MIL-STD-882E System Safety Process questions for the ASP

Question 1

A contractor is performing a Subsystem Hazard Analysis on a robotic loading arm. The arm's controller uses a purchased commercial-off-the-shelf (COTS) motion-control board with firmware written by another vendor. The project engineer proposes leaving the board and its firmware out of the SSHA because the contractor did not design them and the vendor says the board is reliable. What should the safety professional conclude?

1. AThe board may be excluded, but its firmware must be analyzed because it is software.
2. BBoth may be excluded if the vendor supplies a written reliability statement.
3. CThe board and firmware must be included, because the analysis covers COTS items and software.
4. DBoth may be excluded because COTS items are covered only in the system-level hazard analysis.

Question 2

A contractor developing an automated cargo-handling vehicle reviews the interlock that prevents the lift arm from moving while personnel are in the load zone. Engineers state that inspecting the design drawings and reviewing the logic cannot establish whether the interlock actually reduces the risk to an acceptable level. Under the system safety verification task, what is required next?

1. AAccept the mitigation as adequate because the drawings were inspected, and record it in the hazard log
2. BSpecify and conduct tests to evaluate the overall effectiveness of the mitigation measure, and integrate them into the appropriate T&E plans
3. CDelete the interlock from the design and rely on warning labels in the operator manual
4. DDefer any verification until the vehicle is fielded and user feedback is available

Question 3

A prime contractor is drafting its Hazard Management Plan (HMP) for a new vehicle program. The safety lead proposes listing only the prime's own design reviews and tests in the schedule section. Software development and a subcontractor's braking-subsystem testing are scheduled in separate engineering study plans, and the lead argues they do not belong in the HMP because they are "someone else's schedules." Which response is consistent with the HMP milestone requirements?

1. AThe HMP should omit software schedules until after the first technical review, when software hazards are better understood.
2. BThe HMP should copy the full detailed schedules of the subcontractor's engineering studies into the plan, replacing the prime's own schedule.
3. CThe HMP should identify the schedules for subsystem, component, and software activities that apply to hazard management, even though they are specified in other engineering studies and development efforts.
4. DThe lead is correct, because the HMP schedule is limited to activities the prime contractor performs directly.