NASA/SP-2011-3423

Abstract

<strong>Introduction</strong> <br><strong>Background</strong> <br>Catastrophic accidents are usually preceded by precursory events that, although observable, are not recognized as harbingers of a tragedy until after the fact. In the nuclear industry, the Three Mile Island accident was preceded by at least two events portending the potential for severe consequences from an underappreciated causal mechanism [1]. Anomalies whose failure mechanisms were integral to the losses of Space Transportation Systems (STS) Challenger and Columbia had been occurring within the STS fleet prior to those accidents. Both the Rogers Commission Report [2] and the Columbia Accident Investigation Board report [3] found that processes in place at the time did not respond to the prior anomalies in a way that shed light on their true risk implications. <br>This includes the concern that, in the words of the NASA Aerospace Safety Advisory Panel (ASAP) [4], "no process addresses the need to update a hazard analysis when anomalies occur." At a broader level, the ASAP noted in 2007 [5] that NASA "could better gauge the likelihood of losses by developing leading indicators, rather than continue to depend on lagging indicators". <br>These observations suggest a need to revalidate prior assumptions and conclusions of existing safety (and reliability) analyses, as well as to consider the potential for previously unrecognized accident scenarios, when unexpected or otherwise undesired behaviors of the system are observed. This need is also discussed in NASA&#8223;s system safety handbook [6], which advocates a view of safety assurance as driving a program to take steps that are necessary to establish and maintain a valid and credible argument for the safety of its missions. <br>It is the premise of this handbook that making cases for safety more experience-based allows NASA to be better informed about the safety performance of its systems, and will ultimately help it to manage safety in a more effective manner.