AC 431.35-2A

U.S. Department of Transportation Federal Aviation Administration

Advisory Circular

Subject: REUSABLE LAUNCH AND REENTRY

VEHICLE SYSTEM SAFETY PROCESS Date: July 20, 2005 Initiated by: AST-1 AC No: 431.35-2A Change:

1.0 PURPOSE

a. This Advisory Circular (AC) provides guidance concerning applying a systematic and logical system safety process for identification, analysis, and control of public safety hazards and risks associated with the operation of reusable launch vehicle (RLV) and reentry vehicle (RV) systems. The approach described here provides an acceptable approach to system safety methodology. Other approaches that fulfill regulatory objectives may be acceptable to the Federal Aviation Administration (FAA), Office of Commercial Space Transportation (AST).

b. This AC is not, in itself, mandatory and does not constitute a regulation. It is issued to describe an acceptable means, but not the only means, for demonstrating compliance with certain RLV and RV systems requirements. While not mandatory, these guidelines are derived from extensive FAA/AST and industry experience.

2.0 CANCELLATION AC 431.35-2, Reusable Launch and Reentry Vehicle System Safety Process, dated September 2000, is canceled.

3.0 RELATED REGULATIONS AND DOCUMENTS

a. Regulations 14 CFR Parts 401; 431, Subpart C; and 435: Commercial Space Transportation Reusable Launch Vehicle and Reentry Licensing 401, Organization and Definitions 431, Subpart C, Safety Review and Approval for Launch and Reentry of a Reusable Launch Vehicle 435, Reentry of a Reentry Vehicle Other Than a Reusable Launch Vehicle

b. FAA Advisory Circulars and Guidance Documents AC 431.35-1, Expected Casualty Calculations for Commercial Space Launch and Reentry Missions, August 2000 AC 431.35-3, Licensing Test Flight Reusable Launch Vehicle Missions, August 2002 AC 25.1309-1A, System Design and Analysis, June 1988 Guide to Reusable Launch Vehicle Safety Validation & Verification Planning, Version 1.0, September 2003 Guide to Commercial Reusable Launch Vehicle Operations and Maintenance, Version 1.0, May 2005

c. Industry and U.S. Military Documents ARP 4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment, December 1996

2 MIL-STD-882D, Standard Practice for System Safety, February 10, 2000 System Safety Society, Inc., System Safety Analysis Handbook, 2nd Edition, Unionville, Virginia, 1997.

4.0 DEFINITIONS

4.1 Acronyms

a. AC Advisory Circular

b. AST Office of Commercial Space Transportation

c. CDR Critical Design Review

d. CDRL Contract Data Requirements List

e. E c Expected number of casualties

f. ESD Event Sequence Diagram

g. ETA Event Tree Analysis

h. FAA Federal Aviation Administration

i. FMEA Failure Modes and Effects Analysis

j. FMECA Failure Modes, Effects, and Criticality Analysis

k. FSS Flight Safety System

l. FTA Fault Tree Analysis

m. FTS Flight Termination System

n. HRI Hazard Risk Index

o. O&M Operations and Maintenance

p. PDR Preliminary Design Review

q. PHA Preliminary Hazard Analysis

r. PHL Preliminary Hazard List

s. MIL-STD Military Standard

t. R&D Research and Development

u. RLV Reusable Launch Vehicle

v. RV Reentry Vehicle

w. SHA System Hazard Analysis

x. SOW Statement of Work

y. SSHA Subsystem Hazard Analysis

z. SSP Safety System Process aa. SSPP System Safety Program Plan bb. TIM Technical Interchange Meeting cc. TTS Thrust Termination System dd. V&V Validation and Verification ee. VDD Vehicle Design Document

4.2 Definitions

a. Criticality. Relative measure of the consequences of a failure or hazard and its frequency of occurrence.

b. Event Sequence Diagram (ESD). Qualitative graphical technique that analyzes the order of events that is likely to occur given that an initiating event has occurred.

