SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Explore the source record for details and available documents.
A principal too under development as part of the NASA Failure Detection and Prevention Program is the Defect Detection and Prevention(DDP) tool.
A discussion of Systems Engineering principles as related to failure prevention methodologies and technologies. The presentation outlines requirements development, design reviews, verification and validation, and finally risk management prectices.
The Software QA / V&V guide will be reviewed and updated based on feedback from NASA organizations and others with a vested interest in this area. Hardware, EEE Parts, Reliability, and Systems Safety are a sample of the future guides that will be developed. Cost Estimates, Lessons Learned, Probability of Failure and PACTS (Prevention, Avoidance, Control or Test) are needed to provide a more complete risk management strategy. This approach to risk management is designed to help balance the resources and program content for risk reduction for NASA's changing environment.
As NASA continues to impement its Faster, Better, Cheaper philosophy, new approaches for implementing Mission Assurance activities are being developed.
The US civil aerospace program has been a great contributor to the creation and implementation of techniques and methods to identify, analyze, and confront risk. NASA has accomplished mission success in many instances, but also has had many failures. Anomalies have kept the Agency from achieving success on other occasions, as well. While NASA has mastered ways to prevent risks, and to quickly and effectively react and recover from anomalies or failures, it was not until few years ago that a comprehensive Risk Management process started being implemented in some of its programs and projects. A Continuous Risk Management (CRM) cycle process was developed and has been promoted and used successfully in programs and projects across the Agency.
The Johnson Space Center has pursued integrating risk management practices and techniques throughout a large organization with an extraordinarily diverse mission. Past mission and institutional failures have been used to inform NASA's safety culture and a implement a uniform risk management environment. Basics from the loss prevention industry have influenced NASA's approach to sustaining its unique, yet aging, infrastructure. Lessons learned at NASA can augment and enhance occupational safety, health and risk management capabilities within hazardous industries. By focusing on risk informed decision-making, building a pervasive safety culture, and accommodating human factors, NASA's safety capabilities have been specifically developed to minimize the risk of loss of life and loss of mission.
The Johnson Space Center has pursued integrating safety culture and risk management practices and techniques throughout a large organization with an extraordinarily diverse mission. Past mission and institutional failures have been used to inform NASA's safety culture and a implement a uniform risk management environment. Basics from the loss prevention industry have influenced NASA's approach to sustaining its unique, yet aging, infrastructure. Lessons learned at NASA can augment and enhance occupational safety, health and risk management capabilities within hazardous industries. By focusing on risk informed decision-making, building a pervasive safety culture, and accommodating human factors, NASA's safety capabilities have been specifically developed to minimize the risk of loss of life and loss of mission.
This white paper explores how to increase the success and operation of critical, complex, national systems by effectively capturing knowledge management requirements within the federal acquisition process. Although we focus on aerospace flight systems, the principles outlined within may have a general applicability to other critical federal systems as well. Fundamental design deficiencies in federal, mission-critical systems have contributed to recent, highly visible system failures, such as the V-22 Osprey and the Delta rocket family. These failures indicate that the current mechanisms for knowledge management and risk management are inadequate to meet the challenges imposed by the rising complexity of critical systems. Failures of aerospace system operations and vehicles may have been prevented or lessened through utilization of better knowledge management and information management techniques.
The NASA Integrated Action Team (NIAT) was formed by the NASA Administrator in March 2000. The purpose of this team was to identify the actions that NASA must take to address systemic findings reported in 4 different anomaly investigations. Team membership represented senior managers from all the field centers and NASA Headquarters. NIAT report addressed 165 findings and developed 17 action plans that are described in five themes: people and teams, technology, risk, formulation rigor, and communications. The NIAT actions present a systems solution for strengthening formulation and implementation of programs and improving the environment for their support. NIAT results included: enhancing success by avoiding failures that could have been prevented through good planning and sound practice; ensuring that prudent risks do not compromise safety; and ensuring that mission risks are objectively assessed, appropriately mitigated and consciously accepted by the program team and customers. Definitions of Faster, Better, Cheaper and Success Criteria were also developed and included as part of the NIAT report. As a result of the NIAT report, program and project management process changes were incorporated into NASA's quality system documentation, including NPG 7120.513, "NASA Program and Project Management Processes and Requirements. This paper describes the NIAT results and the resulting updates to NPG 7120.5 that keep this program and project management description a living process.
This Conference convened approximately 86 registered participants of invited guest speakers, NASA presenters, and a broad spectrum of the Occupational Health disciplines representing NASA Headquarters and all NASA Field Centers. Two days' Professional Development Courses on Exposure Assessment Strategies and Statistics and on Advanced Cardiac Life Support training and recertification preceded the Conference. With the theme, 'Risk Assessment and Management in 2001,' conferees were first provided updates from the Program Principal Center Office and the Headquarters Office. Plenary sessions elaborated on several topics: biological terrorism, OSHA recordability, Workers' Compensation issues, Federal ergonomic standards, bridging aerospace medicine and occupational health-especially in management of risk in spaceflight, and EAP operations with mission failures. A keynote address dealt with resiliency skills for 21st century workers and two NASA astronaut speakers highlighted a tour of the Johnson Space Center. During discipline specific breakout sessions, current issues in occupational health management and policy, credentialing and privileging, health risk assessment, measurement and standardization, audits, database development, prevention and rehabilitation, international travel and infection control, employee assistance, nursing process, and environmental health were presented.
