CHAPHS: critical hardware and proximate hazards system
Explore the source record for details and available documents.
safety hazard tracking systems safety↗
SEARCH · Search NASA
Results for “safety hazard tracking systems safety”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
A Predictive Safety Management System Software Package Based on the Continuous Hazard Tracking and Failure Prediction Methodology
The goal of this research was to integrate a previously validated and reliable safety model, called Continuous Hazard Tracking and Failure Prediction Methodology (CHTFPM), into a software application. This led to the development of a safety management information system (PSMIS). This means that the theory or principles of the CHTFPM were incorporated in a software package; hence, the PSMIS is referred to as CHTFPM management information system (CHTFPM MIS). The purpose of the PSMIS is to reduce the time and manpower required to perform predictive studies as well as to facilitate the handling of enormous quantities of information in this type of studies. The CHTFPM theory encompasses the philosophy of looking at the concept of safety engineering from a new perspective: from a proactive, than a reactive, viewpoint. That is, corrective measures are taken before a problem instead of after it happened. That is why the CHTFPM is a predictive safety because it foresees or anticipates accidents, system failures and unacceptable risks; therefore, corrective action can be taken in order to prevent all these unwanted issues. Consequently, safety and reliability of systems or processes can be further improved by taking proactive and timely corrective actions.
Quintana, Rolando↗
S&MA Internship to Support Orion and the European Service Module
As a University Space Research Association (USRA) intern for NASA Johnson Space Center (JSC) during the summer 2016 work term, I worked on three main projects for the Space Exploration Division (NC) of the Safety and Mission Assurance (S&MA) Directorate. I worked on all three projects concurrently. One of the projects involved facilitating the status and closure of technical actions that were created during European Service Module (ESM) safety reviews by the MPCV Safety & Engineering Review Panel (MSERP). The two main duties included accurately collecting and summarizing qualitative data, and communicating that information to the European Space Agency (ESA) and Airbus (ESA's prime contractor) in a clear, succinct and precise manner. This project also required that I create a report on the challenges and opportunities of international S&MA. With its heavy emphasis on soft skills, this project taught me how to communicate better, by showing me how to present and share information in an easy-to-read and understandable format, and by showing me how to cooperate with and culturally respect international partners on a technical project. The second project involved working with the Orion Thermal Protection System (TPS) Process Failure Modes and Effects Analysis (PFMEA) Working Group to create the first full version of the Orion TPS PFMEA. The Orion TPS PFMEA Working Group met twice a week to analyze the Avcoat block installation process for failure modes, the failure modes effects, and how such failure modes could be controlled. I was in charge of implementing changes that were discussed in meeting, but were not implemented real time. Another major task included creating a significant portion of the content alongside another team member outside the two weekly meetings. This project caused me to become knowledgeable about TPS, heatshields, space-rated manufacturing, and non-destructive evaluation (NDE). The project also helped me to become better at working with a small team and helped improved my technical communication skills. My main duty for the third project was creating a Safety Verification Tracking Log (SVTL) for the Orbital Maneuvering System Engine (OMS-E), and contacting subject matter experts to close Hazard Report (HR) control verifications. This project also required me to support other OMS-E safety process tasks, like monitoring OMS-E vibration testing for Quality Assurance (QA) purposes. This project helped me become even more proficient in Excel. Throughout the project, I gained knowledge about the OMS-E system and improved my understanding of pressure systems and propellant systems. In terms of education goals, this work term has affirmed my desire to take a few more space-related courses, like orbital mechanics, so that I can have a better understanding of human spaceflight and the industry surrounding it. However, the work term did not persuade me to pursue a master's degree. In terms of career goals, this work term has helped me clarify the direction I would like to head in the future. The perspective of three summer terms working for NASA in S&MA has allowed me to observe that most S&MA employees joined S&MA after working in other NASA directorates, such as Engineering or Flight Operations. It is my belief that it would be advantageous for both NASA and I for me to broaden my knowledge base and technical skill set by completing hands-on technical work on human spaceflight projects, and for me to integrate my safety experience directly into technical work in other directorates. The other significant advantage to this proposed situation is that if I were to eventually return to S&MA, I would be returning with a substantial set of hands-on technical experience and knowledge, which would be a significant resource for S&MA tasks and projects.
