Satellite System Safety Analysis Using STPA

Traditional hazard analysis techniques based on failure models of accident causality, such as the probabilistic risk assessment (PRA) method currently used at NASA, are inadequate for analyzing safety at the system level. System-Theoretic Accident Model and Processes (STAMP) shifts the focus of safety from preventing failures to that of a dynamic feedback control system that enforces behavioral constraints. System-Theoretic Process Analysis (STPA), the hazard analysis method based on STAMP, was applied to the launch and mission phases of a NASA/JAXA Global Precipitation Measurement (GPM) Core Observatory-based satellite. Exploiting the fact that nearly all satellites follow similar lifecycles and employ common functional architectures with relatively-decoupled, unique mission payloads, a template for future satellite STPA safety analyses was developed. The template seeks to aid and guide new STPA applications while reducing analysis time by providing the STPA analysis for many common satellite functions. Increasing pressure to reduce satellite mission costs has renewed interest in modular payloads. Traditional hazard analysis methods are dependent on the hardware used, so they must be redone for the entire system if the payload is changed. This repetition of work is time intensive and costly. STPA is the only hazard analysis method that may be performed early in development and without details of the system hardware implementation. Using the GPM-based satellite STPA analysis, the influence of the mission payload on safety at the system-level is considered. Five types of control action mismatch resulting from changing payloads were identified along with the corresponding additional STPA analysis required to ensure safety at the system level.

Department dc:contributor.department

Massachusetts Institute of Technology. Department of Aeronautics and Astronautics.

Grantor dc:publisher

Massachusetts Institute of Technology

Year dc:date.issued

2013

Author dc:creator

• Dunn, Nicholas Connor

Advisor dc:contributor.advisor

• Nancy G. Leveson and Mary E. Devenny.

• Aeronautics and Astronautics.

Statement dc:rights

• M.I.T. theses are protected by copyright. They may be viewed from this source for any purpose, but reproduction or distribution in any format is prohibited without written permission. See provided URL for inquiries about permission.

Licence dc:rights.uri

• http://dspace.mit.edu/handle/1721.1/7582

Language dc:language.iso

eng

Handle dc:identifier.uri

http://hdl.handle.net/1721.1/85777

OAI identifier oai:identifier

oai:dspace.mit.edu:1721.1/85777