c. Event Tree Analysis (ETA). System analysis technique that explores responses to an initiating event and enables assessment of the probabilities of unfavorable or favorable outcomes.

d. Failure Modes and Effects Analysis (FMEA). System analysis by which each potential failure in a system is analyzed to determine the effects on the system and to classify each potential failure according to its severity and likelihood.

e. Failure Modes, Effects, and Criticality Analysis (FMECA). Failure Modes and Effects Analysis that includes the relative mission significance or criticality of all potential failure modes.

f. Fault Tree Analysis (FTA). Deductive system reliability analysis that provides qualitative and quantitative measures of the likelihood of failure of a system, subsystem, or event. This analysis estimates the likelihood that a top-level or causal event will occur, identifies possible causes leading to that event, and documents the results of the analytic process to provide a baseline for future studies of alternate designs.

g. Flight Safety System (FSS). Destructive or nondestructive system designed to limit or restrict the hazards to public health and safety and the safety of property presented by a launch vehicle or reentry vehicle while in flight by initiating and accomplishing a controlled ending to vehicle flight.

h. Hazard. Equipment, system, operation, or condition with an existing or potential condition that may result in loss or harm.

i. Mishap. A launch or reentry accident, launch or reentry incident, launch site accident, failure to complete a launch or reentry as planned, or an unplanned event or series of events resulting in a fatality, serious injury, or greater than $25,000 worth of damage to the payload, launch or reentry vehicle, launch or reentry support facility, or government property located on the launch or reentry site.

j. Preliminary Hazard Analysis (PHA). Examination of a system or subsystem to identify and classify each potential hazard according to its severity and likelihood of occurrence and to develop mitigation measures to those hazards to protect the public.

k. Preliminary Hazard List (PHL). Initial list of potential system hazards, compiled without regard to risk or possible mitigation measures.

l. Risk. Measure that takes into consideration the likelihood of occurrence and the consequence of a hazard to a population or property. Types of risk include the following:

(1) Unacceptable. Risk to a population or property that is identified and cannot be tolerated under existing law. Unacceptable risk is the part of the identified risk that must be either eliminated or controlled.

(2) Acceptable. Risk to a population or property that is identified and allowed to persist without further engineering or management action.

(3) Residual. Risk to a population or property remaining after the system safety efforts have been employed. Residual risk is the sum of the known acceptable risk and the unidentified (unknown) risk. This is the total risk to the public. Although unidentified risk cannot be directly measured, it is accounted for through risk mitigation measures.

(4) Individual. The likelihood of a casualty to an individual member of the uninvolved public.

(5) Collective. Expected average number of casualties to members of the uninvolved public.

m. Risk acceptance. The act by a decision maker of tolerating a risk.

n. Risk mitigation. Process of reducing the likelihood of occurrence, severity of consequences, or both the likelihood and severity of a hazard to a population or property.

o. Safety-critical. Essential to safe performance or operation. A safety-critical system, subsystem, condition, event, operation, process, or item is one whose proper recognition, control, performance, or tolerance is essential to system operation such that it does not jeopardize public safety.

p. System safety program. The combined tasks and activities of system safety management and engineering that enhance operational effectiveness by satisfying safety requirements throughout all phases of the system life cycle.

q. Validation. Process that determines that the safety requirements created in the system safety process are correct and complete.

r. Verification. Evaluation (test, demonstration, analysis, inspection) to determine that applicable safety requirements created in the system safety process have been met.

5.0 BACKGROUND The FAA requires an RLV or RV operator to use a three-pronged approach to ensure that public health and safety and the safety of property would not be jeopardized by the conduct of an RLV mission, defined to include ascent and descent flight of an RLV that has been authorized under an FAA license. Figure 1 shows the three-pronged approach. The three safety-related elements reflected in the FAA's safety strategy for RLV and RV missions and licensing are as follows:

• Acceptable public risk as determined through a calculation of the individual and collective risk, measured by expected number of casualties (Ec).

