Architectural mitigation

Product Service Experience Service experience (i.e., previous or current usage of the component) may be used to substantiate Development Assurance for previously developed hardware and for COTS components, where change is not introduced within this application. Note that in this context, this is direct product service history evidence, and not colloquial here say evidence. Data from non-airborne applications is not specifically excluded under RTCA/DO-254, although often these applications lack the necessary failure reporting data in order to be able to assess the product service experience. RTCA/DO-254 defines criteria on how to evaluate product service history. It should be noted that this is an onerous process, and many product service history cases do not have sufficient data in order to successfully evaluate product service history. Therefore, the architectural mitigation or advance verification methods must be used. 

Based on the process architecture of the three mitigation systems isolation, neutralisation and flushing fault trees were developed for each of them. 

Systems can often be designed and scaled to meet the requirements of individual organisations. To mitigate the risk of poor system performance healthcare organisations should take appropriate measmes at design time to estimate the numbers of concurrent users. Hosting organisations can use this information to predict the specification and architecture of systan components required to meet performance requirements. 

The combination of carefully projected user numbers, well established application demands and a scalable architecture provides strong evidence to mitigate hazards relating to poor system performance. 

We decided to use the mitigation potential of the hazard in the candidate architecture as an estimator of, or surrogate for, likelihood. Hazards that are more easily mitigated in the design and operations are less likely to lead to accidents. Similarly, hazards that have been eliminated during system design, and thus are not part of that candidate architecture or can easily be eliminated in the detailed design process, cannot lead to an accident. 

The final step in the process is to create safety risk metrics for each candidate architecture. Because the system engineers on the project created hundreds of feasible architectures, the evaluation process was automated. The actual details of the mathematical procedures used are of limited general interest and are available elsewhere [59]. Weighted averages were used to combine mitigation factors and severity factors to come up with a final Overall Residual Safety-Risk Metric. This metric was then used in the evaluation and ranking of the potential manned space exploration architectures. 

While hundreds of parameters were considered in the risk analysis, the process allowed the identification of major contributors to the hazard mitigation potential of selected architectures and thus informed the architeaure selection process and... 

The enterprise shall establish the models, simulations, or prototypes needed to support requirements definition, analyze the system architecture and design, mitigate identified risks, and thereby ensure that the final product satisfies market needs, requirements, and constraints. This effort supports the assessment of system functional and performance characteristics, producibility, supportability, environmental impact, and human systems engineering issues such as maintainability, usability, operability, and safety. 

While both types of architecture are subject to malfunctions, their inherent failure mitigation strategies differ. SBNs not only enable the transfer of capability to functioning modules, but also offer ways of reducing the cost penalty associated with an on-orbit failure, by targeting replacements to the failed sub-system(s) only instead of the entire system. Sources and localizations of failures constitute a diverse set in which the spacecraft subsystems that are potential candidates to fractionation represent a sigiuficant fraction. For example, a recent study of 156 on-orbit failures which occurred on 129 different spacecraft from 1980 to 2005 showed that 15% of the failures were due to the Command and Data Handling system (C DH) subsystem, and that 12% of the failures were due to the... 

As already discussed in section 3.2, the landing gear system uses hardware redundancy to mitigate some of the hazards associated with a landing gear control system. The system architecture uses four processors. 

---