator driven system requires high quality cross sections of
plutonium and minor actinides formed by consecutive neutron captures and
decays of the nuclides in the reactor fuels [1]. Target accuracies of the
cross sections based on sensitivity analysis and cross section covariance are
established (e.g.,[2, 3]), and efforts to improve the accuracies have been
made by cross section measurements (e.g., [4]) and evaluations (e.g., [5]) as
well as integral measurements (e.g., [6]) and benchmark calculations (e.g.,
[7, 8]).

Plutonium-242 has long half-life (3.73$\times 10^{5}$ year [9]) and is
accumulated during operation of thermal reactors. Several more neutron
captures and decays are required to convert 242Pu to a fissile. However, the
thermal cross section of 242Pu is rather small (18.9$\pm$0.7 b for capture,
0.16$\pm$0.04 b for fission [10]), and fast reactor systems are more efficient
for transmutation of this nuclide [11]. Sensitivity and uncertainty studies
show reduction of the uncertainty is required for the 242Pu fission cross
section in the fast neutron region. For example, a comprehensive analysis [3]
sets the target accuracy of the fission cross section to 3 – 5% in two energy
groups (498 keV – 1.35 MeV and 1.35 MeV – 2.23 MeV), where the current
accuracy is $\sim$20% and $\sim$10% according to “ANL covariance” or “BOLNA
covariance”, respectively. This requirement stimulated several new
measurements of the 242Pu fission cross section in the fast neutron region at
PTB [12], HZDR [13], CEA [14], NPL [15], EC-JRC [16] and LANL [11].

It has been known that calculations with the JENDL-4.0 library [17]
overestimate the criticalities of 242Pu-loaded small-sized LANL fast systems
[7] and 242Pu/239Pu fission rate ratios of the FCA-IX experiment [18]. In
order to improve the situation, the 242Pu fission cross section was
reevaluated for the JENDL-5 library by least-squares analysis of experimental
datasets including those from the above-mentioned new experiments except for
the latest ones [12, 13], and the reevaluated cross section became lower than
the JENDL-4.0 cross section in the fission neutron spectrum peak region [19].

The JENDL-5 242Pu fission cross section evaluation (2019) adopted the absolute
cross sections published between 2000 and 2018 as the experimental data input.
Some of these experimental datasets were measured as the 242Pu/235U fission
cross section ratios and normalised by the experimentalists to the absolute
242Pu fission cross sections by multiplying a reference (standard) 235U
fission cross section (e.g., [20, 21, 22]). The experimental data input of the
JENDL-5 evaluation therefore depends on choice of the 235U reference fission
cross section. The simultaneous evaluation approach (e.g.,[23]) uses
experimental cross section ratios without such conversion, and this technique
would be a more adequate for evaluation of the 242Pu fission cross section.
Also, some experimental datasets published before 2000 are well documented but
discarded in JENDL-5 evaluation, and it would be worthwhile to perform
reevaluation considering these datasets as well as the experimental datasets
published after JENDL-5 evaluation [12, 13]111Kögler et al.’s experiment [13]
is not used in JENDL-5 evaluation though the dataset is plotted in Fig. 22 of
the JENDL-5 evaluation full summary [19]..

The purpose of this work is to evaluate the 242Pu fission cross section for
fast neutrons by the simultaneous evaluation approach including some
experiments not take into account in JENDL-5 evaluation and to check if the
newly evaluated cross section still shows better performance than the
JENDL-4.0 242Pu fission cross section.

##  2 Method

We performed the present evaluation with the least-squares analysis code SOK
[24, 25] which updated a prior estimate by including experimental datasets
one-by-one. We adopted the JENDL-5 cross section as the prior estimate with
50% uncertainty without correlation. The procedure of the JENDL-5 simultaneous
evaluation [23] was applied to the present evaluation, and we provide below
only brief description of general procedures and items particular for the
present evaluation.

We first performed simultaneous evaluation with an experimental database
collecting the 242Pu and 235U fission cross sections and their ratios (“two-
nuclide evaluation”) and then performed more extensive evaluation with an
experimental database extended to 233,238U and 239,240,241Pu fissions (“seven-
nuclide evaluation”). We set the incident energy range of the present
evaluation to 100 keV to 200 MeV. All 242Pu and 242Pu/235U experimental
datasets published no earlier than 1970 were extracted from the EXFOR library
[26] and were included in our experimental database but excluding

  * •

the data measured relative to a reference fission cross section which ratio is
not available (e.g., [16, 11, 27])

  * •

the data measured with neutrons from nuclear explosions (e.g., [28, 29])

  * •

the data compiled without partial uncertainty information (e.g., [30])

  * •

the data not available from the authors and read from figure images (e.g.,
[31, 32])

Cancé et al.. report two 242Pu absolute cross section datasets derived with
the neutron flux determined by a proton recoil telescope and BF3 counter. We
combined these two datasets (EXFOR 21821.004 and 005) into one dataset (EXFOR
51013.002) to avoid use of the 242Pu fission counts from this experiment
twice. Except for this case, all numbers of the 242Pu and 242Pu/235U
experimental datasets were directly taken from the EXFOR library and converted
to the SOK input files by using the SOX code [33]. For construction of the
energy-energy correlation coefficients of each experimental dataset, we
assumed the uncertainty due to counting statistics is uncorrelated while the
other uncertainties are fully correlated. The experimental 242Pu and
242Pu/235U datasets adopted in the present evaluation are listed in Table 1.