Hutcheson, Connor↗
Infusing Reliability Techniques into Software Safety Analysis
Software safety analysis for a large software intensive system is always a challenge. Software safety practitioners need to ensure that software related hazards are completely identified, controlled, and tracked. This paper discusses in detail how to incorporate the traditional reliability techniques into the entire software safety analysis process. In addition, this paper addresses how information can be effectively shared between the various practitioners involved in the software safety analyses. The author has successfully applied the approach to several aerospace applications. Examples are provided to illustrate the key steps of the proposed approach.
FTA↗
Evolution of International Space Station Program Safety Review Processes and Tools
The International Space Station Program at NASA is constantly seeking to improve the processes and systems that support safe space operations. To that end, the ISS Program decided to upgrade their Safety and Hazard data systems with 3 goals: make safety and hazard data more accessible; better support the interconnection of different types of safety data; and increase the efficiency (and compliance) of safety-related processes. These goals are accomplished by moving data into a web-based structured data system that includes strong process support and supports integration with other information systems. Along with the data systems, ISS is evolving its submission requirements and safety process requirements to support the improved model. In contrast to existing operations (where paper processes and electronic file repositories are used for safety data management) the web-based solution provides the program with dramatically faster access to records, the ability to search for and reference specific data within records, reduced workload for hazard updates and approval, and process support including digital signatures and controlled record workflow. In addition, integration with other key data systems provides assistance with assessments of flight readiness, more efficient review and approval of operational controls and better tracking of international safety certifications. This approach will also provide new opportunities to streamline the sharing of data with ISS international partners while maintaining compliance with applicable laws and respecting restrictions on proprietary data. One goal of this paper is to outline the approach taken by the ISS Progrm to determine requirements for the new system and to devise a practical and efficient implementation strategy. From conception through implementation, ISS and NASA partners utilized a user-centered software development approach focused on user research and iterative design methods. The user-centered approach used on the new ISS hazard system utilized focused user research and iterative design methods employed by the Human Computer Interaction Group at NASA Ames Research Center. Particularly, the approach emphasized the reduction of workload associated with document and data management activities so more resources can be allocated to the operational use of data in problem solving, safety analysis, and recurrence control. The methods and techniques used to understand existing processes and systems, to recognize opportunities for improvement, and to design and review improvements are described with the intent that similar techniques can be employed elsewhere in safety operations. A second goal of this paper is to provide and overview of the web-based data system implemented by ISS. The software selected for the ISS hazard systemMission Assurance System (MAS)is a NASA-customized vairant of the open source software project Bugzilla. The origin and history of MAS as a NASA software project and the rationale for (and advantages of) using open-source software are documented elsewhere (Green, et al., 2009).