A systematic approach for the development of a hardware qualification approach is described. This approach stems from the need to break the "Catch-22" of not being able to fly new technology because it hasn't flown. A physics of failure approach is used to identify failure modes and the impact and likelihood of these failures on the mission requirements is plotted in a Requirements Matrix. These same failure modes are plotted against the effectiveness of the available Preventions, Analyses, Control and Tests (PACTs) at screening for, or eliminating, these failure modes in a Test Effectiveness Matrix. Matrix multiplication results in a ranked set of PACTs which can be sorted according to cost and redundancy with other PACTs. This, and other information which results from the process, will allow project managers to make more informed decisions regarding the cost and risk tradeoffs inherent in any qualification program.
Integrated Systems Health Management (ISHM) is intended to become a critical capability for all space, lunar and planetary exploration vehicles and systems at NASA. Monitoring and managing the health state of diverse components, subsystems, and systems is a difficult task that will become more challenging when implemented for long-term, evolving deployments. A key technical challenge will be to ensure that the ISHM technologies are reliable, effective, and low cost, resulting in turn in safe, reliable, and affordable missions. To ensure safety and reliability, ISHM functionality, decisions and knowledge have to be incorporated into the product lifecycle as early as possible, and ISHM must be considered as an essential element of models developed and used in various stages during system design. During early stage design, many decisions and tasks are still open, including sensor and measurement point selection, modeling and model-checking, diagnosis, signature and data fusion schemes, presenting the best opportunity to catch and prevent potential failures and anomalies in a cost-effective way. Using appropriate formal methods during early design, the design teams can systematically explore risks without committing to design decisions too early. However, the nature of ISHM knowledge and data is detailed, relying on high-fidelity, detailed models, whereas the earlier stages of the product lifecycle utilize low-fidelity, high-level models of systems and their functionality. We currently lack the tools and processes necessary for integrating ISHM into the vehicle system/subsystem design. As a result, most existing ISHM-like technologies are retrofits that were done after the system design was completed. It is very expensive, and sometimes futile, to retrofit a system health management capability into existing systems. Last-minute retrofits result in unreliable systems, ineffective solutions, and excessive costs (e.g., Space Shuttle TPS monitoring which was considered only after 110 flights and the Columbia disaster). High false alarm or false negative rates due to substandard implementations hurt the credibility of the ISHM discipline. This paper presents an overview of the current state of ISHM design,and a review of formal design methods to make recommendations about possible approaches to enable the ISHM capabilities to be designed-in at the system-level, from the very beginning of the vehicle design process.
Every day in aviation, pilots, air traffic controllers, and other front-line personnel perform countless correct judgments and actions in a variety of operational environments. These judgments and actions are often the difference between an accident and a non-event. Ironically, data on these behaviors are rarely collected or analyzed. Data-driven decisions about safety management and design of safety-critical systems are limited by the available data, which influence how decision makers characterize problems and identify solutions. Large volumes of data are collected on the failures and errors that result in infrequent incidents and accidents, but in the absence of data on behaviors that result in routine successful outcomes, safety management and system design decisions are based on a small sample of nonrepresentative safety data. This assessment aimed to find and document “safety successes” made possible by human operators. With many Aeronautics Research Mission Directorate (ARMD) Programs and Projects focusing on increased automation and autonomy and decreased human involvement, failure to fully consider the human contributions to successful system performance in civil aviation represents a significant risk — a risk that has not been recognized to date. Without understanding how humans contribute to safety, any estimate of predicted safety of autonomous capabilities is incomplete and inherently suspect. Furthermore, understanding the ways in which humans contribute to safety can promote strategic interactions among safety technologies, functions, procedures and the people using them. Without this understanding, the full benefits of an integrated, optimized human/technology or autonomous system will not be realized. Historically, safety has been consistently defined in terms of the occurrence of accidents or recognized risks (i.e., in terms of things that go wrong). These adverse outcomes are explained by identifying their causes, and safety is restored by eliminating or mitigating these causes. An alternative to this approach is to focus on what goes right and identify how to replicate that process. Focusing on the rare cases of failures attributed to “human error” provides little information about why human performance routinely prevents adverse events. Hollnagel has proposed that things go right because people continuously adjust their work to match their operating conditions. These adjustments become increasingly important as systems continue to grow in complexity. Thus, the definition of safety should reflect not only “avoiding things that go wrong” but “ensuring that things go right.” The basis for safety management requires developing an understanding of everyday activities. However, few mechanisms to monitor everyday work exist in the aviation domain, which limits opportunities to learn how designs function in reality. This concept of safety thinking and safety management is reflected in the emerging field of resilience engineering. According to Hollnagel, a system is resilient if it can sustain required operations under expected and unexpected conditions by adjusting its functioning prior to, during, or following changes, disturbances, and opportunities. To explore “positive” behaviors that contribute to resilient performance in commercial aviation, the assessment team examined a range of existing sources of data about pilot and air traffic control (ATC) tower controller performance, including subjective interviews with domain experts and objective aircraft flight data records. These data were used to identify strategies that support resilient performance, methods for exploring and refining those strategies in existing data, and proposed methods for capturing and analyzing new data.
