NPR 8715.3.pdf

| NODIS Library | Program Management(8000s) | Search |

NASA

Procedural Requirements

NPR 8715.3D

Effective Date: August 01, 2017

Expiration Date: August 01, COMPLIANCE IS MANDATORY FOR NASA EMPLOYEES

NASA General Safety Program Requirements (Updated w/Change 3)

Responsible Office: Office of Safety and Mission Assurance

Table of Contents NPI 8715.93, NASA Policy Instructions: Impacts of NSPM-20 on NASA Nuclear Flight Safety Requirements and Practices.

Change Log

Preface P.1 Purpose P.2 Applicability P.3 Authority P.4 Applicable Document and Forms P.5 Measurement/Verification P.6 Cancellation

Chapter 1. Programmatic Safety Requirements

1.1 Overview of the NASA Safety Program

1.2 NASA General Safety Program Roles and Responsibilities

1.3 Public Safety

1.4 Institutional Roles and Responsibilities in the NASA Safety Program - RESERVED

1.5 Program Management Roles and Responsibilities in the NASA Safety Program

1.6 Risk Assessment and Risk Acceptance

1.7 Technical Safety Requirements for NASA-Unique Designs and Operations

1.8 SMA Program Reviews

1.9 Advisory Panels, Committees, and Boards

NPR 8715.3D -- TOC

This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 8715.3D -- TOC Page 1 of 63 https://nodis3.gsfc.nasa.gov/main_lib.html https://nodis3.gsfc.nasa.gov/lib_docs.cfm?range=8___ https://nodis3.gsfc.nasa.gov/adv_search.cfm https://nodis3.gsfc.nasa.gov/

1.10 Coordination with Organizations External to NASA - RESERVED

1.11 Safety Motivation and Awards Program - RESERVED

1.12 Safety Management Information - RESERVED

1.13 Relief from Agency-level SMA Requirements

1.14 Hazardous Work Activities That Are Outside NASA Operational Control

Chapter 2. System Safety

2.1 Introduction

2.2 Institutional Roles and Responsibilities

2.3 System Safety Framework

2.4 Scope of System Safety Modeling

2.5 Core Requirements for System Safety Process

2.6 System Safety Reviews

2.7 Change Review

2.8 Documentation

Chapter 3. Operational Safety - Cancelled by NPR 8715.1B

Chapter 4. Aviation Safety - Cancelled by NPR 8715.1B

Chapter 5. Fire Safety - Cancelled by NPR 8715.1B

Chapter 6. Nuclear Safety for Launching of Radioactive Materials

6.1 Purpose

6.2 Responsibilities

6.3 Nuclear Launch Safety Approval Process

6.4 Report Requirements

Chapter 7. Safety Training and Personnel Certification - Cancelled by NPR 8715.1B

Chapter 8. Safety for Facility Acquisition, Construction, Activation, and Disposal - Cancelled by NPR 8715.1B

Chapter 9. Safety and Risk Management for NASA Contracts

9.1 Purpose

9.2 Applicability and Scope

9.3 Authority and Responsibility

9.4 Requirements

NPR 8715.3D -- TOC

This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 8715.3D -- TOC Page 2 of 63

APPENDIX A. Definitions

APPENDIX B. Acronyms

APPENDIX C. Safety Motivation and Awards Program -

RESERVED

APPENDIX D. Activity and Radioactive Material Limits: Basic A1/A2 Values

APPENDIX E. Sample Safety and Health Plan for Service or Operations Contracts - RESERVED

APPENDIX F. Sample System Safety Technical Plan for Systems Acquisition, Research, and Development Programs -

RESERVED

APPENDIX G. References

NPR 8715.3D -- TOC

This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 8715.3D -- TOC Page 3 of 63

Change Log

Ch# Office Date Description

1 Chief, Safety and Mission Assurance

10/29/2018 Updated with 1400 compliance in the Authority and Reference documents section and corrected spelling.

2 Chief, Safety and Mission Assurance

02/01/2021 Chapters 3-5 and 7-8 Cancelled by NPR 8715.1B

3 Chief, Safety and Mission Assurance

04/13/2021 The following administrative changes were made:

1. Updated to ensure consistency with NPR 8715.1B.

Removed the institutional safety roles, responsibilities, and requirements (parts of Chapter 1, and all of chapters 3, 4, 5, 7, and 8, and appendices C, E, and F) that are now addressed in NPR 8715.1. Cleaned up the P.1 Purpose and P.2 Applicability to reflect changes.

Removed outdated and unused references, definitions, and acronyms primarily related to institutional safety.

2. Removed other unnecessary and outdated content such as Section 1.6, Risk Assessment and Risk Acceptance (addressed in NPR 8000.4), and Section 2.3, System Safety Framework (addressed in system safety handbooks).