Ratterman, Christian D.↗
[High Pressure Gas Tanks]
Four high-pressure gas tanks, the basis of this study, were especially made by a private contractor and tested before being delivered to NASA Kennedy Space Center. In order to insure 100% reliability of each individual tank the staff at KSC decided to again submit the four tanks under more rigorous tests. These tests were conducted during a period from April 10 through May 8 at KSC. This application further validates the predictive safety model for accident prevention and system failure in the testing of four high-pressure gas tanks at Kennedy Space Center, called Continuous Hazard Tracking and Failure Prediction Methodology (CHTFPM). It is apparent from the variety of barriers available for a hazard control that some barriers will be more successful than others in providing protection. In order to complete the Barrier Analysis of the system, a Task Analysis and a Biomechanical Study were performed to establish the relationship between the degree of biomechanical non-conformities and the anomalies found within the system on particular joints of the body. This relationship was possible to obtain by conducting a Regression Analysis to the previously generated data. From the information derived the body segment with the lowest percentage of non-conformities was the neck flexion with 46.7%. Intense analysis of the system was conducted including Preliminary Hazard Analysis (PHA), Failure Mode and Effect Analysis (FMEA), and Barrier Analysis. These analyses resulted in the identification of occurrences of conditions, which may be becoming hazardous in the given system. These conditions, known as dendritics, may become hazards and could result in an accident, system malfunction, or unacceptable risk conditions. A total of 56 possible dendritics were identified. Work sampling was performed to observe the occurrence each dendritic. The out of control points generated from a Weighted c control chart along with a Pareto analysis indicate that the dendritics "Personnel not Wearing Proper Protective and Hose/tubing located in high-traffic area" which account for 59.18% of total dendritic frequency need to be addressed to reduce the chance of a hazard from occurring. However, the occurrences of some dendritics are more important than others. As a result immediate, from a Weighted c perspective, corrective action should be taken to ameliorate the cause of the Class A dendritic "Personnel located under suspended or moving loads" rather than just the most commonly occurring dendritics. In any case the vast majority of data obtained indicates that testing operations possess a relatively high degree of safety.
Quintana, Rolando↗
Commercial Crew Program and the Safety Technical Review Board
The Commercial Crew Program (CCP) is unique to any other program office at NASA. After the agency suffered devastating budget cuts and the Shuttle Program retired, the U.S. gave up its human spaceflight capabilities. Since 2011 the U.S. has been dependent on Russia to transport American astronauts and cargo to the International Space Station (ISS) and back. NASA adapted and formed CCP, which gives private, domestic, aerospace companies unprecedented reign over America's next ride to space. The program began back in 2010 with 5 companies and is now in the final phase of certification with 2 commercial partners. The Commercial Crew Program is made up of 7 divisions, each working rigorously with the commercial providers to complete the certification phase. One of these 7 divisions is Systems Engineering and Integration (SE&I) which is partly comprised of the Safety Technical Review Board (STRB). The STRB is primarily concerned with mitigating improbable, but catastrophic hazards. It does this by identifying, managing, and tracking these hazards in reports. With the STRB being in SE&I, it significantly contributes to the overall certification of the partners' vehicles. After the partners receive agency certification approval, they will have the capability to provide the U.S. with a reliable, safe, and cost-effective means of human spaceflight and cargo transport to the ISS and back.
crew transportation system↗
NGSLR Safety Handbook
NASA's Next Generation Satellite Laser Ranging (NGSLR) station is the prototype for NASA's Satellite Laser Ranging (SLR) systems which will be deployed around the world in the coming decade. The NGSLR system will be an autonomous, photon-counting SLR station with an expected absolute range accuracy of better than one centimeter and a normal point (time-averaged) range precision better than one millimeter. The system provides continuous (weather permitting), 24 hour tracking coverage to an existing constellation of approximately two dozen artificial satellites equipped with passive retroreflector arrays, using pulsed, 532 nm, class IV laser systems. Current details on the approved laser systems can be found in the Appendix 1 of this document. This safety plan addresses the potential hazards to emitted laser radiation, which can occur both inside and outside the shelter. Hazards within the shelter are mitigated through posted warning signs, activated warning lights, procedural controls, personal protective equipment (PPE), laser curtains, beam blocking systems, interlock controls, pre-configured laser control settings, and other controls discussed in this document. Since the NGSLR is a satellite tracking system, laser hazards exist outside the shelter to personnel on the shelter roof and to passing aircraft. Potential exposure to personnel outside the system is mitigated through the use of posted warning signs, access control, procedural controls, a stairwell interlock, beam attenuation/blocking devices, and a radar based aircraft detection system.
