13 analysis can be used to aid in system safety design tradeoffs. Reliability testing and analyses can provide input into the V&V of the system and subsystems. In addition, reliability estimates and system failures identified during the system safety process can be used in the expected number of casualties (Ec) calculation. The launch vehicle operator should perform reliability activities, including conducting reliability analyses, performing reliability testing and demonstration, developing approaches to improving reliability, and resolving reliability issues of safety-critical systems.
v. Operations and Maintenance Operations of RLVs provide critical safety data to ensure that all safety-critical systems are performing as expected. Also, the operator may obtain trend data during operations that can be used to warn of operational safety problems or lead to corrective or preventative actions to prevent future safety problems from occurring. Therefore, an operator should develop a function to collect and analyze operations safety data.
Maintenance engineering ensures that systems and subsystems will remain at the design safety level by minimizing wear-out failures through replacement of failed items and surveillance over possible degraded environments. Maintenance engineering personnel also participate in analyzing the safety implications of proposed maintenance procedures on the ground and in flight.
Therefore, the launch vehicle operator should perform maintenance activities to aid maintenance and repair in the expected operating environments. The FAA/AST Guide to Commercial Reusable Launch Vehicle Operations and Maintenance, Version 1.0, May 2005, describes important considerations for the O&M of RLVs.
vi. Anomaly Reporting and Corrective Action Analyses of mishaps often show that clues existed before the mishap in the form of anomalies during the project life cycle. Examination and understanding of launch vehicle system and subsystem anomalies throughout the life cycle can warn of an impending mishap and provide important information leading to safety measures to mitigate public risk. The launch vehicle operator should develop standardized processes to document anomalies, analyze the root cause, and determine corrective actions to help prevent recurrence of safety-related anomalies and form a proactive means to protect public safety.
vii. Training Designing safety into the system requires that personnel involved in system development, production, and operation understand and practice operations and procedures that protect public safety. Training can help ensure that personnel can produce a safe system or operation. In addition, training can be included as a risk mitigation measure; therefore, training can be a critical element in helping ensure the safety of the public. The launch vehicle operator should develop plans that describe essential training.
c. System Safety Program Plan The methodology by which the system safety process is employed for a specific program is documented in the SSPP (see appendix A). The plan also defines the products that result from the system safety program. The objectives of a system safety program are to ensure the following items:
• Safety, consistent with overall system objectives and requirements, is designed into the system.
• Hazards associated with the form, fit, function, operation, and support of the system are identified, evaluated, and eliminated, or the associated risk is reduced to acceptable levels throughout its entire life cycle.
• System safety data, including lessons learned from similar systems, are identified and applied.
• Safety evaluation and analytical techniques are selected and applied to new designs, materials, processes, and procedures to minimize the associated risk.
• Methods employed to eliminate hazards and reduce risks are properly applied and documented.
Effectiveness of such methods should be included in the documentation.
• Design changes required to meet specified levels of risk are minimized through the efficient and effective application of safety features during the R&D or acquisition phase of the system.
• Changes in system design, configuration, or application are evaluated and analyzed for impacts to overall system safety.
• Data banks are established to ensure that significant safety data are retained and readily available for trend analysis.
The SSPP describes the planned methods by which recognized and accepted safety standards and requirements are to be integrated with other system engineering functions to ensure hazards are identified and eliminated.
This plan also includes methods by which the likelihood of occurrence or severity of consequences is reduced to acceptable levels of risk. Organizational responsibilities, resources, methods of accomplishment, milestones, and levels of effort should be addressed. An SSPP also describes how hazards and residual risk are communicated to the program manager and how the program manager will formally accept and track the hazards and residual risk. At a minimum, this plan should exhibit the following essential attributes of a system safety program:
• Planned approaches for task accomplishment
• Qualified staff to accomplish tasks
• Authority to carry out tasks through all levels of management
• Appropriate staffing to ensure completion of tasks
To demonstrate these essential attributes, the plan must include the following system safety management and engineering elements:
(1) System Safety Management
• Purpose, scope, and objectives of the overall system safety program and its tasks. This description includes a breakdown of the project by organization and responsibilities of each organization, including reliability, quality assurance, operations, maintenance, design, flight test, and associate contractors.
• System safety organization to meet the requirements of 14 CFR 431.33, including tracing the lines of communication and approval authority for all mission decisions that may affect public safety and identifying a person responsible for conduct of all licensed RLV mission activities.
• System safety reviews and milestones.
• General system safety requirements.
• Preferable approaches to minimizing risk to the public.