Table 1:  242Pu fission cross sections and their ratio to 235U fission cross sections included in the experimental database for the present evaluation. Meadows’s 1978 dataset [48] was treated as a shape dataset. “Ver.”, “Lab.” and “Pts.” give the date (N2) of the SUBENT record in EXFOR, EXFOR/CINDA abbreviation [49] of the institute where the experiment was performed, and number of data points, respectively.  EXFOR # | Ver. | First author | Year | Lab. | Pts. | Energy range (eV) | Ref.
---|---|---|---|---|---|---|---
242Pu |  |  |  |  |  |  |  |
23653.003.1 | 20221126 | F.Belloni | 2022 | 2GERPTB | 2 | 2.5E+06 | 1.5E+07 | [12]
23334.002 | 20170410 | C.Matei | 2017 | 2UK NPL | 5 | 1.0E+06 | 2.5E+06 | [15]
23391.003 | 20191113 | P.Marini | 2017 | 2FR BRC | 4 | 1.0E+06 | 1.9E+06 | [14]
31711.004 | 20110511 | K.Gul | 1986 | 3PAKNIL | 1 | 1.5E+07 | 1.5E+07 | [50]
51013.002 | 20230104 | M.Cance | 1982 | 2FR BRC | 2 | 2.5E+06 | 2.5E+06 | [51]
242Pu/235U |  |  |  |  |  |  |  |
23469.002.1 | 20221219 | T.Kögler | 2019 | 2GERZFK | 238 | 5.0E+05 | 1.0E+07 | [13]
13801.004 | 20170724 | P.Staples | 1998 | 1USALAS | 210 | 5.1E+05 | 2.5E+08 | [52]
22211.003 | 20200925 | T.Iwasaki | 1990 | 2JPNTOH | 17 | 6.0E+05 | 6.8E+06 | [53]
13134.010.1 | 20170724 | J.W.Meadows | 1988 | 1USAANL | 1 | 1.5E+07 | 1.5E+07 | [54]
22282.008.1 | 20130924 | F.Manabe | 1988 | 2JPNTOH | 3 | 1.4E+07 | 1.5E+07 | [55]
40509.003 | 20221221 | V.M.Kupriyanov | 1979 | 4RUSFEI | 73 | 1.3E+05 | 7.4E+06 | [56]
40509.005.2 | 20210920 | V.M.Kupriyanov | 1979 | 4RUSFEI | 5 | 9.8E+05 | 3.0E+06 | [56]
10597.003 | 20221221 | J.W.Behrens | 1978 | 1USALRL | 140 | 9.7E+04 | 3.3E+07 | [57]
10734.003.1 | 20221223 | J.W.Meadows | 1978 | 1USAANL | 48 | 4.0E+05 | 9.9E+06 | [48]

The energy ranges of the 233,235,238U and 239,240,241Pu cross sections
considered in the present evaluation are same as those of the JENDL-5
simultaneous evaluation, namely 10 keV (fissile) or 100 keV (non-fissile) to
200 MeV, and their experimental database constructed for the JENDL-5
evaluation [33] was adopted after exclusion of one 235U dataset (See Ref. [34]
for the reason) and addition of a few datasets as listed in Table 2.

Table 2:  Update of the experimental database for 233,235,238U and 239,240,241Pu fission cross sections and their ratios from the database for JENDL-5 evaluation [33]. Arlt et al..’s ratio was deleted while the other datasets were added. “Ver.”, “Lab.” and “Pts.” give the date (N2) of the SUBENT record in EXFOR, EXFOR/CINDA abbreviation [49] of the institute where the experiment was performed, and number of data points, respectively.  EXFOR # | Ver. | First author | Year | Lab. | Pts. | Energy range (eV) | Ref.
---|---|---|---|---|---|---|---
235U |  |  |  |  |  |  |  |
31833.002 | 20201103 | R.Arlt | 1980 | 2GERZFK | 1 | 8.2E+06 | 8.2E+06 | [58]
23294.004 | 20211216 | I.Duran | 2019 | 2ZZZCER | 8 | 7.5E+03 | 2.7E+04 | [59]
240Pu |  |  |  |  |  |  |  |
51014.002 | 20221222 | F.Belloni | 2022 | 2GERPTB | 4 | 2.5E+06 | 1.5E+07 | [12]
238U/235U |  |  |  |  |  |  |  |
32886.003.1 | 20230206 | Z.Ren | 2023 | 3CPRINP | 135 | 5.1E+05 | 1.8E+08 | [60]
239Pu/235U |  |  |  |  |  |  |  |
14721.002 | 20211220 | L.Snyder | 2021 | 1USALAS | 119 | 1.1E+05 | 9.7E+07 | [61]

##  3 Results

The number of the experimental data points used in the present evaluation is
8395 (including 1169 data points of 242Pu and 235U) and the number of the
fitting parameters was 589 (including 158 parameters of 242Pu and 235U). In
addition to the fitting parameters representing the evaluated cross sections
on the energy nodes, there are three parameters normalising the shape datasets
of 242Pu/235U (EXFOR 10734.003.1) and 238U (14529.002, 40483.002)222 See Ref.
[23] for treatment of EXFOR 14529.002 and 40483.002 in our evaluation.. With
these parameters and experimental data points in the whole energy range for
fitting (7 or 70 keV to 250 MeV), the reduced chi-square (chi-square divided
by the degree-of-freedom) is 3.85 for the seven-nuclide evaluation and 3.30
for the two-nuclide evaluation.

###  3.1 Point-wise cross sections

The newly evaluated 242Pu cross section and its ratio to the 235U cross
section are plotted in Figs. 1 to 3 along with the 235U cross section in Fig.
4 333 The evaluated cross sections in an ASCII file are available as a
Supplemental Material of this article. . The symbols in these figures show the
experimental data points used in the present evaluation except for the three
242Pu cross section datasets plotted in Fig. 3 in grey symbols. The band
accompanying the newly evaluated cross section or its ratio in each figure
shows the external uncertainty (i.e.,uncertainty obtained by the least-squares
analysis multiplied by the square root of the reduced chi-square) in the cross
section from the seven-nuclide evaluation.

