page 194

2R - failure could cause loss of mission, but redundant hardware is present 2S - a ground support system that could cause loss of vehicle systems

3 - other failure types that may cause less severe damage without catastrophic effects on the mission

•Items rated 1, 1R, 2, 2R must be on the CIL.

•Items on the CIL must be redesigned or improved to fail safe, or else they will require that a special waiver be granted.

•EIFA (Element Interface Functional Analysis) is used to evaluate the effects of failure modes in either component on other components.

•These procedures don’t typically extend to software, although efforts were made to consider its effects. And, future efforts are expected to address some aspects.

•Other types of hazards are considered by,

-PHA (Process Hazard Analysis)

-SHA (Subsystem Hazard Analysis)

-OHA (Operations Hazard Analysis)

8.1.10 References and Bibliography

American Institute of Chemical Engineers, Guidelines for hazard evaluation procedures: with worked examples, 2nd edition, 1992.

Brimley, W., “Spacecraft Systems; Safety/Failure Tolerance Failure Management”, part of a set of course note for a course offered previously at the University of Toronto, 199?.

Dhillon, B.S., Engineering Design; a modern approach, Irwin, 1996.

Dorf, R.C. (editor), The Electrical Engineering Handbook, IEEE Press/CRC Press, USA, 1993, pp. 2020-2031.

Leveson, N., Safeware: system safety and computers, Addison-Wesley Publishing Company Inc., 1995.

Rasmussen, J., Duncan, K., and Leplat, J., New Technology and Human Error, John Wiley & Sons Ltd., 1987.

Ullman, D.G., The Mechanical Design Process, McGraw-Hill, 1997.