1. Add Graphic(s) or Photo(s) CAD/PAD Staff Engineer
System Safety – Risk Assessments and Their Role in Service Life Extensions
Add Graphic(s) or Photo(s)
USS Forrestal
Rae Azorandia
CAD/PAD Staff Engineer
23 May 2017

2. Agenda System Safety CAD/PAD System Safety Approach Background
Risk Baseline
Service Life Extension Drivers
Service Life Extension (SLE) Process
Risk Analysis
Risk Assessment
Risk Acceptance
Issues
Proactive Efforts

3. System Safety Definitions:
System safety is defined as “The application of engineering and management principles, criteria, and techniques to achieve acceptable mishap risk, within the constraints of operational effectiveness and suitability, time, and cost, throughout all phases of the system life cycle” (MIL-STD-882D).
Definitions:
System Safety – The practice of identifying, classifying, mitigating, and accepting residual mishap risk
Hazard – An event or situation that has the possibility of causing an undesirable impact to safety, cost, schedule, or mission performance
Risk – Classifying a hazard based on severity and probability
Safety Risk
(Prevent Mishaps
& Accidents)
Program Risk
(Prevent impact to cost,
schedule, or performance)
Read green
Simply identifying and documenting hazards
Determine how bad and how often
Mitigate where possible
Re-evaluate

4. CAD/PAD System Safety Approach
Nature of CAD/PAD dictates System Safety be done a bit differently than other programs.
Focus on components of some other sub-system or system
Coordination with higher level System Safety structure
Serve varying customers (services, NASA, Foreign Military sales, and private organizations)
Varying requirements (performance, safety, logistics, fielding)
Provisioned by differing program offices
Facilitates grouping items together by attributes (design characteristics, application, use, and/or acquisition method)
Energetic content in CAD/PAD dictates special attention to explosive safety as a key component of System Safety
Components within complex systems
Different customers have different requirements – some are more risk averse than others
Leverage similar designs in assessments
Since CAD/PAD contain energetics, explove risk must be considered – not just will it go or not when called upon, but is it safe to be around

5. Background
CAD/PAD System Safety Program evaluates safety risk over the life cycle of the program
Focuses on:
CAD/PAD component
System used
Energetic materials used in the device
Life cycle includes development, qualification, in-service which includes service life, demilitarization
Risk posture is monitored during each phase of life cycle
Start with the hazards of the component alone
Consider the system it is used in both directly – what is it connected to, but also what is the environment this system sees.
What are the constituents of the item, what affects them – and how does it affect them…
Begin with assessing risk at development and monitor thought its lifecycle through CODRs and OAs

6. Risk Baseline
Performance is baselined during development and qualification
Performance limits are established
System performance limits
Design limits
Lot acceptance limits
Verified by qualification testing and documented in procurement documents (drawings, spec, acceptance test plans)
At service release, risks assessed to be negligible
Frequency of Hazard/Failure less than improbable
Service life established at time of qualification
Baselined during qualification using as much information as we have…
What are the known hazards to an item – what affects them.
Environments, installation, transportation
Establish performance limits
3 levels of limits
Lot Acceptance limits are within the design limits which are within the system limits.
We know the energetics in items change over time, so we try to determine LAT limits within the design limits to ensure we are within specification limits for the life of the unit
Verify these limits with testing
At release we assess and mitigate hazards so their likelihood is less than improbable.
Establish service life.

7. Risk Baseline - Qualification
System
Component
Exceeds NAVSEA C Final (Type) Qualification Requirements
Tailored for system application
MIL-D-23615, Design and Evaluation of Cartridge Actuated Devices
MIL-D-21625, Design and Evaluation of Cartridges for Cartridge Actuated Devices
MIL-C-83124, Cartridge Actuated Devices/Propellant Actuated Devices, General Specification For
MIL-C-83125, Cartridge for Cartridge Actuated/Propellant Actuated Devices, General Specification For
MIL-C-83126, Propulsion Systems, Aircrew Escape, Design Specification For
MIL-DTL-23659, Initiator, Electric, General Design Specification
MIL-D-81980, Design and Evaluation of Signal Transmission Subsystem, General Specification For
MIL-D-81514B, Devices restraint Harness take-up, Inertia-Locking, powers-Retracting, General Specification
MIL-D-81303, Design and Evaluation of Cartridges for Store Suspension Equipment
MIL-S-9479, Seat System, Upward Ejection, Aircraft, General Specification For,
MIL-STD-1512, Electro-explosive Subsystem, Electrically Initiated, Design Requirements and Test Methods
These are the types of tests we do at qualifcation