Figure 1 shows the 242Pu/235U cross section ratio below 1 MeV. Only two
experimental datasets are available below 400 keV and they do not agree with
each other within their error bars. The ratio from the present evaluation is
between these two experimental datasets, while the JENDL-5 ratio is closer to
Behrens et al.. rather than Kupriyanov et al.. This figure shows that all
evaluations and experimental datasets are consistent between 400 keV and 1
MeV.

Figure 2 shows that the 242Pu/235U ratio in JENDL-4.0 is systematically higher
than the majority of the experimental datasets between 1 and 10 MeV. Figure 3
in the same energy region shows that JENDL-4.0 is closer than the present
evaluation to Weigmann’s dataset. We confirmed that the discrepancy between
Weigmann’s and other datasets is not resolved even if we renormalise
Weigmann’s dataset (originally normalised with the ENDF/B-V 235U fission cross
section) with the latest IAEA standard [20]. As the 242Pu/235U ratio from
Weigmann’s measurement is not available in EXFOR, this dataset is discarded in
the present evaluation. It is also not used in JENDL-5 evaluation since it is
a dataset released before 2000. Figure 2 shows that the JENDL-5 ratio is
systematically higher than the present ratio above 10 MeV though they agree
with each other within the uncertainty associated with the present evaluation
in general.

The systematic deviation between present evaluation and Staple et al..’s
measurement seen in Fig. 2 is remarkable. The inset of Fig. 2 shows that the
242Pu/235U ratio from the present evaluation above 20 MeV is systematically
higher than the ratio measured by Staples et al.., which is more consistent
with the JENDL-5 evaluation. The main part of Fig. 2 also shows that the
present ratio is systematically higher than Staple et al..’s ratio above 10
MeV. The 242Pu/235U ratio in this region was also measured by the CERN n_TOF
fission ionization chamber [35, 36]. The numerical data of the n_TOF ratio
have not been submitted to the EXFOR library yet and we could not use them for
our evaluation. A figure in Tsinganis’s thesis [37] shows the n_TOF ratio is
more consistent with the measurements by Behrens et al.. and Manabe et al..
rather than Staple et al.. between 10 and 20 MeV, and hence we infer our
present evaluation is also consistent with the n_TOF ratio in this energy
region.

Figure 3 shows that the present evaluation is consistent with the experimental
absolute 242Pu cross sections adopted in the present evaluation including the
three recent measurements by Belloni et al.., Matei et al.. and Marini et al..
though the cross section measured by Matei et al.. is higher than ours.
Between 1 and 2 MeV, Figs. 3 and 4 show that the two-nuclide evaluation makes
the 242Pu and 235U cross sections lower than those from the seven-nuclide
evaluation, while Fig. 2 shows that the evaluated 242Pu/235U ratio does not
show such difference between the two- and seven-nuclide evaluations. It
implies the evaluated 242Pu cross section is more strongly influenced by the
experimental 242Pu/235U cross section ratios than the experimental 242Pu
absolute cross sections.

The 242Pu cross section measured by Tovesson et al.. is systematically higher
than ours between 10 and 100 MeV as seen in Fig. 3. Tsinganis’s thesis shows
the n_TOF 242Pu/235U cross section ratio converted to the absolute 242Pu cross
section is consistent with Tovesson et al..’s cross section between 10 and 20
MeV where Tovesson et al..’s cross section is more consistent with the JENDL-5
evaluation than the present evaluation. This situation indicates that our
evaluation could underestimate the actual fission cross section above 10 MeV
and we wish to repeat the evaluation again once the n_TOF 242Pu/235U ratio is
compiled in EXFOR.

Figure 1: 242Pu/235U fission cross section ratios below 1 MeV from evaluations
along with the experimental ones used in the present evaluation[13, 52, 53,
56, 57, 48].  Figure 2: 242Pu/235U fission cross section ratios above 1 MeV
from evaluations along with the experimental ones used in the present
evaluation[13, 52, 53, 54, 55, 56, 57, 48].  Figure 3: 242Pu fission cross
sections from evaluations along with the experimental ones used in the present
evaluation[12, 15, 14, 50, 51]. Three datasets excluded from the present
evaluation [16, 11, 27] are also plotted by grey symbols.

Figure 4 compares the 235U cross section updated by the present evaluation
with JENDL-5 (our prior estimate). This figure shows that the seven-nuclide
evaluation does not introduce major change to the JENDL-5 235U cross section
below 100 MeV, which is verified well with various important benchmark tests
[8]. On the other hand, the two-nuclide evaluation systematically reduces the
prior estimate between 0.2 and 2 MeV. The unphysical structure of the cross
section between 0.1 and 0.2 MeV from the two-nuclide evaluation is resolved by
inclusion of other five nuclides in evaluation. Considering these facts, we
conclude that the seven-nuclide evaluation provides more reasonable evaluation
of the 242Pu cross section.

Figure 4: 235U fission cross sections from evaluations along with the
experimental ones used in the present evaluation[62, 63, 64, 65, 66, 67, 68,
69, 70, 71, 72, 73, 74, 75, 76, 77, 78]. Error bars of the experimental data
points are omitted for readability.

Figure 5 shows the change in the new evaluation from the JENDL-4.0 evaluation
in the SAND-II 725 energy group structure. The change from the JENDL-4.0
evaluation looks similar for all three evaluations. Below 2 MeV the decrease
from the JENDL-4.0 evaluation becomes larger as the energy decreases and the
difference is about 5% around 1 MeV.

Figure 5: Difference in 242Pu fission cross sections between evaluations.

###  3.2 Californium-252 spontaneous fission neutron spectrum averaged cross
section

Figure 6 shows the cross section averaged over the 252Cf spontaneous fission
neutron spectrum (spectrum averaged cross section, SACS) relative to the SACS
measured by Adamov [38]. The evaluated cross sections from the SOK code were
converted to the group-wise cross sections in the SAND-II 725 energy group
structure and then averaged over the 252Cf spontaneous fission neutron
spectrum in the 725 energy groups in the IRDFF-II library [39] as described in
Ref. [23]. To obtain the SACS for the present results, the newly evaluated
cross section above 100 keV was merged with the cross section in the JENDL-5
library below 100 keV.

