Software risk estimation and risk reduction using the 'defect detection and prevention' risk approach and tool
Explore the source record for details and available documents.
SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Explore the source record for details and available documents.
Explore the source record for details and available documents.
As an intern this summer in the GRC Risk Management Office, I have become familiar with the NASA Continuous Risk Management Process. In this process, risk is considered in terms of the probability that an undesired event will occur and the impact of the event, should it occur (ref., NASA-NPG: 7120.5). Risk management belongs in every part of every project and should be ongoing from start to finish. Another key point is that a risk is not a problem until it has happened. With that in mind, there is a six step cycle for continuous risk management that prevents risks from becoming problems. The steps are: identify, analyze, plan, track, control, and communicate & document. Incorporated in the first step are several methods to identify risks such as brainstorming and using lessons learned. Once a risk is identified, a risk statement is made on a risk information sheet consisting of a single condition and one or more consequences. There can also be a context section where the risk is explained in more detail. Additionally there are three main goals of analyzing a risk, which are evaluate, classify, and prioritize. Here is where a value is given to the attributes of a risk &e., probability, impact, and timeframe) based on a multi-level classification system (e.g., low, medium, high). It is important to keep in mind that the definitions of these levels are probably different for each project. Furthermore the risks can be combined into groups. Then, the risks are prioritized to see what risk is necessary to mitigate first. After the risks are analyzed, a plan is made to mitigate as many risks as feasible. Each risk should be assigned to someone in the project with knowledge in the area of the risk. Then the possible approaches to choose from are: research, accept, watch, or mitigate. Next, all risks, mitigated or not, are tracked either individually or in groups. As the plan is executed, risks are re-evaluated, and the attribute values are adjusted as necessary. Metrics are established and monitored as tools for risk tracking. Also a trigger or threshold should be set on the metric data that indicates when an action is needed. Results of this tracking are usually evaluated and reported in a relevant format at weekly or monthly meetings. Choosing controls is the subsequent step, which involves the effects of the tracking. The three basic controls are: close, continue tracking, and re- plan. Finally communicate & document is the last step, but occurs throughout the process. It is vital that main risks, plans, changes, and progress are known by everyone in the project. A good way to keep everyone updated and inform other projects of common issues is by thoroughly documenting project risks. NASA sees value in risk management and believes that projects have greater probability or success by using the NASA Continuous Risk Management Process.
Full scale fire testing complemented by computer modelling has provided significant know how about the risk, prevention and suppression of fire in terrestrial systems (cars, ships, planes, buildings, mines, and tunnels). In comparison, no such testing has been carried out for manned spacecraft due to the complexity, cost and risk associated with operating a long duration fire safety experiment of a relevant size in microgravity. Therefore, there is currently a gap in knowledge of fire behaviour in spacecraft. The entire body of low-gravity fire research has either been conducted in short duration ground-based microgravity facilities or has been limited to very small fuel samples. Still, the work conducted to date has shown that fire behaviour in low-gravity is very different from that in normal-gravity, with differences observed for flammability limits, ignition delay, flame spread behaviour, flame colour and flame structure. As a result, the prediction of the behaviour of fires in reduced gravity is at present not validated. To address this gap in knowledge, a collaborative international project, Spacecraft Fire Safety, has been established with its cornerstone being the development of an experiment (Fire Safety 1) to be conducted on an ISS resupply vehicle, such as the Automated Transfer Vehicle (ATV) or Orbital Cygnus after it leaves the ISS and before it enters the atmosphere. A computer modelling effort will complement the experimental effort. Although the experiment will need to meet rigorous safety requirements to ensure the carrier vehicle does not sustain damage, the absence of a crew removes the need for strict containment of combustion products. This will facilitate the possibility of examining fire behaviour on a scale that is relevant to spacecraft fire safety and will provide unique data for fire model validation. This unprecedented opportunity will expand the understanding of the fundamentals of fire behaviour in spacecraft. The experiment is being developed by an international topical team that is collaboratively defining the experiment requirements and performing supporting analysis, experimentation and technology development. This paper presents the objectives, status and concept of this project.
