Inadvertent launch

The control structure for a second more complex example to be used later in the chapter, a fictional but realistic ballistic missile intercept system (FMIS), is shown in figure 8.2. Pereira, Lee, and Howard [154] created this example to describe their use of STPA to assess the risk of inadvertent launch in the U.S. Ballistic Missile Defense System (BMDS) before its first deployment and field test. 

Fire Enable Not Hazardous Will accept interceptor tasking and can progress to a launch sequence EARLY Can Inadvertently progress to an inadvertent launch Not Appiicabie... 

The FMIS system provides a less trivial example of step 1. Remember, the hazard is inadvertent launch. Consider the fire enable command, which can be sent by the fire control module to the launch station to allow launch commands subsequently received by the launch station to be executed. As described in Pereira, Lee, and Howard [154], the hre enable control command directs the launch station to enable the live fire of interceptors. Prior to receiving this command, the launch station will return an error message when it receives commands to fire an interceptor and will discard the fire commands. ... 

Figure 8.4 shows the results of performing STPA Step 1 on the fire enable command. If this command is missing (column 2), a launch will not take place. While this omission might potentially be a mission assurance concern, it does not contribute to the hazard being analyzed (inadvertent launch). 

If the FIRE ENABLE command is provided to a launch station incorrectly, the launch station will transition to a state where it accepts interceptor tasking and can progress through a launch sequence. In combination with other incorrect or mistimed commands, this control action could contribute to an inadvertent launch. 

A late FIRE ENABLE command will only delay the launch station s ability to process a launch sequence, which will not contribute to an inadvertent launch. A FIRE ENABLE Command sent too early could open a window of opportunity for inadvertently progressing toward an inadvertent launch, similar to the incorrect FIRE ENABLE Considered above. In the third case, a hre enable command might be out of sequence with a fire disable command. If this incorrect sequencing is possible in the system as designed and constructed, the system could be left capable of processing interceptor tasking and launching an interceptor when not intended. 

Inadvertent functioning is the accidental or unintentional initiation and execution of a system function. For example, inadvertent launch (IL) is an... 

Nuclear weapons are inadvertently prearmed, armed, launched, fired, or released. 

Plastic pellets inadvertently lost from plastic production and warehouse facilities pose a threat to fish and wildlife. Therefore, the U.S. EPA (Environmental Protection Agency) has classified plastic pellets as significant materials. . The finding of even one pellet in a storm water run-off without a permit is now subject to federal regulatory action with the potential for substantial fines and penalties. As a result, the plastics industry has launched Operation Clean Sweep, an initiative to prevent the accidental release of pellets into the environment. Specific recommendations for handling polyolefins to prevent resin loss into the environment have been developed by the Society for the Plastics Industry (38). 

A barrier function is a special safety function designed to prevent, control, or mitigate the propagation of failures or energy into an undesired event (UE) or mishap. A safety barrier can be a series of elements that together implement a barrier function, each element consisting of a technical system or human action. For example, series of interlocks are designed into a missile fire control system to prevent the inadvertent and unauthorized outcome of inadvertent missile launch function. The set of interlocks are safety barriers that implement a barrier function. 

Cascading failures can cause cascading fault states, whereby a sequence of normally off states can be initiated to the on fault states by a component failure. For example, the simple failure of a switch can result in prematurely (or inadvertently) applying power to a missUe launch system. The switch failure results in providing the normally expected power to the launch system, except at the wrong time. This is considered a command fault state, which is used extensively as a fault guide in FTA. 

For normal system operation missile launch would be expected when aU of the following conditions are successful (a) launch power is made available, (b) interlock 1 closure occurs, (c) interlock 2 closure occurs, and (d) interlock 3 closure occurs. The FT models these normal intended events occurring prematurely or inadvertently due to system failures. 

There shall be positive measures to prevent inadvertent prearming, arming, launching, firing, or releasing of nuclear weapons in all normal and credible abnormal environments. 

A quantitative analysis to assure that the probability of inadvertent nuclear detonation, inadvertent programmed launch, accidental motor ignition, inadvertent enabling, or inadvertent prearming meets the numerical requirements specified in applicable nuclear safety criteria documents. 

Most hazards will be inherent-type hazards (contact with high voltage, excessive weight, fire, etc.). Some hazards may contribute to system hazards (e.g., inadvertent missile launch), but generally, several subsystems will be required for this type of system hazard (thus the need for SHA). 

Top level in TLM does not necessarily imply a particular level of safety importance, but rather the common category visible at the system level (i.e., a hazard should fall within a particular TLM category). It should be noted, however, that by their very nature, TLMs have an implied level of safety-criticality. For example, the TLM Inadvertent missile launch has a greater safety-criticality than the TLM Personnel injury due to electrical contact. ... 

Inadvertent missile launch Controlled flight into Loss of astronaut oxygen... 

---