The JENDL-5 evaluation adopts the experimental datasets published after 2000
considering the trend that the newer measurements tend to report lower cross
sections. On the other hand, the present simultaneous evaluation based on the
measurements after 1970 gives lower SACS, which are closer to the SACS
measured by Adamov et al.. than the JENDL-5 evaluation. The figure also shows
that the SACS of CENDL-3.2 [40] and JENDL-5 libraries are similar and those of
other two libraries (JEFF-3.3 [41] and BROND-3.1 [42]) are higher. Note that
the ENDF/B-VIII.0 [43] and TENDL-2021 [44] libraries adopt the JENDL-4.0
evaluation and they are not shown in this figure.

There is no other measured SACS in the EXFOR library for 242Pu fission. In
order to check reliability of Adamov et al..’s measurement, we also compared
the widely accepted SACS recommended by Mannhart [45] with those measured by
Adamov et al.. for the 235,238U and 239Pu fission cross sections. We observe
that Admov et al..’s SACS is higher than Mannhart’s recommendation in general.
Even if Adamov et al..’s SACS are biased, however, we can still conclude that
the present evaluation shows better consistency with the measured and
recommended SACS than the JENDL-4.0 library.

Figure 6: Ratios of 252Cf spontaneous fission neutron spectrum averaged cross
sections from present evaluation, evaluated data libraries [17, 19, 40, 41,
42] and Mannhart’s recommendation [45] to those measured by Adamov [38]. The
ENDF/B-VIII.0 [43] and TENDL-2021 [44] libraries adopt the JENDL-4.0
evaluation and not shown.

Table 3 compares the SACS from various evaluations, measurements and
recommendation. This table shows that the good consistency between the JENDL-5
evaluation and Grundl et al..’s measurement [46] (which is close to Mannhart’s
recommendation) is maintained by the present evaluation except for 238U cross
section. Our preceding evaluation for the JENDL-5 library [23] and its minor
update [34] estimate the 238U SACS lower than those measured by Grundl and
recommended by Mannhart, and the present evaluation confirms that this
underestimation still exists.

Table 3: 252Cf spontaneous fission neutron spectrum averaged cross sections (mb). See Ref. [33] for the difference between Otuka (2022) and JENDL-5 (2023). |  242Pu |  233U |  235U |  238U |  239Pu |  240Pu |  241Pu
---|---|---|---|---|---|---|---
JENDL-4.0 (2011) [17] | 1161 | 1906 | 1218 | 317 | 1802 | 1340 | 1625
JENDL-5 (2023) [19] | 1130 | 1901 | 1221 | 321 | 1808 | 1340 | 1606
Otuka (2022) [23] |  | 1900 | 1223 | 316 | 1808 | 1340 | 1606
Otuka (2023) [34] |  | 1899 | 1221 | 315 | 1814 | 1339 | 1608
Present (7 nuclides) | 1122 | 1897 | 1220 | 315 | 1812 | 1337 | 1607
Present (2 nuclides) | 1113 |  | 1206 |  |  |  |
Adamov (1980) [38] | 1092$\pm$18 | 1910$\pm$29 | 1241$\pm$18 | 344$\pm$6 | 1831$\pm$27 |  |
Mannhart (2006) [45] |  |  | 1210$\pm$15 | 325.7$\pm$5.3 | 1812$\pm$25 |  |
Grundl (1983) [46] |  | 1893$\pm$48 | 1216$\pm$19 | 326$\pm$6.5 | 1824$\pm$35 | 1337$\pm$32 | 1616$\pm$80

###  3.3 Verification with integral measurements

To verify the newly evaluated 242Pu cross section, we calculated the
criticalities ($k_{\mathrm{eff}}$) of three small-sized LANL fast systems
known as SPEC-MET-FAST-004 Cases 1 to 3 in the ICSBEP Handbook.

  * •

Case 1 (239Pu): 239Pu plate without 242Pu.

  * •

Case 2 (Center-Driven): 239Pu plate sandwiched between high (94.9%) and low
(82.3%) enriched 242Pu plates.

  * •

Case 3 (End-Driven): High and low enriched 242Pu plates sandwiched between
239Pu plates.

All these systems have cylinder shapes. The criticalities were calculated by
the ACE-FRENDY-CBZ neutronics analysis sequence [47] with the nuclear data
libraries based on JENDL-4.0 except for 242Pu. Energy-averaged (multi-group)
macroscopic cross sections of each homogeneous region were calculated with
FRENDY from the ACE-formatted continuous energy cross section data. The
VITAMIN-J 175-group structure was adopted and the neutron flux energy spectrum
of the Godiva was used as the weight function. The 175-group neutron transport
equations for these systems were numerically solved by the discrete-ordinate
solver SNRZ of CBZ. The scattering anisotropy was taken into account by the
Legendre polynomials up to the fifth order, and the S16 level symmetric
angular quadrature set was used. Figure 7 shows that the overestimation of the
SMF004-2 and SMF004-3 criticalities with JENDL-4.0 is improved by adoption of
the 242Pu fission cross section from the present work as well as the JENDL-5
library.

Figure 7: C/E values of the LANL small-sized fast system (SPEC-MET-FAST-004-1,
2 and 3) criticalities calculated by ACE-FRENDY-CBZ sequence with the
JENDL-4.0 library updated with the present 242Pu evaluation.