NPR 8715.3D -- ChangeLog This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 8715.3D -- ChangeLog Page 4 of 63

Preface P.1 Purpose The purpose of this directive is to assure mission success. This directive defines NASA roles and responsibilities for assuring safety and mission success of NASA missions, and describes processes and evidence necessary to provide that assurance. NASA roles, responsibilities, and processes for protecting the public, workforce, and non-mission assets from NASA activities are defined in NPR 8715.1, NASA Safety and Health Programs.

P.2 Applicability

a. This directive is applicable to NASA Headquarters and NASA Centers, including Component Facilities and Technical and Service Support Centers. This language applies to the Jet Propulsion Laboratory (a Federally-Funded Research and Development Center), other contractors, recipients of grants, cooperative agreements, or other agreements only to the extent specified or referenced in the applicable contracts, grants, or agreements.

b. This directive is applicable to NASA missions and NASA controlled activities in support of NASA missions.

c. In this directive, all mandatory actions (i.e., requirements) are denoted by statements containing the term "shall." The term "may" denotes a discretionary privilege or permission, "can" denotes statements of possibility or capability, "should" denotes a good practice and is recommended, but not required, "will" denotes expected outcome, and "are/is" denotes descriptive material.

d. In this directive, the word "project" refers to a unit of work performed in programs, projects, and activities. Management of a work unit is referred to as "project management," which includes managing programs, projects, and activities.

e. In this directive, all document citations are assumed to be the latest version unless otherwise noted. Use of more recent versions of cited documents may be authorized by the responsible Safety and Mission Assurance Technical Authority.

P.3 Authority

a. The National Aeronautics and Space Act, 51 U.S.C. ch. 201.

b. Procedures for Implementing the National Environmental Policy Act (NEPA), 14 CFR § 1216.3.

c. Presidential Directive/National Security Council Memorandum Number 25 (PD/NSC-25), Scientific or Technological Experiments with Possible Large-Scale Adverse Environmental Effects and Aerospace Use of Major Radioactive Sources.

d. NPD 1000.0, NASA Governance and Strategic Management Handbook.

e. NPD 1000.3, The NASA Organization.

NPR 8715.3D -- Preface This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 8715.3D -- Preface Page 5 of 63

f. NPD 8700.1, NASA Policy for Safety and Mission Success.

P.4 Applicable Documents and Forms

a. NPR 1441.1, NASA Records Management Program Requirements.

b. NPR 7120.5, NASA Space Flight Program and Project Management Requirements.

c. NPR 8715.1, NASA Safety and Health Programs.

d. NASA-STD-8739.8, Software Assurance and Software Safety Standard.

e. IAEA Safety Series Number 6, International Atomic Energy Agency (IAEA), Safety Series Number 6, Regulations for the Safe Transport of Radioactive Material.

P.5 Measurement/Verification Compliance with the requirements contained in this directive is continuously monitored by the Center Institutional Safety Discipline Leads, by the project Safety and Mission Assurance Technical Authority, and by the NASA Office of Safety and Mission Assurance. Compliance may also be verified as part of selected life cycle reviews and by assessments, reviews, and audits of the requirements and processes defined within this directive.

P.6 CANCELLATION

NPR 8715.3C, NASA General Safety Program Requirements, dated March 12, 2008.

NPR 8715.3D -- Preface This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 8715.3D -- Preface Page 6 of 63

Chapter 1. Programmatic Safety Requirements

1.1 Overview of the NASA Safety Program

1.1.1 This document provides the procedural requirements that define the NASA Safety Program.

Safety program responsibility starts at the top with senior management's role of developing policies and providing strategies and resources necessary to implement and manage a comprehensive safety program. The NASA Safety Program is executed by the responsible Mission Directorate Associate Administrators, Center Directors, Office of Safety and Mission Assurance (OSMA), component facility managers, safety managers, project managers, systems engineers, supervisors, line organizations, employees, and NASA contractors.

Note: The basic principles for governing, managing, implementing, monitoring, and controlling work at NASA are addressed in NPD 1000.0, which provides direction for Mission Directorates and Centers to execute programs and projects.

1.1.2 As stated in NPD 8700.1, the objectives of the NASA Safety Program are to protect the public from harm, ensure the safety of employees, and affect positively the overall success rate of missions and operations through preventing damage to high-value equipment and property.

1.1.3 In general, the success or failure of an organization's safety efforts can be predicted by a combination of leading indicators (e.g., the number of open vs. closed inspection findings, awareness campaigns, training metrics, progress towards safety goals/objectives, the amount of hazard and safety analyses completed, and close calls) and its achievement measured by lagging indicators (e.g., the number of incidents involving injury or death to personnel, lost productivity [lost or restricted workdays], environmental damage, or loss of, or damage to, property). Like many successful corporations, NASA has learned that aggressively preventing mishaps is good management and a sound business practice.