(2) System Safety Engineering
• Methods for identifying safety-critical systems and events.
• Methods and procedures for hazard analysis and risk assessment, including hazard severity categories, hazard likelihood levels, acceptable risk levels, order of precedence for eliminating and mitigating risk, and procedures used for taking action to resolve identified hazards.
• Approaches to V&V of safety-critical systems and requirements.
• Descriptions of what system safety data is maintained and approaches to maintaining that data.
• Approaches to configuration management, quality assurance, reliability engineering, and O&M engineering.
• Approaches to mishap and anomaly reporting and corrective action.
• Approaches to safety training.
d. Determination of Risk to the Public The FAA/AST uses collective and individual risk measures to quantify the public risk. A successful application of a system safety process should yield acceptable risks, which are risks that have been identified and allowed to persist. If it does not, the vehicle, by design or operation, is too risky for the FAA to authorize. However, system and operational uncertainties lead to unidentified (unknown) risk. The combination of known acceptable risk and unknown risk is residual risk. Expected number of casualties (Ec) is a statistical calculation used in the space transportation industry as a collective measure of residual risk to public safety. A collective risk calculation yields the consequences, measured in terms of human casualties, of the probability of occurrence of all events multiplied by the severity of impacts on public safety. Human casualty is defined as a fatality or serious injury. Collective risk measures the sum total risk or the probability of injury or death to the public exposed to the risk of an event.
However, FAA/AST also requires determination of individual risk, which measures the risk to a single person in the exposed population. An individual risk measure is used to address circumstances under which certain people may be exposed to risk, such as where a single dwelling exists along a vehicle trajectory. Application of an individual risk measure for persons residing within the dwelling would dictate whether or not the dwelling must be evacuated for launch or reentry activity along that trajectory to occur safely.
Requirements for collective and individual risk are addressed in 14 CFR 431.35 (b). The FAA AC 431.35-1, Expected Casualty Calculations for Commercial Space Launch and Reentry Missions, August 2000, describes an acceptable means of calculating the expected number of casualties (Ec) to determine public risk.
e. Operating Requirements In combination with the expected casualty analysis, the system safety process yields methods of operation that demonstrate the operator’s ability to operate within the limits of acceptable risk to public safety. Note, however, these analytical processes may not reflect real-world performance even under the best of circumstances.
Because of the uncertainty in RLV performance and operation, the FAA specifies operating requirements.
However, the hazard analysis and risk assessment, V&V, O&M experience, and expected casualty analysis assumptions can yield additional operational requirements or restrictions.
An interrelationship exists between the system design capabilities and system operational limitations. Design changes are not the only way to control risk. Operational limitations are used to restrict risk. While FAA regulatory operational limitations and requirements (14 CFR 431.43 and 435.33 for RLVs and RVs, respectively) must be met, the launch vehicle operator may employ additional operational requirements to limit risk to an acceptable level. Typically, the operator’s decisions reflect a balance between design considerations and operational limitations and are based on such factors as the need to satisfy regulatory risk safety standards, technological capabilities, and cost-benefit tradeoffs.
Figure 6 depicts the relationship between the safety-critical systems and the scope of operations within which the vehicle is operated. Intended operational requirements affecting the proposed vehicle design requirements, capabilities, and limitations also establish the operational system constraints necessary to protect public health and safety. For example, landing sites may have to be within a specific cross-range distance from the orbital ground trace because of cross-range limitations of the vehicle. A vehicle operator may choose or be required to mitigate certain vehicle limitations through the use of operational controls rather than relieving vehicle limitations through design changes.
Figure 6. Interrelationship Between Safety-Critical Systems and Operations
Test parameters and analytic assumptions further define the limits of flight operations. The scope of the analyses and environmental tests, for example, will make up the dimensions of the operator’s demonstration process and, therefore, define the limits of approved operations if a license is issued. Testing limits, identified system and subsystem limits, and analyses identified through application of a system safety process also are expected to be reflected in mission monitoring and mission rules addressing such aspects as commit to launch, flight abort, and commit to reentry.
Vehicle capabilities, limitations, and operational factors, such as launch location and flight path, affect public risk. Completion of system operation demonstrations, such as flight simulations and controlled flight tests, increases confidence in the systems and performance capabilities of the vehicle. As confidence in overall operational safety performance of the system increases, operational restrictions, such as limitations on the operating area, identified through the system safety process may be relaxed.
The following types of operations-related considerations, discussed in 14 CFR 431, may need to be addressed by the launch vehicle operator when establishing operations scenarios:
• Launch commit criteria and rules.