• Logical, disciplined system safety process to identify hazards and to mitigate and control risks.

• Operational requirements.

Together these interrelated elements ensure risks are sufficiently contained at an acceptable level. Just as system redundancy compensates for failure, flawed design, or imperfect performance, interrelated safety elements ensure that hazards from vehicle operation, whether expected in analytical assessments or unforeseen, will not increase risk to the public beyond an acceptable level. The FAA requires the combination of the three elements, working together, to reduce public risk to an acceptable level.

Figure 1. Three-Pronged Approach to RLV Public Safety

Understanding the relationship of the system safety process to the licensing process and the safety of the proposed operation is important. Using a systematic process for the identification and control of safety-critical systems and operations provides the foundation supporting the expected casualty analysis (see AC 431.35-1). Without a process that helps ensure a disciplined approach to the design, manufacture, integration, test, and operation of a system, establishing confidence in the probabilities of failure provided for the expected casualty analysis may prove very difficult. An analytical or statistical approach is normally used to obtain a probability of failure. In addition, the results of the analysis are supported by historical data resulting from a system safety process.

While extremely important in creating a strong foundation for ensuring the safety of a system, a system safety process does not ensure public safety. Application of the system safety engineering approach in combination with the expected casualty analysis, mandatory operational restrictions defined in regulations, and operational requirements derived from the collective and individual risk analyses, and system safety processes are all intended to help maintain the risk to the public at an acceptable level.

RLV PUBLIC SAFETY

RESULT IN 3 INTERDEPENDENT PRONGS AND Expected Casualty Analysis System Safety Process Operating Requirements

5 Paragraph 6 describes each element of the three-pronged approach to public safety, with an emphasis on the system safety process. This discussion also provides an acceptable system safety engineering process. The System Safety Program Plan (SSPP) is part of an RLV license application. Therefore, the operator is bound by the terms of the SSPP it submits to the FAA. Appendix A provides an example of an SSPP, and a format for reporting risk, including sample forms, is in appendix B.

6.0 SYSTEM SAFETY PROCESS The requirements for the RLV system safety process are addressed in 14 CFR 431.35 (c) and (d). The RV system safety process is addressed in 14 CFR 435.33.

Reusable launch vehicles typically include ascent and descent phases of flight, while RVs include only a descent phase. Although RLVs and RVs could technically be different types of vehicles, the system safety process described here is the same for both types of vehicles. For the purposes of this document, the term “RLV” is used for both RLVs and RVs.

The system safety process consists of the structured application of system safety engineering and management principles, criteria, and techniques to address safety within the constraints of operational effectiveness, time, and resources throughout all phases of the life cycle of a system. This process identifies and analyzes hazards and risks, then reduces or controls such risks to acceptable levels. The launch vehicle operator implements this process. An acceptable system safety analysis identifies and assesses the likelihood and consequences of any reasonably foreseeable hazardous event and safety-critical system failures during flight or reentry that could result in a casualty to the public. At a minimum, a system safety analysis should meet the following criteria:

• Identify and describe safety-critical systems

• Identify and describe safety-critical failure modes and their consequences

• Provide a timeline identifying safety-critical events

• Identify mitigation and control measures to reduce or minimize risk

• Provide evidence that validates and verifies the system safety analysis Because of the complexity and variety of vehicle concepts and operations, a system safety process can help ensure that all risks to public safety are considered and addressed. Without a system safety process, very detailed requirements would have to be imposed on all systems and operations to ensure that all potential hazards have been addressed. Imposing detailed requirements could have the undesired effect of restricting design alternatives and innovation or could effectively dictate design and operations concepts.