satellite laser ranging↗
Relaxing USOS Solar Array Constraints for Russian Vehicle Undocking
With the retirement of Space Shuttle cargo delivery capability and the ten year life extension of the International Space Station (ISS) more emphasis is being put on preservation of the service life of ISS critical components. Current restrictions on the United States Orbital Segment (USOS) Solar Array (SA) positioning during Russian Vehicle (RV) departure from ISS nadir and zenith ports cause SA to be positioned in the plume field of Service Module thrusters and lead to degradation of SAs as well as potential damage to Sun tracking Beta Gimbal Assemblies (BGA). These restrictions are imposed because of the single fault tolerant RV Motion Control System (MCS), which does not meet ISS Safety requirements for catastrophic hazards and dictates 16 degree Solar Array Rotary Joint position, which ensures that ISS and RV relative motion post separation, does lead to collision. The purpose of this paper is to describe a methodology and the analysis that was performed to determine relative motion trajectories of the ISS and separating RV for nominal and contingency cases. Analysis was performed in three phases that included ISS free drift prior to Visiting Vehicle separation, ISS and Visiting Vehicle relative motion analysis and clearance analysis. First, the ISS free drift analysis determined the worst case attitude and attitude rate excursions prior to RV separation based on a series of different configurations and mass properties. Next, the relative motion analysis calculated the separation trajectories while varying the initial conditions, such as docking mechanism performance, Visiting Vehicle MCS failure, departure port location, ISS attitude and attitude rates at the time of separation, etc. The analysis employed both orbital mechanics and rigid body rotation calculations while accounting for various atmospheric conditions and gravity gradient effects. The resulting relative motion trajectories were then used to determine the worst case separation envelopes during the clearance analysis. Analytical models were developed individually for each stage and the results were used to build initial conditions for the following stages. In addition to the analysis approach, this paper also discusses the analysis results, showing worst case relative motion envelopes, the recommendations for ISS appendage positioning and the suggested approach for future analyses.
Menkin, Evgeny↗
In-Time Safety Assessment & Risk Prediction for Unmanned Aerial Systems
One of the critical challenges in emerging autonomous systems is timely mitigation of hazards encountered during operation which may not be known or accounted for at the time of design. Efficient execution of unmanned systems therefore demands a paradigm shift from scheduled periodic maintenance to predictive risk analysis that includes condition-based-monitoring, real-time reliability assessment and hazard mitigation. Particularly, the state-of-health parameters needs to be computed at the component level, unit level as well as the integrated system level. While in the former two levels, the physics of health propagation may be based on underlying electro-mechanical properties, system level prognostics often relies on data-driven models. Further, uncertainty from model, measurements and input sources should be accurately quantified to generate meaningful prediction results that can be fed into reliable decision making processes. Finally, the expected risk and time to failure has to be computed based on the current state-of-health of the overall system. This talk presents a conceptual design of such an in-time safety assurance approach for unmanned aerial vehicles (UAV) operating at low altitudes near and over populated areas. Typical in-flight hazard incidents include unplanned detour, proximity to obstacles, mid-flight component faults, limited battery life and poor quality of GPS measurements. Safety assessment therefore comprises trajectory generation and re-plan, battery RUL computation, distributed fault diagnostics and uncertainty management of predicted trajectory based on GPS measurement noise. The entire monitoring framework will be demonstrated on simulated as well as real UAV flight experiments conducted at the NASA Langley Research Center. This tutorial will therefore guide the audience through a step-by-step tracking of an autonomous system with focus on in-time risk prediction in the presence of unforeseen hazards and uncertain environment.
diagnostics↗
Design and Testing of an Approach to Automated In-Flight Safety Risk Management for sUAS Operations
An onboard risk management automation design is presented based on run-time assurance principles, as well as the concept for In-Time Aviation Safety Management Systems (IASMS) as described by the National Academies. The automation is designed to operate independently of the autopilot and perform real-time risk assessment spanning multiple classes of hazards, predict constraint violations, and track autopilot states. In the event of elevated risk conditions or predicted constraint violations, the automation will select from a set of available contingencies and trigger autopilot mode changes if necessary to mitigate risk exposure. The onboard automation also informs the remote operator/pilot of what the independent monitor is observing and any contingency decisions or actions that may arise during flight. Details of an implementation of this design and results of verification and validation activities, as required to meet stringent NASA software and system assurance standards, are also presented. This includes simulation and flight testing using small unmanned aircraft systems.