1.1.4 NASA undertakes many activities involving high risk. Management of this risk is one of NASA's most challenging activities and is an integral part of NASA's safety efforts.

1.1.5 Policies, requirements, and procedures for mishap investigations are provided in NPR 8621.1.

1.1.6 NASA identifies issues of concern through a strong network of oversight councils and internal auditors including the Aerospace Safety Advisory Panel (ASAP).

1.1.7 NASA's goal is to maintain a world-class safety program based on management and employee commitment and involvement; system and worksite safety and risk assessment; hazard and risk prevention, mitigation, and control; and safety and health training.

1.2 NASA General Safety Program Roles and Responsibilities

Per NPD 1000.3, Mission Directorate Associate Administrators, through their project managers, and Center Directors, through their line managers, are responsible for the safety of the public and of their

NPR 8715.3D -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 8715.3D -- Chapter1 Page 7 of 63 assigned personnel, facilities, and mission systems from hazards created or controlled by the Mission Directorate or Center. Toward that end, they shall establish a safety and health program in accordance with NPR 8715.1, NASA Safety and Health Programs and meet the requirements of this

NPR.

1.3 Public Safety

Mission Directorate Associate Administrators and Center Directors shall ensure operational safety in accordance with NPR 8715.1.

1.4 Institutional Roles and Responsibilities in the NASA Safety Program - RESERVED

1.5 Program Management Roles and Responsibilities in the

NASA Safety Program

1.5.1 Mission Directorate Associate Administrators shall ensure that program and project Safety and Mission Assurance (SMA) Plans:

a. Addresses life cycle safety-relevant functions and activities.

b. Reflects a life cycle SMA process perspective, addressing areas including: procurement, management, design and engineering, design verification and test, software design, software verification and test, manufacturing, manufacturing verification and test, operations, and preflight verification and test.

c. Contains data and information to support each section of the SMA Plan for each major milestone review to include the Safety and Mission Success Review.

d. Contains trending and metrics utilized to display progress and to predict growth towards SMA goals and requirements.

e. As a minimum, addresses the following topics and associated requirements:

(1) Safety and mission success per this NPR.

(2) Risk classification of NASA payloads per NPR 8705.4.

(3) Reliability and maintainability per NPD 8720.1.

(4) Risk assessment per NPR 8705.5.

(5) Quality assurance per NPR 8735.2.

(6) Software safety and assurance per and NASA-STD-8739.8.

(7) Public and workforce safety and health per host Center requirements and consistent with NPR 8715.1.

(8) Range safety per per host Center requirements and consistent with NPR 8715.5.

NPR 8715.3D -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 8715.3D -- Chapter1 Page 8 of 63

(9) Payload safety per host Center requirements and consistent with NPR 8715.7.

(10) Orbital debris mitigation requirements per NPR 8715.6.

(11) Planetary protection requirements per NPR 8020.12, NID 8715.128, and NID 8715.129.

(12) Nuclear flight safety per chapter 6 of this NPR.

(13) Human-rating per NPR 8705.2.

(14) Mishap reporting per NPR 8621.1.

(15) Compliance verification, SMA audits, reviews, and assessments per NPR 8705.6.

1.5.2 Project managers shall ensure that contractor operations and designs are evaluated for consistency and compliance with the safety and health provisions provided in their contractual agreements.

1.6 Risk Assessment and Risk Acceptance

Requirements for risk assessment and acceptance are addressed as part of risk management in NPR 8000.4, Agency Risk Management Procedural Requirements.

1.7 Technical Safety Requirements for NASA-Unique Designs

and Operations

1.7.1 Risk Reduction Protocol

1.7.1.1 Project managers shall ensure that hazards and dominant contributors to risk are controlled according to the following:

a. Eliminate accident scenarios (e.g., eliminate hazards or initiating events by design).

b. Reduce the likelihood of accident scenarios through design and operational changes (hazard control).

c. Reduce the severity of accident consequences (hazard mitigation).

d. Improve the state-of-knowledge regarding key uncertainties that drive the risk associated with a hazard (uncertainty reduction to support implementation of the above strategies).

Note: Designs for hazard control and accident prevention and mitigation should include considerations for the possibility of human errors. The level of hazard control should be based on the level of risk associated with that hazard. Examples of risk reduction strategies include: control of system and operational characteristics, incorporation of safety devices, use of caution and warning devices, and the use of operational and management procedures and training. Some hazards may require a combination of several of these approaches for prevention, mitigation, and/or control. Providing protective clothing and equipment is considered an operational procedure.