As described in Military Standard (MIL-STD) 882D, Standard Practice for System Safety, a system safety process consists of two elements: system safety management and system safety engineering. The system safety process is documented in the SSPP. Each of these elements is discussed below.

a. System Safety Management System safety management defines the system safety program requirements and ensures the planning, implementation, and accomplishment of the identified tasks within the scope of the overall system design, engineering, and integration program. At a minimum, system safety management is responsible for the following items:

• Ensuring that safety is consistent with mission objectives.

• Planning, organizing, and implementing the system safety program, including generating and maintaining the SSPP.

• Establishing overall requirements.

• Establishing the decision-making process for managing risks.

• Defining functions, authority, and interrelationships.

• Reviewing contractor efforts and data.

• Identifying and creating policies and procedures.

• Resolving conflicts between safety and other mission requirements.

Some of these system safety management elements are required under sections in 14 CFR 431. However, system safety management takes a broader view in that it defines the tasks and rules for conducting system safety engineering.

The development of a safety organization is a critical component in the management of the system safety program. The following are requirements in 14 CFR 431.33 for the safety organization. An operator must:

• Maintain a safety organization and document it by identifying lines of communication and approval authority for all mission decisions that may affect public safety. Such documentation typically includes descriptions of the roles and graphical representations showing the interactions of those roles.

• Designate a person, often called the mission conductor, responsible for the conduct of licensed RLV mission activities.

• Designate a person, often called the safety official, responsible for safety operations and procedures.

This official examines all aspects of the operator’s operations with respect to safety of RLV mission activities and monitors independently compliance by vehicle safety operations personnel with the safety policies and procedures of the operator.

Lessons learned from mishaps have identified the importance of the independence of the mission conductor and safety official roles to ensure that safety is a primary goal of the operator. To help achieve this independence, FAA/AST requires that one individual will be assigned to each of these roles.

The safety official reports to the mission conductor. In turn, the mission conductor ensures that all the safety official’s concerns are addressed both before a mission is started and before reentry or descent flight of an RLV is started. Safety officials monitor and evaluate dress rehearsals to ensure such trial runs are conducted in keeping with procedures identified in the regulations. These evaluations also examine the readiness of the safety operations personnel to conduct missions under nominal and off-nominal conditions. The safety official reports any non-compliance with procedures or representations in the license application to the mission conductor.

b. System Safety Engineering System safety engineering consists of scientific and engineering principles, criteria, and techniques necessary to identify and eliminate hazards and reduce the associated risk to acceptable levels. In addition, system safety engineering performs those tasks and activities identified by system safety management; consists of tasks and activities that define safety-critical systems, identify hazards and risks, develop top- and design-level safety requirements; and provides evidence for validation and verification (V&V) of safety-critical systems and requirements.

Figure 2 shows a traditional system safety engineering process modified by the FAA to focus only on risks to the public. The U.S. Department of Defense, National Aeronautics and Space Administration, and aerospace industry have successfully used this process for decades. This process represents one acceptable methodology.

Other approaches that fulfill regulatory requirements may be acceptable. Note that the FAA recommends operators use a process comparable to that reflected in MIL-STD-882D, System Safety Analysis Handbook (a System Safety Society Standard), or FAA AC 25-1309.

The system safety process is iterative; for ease of discussion, this process is presented here in a linear, one-pass fashion. As the development life cycle progresses, continuing to apply the system safety engineering process may identify additional safety-critical systems, hazards, failure modes, mitigation measures, and safety requirements. Detailed discussion of each element is provided.

(1) System Safety Engineering Planning

The operator must include the system safety engineering plans as part of an overall SSPP. At a minimum, such plans must include approaches to be used in the following elements:

• Identifying safety-critical systems

• Conducting hazard analyses and risk assessments

• Performing V&V

• Tracking hazards through the development life cycle of the program

Figure 2. System Safety Engineering Process Flow

These elements provide the ground rules for conducting the analyses (see appendix A). Planning also covers the collection of data to provide descriptions of systems and subsystems (including the vehicle weight, structure, and physical dimensions) and interactions among people, procedures, tools, materials, equipment, facilities, software, and environment for use in later analyses. This phase includes defining hazardous materials and flight trajectory, including launch or ascent, orbital insertion, reentry or descent, and landing. Outputs of this phase of the process include system safety engineering objectives, approaches, and scope.