8. Service Life Extension Drivers
CAD/PAD Program Processes SLEs on 800+ items/mo
Acquisition/delivery delays
Obsolescence causing more late deliveries increasing need for SLEs (especially AV-8)
Operational needs (i.e. deployments)
SLEs are usually “pulled” via SLE requests.
Occasionally “pushed” in particular situations
Not the same as permanent Service Life Change (SLC)
Many SLEs per month – many automatic
Katie mentioned earlier there are sometimes delays in awarding contracts.
Obsolescence is affecting ability to procure and deliver
Sometimes the operational need drives the SLE request – a deployment may mean an aircraft is not available at the necessary time for change out
Right now, SLEs are typically requested by the user. Sometimes they are requested by the logistician when there is a known delivery delay
SLEs are not the same as service life changes. A service life change occurs when we have sufficient data to permanently extend the life of the unit. Essentially we have tested the units and we can say with confidence the item can be installed longer with no increase in hazard risk.

9. Service Life Extension Process
Review of Ordnance Assessment and other data
Compared to baseline data (qualification, lot acceptance testing (LAT))
Compared to system design limits
Three levels of review/approval
Automatic, previously approved decisions - immediate
Within spec but requires engineering review
Out of spec and beyond design limits, requires system review and risk analysis/assessment
OA data is compared to qualification and LAT data. Determine if the unit is acting as expected.
Compared to design limits – are we within the range the component has been qualified for.
Three levels of review

10. Service Life Extension Process
All recommendations to approve or deny are reviewed by the CAD/PAD Senior Engineer before being processed in the SLE module
Fleet requests extension through SLE module in VFS
Review SLE request and relevant data
Performance within requirements?
Approve request through SLE module
Risk Analysis
Yes
Approve or limited approve request through SLE module No
Calculate expected performance and failure rate at requested lives
Submit expected performance and failure rate to appropriate PMA
Yes
Risk accepted?
Deny request through SLE module
Flow chart of the previous bullet points.
All recommendations are reviewed by the CAD/PAD Senior Engineer – Bob Hastings No

11. Common Performance Parameters
Risk Analysis
Trends are analyzed at projected extension limit
Impact to system performance calculated at extension limits (via NAVAIR Models)
Common Performance Parameters
Go / No-Go
Delay time
Thrust
Burn time
Impulse
System Impact
Seat timing/Interference
Seat timing/Minimum safe altitude
Tail clearance
Physiological impact
Canopy removal
Review trends
Are the parameters changing
Is max thrust increasing with time? Or decreasing?
Each response has a system impact
More in a catapult thrust means greater risk of spinal damage for a pilot
Less thrust means you may not have the same tail clearance

12. Risk Analysis Sample Delay Time Data
Current Life
Requested Life
Expected Need

13. Risk Assessment NAVAIR System models determine impact in system
System engineering (NAVAIR 4.6) and NAVAIR System Safety (4.1.1) evaluate impact
Collective recommendation taken to platform for concurrence (Hazard Risk Index (HRI) = 1-20)
Decision documented in NAVAIR formal System Safety Risk Assessment (SSRA) and signed by appropriate offices as function of risk
For Navy and Navy FMS items we rely on NAVAIR to determine system impacts
They model the response using the new parameters
Typically they start with a worst case scenario (90º nose down, high speed)
Often program offices want to evaluate a more realistic scenario so this part of the risk assessment is often iterative.
The impact is then given an index value and depending on the value of that risk a higher office may be necessary to approve and accept it

14. Risk Acceptance
SSRA reviewed and signed by appropriate offices as function of risk
HRI chart indicating the offices that are necessary for approval
Frequency is per flight hours, meaning likelihood of ejection is calculated with the hazard. Often that means we are in the improbable region since the likelihood of ejection is low, but those values are platform specific.

15. Potential Issues Data on current installs not available for all items
Exact date of installation
Hours flown (vibratory effects)
Environments (shelf and install)
Combined issues require combined analysis
Analysis required on more than one component at a time
May have been insufficiently baselined at system level
Read bullets - paraphrase

16. Proactive Efforts
Developing second sources for problem propellants/items
Monitoring projected delivery delays to preemptively conduct risk assessments
Running models prior to need, just in case
Verifying/establishing system/design/LAT limits during system qualification

17. Questions?