1.7.2 Reliability and Failure Tolerance

NPR 8715.3D -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 8715.3D -- Chapter1 Page 9 of 63

1.7.2 Reliability and Failure Tolerance

1.7.2.1 Safety critical operations must have high reliability. High reliability is verified by reliability analysis using accepted modeling techniques and data in which uncertainties are incorporated.

Where this cannot be accomplished with a specified confidence level, the design of safety critical operations shall have failure tolerance and safety margins in which critical operability and functionality are ensured. Failure tolerance is the ability of a system to perform its function(s) or maintain control of a hazard in the presence of failures of its subsystems. Failure tolerance may be accomplished through like or unlike redundancy. Safety margins are the difference between as-built factor of safety and the ratio of actual operating conditions to the maximum operating conditions specified during design.

Note: For human space systems, failure tolerance requirements are provided in NPR

8705.2. Applicable failure tolerance requirements in this NPR pertain to all other systems.

1.7.2.2 To assure operability and functionality and to achieve failure tolerance, project managers shall use these design considerations.

a. Design safety critical systems such that the critical operation or its necessary functions can be assured. To provide assurance, design the component, subsystem, or system so it is are capable of being tested, inspected, and maintained.

b. Where high reliability cannot be verified by reliability analysis using accepted data in which uncertainties are incorporated, design safety critical systems so that no combination of two failures and/or operator errors (fail-safe, fail-safe as a minimum) will result in loss of life.

Note: Safety-critical operational controls are applied to conditions, events, signals, processes, or items for which proper recognition, control, performance, or tolerance are essential to safe system operation, use, or function.

c. Where high reliability cannot be verified by reliability analysis using accepted data in which uncertainties are incorporated, design safety critical operations so that no single failure or operator error (fail-safe) will result in system loss/damage or personal injury.

d. Where high reliability cannot be verified by reliability analysis using accepted data in which uncertainties are incorporated, provide functional redundancy where there is insufficient time for recovery or system restoration. Where there is sufficient time between a failure and the manifestation of its effect, design for restoration of safe operation using spares, procedures, or maintenance provides an alternative means of achieving failure tolerance.

e. Design safety critical systems and operations to have a safety margin.

f. When using redundancy, verify that common cause failures (e.g., contamination, close proximity) do not invalidate the assumption of failure independence.

g. When using redundancy in operations that could cause or lead to severe injury, major damage, or mission failure (safety critical operations), verify operability under conditions that singularly or separately added together represent the operating intended condition.

h.. When using reliability analyses, assess the probability of failure and associated uncertainties to provide the function and the time to restore the function, where loss of life, serious injury, or

NPR 8715.3D -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 8715.3D -- Chapter1 Page 10 of 63 provide the function and the time to restore the function, where loss of life, serious injury, or catastrophic system loss can occur. The time to restore the function shall include the active time to repair and the time associated with the logistics or administrative downtime that affects the ease or rapidity of achieving full restoration of the failed function.

1.7.2.3 To assure functional protection, project managers shall ensure that:

a. Loss of functional protection for safety-critical operations requires termination of the operation at the first stable configuration.

b. At least one single level of functional protection is used to protect high-value facilities and flight systems.

1.7.3 Inhibits

1.7.3.1 Where high reliability is not verified by reliability analysis using accepted data with uncertainties incorporated, the project manager shall ensure that:

a. Operations that require the control of a condition, event, signal, process, or item for which proper recognition, performance, or tolerance is essential to safe system operation, use, or function are designed such that an inadvertent or unauthorized event cannot occur (inhibit).

b. Operations have three inhibits where loss of life can occur.

c. Operations have two inhibits where personal injury, illness, mission loss, or system loss or damage can occur.

d. The capability of inhibits or control procedures when required in operations by this paragraph are verified under operational conditions including the verification of independence among multiple inhibits.

Note: Inhibits (designs that specifically prevent an inadvertent or unauthorized event from occurring) are not to be confused with the lockout/tagout program, which is a program to isolate or control facility system hazards; e.g., electrical, mechanical, hydraulic, pneumatic, chemical, thermal, or other energy.

1.8 SMA Program Reviews

Requirements for conducting and supporting independent SMA audits, reviews, and assessments are provided in NPR 8705.6.

1.9 Advisory Panels, Committees, and Boards

The Aerospace Safety Advisory Panel and the Independent Verification and Validation Board of Advisors are addressed in NPD 1000.3.

