A framework for safe system design in space launch vehicles

Abstract

A hazard analysis for the test firing of NASA's Space Launch System core stage is performed using a systems-based alternative to the traditional reliability-based method. The method used, Systems-Theoretic Process Analysis (STPA), is shown to be a versatile and powerful tool in this application and by extension the development of future space launch vehicles. The Boeing Company has been selected by NASA as the prime contractor for the Space Launch System (SLS) cryogenic stages. As such, they are working with NASA to develop a comprehensive hazard analysis for core stage test firing and eventual launch operations. Developing, testing, and launching rockets is an inherently complex and high risk endeavor. Preceding the launch itself, one of the highest risk times in the operation of a rocket is the static fire testing, also called a hot fire. Hundreds of parameters need to be monitored in real time in order to ensure the system is operating nominally and equipment damage (and possible injury or death) will not occur. Depending on the point of the testing and the resultant speed at which events are occurring, different levels of automatic safing conditions and operator actions are required to protect the vehicle. Traditionally, the way these safing conditions are derived is through the evaluation of hazard reports, which are themselves based on a "reliability" model: hazards are seen to arise from the failure of individual components and are thus primarily mitigated through increasing component reliability or adding in redundancy. With the level of complexity and required safety of today's launch systems, it is beneficial to evaluate a new approach to identifying the underlying hazards in a system, including ones that arise from unsafe component interactions and not simply failures