Full scale fire testing complemented by computer modelling has provided significant knowhow about the risk, prevention and suppression of fire in terrestrial systems (cars, ships, planes, buildings, mines, and tunnels). In comparison, no such testing has been carried out for manned spacecraft due to the complexity, cost and risk associated with operating a long duration fire safety experiment of a relevant size in microgravity. Therefore, there is currently a gap in knowledge of fire behaviour in spacecraft. The entire body of low-gravity fire research has either been conducted in short duration ground-based microgravity facilities or has been limited to very small fuel samples. Still, the work conducted to date has shown that fire behaviour in low-gravity is very different from that in normal gravity, with differences observed for flammability limits, ignition delay, flame spread behaviour, flame colour and flame structure. As a result, the prediction of the behaviour of fires in reduced gravity is at present not validated. To address this gap in knowledge, a collaborative international project, Spacecraft Fire Safety, has been established with its cornerstone being the development of an experiment (Fire Safety 1) to be conducted on an ISS resupply vehicle, such as the Automated Transfer Vehicle (ATV) or Orbital Cygnus after it leaves the ISS and before it enters the atmosphere. A computer modelling effort will complement the experimental effort. Although the experiment will need to meet rigorous safety requirements to ensure the carrier vehicle does not sustain damage, the absence of a crew removes the need for strict containment of combustion products. This will facilitate the possibility of examining fire behaviour on a scale that is relevant to spacecraft fire safety and will provide unique data for fire model validation. This unprecedented opportunity will expand the understanding of the fundamentals of fire behaviour in spacecraft. The experiment is being developed by an international topical team that is collaboratively defining the experiment requirements and performing supporting analysis, experimentation and technology development. This paper presents the objectives, status and concept of this project.
The US civil aerospace program has been a great contributor to the creation and implementation of techniques and methods to identify, analyze, and confront risk. NASA has accomplished mission success in many instances, but also has had many failures. Anomalies have kept the Agency from achieving success on other occasions, as well. While NASA has mastered ways to prevent risks, and to quickly and effectively react and recover from anomalies or failures, it was not until few years ago that a comprehensive Risk Management process started being implemented in some of its programs and projects. A Continuous Risk Management (CRM) cycle process was developed and has been promoted and used successfully in programs and projects across the Agency.
At JPL and NASA, a process has been developed to perform life cycle risk management. This process requires users to identify: goals and objectives to be achieved (and their relative priorities), the various risks to achieving those goals and objectives, and options for risk mitigation (prevention, detection ahead of time, and alleviation). Risks are broadly defined to include the risk of failing to design a system with adequate performance, compatibility and robustness in addition to more traditional implementation and operational risks. The options for mitigating these different kinds of risks can include architectural and design choices, technology plans and technology back-up options, test-bed and simulation options, engineering models and hardware/software development techniques and other more traditional risk reduction techniques.
Risk assessment and mitigation is the focus of the Defect Detection and Prevention (DDP) process, which has been applied to spacecraft technology assessments and planning, both hardware and software. DDP's major elements and their relevance to core requirement engineering concerns are summarized. The accompanying research demonstration illustrates DDP's tool support, and further customizations for application to software.
The limited number of astronauts available for risk-assessment prevents classic epidemiologic study, and thereby requires alternative approach to assessing risks within individual astronauts exposed to toxic agents identified within the Bioastronautics Critical Path Roadmap (BCPR). Developing a system of noninvasive real-time biodosimetry that provides large datasets for analyses before, during, and after missions for simultaneously determining 1) the kinds of toxic insult, 2) the degree of that insult, both within tissues absorbing that insult, would be usehl for resolving statistically significant risk-assessment in individual astronauts. Therefore, a currently achievable multiparametric paradigm is presented for use in analyzing gene-expression and protein-expression so as to establish predictive outcomes.