1.10 Coordination with Organizations External to NASA -

RESERVED

NPR 8715.3D -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 8715.3D -- Chapter1 Page 11 of 63

1.11 Safety Motivation and Awards Program - RESERVED

1.12 Safety Management Information - RESERVED

1.13 Relief from Agency-level SMA Requirements

1.13.1 This section provides policy and associated requirements for requesting and approving determination of nonapplicability, waivers, and deviations (aka: requests for relief) to Agency SMA requirements specified as overall SMA requirements for which OSMA is the Office of Primary Responsibility (OPR) or Point of Contact (POC). The primary objective of this policy is to assure that NASA Headquarters maintains oversight of the Agency SMA requirements while providing the program and project managers with the authority and flexibility to accept reasonable risks (in accordance with NPR 8000.4) necessary to accomplish their tasks. This policy is consistent with the ISO 9001 requirement for maintaining process control of services that an organization provides. This policy applies to all requirements levied on the programs and projects for which OSMA is the OPR or POC with the exception of requests for relief to requirements NPR 8715.1, NPR 8715.5 and NPR 8715.7, and standards incorporated by reference therein.

1.13.2 Relief from a requirement consists of documented and approved permission to vary from an established SMA requirement. There are four types of relief which can be granted to NASA SMA requirements that may be requested at different times during the life cycle of a program or project:

nonapplicable determination, tailoring, deviations, and waivers.

a. Determination of nonapplicability of a requirement eliminates a requirement from the list of applicable senior-level requirements during the requirement development process (NPR 7120.5 program/project phase A, or as defined in NPR 7120.8).

b. Deviations may be done to allow a program or project to decrease the scope of a senior-level requirement or increase the risk associated with a requirement during phases A and B as defined in NPR 7120.5, or the design phases as defined in NPR 7120.8.

c. Waivers are similar to deviations except they are granted after Phase B as defined in NPR 7120.5, or design complete as defined in NPR 7120.8.

1.13.3 Requests for relief to this document are processed in accordance with the requirements of NASA-STD 8709.20, Management of Safety and Mission Assurance Technical Authority (TA) Requirements.

Note: NASA-STD 8709.20 fully implements the requirements contained in NPR 1400.1, NASA Directives Procedural Requirements, and NPR 7120.4, NASA Engineering and Program/Project Management Policy.

1.13.4 The Chief, Safety and Mission Assurance, shall:

a. Serve as the adjudicating official for all requests for relief to Agency SMA requirements where OSMA is the OPR or POC.

b. Review all requests for relief to Federal, State, regulations, or Tribal laws, codes, standards, regulations, directives, and orders, where OSMA is the OPR or POC, before submittal to the Federal or State agency for approval.

NPR 8715.3D -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 8715.3D -- Chapter1 Page 12 of 63 or State agency for approval.

c. Forward requests for relief to the NASA Associate Administrator for requirements which are directed from Federal, State, local, or Tribal laws, codes, standards, regulations, directives, and orders and requests that have been denied and are being appealed per NPR 1400.1, NASA Directives Procedural Requirements, and NPR 7120.5, NASA Space Flight Program and Project Management Requirements.

d. Forward appeals to the NASA Associate Administrator where relief requests were originally adjudicated by the Chief, Safety and Mission Assurance.

e. Oversee project and program implementation of the relief request procedures in accordance with NPR 8705.6, Safety and Mission Assurance (SMA) Audits, Reviews, and Assessments.

1.14 Hazardous Work Activities That Are Outside NASA

Operational Control

Note: Non-spaceflight activities are now addressed in NPR 8715.1, in particular section 4.3.10, Multiemployer Worksites - Worksites not under NASA control, and section 13.8, Test / Operations Safety, for requirements on NASA civil servant participation in hazardous work activities outside NASA operational control.

1.14.1 It is NASA policy to formally review and approve NASA participation in hazardous work activities that are outside NASA operational control as needed to ensure that NASA safety and health responsibilities are satisfied. This policy applies unconditionally to NASA participation in commercial human spaceflight where current federal regulations do not necessarily provide for the safety of spaceflight vehicle occupants. This policy is non-retroactive and applies to hazardous ground or flight activities that involve research, development, test and evaluation, operations, or training, where all five of the following conditions exist:

a. NASA civil service personnel, Government detailees, specified contractors, or specified grantees are performing work for NASA.

Note 1: Paragraph 1.14 of this NPR applies to contractors and grantees only as specified by the responsible NASA manager in consultation with the cognizant NASA Center SMA organization based on an assessment of NASA safety responsibilities and/or obligations with regard to the activity.

Note 2: This policy only applies to personnel participating in activities within their official NASA duties.

b. The activity is outside NASA's direct operational control/oversight.

c. An assessment by the responsible NASA manager indicates there are insufficient safeguards and/or oversight in place.

Note: This policy does not apply to activities where safety oversight and/or safety regulations of other entities provide for safety of the participants (e.g., FAA, DoD, OSHA, ESA, JAXA) and foreign government-associated safety regulatory regimes.