(2) Safety-Critical Systems and Events Identification

The next step of the system safety engineering process is to identify the safety-critical systems and events using the approaches outlined in the planning phase (see figure 3). Whether they directly or indirectly affect the operation of the vehicle, safety-critical systems may or may not be critical at all times. For example, the vehicle’s flight path, ability to reach populated areas, or both, may vary System Hazard Analysis, Risk Assessment Safety-critical scenarios and events Safety-critical systems Failure modes, effects, mitigating measures Design-level safety requirements Reduction of risk to acceptable levels System Safety Engineering Planning Subsystem Hazard Analysis, Risk Assessment Objectives, approaches, scope

Safety-Critical Systems and Events Identification Validation and Verification Top-level safety requirements

8 greatly, thereby influencing the periods when a specific system is safety-critical. For this reason, the launch vehicle operator should determine the phases where these systems are safety-critical and only analyze those systems for that phase. Identifying safety-critical systems as early as practicable is important. The life cycle of such systems may be divided into the following six phases:

• Conception

• Research and Development (R&D)

• Design

• Deployment

• Operation

• Decommissioning and Disposition Common analytical approaches used for identifying safety-critical systems and events include Preliminary Hazard Lists (PHL), Preliminary Hazard Analyses (PHA), Event Tree Analyses (ETA), and Fault Tree Analyses (FTA). Any of these approaches would be acceptable to the FAA. Other tools that may be acceptable for determining safety-critical systems include industry guidelines that may list safety-critical systems, mishap data, and experience with similar systems. Outputs from the identification of safety-critical systems, scenarios, and events include top-level safety requirements.

(For example, all composite structures shall be proof tested to 110 percent of the maximum expected flight load per company standard XYZ-001.)

Figure 3. Identification of Safety-Critical Systems and Events

(3) Hazard Analysis and Risk Assessment

Once the safety-critical subsystems, components, and events have been identified, analyses are normally performed to identify hazards associated with those items. Then risks associated with those hazards are assessed (see figure 4). Such assessments focus on identifying, characterizing, quantifying, and evaluating risks in terms of likelihood and severity. Generally, performing a risk assessment requires answering three questions:

• What can go wrong?

• How likely is it?

• What are the consequences?

Safety-critical scenarios and events Safety-critical systems Objectives, approaches, scope, system and process descriptions Top-level safety requirements Tools: PHL, PHA, ETA, FTA, Mishap Data, Industry Guidelines

Safety-Critical Systems, Events Identification

Figure 4. Hazard Analysis and Risk Assessment

To answer these questions, the FAA requires the use of systematic methods for characterizing the hazards and quantifying the risks in terms of likelihood and severity. These methods include both inductive or “bottom-up” subsystem analyses and deductive or “top-down” system analyses.

i. Subsystem Hazard Analysis Failure Modes, Effects, and Criticality Analysis is one acceptable subsystem hazard analysis (SSHA) and risk assessment method. In this bottom-up (inductive) system analysis technique, each potential failure mode in a system is analyzed to identify its consequences and determine the qualitative severity and likelihood of occurrence. MIL-STD-882D provides definitions that the launch vehicle operator can use in the qualitative evaluation of severity and likelihood in these bottom-up risk assessments. Tables 3.1 and 3.2 in appendix A provide examples of qualitative severity and likelihood categories.

Through the System Safety Engineering Process, risks are identified and reduced. Typically, the severity and likelihood are combined and used to define risk acceptability criteria. These risk acceptability criteria determine when risk control measures are required. MIL-STD-882D provides a recommended risk acceptability matrix. Figure 3.3 in appendix A provides an example of a risk acceptability matrix.