##  4 Summary

The 242Pu neutron-induced fission cross section was evaluated between 100 keV
and 200 MeV. The experimental 242Pu fission cross sections and 242Pu/235U
fission cross section ratios in the EXFOR library were reviewed and analysed
simultaneously. In addition to the evaluation including the two nuclides, we
also performed evaluation including the seven nuclides by extending our
experimental database to the 233,238U and 239,240,241Pu fission cross sections
and their ratios. The newly obtained 242Pu fission cross section is
systematically lower than the JENDL-4.0 cross section in the energy region of
the prompt fission neutron spectrum peak region, and its reduction is about 5%
around 1 MeV. The 242Pu fission cross sections from our evaluation and JENDL-5
evaluation are close to each other below 1 MeV while systematically differ
from each other above 10 MeV. The 252Cf fission neutron spectrum averaged
cross section (SACS) of the 242Pu fission cross section from the present
evaluation improves the overestimation of Adamov et al..’s experimental SACS
by the JENDL-4.0 cross section. The newly obtained cross section also improves
overestimation of the criticalities of 242Pu enriched systems by the JENDL-4.0
cross section on the same level with the JENDL-5 cross section.

## Acknowledgement

Antonio Jiménez-Carrascosa and Oscar Cabellos (Universidad Politécnica de
Madrid) performed criticality calculations by KENO to check if our criticality
calculations are reasonable. We thank Melissa Denecke (IAEA) for careful
reading of the manuscript. RO would like to thank the members of IAEA Nuclear
Data Section for their hospitality during her internship. Her internship was
financially supported by “Fundamental Nuclear Education Program by Japanese
University Network for Global Nuclear Human Resource Development” entrusted to
Tokyo Institute of Technology by Ministry of Education, Culture, Sports,
Science and Technology (MEXT).