NPR 8715.3D -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 8715.3D -- Chapter1 Page 13 of 63

d. The activity is not covered by a basic contract, grant, or agreement where Federal, State, and/or local requirements address personnel safety.

e. The nature of the activity is such that, if NASA were controlling it, a formal safety and/or health review would be required as part of the NASA approval process.

Note: Paragraph 1.14 of this NPR applies to activities conducted in unusual or unforgiving environments (such as underwater or extreme temperature/altitude), as well as activities conducted in remote areas where there is little or no access to medical care or other assistance in an emergency.

1.14.2 For NASA work activities that satisfy the conditions listed in paragraph 1.14.1 of this NPR, it is NASA policy to document and verify that risks are adequately controlled and any residual risk is acceptable following the steps below or through implementation of the System Safety process in Chapter 2 of this NPR:

a. As early as practical, conduct a comprehensive, documented review of the planned activity (the review may address a series of related activities). (See paragraph 1.14.3.h of this NPR for requirements that apply to the review.)

b. Document Agency approval by cognizant NASA officials, including formal acceptance of all associated risks.

c. Ensure activity participants are fully briefed on the safety and health aspects of the activity and the associated risks and that they formally consent to take the risk.

d. Ensure activity participants have all necessary training, equipment, and support.

1.14.3 Roles and Responsibilities. The following roles and responsibilities apply with regard to implementing the policy stated in paragraph 1.14.2 of this NPR.

a. The Chief, Safety and Mission Assurance shall oversee and resolve any questions regarding the implementation and applicability of this policy and related requirements to a proposed work activity.

b. Each Center Safety and Mission Assurance Director shall:

(1) Establish and implement processes and requirements needed to ensure compliance with this policy for applicable work activities within the scope of their authority.

(2) Provide safety expertise as needed to assist programs and projects to successfully complete the required NASA review and approval of applicable work activities.

(3) Formally concur in the scope of hazard assessments executed per paragraph 1.14.3.h.(2) for activities under their cognizance.

(4) Maintain records of all approvals granted under this policy and track the status of each activity.

c. The NASA official, at the appropriate level of authority in the supervisory chain over the participating personnel and any applicable non-NASA supervisor (identified by the Review Team per paragraph 1.14.3.h .(5) of this NPR), shall sign the approval documentation indicating consent for their assigned personnel to take the risk and participate in the activity.

d. Where deemed applicable by the review, the following NASA officials shall sign the approval documentation indicating that the risks are properly characterized for their area of responsibility and

NPR 8715.3D -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 8715.3D -- Chapter1 Page 14 of 63 documentation indicating that the risks are properly characterized for their area of responsibility and that they concur with acceptance of the risks to personnel under NASA safety responsibility, risk to NASA property, and any public risk due to NASA's part in the activity:

(1) The Center SMA official with cognizance over the activity (mandatory for any activity that involves safety risk to participants, the public, or to NASA property).

(2) The Center Health and Medical official with cognizance over the activity (mandatory for any activity that involves health risk to participants or the public or involves medical equipment or operations as part of the safety risk mitigation strategy).

(3) The NASA General Counsel or Center Chief Counsel (mandatory for any activity that involves U.S. or international law).

(4) The designated Technical Authority(ies) with cognizance over the associated project/program (mandatory for any activity that involves system design changes or invocation of NASA technical requirements as part of the risk mitigation strategy).

e. The personnel participating in the hazardous activity shall sign the approval documentation indicating that they are fully briefed on all safety and health risks inherent in the activity and are willing and able to participate.

f. After signature by the officials/personnel identified in paragraphs 1.14.3.c, 1.14.3.d, and 1.14.3.e of this NPR, the NASA official, at the appropriate level, as identified by the review per paragraph 1.14.3.h.(6) of this NPR, shall sign the approval documentation indicating formal acceptance of the associated risks to personnel under NASA safety responsibility, risk to NASA property, and any public risk due to NASA's part in the activity.

g. NASA managers (program/project/grant/institutional/other) shall ensure that all aspects of the policy in paragraph 1.14.2 of this NPR are satisfied for applicable work activities under their authority. In accomplishing this, NASA managers shall:

(1) Identify work activities that fall under the applicability of this policy in consultation with the cognizant Center SMA organization.

Note: Per paragraph 1.14.3a of this NPR, the Chief, Safety and Mission Assurance is responsible for resolving any questions regarding the applicability of this policy to a work activity.

(2) Satisfy local SMA processes and requirements designed to implement this policy.

(3) Establish a Review Team (see paragraph 1.14.3.h of this NPR for Review Team responsibilities) in consultation with the cognizant SMA, Health and Medical, Engineering, and Legal organizations;

and ensure that the Review Team incorporates all necessary expertise as required.

(4) Ensure that funding and other resources needed to satisfy this policy are budgeted and allocated.