• Human activation or initiation of an FSS to initiate safe abort during launch and reentry.
• System monitoring, inspection, and checkout procedures.
• Inspection and maintenance for reflight.
• Selection of primary and alternate landing sites for the vehicle or stages.
• Surveillance and control of landing areas.
• Standard limits on weather.
• Coordination with appropriate airspace authorities.
• Limits on flight regime (ties in with analysis, testing and demonstrating confidence in system performance and reliability).
• Regulatory limits on flights over populated areas.
• Other considerations identified through hazard analysis.
Vehicle Capabilities and Limitations Operations Capabilities and Limitations Public Risk Safety-Critical Operations
• Operations Standards for Systems
• Analysis, Tests, Rehearsals, Simulations, Controlled Flights Safety-Critical Systems
• Design Standards for Systems
• Analysis, Tests, Inspections
APPENDIX A Sample Reusable Launch Vehicle System Safety Program Plan
The System Safety Program Plan (SSPP) is part of an RLV license application. Therefore, the launch vehicle operator is bound by the terms of the SSPP it submits to the FAA. This appendix provides guidance on developing an acceptable SSPP that addresses public safety considerations. Based on a hypothetical scenario, an RLV operator creates its system safety program as described in this sample SSPP. The intention is to demonstrate a systematic, logical, and disciplined approach for identifying hazards and assessing risks to the public during the design, development, and operation of an RLV system.
Methods and procedures described here illustrate an acceptable SSPP, but they are not the only ones acceptable to the Federal Aviation Administration (FAA), Office of Commercial Space Transportation (AST). Addressing all RLV safety-related systems activities in an SSPP even if they do not relate to public safety is acceptable; however, FAA/AST will only assess those matters that may impact public safety.
18 Leading The Way
X Y ZX Y Z
COMPANY ABC, INC.
XYZ VEHICLE
SYSTEM SAFETY PROGRAM PLAN
CONTENTS
1.0 Introduction
2.0 System Safety Management
2.1 Purpose
2.2 Scope and Objectives
2.3 Tasks and Activities
2.4 System Safety Organization
2.4.1 Integration and Management of Associate Contractors
2.5 System Safety Program Milestones
2.6 Safety Requirements
2.7 Approaches to Reducing Risk
3.0 System Safety Engineering
3.1 Safety-Critical Systems and Events Identification
3.2 Hazard Analyses and Risk Assessment
3.2.1 Subsystem Hazard Analysis
3.2.2 System Hazard Analysis
3.2.3 Software Safety
3.2.4 Risk Assessment
3.2.5 Risk Acceptability Criteria
3.2.6 Risk Mitigation Measures
3.3 Validation and Verification
3.4 Operations and Maintenance
3.5 Anomaly Reporting and Corrective Action
3.6 Safety Risk Tracking
3.7 Additional Considerations
1.0 INTRODUCTION This Company ABC, Inc., System Safety Program Plan (SSPP) for the XYZ Vehicle Program covers aspects of the design and development of the XYZ vehicle affecting public safety. Ground operations, launch facilities, support equipment, flight tests, and subsequent operations of the vehicle system are addressed.
System safety management and engineering tasks required during the life cycle of the XYZ vehicle to identify, evaluate, and eliminate hazards or to reduce the associated risk to a level acceptable to program management and the FAA are discussed. In addition, this plan provides direction and guidance between Company ABC and its associate contractors as to how the system safety program will be accomplished. In this SSPP, the term “associate contractors” refers to all contractors, subcontractors, suppliers, and vendors.
Company ABC will ensure that all associate contractors supporting the XYZ Vehicle Program adhere to this SSPP.
The XYZ vehicle system safety program described in this plan will be conducted jointly by the system safety organizations of Company ABC and its associate contractors. In addition to providing the necessary resources, the system safety organizations of each company will coordinate and accomplish the tasks, activities, and data preparation required by Company ABC in accordance with this plan. Company ABC will give direction to the associate contractors to integrate the system safety program and provide a single point of contact for program management on system safety issues.
2.0 SYSTEM SAFETY MANAGEMENT
2.1 PURPOSE The XYZ system safety program ensures that safety, consistent with Company ABC and FAA requirements, is designed into the XYZ vehicle, including its subsystems, supporting equipment, operations, and interfaces. During development of the XYZ vehicle, the emphasis will be on ensuring the safety of the uninvolved public and public property.