## References

  * [1] Salvatores M. Nuclear fuel cycle strategies including Partitioning and Transmutation. Nuclear Engineering and Design. 2005;235:805–816, DOI: 10.1016/j.nucengdes.2004.10.009.
  * [2] Aliberti G, Palmiotti G, Salvatores M, et al. Nuclear data sensitivity, uncertainty and target accuracy assessment for future nuclear systems. Annals of Nuclear Energy. 2006;33:700–733, DOI: 10.1016/j.anucene.2006.02.003.
  * [3] Salvatores M, Aliberti G, Dunn M, et al. Uncertainty and target accuracy assessment for innovative systems using recent covariance data evaluations. Nuclear Energy Agency; 2008. NEA/WPEC-26.
  * [4] Igashira M, Katabuchi T, Harada H, et al. A nuclear data project on neutron capture cross sections of long-lived fission products and minor actinides. Nuclear Data Sheets. 2014;118:72–77, DOI: 10.1016/j.nds.2014.04.006.
  * [5] Iwamoto O, Nakagawa T, Otuka N, et al. JENDL Actinoid File 2008. Journal of Nuclear Science and Technology. 2009;46:510–528, DOI: 10.1080/18811248.2007.9711557.
  * [6] Mukaiyama T, Ohbu M, Nakano M, et al. Actinide integral measurements in FCA assemblies. Radiation Effects. 1986;93:147–152, DOI: 10.1080/00337578608207441.
  * [7] Chiba G, Okumura K, Sugino K, et al. JENDL-4.0 benchmarking for fission reactor applications. Journal of Nuclear Science and Technology. 2011;48:172–187, DOI: 10.1080/18811248.2011.9711692.
  * [8] Tada K, Nagaya Y, Taninaka H, et al. JENDL-5 benchmarking for fission reactor applications. Journal of Nuclear Science and Technology. 2023;60:???–???, DOI: 10.1080/00223131.2023.2197439.
  * [9] Martin M, Nesaraja C. Nuclear data sheets for A=242. Nuclear Data Sheets. 2022;186:263–395, DOI: 10.1016/j.nds.2022.11.003.
  * [10] Mughabghab S. Atlas of Neutron Resonances (sixth edition). Elsevier Science; 2018\.
  * [11] Tovesson F, Hill TS, Mocko M, et al. Neutron induced fission of 240,242Pu from 1 eV to 200 MeV. Physical Review C. 2009;79:014613, DOI: 10.1103/PhysRevC.79.014613. EXFOR 14223.
  * [12] Belloni F, Eykens R, Heyse J, et al. Neutron induced fission cross section measurements of 240Pu and 242Pu relative to the neutron–proton scattering cross section at 2.5 and 14.8 MeV. The European Physical Journal A. 2022;58:227, DOI:10.1140/epja/s10050–022–00858–9. EXFOR 23653\.
  * [13] Kögler T, Junghans A, Beyer R, et al. Fast-neutron-induced fission cross section of 242Pu measured at the neutron time-of-flight facility $n$ELBE. Physical Review C. 2019;99:024604, DOI: 10.1103/PhysRevC.99.024604. EXFOR 23469.
  * [14] Marini P, Mathieu L, Aïche M, et al. 242Pu neutron-induced fission cross-section measurement from 1 to 2 MeV neutron energy. Physical Review C. 2017;96:054604, DOI: 10.1103/PhysRevC.96.054604. EXFOR 23391.
  * [15] Matei C, Belloni F, Heyse J, et al. Absolute cross section measurements of neutron-induced fission of 242Pu from 1 to 2.5 MeV. Physical Review C. 2017;95:024606, DOI: 10.1103/PhysRevC.95.024606. EXFOR 23334.
  * [16] Salvador-Castiñeira P, Bryś T, Eykens R, et al. Neutron-induced fission cross sections of 242Pu from 0.3 MeV to 3 MeV. Physical Review C. 2015;92:044606, DOI: 10.1103/PhysRevC.92.044606. EXFOR 23280.
  * [17] Shibata K, Iwamoto O, Nakagawa T, et al. JENDL-4.0: A new library for nuclear science and engineering. Journal of Nuclear Science and Technology. 2011;48:1–30, DOI: 10.1080/18811248.2011.9711675.
  * [18] Fukushima M, Tsujimoto K, Okajima S. Analyses with latest major nuclear data libraries of the fission rate ratios for several TRU nuclides in the FCA-IX experiments. Journal of Nuclear Science and Technology. 2017;54:795–805, DOI: 10.1080/00223131.2017.1299644.
  * [19] Iwamoto O, Iwamoto N, Kunieda S, et al. Japanese evaluated nuclear data library version 5: JENDL-5. Journal of Nuclear Science and Technology. 2023;60:1–60, DOI: 10.1080/00223131.2022.2141903.
  * [20] Carlson A, Pronyaev V, Capote R, et al. Evaluation of the neutron data standards. Nuclear Data Sheets. 2018;148:143–188, DOI: 10.1016/j.nds.2018.02.002.
  * [21] Carlson A, Pronyaev V, Smith D, et al. International evaluation of neutron cross section standards. Nuclear Data Sheets. 2009;110:3215–3324, DOI: 10.1016/j.nds.2009.11.001.
  * [22] International Atomic Energy Agency. International evaluation of neutron cross-section standards. International Atomic Energy Agency; 2007. STI/PUB/1291.
  * [23] Otuka N, Iwamoto O. EXFOR-based simultaneous evaluation of neutron-induced uranium and plutonium fission cross sections for JENDL-5. Journal of Nuclear Science and Technology. 2022;59:1004–1036, DOI: 10.1080/00223131.2022.2030259.
  * [24] Kawano T, Matsunobu H, Murata T, et al. Simultaneous evaluation of fission cross sections of uranium and plutonium isotopes for JENDL-3.3. Journal of Nuclear Science and Technology. 2000;37:327–334, DOI: 10.1080/18811248.2000.9714902.
  * [25] Kawano T, Matsunobu H, Murata T, et al. Evaluation of fission cross sections and covariances for 233U, 235U, 238U, 239Pu, 240Pu, and 241Pu. Japan Atomic Energy Research Institute; 2000. JAERI-Research 2000-004. DOI: 10.11484/jaeri-research-2000-004.
  * [26] Otuka N, Dupont E, Semkova V, et al. Towards a more complete and accurate experimental nuclear reaction data library (EXFOR): International collaboration between Nuclear Reaction Data Centres (NRDC). Nuclear Data Sheets. 2014;120:272–276, DOI: 10.1016/j.nds.2014.07.065.
  * [27] Weigmann H, Wartena J, Bürkholz C. Neutron-induced fission cross section of 242Pu. Nuclear Physics A. 1985;438:333–353, DOI: 10.1016/0375–9474(85)90379–3. EXFOR 21931, 21996.
  * [28] Bergen D, Fullwood R. Neutron-induced fission cross section of 242Pu. Nuclear Physics A. 1971;163:577–582, DOI: 10.1016/0375–9474(71)90510–0. EXFOR 10062.
  * [29] Auchampaugh G, Farrell J, Bergen D. Neutron-induced fission cross sections of 242Pu and 244Pu. Nuclear Physics A. 1971;171:31–43, DOI: 10.1016/0375–9474(71)90360–5. EXFOR 10266\.
