Model-Based SMA Initiative Phase 2 Report: Safety

In order to include Safety in Model Based Safety and Mission Assurance (MBSMA), an agency-sponsored team at Goddard Space Flight Center (GSFC) has completed a Safety study of modeling and testing as part of the Model-Based Safety and Mission Assurance Initiative (MBSMAI). In this study, GSFC Reliability experts developed a safety model of the Europa mission propulsion subsystem using a representative Commercial Off-The-Shelf tool, MADE (Maintenance Aware Design Environment from PHM Technology-Siemens). MADE was selected since its counterpart, SysML, does not have a safety plugin. If SysML adds capability as a follow-on action, we hope to test and compare with MADE. Since propulsion is/is one of the greatest contributors to hazards in satellite spacecraft, due to more inherent hazards than other subsystems and higher severity of hazards on average, it was chosen to demonstrate the possibility of modeling systems safety as a proof of concept. The model and its ability to support Systems Safety Analysis were then evaluated for accuracy, consistency, and efficiency in supporting traditional Safety and Mission Assurance (SMA) analysis and milestone artifact generation risks assessment and communication. Based on the modeling results and experiences in this study, the following is found in regard to modeling and modeling environments (modeling tools with associated safety embellishments/accessories – See Section 5): Model-Based Engineering is valid and useable for Safety Engineering for NASA SMA if adequate modeling processes and environment are established. Thus far, MADE is the only SMA-capable tool and provided the best current and future efficiency/consistency/accuracy possibilities for system-safety analysis at the time of this study (See Table 3). Further, it was determined that modeling process and controls are needed prior to generating any models to ensure and validate model accuracy. Hence, a key recommendation of this study is that the follow modeling process guidance be established (as shown in Figure 81): 1) Create a multi-discipline mission-specific modeling team (Systems Engineering (SE) and SMA at a minimum); 2) Clearly define modeling responsibilities (e.g., SEs model requirements, Designers model structure (Functional Block Diagram/Wire Diagram), System Safety Engineer (SSEs) model hazards (categories, mechanisms, causes, linkages, verifications, and controls), and Res model failure behaviors, characteristics, and mitigations (and assist with safety-cause linking); 3) Complete modeling and share common data between modeling elements; 4) Produce System Safety artifacts (and simulation results) and share resulting data between modeling elements; 5) Verify and refine modeling (and designs) until a final and acceptable result is achieved; and 6) Share modeling with future missions. Therefore, this study team recommends this study’s results, recommendations, and guidance (See Appendix B) be used by NASA to advance the modeling scope and depth used for model-based SMA analysis, establish SMA-to-SE/SE-to-SMA modeling collaboration and transition points, adapt/reshape traditional products while maintaining validity, and advance Model-Based tool capabilities. NASA subject matter experts and PHM/MADE are continuing to collaborate on modelling environment optimizations (See Section 4 and Table 3) to ensure accuracy/ efficiency/consistency returns are maximized for future NASA missions. However, the results and recommendations presented herein are based solely on System Safety discipline needs and were derived from modelling a small subsystem. Thus, the authors also recommend that this study continue to test additional SMA disciplines and more complex systems to assist NASA/GSFC in developing a unified model-based engineering approach and determining the best tool set to support that approach. Thus, the next phase planned for MBSMAI will evaluate Software Assurance and/or Quality Engineering analysis compatibility.