2.2 SCOPE AND OBJECTIVES The XYZ vehicle is scheduled to start flight tests on Month/ Day /Year. Objectives of these flight tests are to obtain flight data. Specific goals include the following:
/circle4 Validation of the design /circle4 Verification of vehicle performance /circle4 Identification of system deficiencies /circle4 Demonstration of safe operations Following successful completion of the flight test program, the vehicle will become operational.
The principal system safety objective is to protect public health and safety and to ensure safe and successful flight operations can be conducted within acceptable risk limits. Other objectives of the system safety program are as follows:
/circle4 Identify hazards and implement safety features and requirements during the design phase that provide the optimum degree of system safety consistent with mission requirements.
/circle4 Ensure that system safety issues are properly considered with respect to conducting ground tests, ground servicing, initial flight tests, and flight and reentry operations of the XYZ vehicle.
/circle4 Contain risks to uninvolved public and property to acceptable levels during all phases of the XYZ Vehicle Program.
21 /circle4 Provide lessons learned for application to the design and operation of the XYZ vehicle.
2.3 TASKS AND ACTIVITIES The tasks and activities will be accomplished by the system safety organization of Company ABC. Each associate contractor will perform a hazard analysis on the subsystems for which they have design responsibility. They will also prepare the corresponding portions of the System and Subsystem Hazard Analysis Reports in support of Company ABC’s system safety effort (see appendix B). Unless otherwise stated, the approaches to the tasks and activities listed below apply to all phases of the program, including design, manufacture, and operations (which includes ground and flight test, launch, recovery, and maintenance).
2.4 SYSTEM SAFETY ORGANIZATION The XYZ System Safety Program will be conducted jointly by the system safety organizations of the Company ABC and its associate contractors. Company ABC will act as the focal point of contact and primary integrator of all safety-related activities between Company ABC and other safety organizations.
Company ABC will assign tasks to appropriate team members and ensure the safety requirements addressed by the XYZ System Safety Program are accomplished. The system safety tasks assigned to each associate team member will support the work agreed to by their respective organizations and take advantage of their safety expertise in specific areas.
Company ABC’s safety official is the XYZ Vehicle Program System Safety Manager, John Doe. All safety personnel will report directly to the System Safety Manager. Mr. Doe reports directly to Company ABC Program Manager Jane Smith, who serves as the mission conductor. The safety official monitors and evaluates dress rehearsals to ensure that they are conducted in accordance with procedures identified in the regulations and to ensure the readiness of the safety operations personnel to conduct the mission under nominal and off-nominal conditions. The safety official monitors and reports to the mission conductor any non-compliance with procedures or representations in the license application. The mission conductor ensures that all the safety official’s concerns are addressed both before a mission is started and before reentry or descent flight of the XYZ vehicle. Table 2.1 lists sample contact information for Company ABC’s safety official and mission conductor.
Table 2.1. Company ABC Contact Information
COMPANY NAME TITLE CONTACT Company ABC John Doe Program System Safety Manager/Safety Official
(800) 123 - 4567 Company ABC Jane Smith Program Manager/Mission Conductor (800) 123-7654
2.4.1 INTEGRATION AND MANAGEMENT OF ASSOCIATE CONTRACTORS At the discretion of Company ABC, associate contractors will perform significant portions of the XYZ Vehicle Program. These organizations provide subsystems and components that are critical to the safety of the XYZ vehicle. System safety requirements for associate contractors will generally be imposed through statements of work (SOW), equipment specifications, and contract data requirements lists (CDRL).
Because of the widely varied nature of the products and services provided, safety requirements for each product or service will be tailored on a case-by-case basis. Specific equipment safety requirements will be identified and included in equipment specifications. System safety program and task requirements will be specified in the SOW to ensure that safety is addressed in the equipment design and that associate
22 contractor efforts are integrated into the system safety program described in this plan. The CDRL requirements will specify data needed to document compliance with specification requirements, track hazards, and provide inputs to the hazard analysis process.
2.5 SYSTEM SAFETY PROGRAM MILESTONES The XYZ vehicle is a new vehicle development program. As a result, the system safety program milestones are scheduled to coincide with the traditional design review milestones. System safety data will be prepared and available for the scheduled safety reviews. Updates will be provided as necessary by each company and coordinated by Company ABC. All analyses generated during the program will be available to all participants. Table 2.2 lists examples of major events and dates.