  * [30] Khan N, Khan H, Gul K, et al. 14.8 MeV neutron induced fission studies of 239Pu, 242Pu, 244Pu and 241Am. Nuclear Instruments and Methods. 1980;173:163–168, DOI: 10.1016/0029–554X(80)90583–2. EXFOR 30548.
  * [31] Shpak D. Angular anisotropy of fragments from fission of 242Pu by 0.10–6.38 MeV neutrons. Soviet Journal of Nuclear Physics. 1990;52:419–423. EXFOR 41098.
  * [32] Fursov B, Kuprianov V, Smirenkin G. Anomaly of the (n,n’f) reaction threshold. JETP Letters. 1973;17:257–261. EXFOR 41656.
  * [33] Otuka N, Iwamoto O. EXFOR-based simultaneous evaluation of neutron-induced uranium and plutonium fission cross sections for JENDL-5: Inputs and outputs. Japan Atomic Energy Agency; 2022. JAEA-Data/Code 2022-005. DOI: 10.11484/jaea-data-code-2022-005.
  * [34] Otuka N, Iwamoto O. Simultaneous evaluation of uranium and plutonium fast neutron fission cross sections up to 200 MeV for JENDL-5 and its updates. EPJ Web of Conferences. 2023;284:08011, DOI: 10.1051/epjconf/202328408011.
  * [35] Tsinganis A, Berthoumieux E, Guerrero C, et al. Measurement of the 242Pu(n,f) cross section at n_TOF. EPJ Web of Conferences. 2014;66:03088, DOI: 10.1051/epjconf/20146603088.
  * [36] Tsinganis A, Berthoumieux E, Guerrero C, et al. Measurement of the 242Pu(n,f) cross section at the CERN n_TOF facility. Nuclear Data Sheets. 2014;119:58–60, DOI: 10.1016/j.nds.2014.08.018.
  * [37] Tsinganis A. Measurement of the 242Pu(n,f) reaction cross-section at the CERN n_TOF facility [dissertation]. submitted to National Technical University of Athens; 2014.
  * [38] Adamov V, Alkhazov I, Gusev S, et al. Absolute measurements of induced fission cross sections of heavy nuclides for both 252Cf fission spectrum neutrons and 14.7-MeV neutrons. In: Proceedings of the International Conference on Nuclear Cross Sections for Technology, Knoxville, 22–26 October 1979; 1980. p. 995–999; NBS Special Publication 594. 40547.
  * [39] Trkov A, Griffin P, Simakov S, et al. IRDFF-II: A new neutron metrology library. Nuclear Data Sheets. 2020;163:1–108, DOI: 10.1016/j.nds.2019.12.001.
  * [40] Ge Z, Xu R, Wu H, et al. CENDL-3.2: The new version of Chinese general purpose evaluated nuclear data library. EPJ Web of Conferences. 2020;239:09001, DOI: 10.1051/epjconf/202023909001.
  * [41] Plompen AJM, Cabellos O, De Saint Jean C, et al. The joint evaluated fission and fusion nuclear data library, JEFF-3.3. The European Physical Journal A. 2020;56:181, DOI: 10.1140/epja/s10050–020–00141–9.
  * [42] Blokhin A, Gai E, Ignatyuk A, et al. New version of neutron data library BROND-3.1. Voprosy Atomnoy Nauki i Tekhniki, Seriya Yaderno-Reaktornye Konstanty. 2016;(2):62–93. In Russian.
  * [43] Brown D, Chadwick M, Capote R, et al. ENDF/B-VIII.0: The 8th major release of the nuclear reaction data library with CIELO-project cross sections, new standards and thermal scattering data. Nuclear Data Sheets. 2018;148:1–142, DOI: 10.1016/j.nds.2018.02.001.
  * [44] Koning A, Rochman D, Sublet JC, et al. TENDL: Complete nuclear data library for innovative nuclear science and technology. Nuclear Data Sheets. 2019;155:1–55, DOI: 10.1016/j.nds.2019.01.002.
  * [45] Mannhart W. Response of activation reactions in the neutron field of californium-252 spontaneous fission. International Atomic Energy Agency; 2006\. STI/DOC/010/452. p. 30–45.
  * [46] Grundl J, Gilliam D. Fission cross-section measurements in reactor physics and dosimetry benchmarks. Transactions of the American Nuclear Society. 1983;44:533–535. EXFOR 10809,12821.
  * [47] Chiba G, Yamamoto A, Tada K. ACE-FRENDY-CBZ: a new neutronics analysis sequence using multi-group neutron transport calculations. Journal of Nuclear Science and Technology. 2023;60:132–139, DOI: 10.1080/00223131.2022.2087783.
  * [48] Meadows J. The fission cross sections of plutonium-239 and plutonium-242 relative to uranium-235 from 0.1 to 10 MeV. Nuclear Science and Engineering. 1978;68:360–363, DOI: 10.13182/NSE78–A27315. EXFOR 10734\.
  * [49] Schwerer O, Otuka N. EXFOR/CINDA dictionary manual. International Atomic Energy Agency; 2014. IAEA-NDS-213 Rev. 2014/12.
  * [50] Gul K, Ahmad M, Anwar M, et al. Measurements of neutron fission cross sections of 237Np, 240Pu, 241Pu, 242Pu, 244Pu, and 241Am at 14.7 MeV. Nuclear Science and Engineering. 1986;94:42–45, DOI: 10.13182/NSE86–A17115. EXFOR 31711.
  * [51] Cancé M, Grenier G. Mesures absolues de 240Pu(n,f), 242Pu(n,f) et 237Np(n,f) a l’energie incident de 2,5 MeV. In: Nuclear Data for Science and Technology, Proceedings of the International Conference, Antwerp 6–10 September 1982. Central Bureau for Nuclear Measurements; 1983. p. 51–54, DOI: 10.1007/978–94–009–7099–1_10; EUR 8355\. In French. EXFOR 21821,51013.
  * [52] Staples P, Morley K. Neutron-induced fission cross-section ratios for 239Pu, 240Pu, 242Pu, and 244Pu relative to 235U from 0.5 to 400 MeV. Nuclear Science and Engineering. 1998;129:149–163, DOI: 10.13182/NSE98–A1969. EXFOR 13801.
  * [53] Iwasaki T, Manabe F, Baba M, et al. Measurement of fast neutron induced fission cross section ratios of Pu-240 and Pu-242 relative to U-235. Journal of Nuclear Science and Technology. 1990;27:885–898, DOI: 10.1080/18811248.1990.9731269. EXFOR 22211.
  * [54] Meadows J. The fission cross sections of 230Th, 232Th, 233U, 234U, 236U, 238U, 237Np, 239Pu and 242Pu relative to 235U at 14.74 MeV neutron energy. Annals of Nuclear Energy. 1988;15:421–429, DOI: 10.1016/0306–4549(88)90038–2. EXFOR 13134.
  * [55] Manabe F, Kanda K, Iwasaki T, et al. Measurements of neutron induced fission cross section ratios of 232Th, 233U, 234U, 236U, 238U, 237Np, 242Pu and 243Am relative to 235U around 14 MeV. The Technology Reports of Tōhoku University. 1988;52:97–126. EXFOR 22282.
  * [56] Kupriyanov V, Fursov B, Maslennikov B, et al. Measurement of the 240Pu/235U and 242Pu/235U fission cross-section ratios for 0.127–7.4-MeV neutrons. Soviet Atomic Energy. 1979;46:35–39, DOI: 10.1007/BF01119949. EXFOR 40509.