Ersin Ancel↗
Lockheed Martin Response to the OSP Challenge
The Lockheed Martin Orbital Space Plane System provides crew transfer and rescue for the International Space Station more safely and affordably than current human space transportation systems. Through planned upgrades and spiral development, it is also capable of satisfying the Nation's evolving space transportation requirements and enabling the national vision for human space flight. The OSP System, formulated through rigorous requirements definition and decomposition, consists of spacecraft and launch vehicle flight elements, ground processing facilities and existing transportation, launch complex, range, mission control, weather, navigation, communication and tracking infrastructure. The concept of operations, including procurement, mission planning, launch preparation, launch and mission operations and vehicle maintenance, repair and turnaround, is structured to maximize flexibility and mission availability and minimize program life cycle cost. The approach to human rating and crew safety utilizes simplicity, performance margin, redundancy, abort modes and escape modes to mitigate credible hazards that cannot be designed out of the system.
Sullivan, Robert T.↗
The MECA Payload as a Dust Analysis Laboratory on the MSP 2001 Lander
In a companion abstract, the "Mars Environmental Compatibility Assessment" (MECA) payload for Mars Surveyor Program 2001 (MSP 2001) is described in terms of its capabilities for addressing exobiology on Mars. Here we describe how the same payload elements perform in terms of gathering data about surface dust on the planet. An understanding of the origin and properties of dust is important to both human exploration and planetary geology. The MECA instrument is specifically designed for soil/dust investigations: it is a multifunctional laboratory equipped to assess particulate properties with wet chemistry, camera imagery, optical microscopy (potentially with LTV fluorescence capability), atomic force microscopy (AFM; potentially with mineral-discrimination capabilities), electrometry, active & passive external materials-test panels, mineral hardness testing, and electrostatic & magnetic materials testing. Additionally, evaluation of soil chemical and physical properties as a function of depth down to about 50 cm will be facilitated by the Lander/MECA robot arm on which the camera (RAC) and electrometer are mounted. Types of data being sought for the dust include: (1) general textural and grain-size characterization of the soil as a whole --for example, is the soil essentially dust with other components or is it a clast-supported material in which dust resides only in the clast interstices, (2) size frequency distribution for dust particles in the range 0.01 to 10.00 microns, (3) particle-shape distribution of the soil components and of the fine dust fraction in particular, (4) soil fabric such as grain clustering into clods, aggregates, and cemented/indurated grain amalgamations, as well as related porosity, cohesiveness, and other mechanical soil properties, (5) cohesive relationship that dust has to certain types of rocks and minerals as a clue to which soil materials may be prime hosts for dust "piggybacking", (6) particle, aggregate, and bulk soil electrostatic properties, (7) particle hardness, (8) particle magnetic properties, (9) bulk dust geochemistry (solubility, reactivity, ionic and mineral species). All of these quantities are needed in order for the human exploration program to make assessments of hazards on Mars, and to better enable the production on earth, of soil/dust simulants that can act as realistic test materials in terms of those properties that render dust a contaminant.Such properties include the small grain size that enables penetration of space-suit joints, mechanical interfaces and bearings, seals, etc., and presents difficulty for filtration systems. Size also plays a critical role in the potential for lung disease in long-term habitats. The properties of grain shape and hardness are important parameters in determining the abrasiveness of dust as it enters mechanical systems, or bombards helmet visors and habitat windows in dust-laden winds. Adhesive electrostatic and magnetic properties of dust will be prime causes of contamination of space suits and equipment. Contamination causes mechanical malfunction, tracking of dirt into habitats, "piggybacking" of toxins on dust into habitats, changes in albedo and efficiency of solar arrays and heat exchangers, and changes in electrical conductivity of suit surfaces and other materials that may have specific safety requirements regarding electrical conductivity. Other