Note: This includes any funding needed to staff the Review Team, obtain data, and develop the various review products required by the Review Team, such as the hazards analyses and risk assessments.

(5) Ensure all conditions for NASA approval are met, including implementation of all actions

NPR 8715.3D -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 8715.3D -- Chapter1 Page 15 of 63 identified by the Review Team.

(6) Ensure the preparation and finalization of the approval documentation.

h. The Review Team established per paragraph 1.14.3.g.(3) of this NPR and program/project/grant/institutional/other personnel as needed shall coordinate to:

(1) Identify and evaluate the safety, health and medical, and any safety-legal aspects of the activity.

(2) Identify and evaluate all associated hazards (design and/or operational), including evaluation of existing hazard/risk mitigations and safety requirements being implemented.

Note: The extent of this hazard evaluation is determined by the Review Team with the concurrence of the cognizant Center SMA Director and may vary depending on the specific safety concerns associated with the work activity.

(3) Assess and characterize any residual safety risks to personnel, public, and property.

Note: Characterization of the safety risks may be quantitative or qualitative as determined by the Review Team and as needed to ensure that NASA officials understand any risks they are asked to accept. The basis for the risk assessment includes the current NASA policies, requirements, and standards that would apply if NASA were controlling the activity.

(4) If the initial risks are unacceptable, identify actions that must be implemented to mitigate the risks as conditions for NASA approval to participate.

Note: This may include implementation of NASA technical standards and/or processes (or portions there of).

(5) Identify the NASA official(s), at the appropriate level of authority in the supervisory chain over the participating personnel and any non-NASA supervisor(s) (in the event that non-NASA personnel are involved), who must consent for the personnel to take the risk and participate in the activity.

Note: In accomplishing this, the Review Team identifies the appropriate level of NASA management in the supervisory chain with authority to represent the participating personnel based on the risk level and the applicable NASA risk management policy.

(6) Identify the NASA official who must formally accept the risks associated with and grant final approval of the activity.

Note: In accomplishing this, the Review Team identifies the appropriate level of NASA program/project management with authority for final approval based on the risk level and the applicable NASA risk management policy.

(7) For a series of related activities (that may involve the same or different participants over a period of time), identify a NASA readiness process to be implemented for each activity.

i. If the Review Team determines that a series of activities is a repetition of, or essentially the same as, a previously reviewed and approved activity, the Review Team may recommend that the NASA approving official (identified per paragraph 1.14.3.h.(6) of this NPR) grant a standing approval that

NPR 8715.3D -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 8715.3D -- Chapter1 Page 16 of 63 will remain in effect until there are substantive changes in the activity, personnel, or a specified period of time has elapsed, not to exceed 5 years.

j. The Assistant Administrator for Procurement, NASA Grant and Contracting Officers, and Cooperative Agreement, and other agreement officers shall ensure that grants, contracts, and agreements governing activities performed in support of NASA allow for implementation of this policy where specified by the cognizant NASA manager in consultation with the cognizant NASA Center SMA organization (per paragraph 1.14.3.g(1) of this NPR).

NPR 8715.3D -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 8715.3D -- Chapter1 Page 17 of 63

Chapter 2. System Safety

2.1 Introduction

2.1.1 This chapter establishes requirements for the implementation of system safety processes to support decision making aimed at ensuring human safety, asset integrity, and mission success in programs/projects.

2.1.2 System safety assessment is a disciplined, systematic approach to the analysis of risks resulting from hazards that can affect humans, the environment, and mission assets. It is a critical first step in the development of risk management strategies. System safety covers the total spectrum of technical risk and management activities including safety and risk assessments and safety performance monitoring.

2.1.3 The format of this chapter is different than that of the rest of this NPR because of the need to discuss advanced concepts in system safety by the references.

2.2 Institutional Roles and Responsibilities

2.2.1 Mission Directorate Associate Administrators, Center Directors, program and project managers, and line managers shall ensure that system safety activities are conducted for all programs and projects including system acquisitions, in-house developments (research and technology), design, construction, fabrication and manufacture, experimentation and test, packaging and transportation, storage, checkout, launch, flight, reentry, retrieval and disassembly, maintenance and refurbishment, modification, and disposal.

2.2.2 Center Directors, through their Center SMA Directors, shall ensure that knowledgeable system safety and technical risk analysts are made available to program/project managers and Center engineering directors to define and conduct system safety activities, including assurance of prime contractor system safety activities.

2.3 System Safety Framework

NASA's framework for system safety is described in NASA/SP-2010-580, NASA System Safety Handbook, Volume 1: System Safety Framework and Concepts for Implementation, and NASA/SP-2014-612, NASA System Safety Handbook Volume 2: System Safety Concepts, Guidelines, and Implementation Examples.