Based on the qualitative risk acceptability matrix, a launch vehicle operator makes a decision on whether to eliminate or mitigate the hazard. The recommended order of precedence for eliminating or mitigating risk is as follows:

• Design for minimum risk. The first priority should be to design to eliminate risk.

If the identified risk cannot be eliminated, reduce the risk to an acceptable level through design selection.

• Incorporate safety devices. If risks cannot be eliminated through design selection, then launch vehicle operators should reduce risks through the use of active and passive safety devices. The launch vehicle operator must make provisions for periodic functional checks of safety devices.

• Provide warning devices. When neither design nor safety devices can effectively eliminate identified risks or adequately reduce risk, the launch vehicle operator should use devices to detect the condition and produce an adequate warning signal. The launch vehicle operator must design warning signals and their Safety-critical scenarios and events Safety-critical systems Failure modes, effects, mitigating measures Design-level safety requirements Subsystem Hazard Analysis, Risk Assessment Tools: PHA, ETA, FTA Tools: FMECA, Software Hazard Analysis, Operating & Support Hazard Analysis System Hazard Analysis, Risk Assessment

10 application to minimize the likelihood of inappropriate human reaction and response.

• Develop procedures and training. When it is impractical to eliminate risks through design selection or specific safety and warning devices, the launch vehicle operator should use procedures and training.

Selection of a mitigation approach is usually based on a number of factors, such as the feasibility of implementing the approach, effectiveness of the approach, and impact on system performance.

The analysis should also consider whether the mitigation measure introduces new hazards.

Outputs of the SSHA include design-level safety requirements derived from the mitigation measures chosen. See paragraph 6.0 b (4), Validation and Verification, for further discussion of safety requirements.

ii. System Hazard Analysis The majority of mishaps result from a combination of such factors as the environment, mechanical failure, software, human error, procedures, and system design. System hazard analyses (SHA) and risk assessments are necessary because these factors may not be represented in the subsystem analyses. Therefore, the FAA recommends that the launch vehicle operator use system risk assessment methods in addition to the bottom-up, subsystem risk assessment.

System risk assessment usually consists of inductive scenario modeling supplemented by deductive (top-down) failure modeling. The failure models and scenarios are often developed based on safety-critical events, failure modes, effects, and mitigation measures from the earlier tasks of identifying safety-critical systems and performing SSHA and risk assessment. Acceptable methods for performing scenario modeling include, but are not limited to, ETA and ESD. Other methods, such as PHA, can also aid in developing mishap scenarios. Failure modeling is performed to supplement the scenario models, and an FTA is one acceptable method for performing the failure modeling. The output from the SHA and risk assessment includes additional design-level requirements. In addition, the SHA may be used to identify additional failure modes, effects, and mitigation measures that can then be analyzed further on a subsystem level.

iii. Updating and Combining Analyses Experience gained during design, manufacture, and test usually translates into changes in the analyses. In addition, knowledge gained during assembly and operation of components, subsystems, and systems as the program matures contributes to such changes. The launch vehicle operator must implement a process to update the hazard analysis and risk assessment to reflect the knowledge gained during the life cycle of the system.

In the interest of preserving resources, it may make sense to combine analyses. To identify safetycritical systems and investigate system interactions, for example, an SHA may examine mechanical failure as well as the environment, software, human error, and procedures. The decision to combine analyses should be made based on the complexity of the system, operations, and program scope.

iv. Specific Risk Mitigation Measures Two specific risk mitigation measures often used for launch vehicles and derived from the system safety process include the use of flight safety systems (FSS) and flight hazard area analyses. An FSS limits or restricts the hazards to the uninvolved public by initiating and accomplishing a controlled ending to vehicle flight, thereby, preventing the vehicle from reaching a populated area in the event of a failure. Expendable launch vehicles launching from the United States typically use a flight termination system (FTS) as the FSS to end the flight whenever the launch vehicle strays outside of a predefined envelope. This FTS normally includes a flight destruct system or a