potentially hazardous properties of dust include the possibility of high solubility of some component grains (rendering them reactive), and toxicity of some materials --grains of superoxidants and heavy metals (there is always the slim, but not inconceivable possibility of biogenic components such as spores). Because Mars has no active surface aqueous regime, volcanic emissions, meteoritic debris, weathering products, and photochemical products of Mars have nowhere to go except reside in the surface; there are few mechanical or chemical (buffering) processes to remove the accumulation of eons. From a planetology perspective, there are many enigmatic issues relating to dust and the aeolian regime in general. MECA will be able to address many questions in this area. For example, if MECA determines a particular particle size distribution (size and sorting values), it will be possible to make inferences about the origin of the dust - - is it all aeolian, or a more primitive residue of weathering, volcanic emissions, and meteoritic gardening? Trenching with the Lander/MECA robot arm will enable local stratigraphy to be determined in terms of depositional rates, amounts and cyclicity in dust storms and/or local aeolian transport. Grain shape will betray the origin of the dust fragments as being the product of recent or ancient weathering, or the comminution products of aeolian transport --the dust-silt ratio might be a measure of aeolian comminution energy. Additional information is contained in the original.
Marshall, J.↗
Markov Jump-Linear Performance Models for Recoverable Flight Control Computers
Single event upsets in digital flight control hardware induced by atmospheric neutrons can reduce system performance and possibly introduce a safety hazard. One method currently under investigation to help mitigate the effects of these upsets is NASA Langley s Recoverable Computer System. In this paper, a Markov jump-linear model is developed for a recoverable flight control system, which will be validated using data from future experiments with simulated and real neutron environments. The method of tracking error analysis and the plan for the experiments are also described.
Zhang, Hong↗
Assurance of Fault Management: Risk-Significant Adverse Condition Awareness
Fault Management (FM) systems are ranked high in risk-based assessment of criticality within flight software, emphasizing the importance of establishing highly competent domain expertise to provide assurance for NASA projects, especially as spaceflight systems continue to increase in complexity. Insight into specific characteristics of FM architectures seen embedded within safety- and mission-critical software systems analyzed by the NASA Independent Verification Validation (IVV) Program has been enhanced with an FM Technical Reference (TR) suite. Benefits are aimed beyond the IVV community to those that seek ways to efficiently and effectively provide software assurance to reduce the FM risk posture of NASA and other space missions. The identification of particular FM architectures, visibility, and associated IVV techniques provides a TR suite that enables greater assurance that critical software systems will adequately protect against faults and respond to adverse conditions. The role FM has with regard to overall asset protection of flight software systems is being addressed with the development of an adverse condition (AC) database encompassing flight software vulnerabilities.Identification of potential off-nominal conditions and analysis to determine how a system responds to these conditions are important aspects of hazard analysis and fault management. Understanding what ACs the mission may face, and ensuring they are prevented or addressed is the responsibility of the assurance team, which necessarily should have insight into ACs beyond those defined by the project itself. Research efforts sponsored by NASAs Office of Safety and Mission Assurance defined terminology, categorized data fields, and designed a baseline repository that centralizes and compiles a comprehensive listing of ACs and correlated data relevant across many NASA missions. This prototype tool helps projects improve analysis by tracking ACs, and allowing queries based on project, mission type, domain component, causal fault, and other key characteristics. The repository has a firm structure, initial collection of data, and an interface established for informational queries, with plans for integration within the Enterprise Architecture at NASA IVV, enabling support and accessibility across the Agency. The development of an improved workflow process for adaptive, risk-informed FM assurance is currently underway.
