Managing space launch and re-entry risks

An assessment of the current global conditions regarding space situational awareness and the need for space traffic control

Safety cases are recommended, and in some cases required, by a number of standards. In the product line context, unlike for single systems, safety cases are inherently complex because they must argue about the safety of a family of products that share various types of engineering assets. Safety case modularization has been proposed to reduce safety case complexity by separating concerns, modularizing tightly coupled arguments, and localizing effects of changes to particular modules. Existing modular safety-case approaches for product lines propose a feature-based modularization, which is too coarse to modularize the claims of different types, at different levels of abstraction. To overcome these limitation, a novel, modular safety-case architecture is presented. The modularization is based on a contract-based specification product-line model, which jointly captures the component-based architecture of systems and corresponding safety requirements as assume-guarantee contracts. The proposed safety-case architecture is analyzed against possible product-line changes and it is shown that it is robust both with respect to fine and coarse-grained, and also product and implementation-level changes. The proposed modular safety case is exemplified on a simplified, but real automotive system.

The purpose of Bureau of Safety and Environmental Enforcement (BSEE)'s Safety and Environmental Management Systems (SEMS) is to enhance safety of operations in the Gulf of Mexico (GoM) region. One of the four principal SEMS objectives is to encourage the use of performance-based operating practices. However, the current U.S. Regulatory framework for offshore operations in GoM does not provide the adequate tools to focus on the specific risks associated with a facility. The adoption of a Safety Case regime would steer the operations in the GoM towards this goal. Operators could take over the Safety Case as a significant input for the development of their Risk Management and Asset Integrity Management (AIM) programs for existing operating facilities as well as new facilities being planned. The paper discusses the application of a Safety Case and how the Operator can demonstrate that the major safety and environmental hazards have been identified, the associated risks are estimated and how these risks are managed by achieving a target level of safety. Throughout the Safety Case road map, the identification of the Safety Critical Elements (SCEs) and the associated Performance Standards represents one of the corner stone of the AIM Strategy. Introduction of the Safety Case would not imply a complete overhaul of the current Regulation, but would lead to a continuous and adequate enhancement of the Regulatory requirements towards a performance-based approach. It would include a prescriptive-based policy, combined with a performance/goal-oriented process, considering the specific risks inherent to the installations and the demonstration of how these risks are managed. With help of an example the paper discusses how application of Safety Case for existing facilities would highlight particular risks that may have been misjudged, taking into account the current state of its installations and the actual operational procedures in place. Further, this paper shows how existing Risk Management and AIM systems could be revised based on identification of SCEs and definition of the associated Performance Standards. This would also give the Regulator a quantified picture of current operations in the GoM and assist in re-defining the distribution of its resources and efforts in order to have an efficient review and verification impact. For the new facilities, the introduction of the Safety Case at the early stages of design would ease the integration of the overall risk management plan at each level of organization. The Regulator would have the ability to cross-analyze the risk results arising from the Formal Safety Assessment studies with the risk management plan drafted by the Operator. This paper investigates the possible integration of a performance/goal-oriented regime into existing Risk Management and AIM systems.

[Context and motivation] Safety-critical systems in application domains such as aerospace, automotive, healthcare, and railway are subject to assurance processes to provide confidence that the systems do not pose undue risks to people, property, or the environment. The development of safety cases is usually part of these processes to justify that a system satisfies its safety requirements and thus is dependable. [Question/problem] Although safety cases have been used in industry for over two decades, their management still requires improvement. Important weaknesses have been identified and means to assess the quality of safety cases are limited. [Principal ideas/results] This paper presents a research preview on the assessment of the quality of safety cases. We explain how the area should develop and present our preliminary work towards enabling the assessment with Verification Studio, an industrial tool for system artefact quality analysis. [Contribution] The insights provided allow researchers and practitioners to gain an understanding of why safety case quality requires further investigation, what aspects must be considered, and how quality assessment could be performed in practice.