Risk assessment is used in many industries to identify and manage risks. Initially developed for use on aeronautical and nuclear systems, risk assessment has been applied to transportation, chemical, computer, financial, and security systems among others. It is used to gain an understanding of the weaknesses or vulnerabilities in a system so modification can be made to increase operability, efficiency, and safety and to reduce failure and down-time. Risk assessment results are primary inputs to risk-informed decision making; where risk information including uncertainty is used along with other pertinent information to assist management in the decision-making process. Therefore, to be useful, a risk assessment must be directed at specific objectives. As the world embraces the globalization of trade and manufacturing, understanding the associated risk become important to decision making. Applying risk assessment techniques to a global system of development, manufacturing, and transportation can provide insight into how the system can fail, the likelihood of system failure and the consequences of system failure. The risk assessment can identify those elements that contribute most to risk and identify measures to prevent and mitigate failures, disruptions, and damaging outcomes. In addition, risk associated with public and environment impact can be identified. The risk insights gained can be applied to making decisions concerning suitable development and manufacturing locations, supply chains, and transportation strategies. While risk assessment has been mostly applied to mechanical and electrical systems, the concepts and techniques can be applied across other systems and activities. This paper provides a basic overview of the development of a risk assessment.
A team is defined as: "two or more individuals who interact socially and adaptively, have shared or common goals, and hold meaningful task interdependences; it is hierarchically structured and has a limited life span; in it expertise and roles are distributed; and it is embedded within an organization/environmental context that influences and is influenced by ongoing processes and performance outcomes" (Salas, Stagl, Burke, & Goodwin, 2007, p. 189). From the NASA perspective, a team is commonly understood to be a collection of individuals that is assigned to support and achieve a particular mission. Thus, depending on context, this definition can encompass both the spaceflight crew and the individuals and teams in the larger multi-team system who are assigned to support that crew during a mission. The Team Risk outcomes of interest are predominantly performance related, with a secondary emphasis on long-term health; this is somewhat unique in the NASA HRP in that most Risk areas are medically related and primarily focused on long-term health consequences. In many operational environments (e.g., aviation), performance is assessed as the avoidance of errors. However, the research on performance errors is ambiguous. It implies that actions may be dichotomized into "correct" or "incorrect" responses, where incorrect responses or errors are always undesirable. Researchers have argued that this dichotomy is a harmful oversimplification, and it would be more productive to focus on the variability of human performance and how organizations can manage that variability (Hollnagel, Woods, & Leveson, 2006) (Category III1). Two problems occur when focusing on performance errors: 1) the errors are infrequent and, therefore, difficult to observe and record; and 2) the errors do not directly correspond to failure. Research reveals that humans are fairly adept at correcting or compensating for performance errors before such errors result in recognizable or recordable failures. Astronauts are notably adept high performers. Most failures are recorded only when multiple, small errors occur and humans are unable to recognize and correct or compensate for these errors in time to prevent a failure (Dismukes, Berman, Loukopoulos, 2007) (Category III). More commonly, observers record variability in levels of performance. Some teams commit no observable errors but fail to achieve performance objectives or perform only adequately, while other teams commit some errors but perform spectacularly. Successful performance, therefore, cannot be viewed as simply the absence of errors or the avoidance of failure Johnson Space Center (JSC) Joint Leadership Team, 2008). While failure is commonly attributed to making a major error, focusing solely on the elimination of error(s) does not significantly reduce the risk of failure. Failure may also occur when performance is simply insufficient or an effort is incapable of adjusting sufficiently to a contextual change (e.g., changing levels of autonomy).
This document is being provided as part of ITT's NASA Glenn Research Center Aerospace Communication Systems Technical Support (ACSTS) contract: "New ATM Requirements--Future Communications, C-Band and L-Band Communications Standard Development." ITT has completed a safety hazard analysis providing a preliminary safety assessment for the proposed C-band (5091- to 5150-MHz) airport surface communication system. The assessment was performed following the guidelines outlined in the Federal Aviation Administration Safety Risk Management Guidance for System Acquisitions document. The safety analysis did not identify any hazards with an unacceptable risk, though a number of hazards with a medium risk were documented. This effort represents an initial high-level safety hazard analysis and notes the triggers for risk reassessment. A detailed safety hazards analysis is recommended as a follow-on activity to assess particular components of the C-band communication system after the profile is finalized and system rollout timing is determined. A security risk assessment has been performed by NASA as a parallel activity. While safety analysis is concerned with a prevention of accidental errors and failures, the security threat analysis focuses on deliberate attacks. Both processes identify the events that affect operation of the system; and from a safety perspective the security threats may present safety risks.