2.4 Scope of System Safety Modeling

2.4.1 Decision makers throughout the entire life cycle of the project, beginning with concept design and concluding with decommissioning, must consider safety. However, the level of formality and rigor that is involved in implementing the system safety processes should match project potential consequences, life cycle phase, life cycle cost, and strategic importance. To assist in determining the scope of activities for safety evaluations as a function of project characteristics, two tables are provided. The categorization scheme identified in Table 2.1 is used to determine a project priority.

NPR 8715.3D -- Chapter2 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 8715.3D -- Chapter2 Page 18 of 63 provided. The categorization scheme identified in Table 2.1 is used to determine a project priority.

This table is similar to Table 1 from NPR 8705.5, Probabilistic Risk Assessment (PRA) Procedures for NASA Programs and Projects.

Table 2.1, Criteria for Determining the Project Priority

CONSEQUENCE

CATEGORY CRITERIA / SPECIFICS

Project Priority Ranking

Human Safety and Health

Public Safety and Health

Planetary Protection Program Requirement

I

White House Approval

(PD/NSC-25)

Space Missions with Flight Termination Systems

Human Space Flight

Mission Success (for non-human rated missions)

High Strategic Importance Projects

Limited Window

High Cost (See NPR 7120.5)

Medium Cost (See NPR 7120.5) II

Low Cost (See NPR 7120.5) III

2.4.2 Once the project priority is determined, the scope of system safety modeling is determined using Table 2.2.

2.4.3 Projects identified as "Priority I" ranking from Tables 2.1 are generally the most visible and complex of NASA's product lines. Because of this, the system safety technical processes for Priority I projects must include probabilistic risk assessment as specified in NPR 8705.5, Probabilistic Risk Assessment (PRA) Procedures for NASA Programs and Projects. For Priority II or III projects, Table 2.2 provides latitude to adjust the scope of system safety modeling. This graded approach to the application of system safety modeling also operates on another dimension. That is, the level of rigor and detail associated with system safety modeling activities must be commensurate with the availability of design and operational information. The two-dimensional nature of the graded approach is intended to ensure that allocation of resources to system safety technical activities considers the visibility and complexity of the project and to ensure that the level of rigor associated with system safety models follows the level of maturity of the system design.

Note: For example, during the formulation phase, an order-of-magnitude or bounding assessment may be performed. In this type of assessment, the probability and/or the magnitude of consequence is approximated or bounded instead of deriving a best-estimate. These assessments are useful for screening purposes and initial risk tradeoff studies.

NPR 8715.3D -- Chapter2 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 8715.3D -- Chapter2 Page 19 of 63

Table 2.2, Graded Approach to System Safety Modeling

Priority Ranking

Scope (The level of rigor and details are commensurate with the level of design maturity)

I Probabilistic risk assessment (per NPR 8705.5) supported by qualitative system safety analysis

II Qualitative system safety analysis supplemented by probabilistic risk assessment where appropriate

III Qualitative system safety analysis

2.5 Core Requirements for System Safety Processes

2.5.1 The system safety modeling approaches previously described should be implemented as part of technical processes that represent system safety activities.

Conceptually, system safety activities consist of three major technical processes as shown in the circular flow diagram in Figure 2.6. These processes are designed to systematically and objectively analyze hazards and identify the mechanism for their elimination or control. These processes begin in the conceptual phase and extend throughout the life cycle of a system including disposal. In general, requirements for safety system technical processes must provide a risk-informed perspective to decision makers participating in the project life cycle. The three critical technical processes to a successful system safety program are (1) system safety modeling, (2) life cycle applications of models for risk-informed decisions and, (3) monitoring safety performance. The circular flow indicates that these technical processes are linked and are performed throughout the project life cycle. A System Safety Technical Plan is used to guide the technical processes and establish roles and responsibilities. This plan is established early in the formulation phase of each project and updated throughout the project life cycle.

NPR 8715.3D -- Chapter2 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 8715.3D -- Chapter2 Page 20 of 63

Figure 2.1, The System Safety Technical Processes

2.5.2 System Safety Technical Plan (SSTP)

NPR 8715.3D -- Chapter2 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 8715.3D -- Chapter2 Page 21 of 63

2.5.2 System Safety Technical Plan (SSTP)

2.5.2.1 The SSTP is designed to be a technical planning guide for the technical performance and management of the system safety activities. The SSTP can be a stand-alone document, or part of the SMA plan or the Systems Engineering Management Plan (SEMP). It provides the specifics of the system safety modeling activities and describes what and how safety adverse consequences will be modeled, how system safety models (qualitative and probabilistic risk assessments) will be integrated and applied for risk-informed decision making and safety monitoring, how the technical team(s) responsible for generating and maintaining system safety models will interact with…