Chapter 8 - Safety Cases

The production of a Safety Case is often seen as the “wrapping up” of the safety process – an activity that begins after earlier steps, such as hazard and risk analysis, have been completed. This misses the opportunity to benefit from the critical thinking that underlies a high-quality Safety Case. Especially when using Eliminative Argumentation, an incremental approach to the Safety Case can make the entire development process more efficient. In a range of industries including automotive, aerospace, energy, nuclear and rail, we have wit-nessed the benefits of starting Safety Case production early. We have used an incremental approach to the Safety Case to help shape the functional safety concept, derive safety requirements, influence system and software architectures, and focus validation and verification in a way that is commensurate with the system and is most likely to yield useful results.

We observed that safety arguments are prone to stay too abstract, e.g. solutions refer to large packages, argument strategies to complex reasoning steps, contexts and assumptions lack traceability. These issues can reduce the confidence we require of such arguments. In this paper, we investigate the construction of confident arguments from (i) hazard analysis (HA) results and (ii) the design of safety measures, i.e., both used for confidence evaluation. We present an argument pattern integrating three HA techniques, i.e., FTA, FMEA, and STPA, as well as the reactions on the results of these analyses, i.e., safety requirements and design increments. We provide an example of how our pattern can help in argument construction and discuss steps towards using our pattern in formal analysis and computer-assisted construction of safety cases.

We propose the concept of a model-connected safety case that could simplify certification of complex systems. System design models support the synthesis of both the structure of the safety case and the evidence that supports this structure. The resultant safety case argues that all hazards are adequately addressed through meeting the system safety requirements. This overarching claim is demonstrated via satisfaction of the integrity requirements that are assigned to subsystems and components of the system through a sound process of model-based allocation that respects the system design and follows industry standards. The safety evidence that substantiates claims is supported by evidence which is also auto-constructed from the system model. As the system model evolves during design, the corresponding model-connected safety case can be auto-updated. The approach is underpinned by a data model that connects safety argumentation and safety analysis artefacts, and is facilitated by a software tool.

Chapter 20 - International launch and re-entry safety standards

Critical Asset Performance Standards (CAPS) are designed to meet operational safety and environmental protection requirements. CAPS define the key aspects of safety-critical elements (SCEs), including equipment, procedures, personnel, inspections and verifications necessary to preserve the integrity of the control measures that reduce the risk of a catastrophic major accident event (MAE). This paper offers an overview of the process involved in developing CAPS for integration into a Safety and Environmental Management System (SEMS) as part of an overall Risk-Based Asset Management strategy that provides regulatory compliance and system reliability. The relationships between SCEs, CAPS and associated maintenance tasks are an important aspect of the design, operation, reliability and safety case of a facility. They ensure that, as far as reasonably practicable, the facility design is in accordance with the latest codes and standards for the facility and complies with any additional requirements defined within the safety case to demonstrate that the risk for MAEs to all personnel working on the facility is maintained as low as reasonably practicable (ALARP). At the end of the CAPS development process, the following information will be available: Comprehensive list of the critical assets and an understanding of their relationship to MAEs; Well-defined performance-based standards for all SCEs; Metrics for trending and continuous improvement efforts; Documented maintenance tasks for all critical assets For each SCE, CAPS are developed to document the minimum performance required of the SCE in meeting its role in preventing or mitigating MAEs. CAPS can then be used as check lists for validation of the design and a basis for ongoing maintenance during operations. It should be noted that codes, standards and best practices are regularly updated in response to incidents that have occurred and it important to incorporate new learning, methods and technologies. Using a proper Management of Change (MoC) process, CAPS can be invaluable tools for assessing impacts to risk as a result of these changes. Performance standards may legitimately change during the life cycle of an installation. Therefore they should remain living documents and be updated as necessary. As with any safety and reliability-related program, a comprehensive approach also includes independent verification and periodic reevaluation for continuous improvement. Leveraging CAPS within a Risk-Based Asset Management strategy provides the framework for setting documented performance standards and establishing traceability to ensure regulatory compliance that ultimately meets corporate objectives for safe operations.