11 thrust termination system (TTS). Reusable launch vehicles may also use an FTS, depending on the design and application, although other systems may be appropriate. For example, an RLV may use a TTS in combination with other measures, such as propellant dumping or parachutes, to reduce potential consequences to the public. By identifying the specific safety-critical failure modes, timelines of safety-critical events, consequences, and risks to the public, the system safety process helps determine the criteria for activating an FSS. Note that this FSS may also serve to reduce the quantitative risk as part of an expected casualty analysis.

A flight hazard area analysis identifies any regions of land, sea, or air that must be monitored, publicized, controlled, or evacuated to control the risk to the public from debris impact hazards.

This analysis establishes the ship and aircraft hazard areas for Notices to Mariners and Notices to Airmen. The system safety process will identify when the public is potentially at risk based on safety-critical failure modes and events and if a flight hazard area analysis is necessary. This analysis often accounts for the following items:

• Regions of land, sea, and air potentially exposed to debris resulting from normal flight events and potential malfunctions.

• Waterborne vessels or aircraft exposed to debris from events resulting from normal, abnormal, or both, flight events.

• Operational controls implemented to control risks to the public from debris hazards.

• Debris identified from debris analysis.

• Vehicle trajectory dispersion effects in the surface impact domain.

(4) Validation and Verification

Safety analyses generate top- and design-level safety requirements. These requirements typically result from implementation of mitigation measures or operational controls to reduce residual risk to an acceptable level. Other sources may include operating practices, standard industry practices, and regulations. Regardless of the source, effective management of the complete set of safety requirements is an essential component of system safety engineering. The V&V process is used to manage the set of safety requirements (see figure 5).

Figure 5. Validation and Verification

Design-level safety requirements Reduction of risk to acceptable levels Top-level safety requirements

Validation and Verification

12 The V&V process determines that the correct safety-critical system is being built (validation), as represented by a correct and complete set of safety requirements, and that the design solution meets all of the safety requirements (verification). This comprehensive, closed-looped, iterative process is to be used in all phases of the system’s life cycle. Although validation of the safety requirements is performed before verification efforts, it is the closed-looped final validation that ultimately ensures the safety system will perform as intended.

The FAA/AST Guide to Reusable Launch Vehicle Safety Validation & Verification Planning , Version

1.0, September 2003, discusses the essential components of an acceptable V&V process. This Guide includes a set of sample implementation documents.

(5) Additional Considerations

Several additional factors should be considered in the management of the system safety process. These factors include:

• System Safety Data

• Configuration Management

• Quality Assurance

• Reliability

• Operations and Maintenance (O&M)

• Anomaly Reporting and Corrective Action

• Training

i. System Safety Data Safety data can include such items as anomaly reports, procedures, test data, hazard reports, lessons learned, and subcontractor safety effort deliverables. Means for describing, collecting, and processing this safety data are part of the system safety process.

ii. Configuration Management Development of any system requires that changes be made throughout the life cycle. Changes to the vehicle, especially on safety-critical systems, can have significant impacts on public safety.

The launch vehicle operator should implement a configuration control process to at a minimum identify components, subsystems, and systems; establish baselines and traceability; and track changes to the configuration and system safety documentation.

iii. Quality Assurance Quality assurance is implemented to verify that objectives and requirements of the system safety program, including those developed from analysis, are being satisfied and that deficiencies are detected, evaluated, tracked, and resolved. This function is usually performed through audits and inspections of elements and processes, such as plans, standards, and problem tracking and configuration management systems. In addition, the quality assurance function can evaluate the validity of system safety data. The launch vehicle operator should perform quality assurance activities suitable to the objectives of the program.

iv. Reliability Reliability plays an important role in protecting public safety because the risk to the public can depend on the failures of system elements and the consequences of those failures. Reliability