NASA hazard levels

Even though some NASA documents reference the use of risk assessment codes (RACs), risk assessment for many NASA efforts is based on hazard level or criticality category. If risk assessment codes are used, they tend to use the hazard severity and probability categories and matrices from MIL-STD-882B. The NASA hazard levels are... 

The high-level system hazards that might be derived from the accidents defined for the NASA thermal tile processing robot in section 7.1 might be ... 

When working at such elevated levels of risk, the only question is which of many potential events will trigger the loss. The fact that it was the foam and not one of the other serious problems identified both before and after the loss was the only random part of the accident. At the time of the Columbia accident, NASA was regularly flying the Shuttle with many uncontrolled hazards the foam was just one of them. 

Safety tests at the battery level should, as a minimum, include overcharge, overdischarge and external short tests. It has been well established through years of testing at NASA-JSC that cell-level controls do not translate into battery-level controls. Controls, especially those internal to the cells, have shown to not protect or themselves be the cause for hazardous events due to their limitations (previously discussed in Section 3). Safety tests should also be carried out in the relevant environment. NASA-JSC test programs have indicated that safety tests under ambient pressure conditions display results contrary to that in a vacuum environment [22]. A cell or battery s safety tolerance up to the settings of the safety controls shall be verified by test. 

The CAIB report states that It was a small and logical next step for the discovery of foam debris damage to the tiles to be viewed by NASA as part of an already existing maintenance problem, an assessment based on experience, not on a thorough hazard analysis (CAIB, 2003 196). This statement is incorrect. As a result of the out-of-family anomaly for STS-87, a hazard analysis was conducted using fault tree methodology. A series of corrective actions were undertaken that, in the SSP s assessments, restored the tile damage to in-family levels. Experiments continued. 

---