Information technology (IT) risk management plays an important role in controlling security and building confidence in using IT system services.Many organizations have focused on risk management for IT security.In this study the committee of sponsoring organizations of the treadway commission (COSO) enterprise risk management (ERM) was used in risk management by identifying risk factors in accordance with the requirements of COBIT 5 areas that need to be controlled.In addition, 2 experiments were conducted with 3 government organizations and 3 business organizations in order to evaluate the performance of IT security control.The first experiment identified the risk levels with risk assessment, which provided the risk levels that need risk response in accordance with COBIT 5 framework implementation life cycle.From the second experiment, it was found that the risk management using all 7 phases of the COBIT 5 implementation life cycle decreased the risk levels for both government and business organizations.However, moderate and low risk levels were still observed which need to be managed in order to keep them at a very low level.In addition, it was found that the risks of government and Business organizations were different, which was a result of differences in obstacles and the context of the problems encountered in risk management.The findings of this study provide the guidelines for developing a framework for IT risk management in the future.

In order to fulfil its mission, the Belgian Regulatory Body (constituted in Belgium by FANC and Bel V) has set up its own Research & Development programme, independent from the Waste Management Organisation's one. The Regulatory Body's Research & Development programme is mostly intended to investigate safety issues with the objective to be able to assess if the safety concept developed by the Waste Management Organisation fulfils the defined safety requirements. It includes the development and the follow-up of in situ experiments in underground research laboratories (e.g. in the Mont Terri project in Switzerland and at Tournemire in France). Such activities are essential to maintain and improve the scientific and technical skills, to strengthen the independence from the Waste Management Organisation and to build public confidence in the regulatory function. More generally, Research & Development in underground research laboratories is important to the Regulatory Body as it allows investigating processes, technologies and activities important to safety under in situ conditions. In particular, it is essential to accurately identify and characterize the processes upon which the safety functions of a disposal system rely, as well as processes that may affect the system performance. It is also necessary to demonstrate that construction and operational methods and technologies are technically feasible and can be implemented as assumed in the safety case. Such research and development activities are of great importance to properly manage some of the key uncertainties associated with a disposal programme and in particular to identify, characterize and reduce them where needed.

