The ESANASA SOHO Mission Interruption Using the STAMP Accident Analysis Technique for a Sof.pdf

-1- The ESA/NASA SOHO Mission Interruption: Using the STAMP Accident Analysis Technique for a Software Related ‘Mishap’ Chris Johnson (a), C.M. Holloway (b) (a) Department of Computing Science, University of Glasgow, Scotland. johnson@dcs.gla.ac.uk (b) NASA Langley Research Center, MS 130 / 100 NASA Road, Hampton, VA 23681-2199, USA c.m.holloway@ Abstract: Mishap investigations provide important information about adverse events and are intended to help avoid any recurrence of previous failures. However, the complexity of many safety critical systems poses new challenges for mishap analysis. Similarly, the recognition that many failures have complex, systemic causes has helped to widen the scope of many mishap investigations. A new generation of mishap analysis techniques has been proposed to help investigators address these problems. For instance, Leveson has recently developed the Systems Theory Accident Modelling and Process (STAMP) approach to address some of the weaknesses associated with previous ‘chain of event’ approaches that can miss the systemic causes of adverse events. There are relatively few examples of the STAMP approach. This paper, therefore, presents the results obtained when two analysts performed an independent application of this technique to analyse the causes, including software problems, which led to the mission interruption of the joint European Space Agency (ESA) and National Aeronautics and Space Administration (NASA) Solar and Heliocentric Observatory (SOHO). Keywords: STAMP, Causation, SOHO, Accident Investigation, Mishap Investigation, Software Mishaps. Introduction Many international standards now require that mishap-reporting systems be integrated into safety management schemes. For example, IEC 61508 is widely used as a standard for the development of safety-critical applications that incorporate computer systems. This includes the recommendation that manufacturers should: “…impl