Software Verification & Validation↗
Adaptive Independent Verification and Validation (IV&V) Reduces Risk of Software Impacting Safety in Artemis Missions
The National Aeronautics and Space Administration (NASA) is asking more of its human spaceflight programs than ever before through the collective Artemis Missions. The NASA Independent Verification and Validation (IV&V) Program contributes to NASA’s human spaceflight goals by providing IV&V services for NASA’s critical spacecraft and ground software. The IV&V Program is tasked with providing assurance from both individual and integrated mission software perspectives. The Artemis IV&V organization is actively supporting six distinct development efforts: Orion, the Space Launch System (SLS), Exploration Ground Systems (EGS), Mission Control Center (MCC), the Lunar Gateway, and the Human Landing System (HLS), representing a wide diversity of developer organizations, management structures, and development approaches. With much of this extremely complex flight and ground software being essential to human safety both on the ground and in space, Artemis IV&V is likewise challenged to provide more value-added assurance to future Artemis missions within a constrained budget. To meet this challenge, Artemis IV&V employs a variety of novel and evolving “Adaptive IV&V” approaches for planning and executing IV&V analysis to increase both the efficiency and effectiveness of the IV&V Program’s assurance activities, and to address the difficulties imposed by assuring software for a large, highly integrated, multi-mission enterprise managed and executed by physically and organizationally distinct programs. Instilling agile principles like iterative planning cycles, self-organizing teams, and regular retrospectives, into IV&V planning and execution has led to a more rapid turnaround of a minimum viable assurance product and allowed for increased alignment of assurance activities with development progress. Adopting an assurance case methodology has led to greater consistency and clearer communication of assurance design and provided a foundation for long-term maintenance of assurance plans, products, and results across missions. The IV&V-developed Assurance / Safety Case Analytical Network (A-SCAN) framework and tool has enabled the quantification and tracking of system/software risk and confidence. These confidence measures provide a means to repeatedly express the impact of planned and completed assurance work and the remaining residual risk. Applied as part of a “Follow-the-Risk” organizational ethos, this allows consistent rightsizing of analysis rigor and intensity commensurate with the perceived risk of defects, as well as appropriate targeting of the highest risk areas of the software to find safety issues before they can manifest. Finally, the development of the IV&V Advanced Risk Reduction Integrated Software Test and Operations Tri-program Lightweight Environment (ARRISTOTLE), an integrated software-only simulation of Orion, SLS, and EGS systems, has made it possible to independently test integrated pad and flight scenarios and inject faults to observe how the Artemis multi-program, mission software behaves in degraded modes and in response to hazards. These adaptive IV&V investments have enabled Artemis IV&V to become more efficient and effective in IV&V planning and execution and respond more readily to changes in the risk landscape, increasing the breadth and depth of risk reduction possible within the available resources. Residual risk tracking allows IV&V to communicate more effectively with stakeholders, both internal and external at all levels, and inform key decision-making personnel. This evolving assurance design approach provides IV&V surety that work is performed in the highest risk, most value-added areas of the software, to keep our astronauts and ground crews safe and ensure mission success.