The Health and Safety Executive (HSE) published three reports on 18February 2000 in relation to operations at British Nuclear Fuels(BNFL), Sellafield. The firstreport, by HSE's Nuclear Installations Inspectorate (NII), gave thefindings of an investigation into falsification of fuel pellet data atBNFL, Sellafield, and its effect on the safety of MOX fuel in use. Itanalysed in detail the issues surrounding the falsification of qualityassurance data at the MOX Demonstration Facility (MDF) and explained whyNII believes the fuel supplied to Japan will be safe in use. The report concluded that: A systematic management failure allowed various individuals to falsifyquality assurance (QA) records for fuel pellet diametermeasurements. It was not possible to establish a motive for the falsification, butpoor ergonomic design of the plant, the tedium of the job and the easewith which the computer data logging system could be manipulated wereseen to be contributory factors. Although QA data were falsified, this would have no effect on thesafety of the fuel in a nuclear reactor, since the diameter of all fuelpellets is checked and recorded at an earlier stage in the process by afully-automated system. The second report on control and supervision of operations at BNFL,Sellafield concluded that the site lacks a high-quality safetymanagement system. It also found that the site lacks: sufficient resources to implement the existing safety managementsystem, and an effective, independent inspection, auditing the reviewsystem within the company.The report is the result of an inspection by HSE's NII, set up after a series of events in 1999 whichpointed to weaknesses in control and supervision. The inspection focusedon: incidents, control and supervision of operations, and staffing andresources, plus central issues associated with the management of thesite. The report makes 28 recommendations.The third report comprised an updated safety review of high-level liquidwaste storage and covers progress since HSE's last report on this issuewas published in 1995. The report is divided into four main parts: Part 1 discusses the highly active liquor (HAL) storage facility (B215)in the context of current and past operations at Sellafield, and thelegislative framework under which the site is regulated. Part 2 explains why NII believes that the B215 operations remainacceptably safe. It summarises and discusses BNFL's safety case. The keysafety issues are addressed, especially those associated withmaintaining the cooling of the HAL and those affecting its containmentand isolation from the environment. Improvements introduced by BNFL,following its own review, are also discussed. Part 3 covers the wider safety requirement to reduce risk by continuingto vitrify the liquid waste. It discussed throughput issues forincorporating the HAL inventory into glass, the requirement to definethe residual buffer stock and sets out BNFL's ongoing approach tomonitoring and regulating BNFL's strategy for emptying the tanks. Part 4 presents the general conclusions on the safety of HAL storage inthe tanks, arising from the discussion of issues in parts 2 and 3. Italso summarises the more important areas where further information isrequired from BNFL. Annexes cover: regulation of operations atSellafield, historical development of B215, a description of the tanksand a summary of NII's recommendations.As a result of NII's recommendations in the report on storage ofhigh-level liquid waste, BNFL is updating its strategies for reprocessing, and its forecasts ofvitrification plant performance, so that its predictions for thereduction of liquid waste stocks will be more reliable, has agreed to carry out an options study for reducing the stocks to abuffer quantity by around 2015, in line with previouscommitments, and has strengthened the safety case to include additional engineeringinformation and fault analysis.The report sets out HSE's regulatory strategy to achieve reductions instocks to a buffer quantity, which should be the minimum required forsafe and efficient operation. The report states that HSE intends usingits regulatory powers to ensure that BNFL reduces HAL stocks to thebuffer quantity by around 2015. As part of the options study, NII requires BNFL to propose a stockreduction programme, with milestones for monitoring progress. HSEintends to publish an addendum to this report when suitable progress hasbeen made.

Summary A sparse grid approach to orbit uncertainty propagation is presented. Efficient and accurate uncertainty propagation methods for nonlinear dynamic systems have been of enormous interest to space object tracking. Recent methods include those based on the time evolution of the probability density function, the statistical moments, the random samples, or a sum of Gaussian components. The idea of the sparse grid method for orbit uncertainty propagation is to represent the initial uncertainty by a sparse grid, propagate the sparse grid points individually through the nonlinear orbit dynamics, and compute the statistical moments from the propagated sparse grid points. The Smolyak rule is used to generate the sparse grid through linear combinations of low-level tensor products; the number of the resultant sparse grid points is polynomial in the dimension of the state. The sparse grid based uncertainty propagation may be considered a generalization of the Unscented Transformation (UT) of the well-known Unscented Kalman Filter but can achieve much higher accuracy levels than UT. Two examples of orbit propagation in different dynamic environments are used to show the efficacy of the sparse grid approach.

: The purposes of the (SERDP) program are as follows: (1) To address environmental matters of concern to the Department of Defense and the Department of Energy through support for basic and applied research and development of technologies that can enhance the capabilities of the departments to meet their environmental obligations. (2) To identify research, technologies, and other information developed by the Department of Energy for national defense purposes that would be useful to governmental and private organizations involved in the development of energy technologies and of technologies to address environmental restoration, waste minimization, hazardous waste substitution, and other environmental concerns, and to share such research, technologies with such governmental and private organizations. (3) To furnish other governmental organizations and private organizations wit data, enhanced data collection capabilities, and enhanced analytical capabilities for use by such organizations in the conduct of environmental research, including research concerning global environmental change. (4) To identify technologies developed by the private sector that are useful for Department of Defense and Department of Energy defense activities concerning environmental restoration, hazardous and solid waste minimization and prevention, hazardous material substitution, and provide for the use of such technologies in the conduct of such activities.