Early Onset Osteoporosis is probably the most recognized but poorly understood long-term health risk due to spaceflight. Osteoporosis management is primarily prophylactic and clinical interventions rely upon the ability to predict fractures which is currently determined by surrogate measures of bone strength. The RMAT for Early Onset Osteoporosis identified some open issues related to the fact that long-duration astronauts compose a unique group of subjects for which clinical approaches for osteoporosis management do not apply. Long-duration astronauts are healthy, young (25 to 55 years of age), predominantly male, and physical fit relative to the typical osteoporosis patient. Moreover, during prolonged space missions (typically 6-month missions) the skeleton not only adapts to weightlessness, but is influenced by numerous risk factors induced by operational constraints, e.g., inability to maintain preflight weight-bearing and aerobic activities, sub-optimal dietary intake (e.g., high sodium content for food stability, lack of fresh fruit and vegetables), suppression of vitamin D metabolism by uv shielding, and remote medicine care. Moreover, adaptation results in novel changes to astronauts bones that cannot be detected by current medically-useful measures. Consequently, a panel of clinicians (recognized leaders and policy-makers in osteoporosis) was convened to review the dataset of bone measures and bone loss risk factors in long-duration astronauts. Driven by the queries in the RMAT, the panel was charged to determine 1) if an intervention is required to prevent this risk, 2) what type and at what time would intervention be optimal, 3) what is the clinical trigger that would require a medical response from flight surgeons and 4) how should research data be used in the clinical care of astronauts. Hence, the RMAT determined that a bone health policy need to be formulated specific for this unique cohort subjected to a novel skeletal condition
A formal approach to managing and mitigating security risks in the software life cycle is requisite to developing software that has a higher degree of assurance that it is free of security defects which pose risk to the computing environment and the organization. Due to its criticality, security should be integrated as a formal approach in the software life cycle. Both a software security checklist and assessment tools should be incorporated into this life cycle process and integrated with a security risk assessment and mitigation tool. The current research at JPL addresses these areas through the development of a Sotfware Security Assessment Instrument (SSAI) and integrating it with a Defect Detection and Prevention (DDP) risk management tool.
The most serious risks of long-duration flight involve radiation, behavioral stresses, and physiological deconditioning. Artificial gravity (AG), by substituting for the missing gravitational cues and loading in space, has the potential to mitigate the last of these risks by preventing the adaptive responses from occurring. The rotation of a Mars-bound spacecraft or an embarked human centrifuge offers significant promise as an effective, efficient multi-system countermeasure against the physiological deconditioning associated with prolonged weightlessness. Virtually all of the identified risks associated with bone loss, muscle weakening, cardiovascular deconditioning, and sensorimotor disturbances might be alleviated by the appropriate application of AG. However, experience with AG in space has been limited and a human-rated centrifuge is currently not available on board the ISS. A complete R&D program aimed at determining the requirements for gravity level, gravity gradient, rotation rate, frequency, and duration of AG exposure is warranted before making a decision for implementing AG in a human spacecraft.
Protecting astronauts from space radiation exposure during an interplanetary mission is an important challenge for mission design and operations. If sufficient protection is not provided near solar maximum, the risk can be significant due to exposure to sporadic solar particle events (SPEs) as well as to the continuous galactic cosmic radiation (GCR). Polyethylene shielded "storm shelters" inside spacecraft have been shown to limit total exposure from a large SPE to a permissible level, preventing acute risks and providing a potential approach to fulfill the ALARA (as low as reasonably achievable) requirement. For accurate predictions of radiation dose to astronauts involved in future space exploration missions, detailed variations of radiation shielding properties are required. Radiation fluences and doses vary considerably across both the spacecraft geometry and the body-shielding distribution. A model using a modern CAD tool ProE(TradeMark), which is the leading engineering design platform at NASA, has been developed to account for these local variations in the radiation distribution. Visual assessment of radiation distribution at different points inside a spacecraft module and in the human body for a given radiation environment are described. Results will ultimately guide in developing requirements for maximal protection for astronauts from space radiation.
OBJECTIVES: The risk of a urinary calculus during an extended duration mission into the reduced gravity environment of space is significant. For medical operations to develop a comprehensive strategy for the spaceflight stone risk, both preventive countermeasures and contingency management (CM) plans must be included. METHODS: A feasibility study was conducted to demonstrate the potential CM technique of endoscopic ureteral stenting with ultrasound guidance for the possible in-flight urinary calculus contingency. The procedure employed the International Space Station/Human Research Facility ultrasound unit for guide wire and stent localization, a flexible cystoscope for visual guidance, and banded, biocompatible soft ureteral stents to successfully stent porcine ureters bilaterally in zero gravity (0g). RESULTS: The study demonstrated that downlinked endoscopic surgical and ultrasound images obtained in 0g are comparable in quality to 1g images, and therefore are useful for diagnostic clinical utility via telemedicine transmission. CONCLUSIONS: In order to be successful, surgical procedures in 0g require excellent positional stability of the operating surgeon, assistant, and patient, relative to one another. The technological development of medical procedures for long-duration spaceflight contingencies may lead to improved terrestrial patient care methodology and subsequently reduced morbidity.
