Safety and Risk-Based Design in Complex Systems-of-Systems

Abstract

*† More powerful, next -generation approaches to safety management and safety -driven design and decision -making are required in order to meet the mission safety and assurance goals for human space exploration in an affordable and effective way. The assumptions underlying our current safety and mission assurance approaches do not match the basic properties of some new types of hardware technology, particularly digital hardware, software, complex human decision -making and human -automation interaction, and accidents that arise from dysfunctional system component interactions rather than component failures. This p aper describes a new model of accident causation, called STAMP (System -Theoretic Accident Model and Processes), that integrates all elements of risk, including technical, organizational, and social. The new model provides the foundation for next -generation hazard analysis techniques, more comprehensive incident and accident root cause analysis, and continuous risk management systems to enhance decision -making in complex systems -of -systems. I. Introduction O achieve the levels of safety and reliability requ ired for successful space exploration, more powerful safety analysis and design techniques will be needed. Traditional hazard analysis and risk assessment techniques (such as Fault Tree Analysis, FMEA/CIL, and Probabilistic Risk Assessment) were created fo r mechanical systems and later extended to electro -mechanical systems and are better at evaluating completed designs than driving early design decisions. They rest on the assumption that accidents result from component failure and thus miss the increasingl y common accidents resulting from interactions among systems and components —such as foam hitting the Orbiter RCC panels or software thinking the spacecraft has landed and cutting off the descent engines prematurely. When building systems -of -systems that ar e software -intensive and require complex human decision making and human -automation interaction as well as distributed decision -making, today’s techniques are inadequate —extremely expensive to apply and capable of only limited results. The complexities inv olved in the interactions among components in sophisticated spacecraft and systems -of -systems overwhelm existing safety engineering techniques based on analyzing individual component failure, do not handle components like software (which is essentially des ign abstracted from its physical representation and thus does not ``fail’’), and present sometimes overwhelming challenges to organizations managing such complex systems. Billions of dollars have been lost in spacecraft mishaps in the past few years, inclu ding the Ariane 501, various Titan launch mishaps, and, of course, Columbia. Every recent Mars mission has run into software problems. This paper describes an approach to safety management and safety -driven design that overcomes the limitations of cur rent safety analysis and risk management techniques. The approach rests on a new model of accident causation called STAMP (Systems -Theoretic Accident Modeling and Processes), which extends the types of accidents that can be handled today. STAMP integrates all elements of risk, including technical, organizational and social. Note that safety here is not limited to human safety and crew survival, but also includes loss of mission, loss of equipment, and negative environmental impacts.

Cite this work

No public copy is stored for this record, so only the metadata is cited.

Stored only when both papers are in the corpus — 31 citations exist upstream.

Papers that cite the same references — the relational fallback while embeddings are still backfilling.