Safety guided design analysis in multi-purposed Japanese unmanned transfer vehicle

Abstract

As with other critical systems, space systems are also getting larger and more complex. Although Japan Aerospace Exploration Agency (JAXA) has designed various spacecraft and had not experienced any serious accident for more than 10 years, loss of an astronomical satellite finally happened in 2016 even though the development process was not drastically different from the past. The accident implies that the complexity of space systems can no longer be managed by the traditional safety analysis. Furthermore, in huge system developments, the fluidity of design is rapidly lost as the development proceeds. Thus, creating a safer system design in the early development phase that is capable of handling various undesirable scenarios will significantly contribute to the success of huge and complex system development. The goal of this thesis is to establish the way to design a safer system in the context of modern huge and complex systems and demonstrate its effectiveness in an actual JAXA future transfer vehicle design. As a solution, in this thesis a new accident model called System Theoretic Accident Model and Process (STAMP) is used. The safety analysis methods based on STAMP were invented to handle the characteristics of modem complex systems. Furthermore, detailed designs are not required in the analysis. Therefore, the issues of modern complex systems are expected to be solved by the system theoretic safety design methods. In this thesis, two types of system analysis were conducted based on STAMP: concept design analysis in the target system and incident analysis in a similar previous system. While any detailed specification was not available, various unsafe off-nominal system behaviors were derived from the concept design, and it was refined. Remarkably, off-nominal behaviors due to a new design policy being applied in the system were successfully described. Furthermore, various design flaws involving human-automation interactions were also found, which usually tends to be discussed in the later development phase. The result indicates the proposed system theoretic safety design approaches can be successfully interwoven with the early stage of development process, and systems can be fundamentally refined from a safety perspective to prevent future serious losses.