Table 2.2. XYZ Vehicle System Safety Program Milestones
REVIEW/TASK PROJECTED
SCHEDULE STATUS Preliminary Design Review (PDR)/Preliminary Hazard Analysis (PHA) Month/ Day /Year Preliminary Hazard Review Month/ Day /Year Critical Design Review (CDR)/Subsystem Hazard Analysis (SSHA) Month/ Day /Year Subsystem Hazard Review Month/ Day /Year First Flight Test Readiness Review/ System Hazard Analysis (SHA) Month/ Day /Year Complete Month/ Day /Year (Approximately 90 days before 1st flight) System Hazard Review Month/ Day /Year First Flight Test (Test does not meet definition of a launch vehicle.)
Month/ Day /Year Second Flight Test (Test does not meet definition of a launch vehicle.)
Month/ Day /Year First Operational Flight (FAA – Licensed) Month/ Day /Year Second Operational Flight (FAA – Licensed) Month/ Day /Year
2.6 SAFETY REQUIREMENTS Safety requirements will be established as a result of hazard analyses performed, validation and verification (V&V) efforts, use of lessons learned from similar programs, results of anomaly reporting and corrective action processes, and company design safety standards. Additionally, safety requirements for the XYZ Vehicle Program are identified through FAA regulations and Company ABC’s use of guidance material. In general, safety requirements will be established to control the safety risk associated with individual hazards to levels acceptable to the Company ABC Program Management and FAA.
2.7 APPROACHES TO REDUCING RISK For the XYZ Vehicle Program, the order of precedence for eliminating and mitigating risk is as follows:
a. Design for minimum risk. Company ABC’s priority will be to design to eliminate risk. If the identified risk cannot be eliminated, then the risk will be reduced to an acceptable level through design selection.
b. Incorporate safety devices. If risks cannot be eliminated through design selection, then the risks will be reduced through the use of active and passive safety devices. Provisions for periodic functional checks of safety devices will be incorporated in the safety review process.
c. Provide warning devices. If neither design selection nor safety devices can effectively eliminate identified risks or adequately reduce risk, then warning devices will be used to detect the condition and to produce an adequate warning signal.
d. Develop procedures and training. If it is impractical to eliminate or reduce risks through design selection or specific safety and warning devices, then training and procedures will be incorporated to mitigate the risk.
In addition to the risk reduction order of precedence, XYZ vehicle safety-critical systems and functions will incorporate the following fault tolerance and risk mitigation approaches:
a. Failure Tolerance. The XYZ vehicle must be able to perform its function in the presence of faults within its hardware or software. This criterion applies to the XYZ operations when loss of a function or inadvertent occurrence of a function results in a hazardous event (risk to public safety).
b. Fault Tolerant. The XYZ vehicle safety-critical command and control functions will be designed to be at least two fault tolerant where applicable. No combination of two failures or operator errors shall result in the potential for loss of control of the vehicle or death or injury to the public.
c. Risk Inhibitors. A function that could lead to death or injury to the public shall be controlled by a minimum of three independent inhibits where possible, whenever the hazard potential exists. Monitoring of these inhibits shall be available to verify that at least two of the three inhibits are in place.
3.0 SYSTEM SAFETY ENGINEERING Figure 3.0 depicts the Company ABC public safety strategy. Each step of Company ABC’s system safety process is described in the following subparagraphs.
3.1 SAFETY-CRITICAL SYSTEMS AND EVENTS IDENTIFICATION The identification of safety-critical systems will be undertaken as early as practicable in the life cycle of the XYZ Vehicle Program. Figure 3.1 shows a process for identifying safety-critical systems. The life cycle will be divided into the following six phases:
• Conception
• Research and Development (R&D)
• Design
• Deployment
• Operation
• Decommissioning and Disposition
Figure 3.0. Company ABC Public Safety Strategy
• Operational restrictions resulting from the System Safety Process & from Expected Casualty analysis
• Launch commit criteria/rules
• Human override capability to initiate safe abort during launch and reentry
• Surveillance/control of landing areas
• Standard limits on weather
• Coordination with appropriate airspace authorities
• System monitoring, inspection and checkout procedures XYZ Risk Thresholds Individual ≤ 1 x 10-6 Collective ≤ 30 x 10-6 Reduction of risk to acceptable levels Objectives, approaches, scope Safety-Critical Systems and Events Identification Validation and Verification Top-level safety requirements System Safety Engineering Planning Safety-critical scenarios and events Safety-critical systems Failure modes, effects, and mitigating measures Design-level safety requirements System Hazard Analysis, Risk Assessment Subsystem Hazard Analysis, Risk Assessment System Safety Management
COMPANY ABC PUBLIC SAFETY STRATEGY Expected Casualty Analysis System Safety Process Operating Restrictions AND