  * [57] Behrens J, Newbury R, Magana J. Measurements of the neutron-induced fission cross sections of 240Pu, 242Pu, and 244Pu relative to 235U from 0.1 to 30 MeV. Nuclear Science and Engineering. 1978;66:433–441, DOI: 10.13182/NSE78–A27227. EXFOR 10597.
  * [58] Arlt R, Josch M, Musiol G, et al. Absolute fission cross section measurement on 235U at 8.4 MeV neutron energy. In: Proceedings of the X-th International Symposium on Selected Topics of the Interaction of Fast Neutrons and Heavy Ions with Atomic Nuclei, Gaussig, 17–21 November 1980. International Atomic Energy Agency; 1981. p. 35–39; INDC(GDR)-19. EXFOR 31833\.
  * [59] Duran I, Paradela C, Caamaño M, et al. High-resolution evaluation of the U5(n,f) cross section from 3 keV to 30 keV. EPJ Web of Conferences. 2019;211:02003, DOI: 10.1051/epjconf/201921102003. EXFOR 23294.
  * [60] Ren Z, Yang Y, Liu R, et al. Measurement of the 236,238U(n,f) cross sections from the threshold to 200 MeV at CSNS Back-n. The European Physical Journal A. 2023;59:5, DOI: 10.1140/epja/s10050–022–00910–8. EXFOR 32886.
  * [61] Snyder L, Anastasiou M, Bowden N, et al. Measurement of the 239Pu(n,f)/235U(n,f) cross-section ratio with the NIFFTE fission Time Projection Chamber. Nuclear Data Sheets. 2021;178:1–40. EXFOR 14721.
  * [62] Amaducci S, Cosentino L, Barbagallo M, et al. Measurement of the 235U(n,f) cross section relative to the 6Li(n,t) and 10B(n,$\alpha$) standards from thermal to 170 keV neutron energy range at n_TOF. The European Physical Journal A. 2019;55:120, DOI: 10.1140/epja/i2019–12802–7. EXFOR 23453,51006.
  * [63] Nolte R, Allie MS, Brooks FD, et al. Cross sections for neutron-induced fission of 235U, 238U, 209Bi, and natPb in the energy range from 33 to 200 MeV measured relative to n-p scattering. Nuclear Science and Engineering. 2007;156:197–210, DOI: 10.13182/NSE06–14. EXFOR 23078.
  * [64] Carlson A, Wasson O, Lisowski P, et al. Measurements of the 235U cross section in the 3 to 30 MeV neutron energy region. In: Proceedings of the International Conference on Nuclear Data for Science and Technology, Jülich, 13–17 May 1991; 1992. p. 518–520, DOI: 10.1007/978–3–642–58113–7_147. EXFOR 14015.
  * [65] Lisowski P, Gavron A, Parker W, et al. Fission cross sections in the intermediate energy region. In: Proceedings of a Specialists’ Meeting on Neutron Cross Section Standards for the Energy Region above 20 MeV, Uppsala, 21–23 May 1991; 1976. p. 177–186; NEANDC-305. EXFOR 14016.
  * [66] Merla K, Hausch P, Herbach C, et al. Absolute measurement of neutron induced fission cross-sections of 235U, 238U, 237Np and 239Pu. In: Proceedings of the International Conference on Nuclear Data for Science and Technology, Jülich, 13–17 May 1991; 1992. p. 510–513, DOI: 10.1007/978–3–642–58113–7_145. EXFOR 22304,51010.
  * [67] Kalinin VA, Kuz’min VN, Solin LM, et al. Correction to the results of absolute measurements of the 235U fission cross section with 1.9 and 2.4-MeV neutrons. Soviet Atomic Energy. 1991;71:700–704, DOI: 10.1007/BF01121671. EXFOR 41112.
  * [68] Iwasaki T, Karino Y, Matsuyama S, et al. Measurement of 235U fission cross section around 14 MeV. In: Proceedings of the International Conference on Nuclear Data for Science and Technology, Mito, 30 May–3 June 1988; 1988. p. 87–90. EXFOR 22091.
  * [69] Li J, Shen G, Ye Z, et al. Absolute measurement of 235U fission cross section induced by 14.2 MeV neutrons. Chinese Journal of Nuclear Physics. 1988;10:237–243. In Chinese. EXFOR 30721.
  * [70] Carlson A, Behrens J, Johnson R, et al. Absolute measurements of the 235U(n,f) cross section for neutron energies from 0.3 to 3 MeV. In: Proceedings of an Advisory Group Meeting on Nuclear Standard Reference Data, Geel, 12–16 November 1984. International Atomic Energy Agency; 1985. p. 162–166; IAEA-TECDOC-335. EXFOR 10987.
  * [71] Dias M, Carlson A, Johnson R, et al. Application of the dual thin scintillator neutron flux monitor in a 235U(n,f) cross-section measurement. In: Proceedings of an Advisory Group Meeting on Nuclear Standard Reference Data, Geel, 12–16 November 1984. International Atomic Energy Agency; 1985. p. 467–470; IAEA-TECDOC-335. EXFOR 12924.
  * [72] Dushin VN, Fomichev AV, Kovalenko SS, et al. Statistical analysis of experimental data on the cross sections of 233,235,238U,237Np,239,242Pu fission by neutrons of energy 2.6, 8.5, and 14.5 MeV. Soviet Atomic Energy. 1983;55:656–660, DOI: 10.1007/BF01124127. EXFOR 51001.
  * [73] Li J, Li A, Rong C, et al. Absolute measurements of fission cross sections for 235U and 239Pu induced by 14.7 MeV neutron using the associated particle method. Chinese Journal of Nuclear Physics. 1983;5:45–50. In Chinese. EXFOR 30634.
  * [74] Wasson O, Meier M, Duvall K. Absolute measurement of the uranium-235 fission cross section from 0.2 to 1.2 MeV. Nuclear Science and Engineering. 1982;81:196–212, DOI: 10.13182/NSE82–A20085. EXFOR 10950.
  * [75] Wasson O, Carlson A, Duvall K. Measurement of the 235U neutron-induced fission cross section at 14.1 MeV. Nuclear Science and Engineering. 1982;80:282–303, DOI: 10.13182/NSE82–A21431. EXFOR 10971.
  * [76] Mahdavi M, Knoll G, Robertson J. Measurements of the 14 MeV fission cross-sections for 235U and 239Pu. In: Nuclear Data for Science and Technology, Proceedings of the International Conference, Antwerp 6–10 September 1982. Central Bureau for Nuclear Measurements; 1983. p. 58–61, DOI: 10.1007/978–94–009–7099–1_12; EUR 8355. EXFOR 12826.
  * [77] Cance M, Grenier G. Mesures absolues des sections efficaces de fission de 235U a 2,5 MeV et 4,5 MeV et de 241Am a 14,6 MeV. Centre d’Etudes de Bruyéres-Châtel; 1981. CEA-N-2194. In French. EXFOR 21620\.
  * [78] Zhagrov E, Nemilov Y, Platonov A, et al. Fission cross sections of 233U and 235U in intermediate neutron energy range. In: Proceedings of the 5th All Union Conference on Neutron Physics, Kyiv, 15–19 September 1980; Vol. 3; 1980. p. 45–48. In Russian. EXFOR 40610.