Gerek A Whitman↗
Adaptive Independent Verification and Validation (IV&V) Reduces Risk of Software Impacting Safety in Artemis Missions
The National Aeronautics and Space Administration (NASA) is asking more of its human spaceflight programs than ever before through the collective Artemis Missions. The NASA Independent Verification and Validation (IV&V) Program contributes to NASA’s human spaceflight goals by providing IV&V services for NASA’s critical spacecraft and ground software. The IV&V Program is tasked with providing assurance from both individual and integrated mission software perspectives. The Artemis IV&V organization is actively supporting six distinct development efforts: Orion, the Space Launch System (SLS), Exploration Ground Systems (EGS), Mission Control Center (MCC), the Lunar Gateway, and the Human Landing System (HLS), representing a wide diversity of developer organizations, management structures, and development approaches. With much of this extremely complex flight and ground software being essential to human safety both on the ground and in space, Artemis IV&V is likewise challenged to provide more value-added assurance to future Artemis missions within a constrained budget. To meet this challenge, Artemis IV&V employs a variety of novel and evolving “Adaptive IV&V” approaches for planning and executing IV&V analysis to increase both the efficiency and effectiveness of the IV&V Program’s assurance activities, and to address the difficulties imposed by assuring software for a large, highly integrated, multi-mission enterprise managed and executed by physically and organizationally distinct programs. Instilling agile principles like iterative planning cycles, self-organizing teams, and regular retrospectives, into IV&V planning and execution has led to a more rapid turnaround of a minimum viable assurance product and allowed for increased alignment of assurance activities with development progress. Adopting an assurance case methodology has led to greater consistency and clearer communication of assurance design and provided a foundation for long-term maintenance of assurance plans, products, and results across missions. The IV&V-developed Assurance / Safety Case Analytical Network (A-SCAN) framework and tool has enabled the quantification and tracking of system/software risk and confidence. These confidence measures provide a means to repeatedly express the impact of planned and completed assurance work and the remaining residual risk. Applied as part of a “Follow-the-Risk” organizational ethos, this allows consistent rightsizing of analysis rigor and intensity commensurate with the perceived risk of defects, as well as appropriate targeting of the highest risk areas of the software to find safety issues before they can manifest. Finally, the development of the IV&V Advanced Risk Reduction Integrated Software Test and Operations Tri-program Lightweight Environment (ARRISTOTLE), an integrated software-only simulation of Orion, SLS, and EGS systems, has made it possible to independently test integrated pad and flight scenarios and inject faults to observe how the Artemis multi-program, mission software behaves in degraded modes and in response to hazards. These adaptive IV&V investments have enabled Artemis IV&V to become more efficient and effective in IV&V planning and execution and respond more readily to changes in the risk landscape, increasing the breadth and depth of risk reduction possible within the available resources. Residual risk tracking allows IV&V to communicate more effectively with stakeholders, both internal and external at all levels, and inform key decision-making personnel. This evolving assurance design approach provides IV&V surety that work is performed in the highest risk, most value-added areas of the software, to keep our astronauts and ground crews safe and ensure mission success.
Gerek Whitman↗
NASA's Identified Risk of Adverse Outcomes due to Inadequate Human Systems Integration Architecture
The NASA Human System Risk Board (HSRB) is responsible for tracking the evolution of the top ~30 human system risks identified to be associated with human spaceflight. As part of this process, the Board is charged with maintaining a consistent, integrated process to evaluate those risks and developing evidence-based risk posture recommendations. Risks are ranked by likelihood and consequence. Intermediate causal relationships between risk contributing factors and countermeasures that link hazards to outcomes are described using Directed Acyclic Graphs (DAGs). The DAGs are also useful for identifying common factors and countermeasures across the top 30 risks as well as communicating how astronaut exposure to spaceflight hazards leads to meaningful mission-level health and performance outcomes. One of the top risks tracked by the HSRB is The Risk of Adverse Outcomes Due to Inadequate Human-Systems Integration Architecture (HSIA). This risk captures the possibility that due to decreasing real-time ground support during missions beyond LEO, crew will be unable to adequately respond to unanticipated critical malfunctions or detect safety-critical procedural errors. The HSIA risk is ranked red (high) for Lunar surface and Mars missions due to the probability of Loss of Crew and Loss of Mission consequences. This paper describes the evidence that supports the HSIA risk ranking and presents the central narrative of the HSIA risk DAG-- i.e., anomaly detection, diagnosis, intervention, and task performance. Characterizations of the current state of practice for each of the DAG’s central nodes and the future tools needed for successful anomaly response are provided.
human-systems integration architecture↗