Mission Operations and Command Assurance (MO&CA) is a Total Quality Management (TQM) task on JPL projects to instill quality in flight mission operations. From a system engineering view, MO&CA facilitates communication and problem-solving among flight teams and provides continuous process improvement to reduce the probability of radiating incorrect commands to a spacecraft. The MO&CA task has evolved from participating as a member of the spacecraft team to an independent team reporting directly to flight project management and providing system level assurance. JPL flight projects have benefited significantly from MO&CA's effort to contain risk and prevent rather than rework errors. MO&CA's ability to provide direct transfer of knowledge allows new projects to benefit from previous and ongoing flight experience.
Mission Operations and Command Assurance (MO&CA) is a Total Quality Management (TQM) task on JPL projects to instill quality in flight mission operations. From a system engineering view, MO&CA facilitates communication and problem-solving among flight teams and provides continuous solving among flight teams and provides continuous process improvement to reduce risk in mission operations by addressing human factors. The MO&CA task has evolved from participating as a member of the spacecraft team, to an independent team reporting directly to flight project management and providing system level assurance. JPL flight projects have benefited significantly from MO&CA's effort to contain risk and prevent rather than rework errors. MO&CA's ability to provide direct transfer of knowledge allows new projects to benefit from previous and ongoing flight experience.
Approximately three years ago, the Agency's lead center for the human elements of spaceflight (the Johnson Space Center), along with the National Biomedical Research Institute (NSBRI) (which has the lead role in developing countermeasures) initiated an activity to identify the most critical risks confronting extended human spaceflight. Two salient factors influenced this activity: first, what information is needed to enable a "go/no go" decision to embark on extended human spaceflight missions; and second, what knowledge and capabilities are needed to address known and potential health, safety and performance risks associated with such missions. A unique approach was used to first define and assess those risks, and then to prioritize them. This activity was called the Critical Path Roadmap (CPR) and it represents an opportunity to develop and implement a focused and evolving program of research and technology designed from a "risk reduction" perspective to prevent or minimize the risks to humans exposed to the space environment. The Critical Path Roadmap provides the foundation needed to ensure that human spaceflight, now and in the future, is as safe, productive and healthy as possible (within the constraints imposed on any particular mission) regardless of mission duration or destination. As a tool, the Critical Path Roadmap enables the decisionmaker to select from among the demonstrated or potential risks those that are to be mitigated, and the completeness of that mitigation. The primary audience for the CPR Web Site is the members of the scientific community who are interested in the research and technology efforts required for ensuring safe and productive human spaceflight. They may already be informed about the various space life sciences research programs or they may be newcomers. Providing the CPR content to potential investigators increases the probability of their delivering effective risk mitigations. Others who will use the CPR Web Site and its content include program managers and administrators who track the program and are involved in decisions regarding resource allocation and program evaluation.
Approximately three years ago, the Agency's lead center for the human elements of spaceflight (the Johnson Space Center), along with the National Biomedical Research Institute (NSBRI) (which has the lead role in developing countermeasures) initiated an activity to identify the most critical risks confronting extended human spaceflight. Two salient factors influenced this activity: first, what information is needed to enable a "go/no go" decision to embark on extended human spaceflight missions; and second, what knowledge and capabilities are needed to address known and potential health, safety and performance risks associated with such missions. A unique approach was used to first define and assess those risks, and then to prioritize them. This activity was called the Critical Path Roadmap (CPR) and it represents an opportunity to develop and implement a focused and evolving program of research and technology designed from a "risk reduction" perspective to prevent or minimize the risks to humans exposed to the space environment. The Critical Path Roadmap provides the foundation needed to ensure that human spaceflight, now and in the future, is as safe, productive and healthy as possible (within the constraints imposed on any particular mission) regardless of mission duration or destination. As a tool, the Critical Path Roadmap enables the decision maker to select from among the demonstrated or potential risks those that are to be mitigated, and the completeness of that mitigation. The primary audience for the CPR Web Site is the members of the scientific community who are interested in the research and technology efforts required for ensuring safe and productive human spaceflight. They may already be informed about the various space life sciences research programs or they may be newcomers. Providing the CPR content to potential investigators increases the probability of their delivering effective risk mitigations. Others who will use the CPR Web Site and its content include program managers and administrators who track the program and are involved in decisions regarding resource allocation and program evaluation.