SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
This is a collection of presentation elements into a consolidated presentation on overall safety and mission assurance practices for highly constrained projects, such as Class D, 7120.8, or Do No Harm.
This presentation describes how assurance arguments for the radiation reliability of a system can be modeled in Goal Structuring Notation over the life-cycle of a project. A practical implementation of the NASA-STD-8729.1 and Model-Based Mission Assurance.
Research into complexities of software systems Fault Management (FM) and how architectural design decisions affect safety, preservation of assets, and maintenance of desired system functionality has coalesced into a technical reference (TR) suite that advances the provision of safety and mission assurance. The NASA Independent Verification and Validation (IV&V) Program, with Software Assurance Research Program support, extracted FM architectures across the IV&V portfolio to evaluate robustness, assess visibility for validation and test, and define software assurance methods applied to the architectures and designs. This investigation spanned IV&V projects with seven different primary developers, a wide range of sizes and complexities, and encompassed Deep Space Robotic, Human Spaceflight, and Earth Orbiter mission FM architectures. The initiative continues with an expansion of the TR suite to include Launch Vehicles, adding the benefit of investigating differences intrinsic to model-based FM architectures and insight into complexities of FM within an Agile software development environment, in order to improve awareness of how nontraditional processes affect FM architectural design and system health management. The identification of particular FM architectures, visibility, and associated IV&V techniques provides a TR suite that enables greater assurance that critical software systems will adequately protect against faults and respond to adverse conditions. Additionally, the role FM has with regard to strengthened security requirements, with potential to advance overall asset protection of flight software systems, is being addressed with the development of an adverse conditions database encompassing flight software vulnerabilities. Capitalizing on the established framework, this TR suite provides assurance capability for a variety of FM architectures and varied development approaches. Research results are being disseminated across NASA, other agencies, and the software community. This paper discusses the findings and TR suite informing the FM domain in best practices for FM architectural design, visibility observations, and methods employed for IV&V and mission assurance.
This report summarizes by task the engineering, technical, and management support services provided by Vitro Corporation to NASA Headquarters Office of Safety, Reliability, Maintainability, and Quality Assurance (now called Office of Safety and Mission Assurance (OSMA)) (Code Q) under Contract Number NASW-4311 from the period February 10, 1994. Each task summary includes significant Vitro accomplishments, conclusions, and recommendations for future efforts in each of the divisions within OSMA.
The emergence of model-based engineering is transforming design and analysis methodologies [5]. A recognized benefit of model-based engineering is the existence of a “single source of truth” about the system that becomes the authoritative source of data and information for designers, analysts, and developers. This promotes consistency and efficiency as the design emerges and can be used to further optimize the design. Integrating System Safety Engineers to the “single source of truth” will ensure that the outputs of their assessments and analyses are relevant to the design as it evolves. Use of an integrated system model enables near immediate evaluation of a design change as well as development of operational processes for risk assessment and communication. Such models can enable efficient and timely analysis of system hazards (e.g., hazard fault tree analysis and procedure simulations) and produce complete, accurate, and more consistent products (e.g., hazard reports and safety requirement evaluations). Therefore, an agency-sponsored team at Goddard Space Flight Center (GSFC) recently completed a System Safety Study of modeling and testing capabilities as part of a Model-Based Safety and Mission Assurance Initiative (MBSMAI). Using an existing model developed for reliability analyses [1], GSFC modeling and system safety experts performed system safety analysis/modeling and produced safety products. The team evaluated model-based feasibility to support System Safety Engineering, developed safety analysis modeling processes, and identified tool capability advancement/development needs. These study results indicate model-based engineering is valid and useable for System
The Software Assurance Technology Center (SATC) is part of the Office of Mission Assurance of the Goddard Space Flight Center (GSFC). The SATC's mission is to assist National Aeronautics and Space Administration (NASA) projects to improve the quality of software which they acquire or develop. The SATC's efforts are currently focused on the development and use of metric methodologies and tools that identify and assess risks associated with software performance and scheduled delivery. This starts at the requirements phase, where the SATC, in conjunction with software projects at GSFC and other NASA centers is working to identify tools and metric methodologies to assist project managers in identifying and mitigating risks. This paper discusses requirement metrics currently being used at NASA in a collaborative effort between the SATC and the Quality Assurance Office at GSFC to utilize the information available through the application of requirements management tools.
The Earth Observing System (EOS) AM-1 spacecraft for NASA's Mission to Planet Earth is scheduled to be launched on an Atlas IIAS vehicle in June of 1998. One concern is that the instruments on the EOS spacecraft are sensitive to the shock-induced vibration produced when the spacecraft separates from the launch vehicle. By employing unique statistical analysis to the available ground test shock data, the NASA Lewis Research Center found that shock-induced vibrations would not be as great as the previously specified levels of Lockheed Martin. The EOS pyroshock separation testing, which was completed in 1997, produced a large quantity of accelerometer data to characterize the shock response levels at the launch vehicle/spacecraft interface. Thirteen pyroshock separation firings of the EOS and payload adapter configuration yielded 78 total measurements at the interface. The multiple firings were necessary to qualify the newly developed Lockheed Martin six-hardpoint separation system. Because of the unusually large amount of data acquired, Lewis developed a statistical methodology to predict the maximum expected shock levels at the interface between the EOS spacecraft and the launch vehicle. Then, this methodology, which is based on six shear plate accelerometer measurements per test firing at the spacecraft/launch vehicle interface, was used to determine the shock endurance specification for EOS. Each pyroshock separation test of the EOS spacecraft simulator produced its own set of interface accelerometer data. Probability distributions, histograms, the median, and higher order moments (skew and kurtosis) were analyzed. The data were found to be lognormally distributed, which is consistent with NASA pyroshock standards. Each set of lognormally transformed test data produced was analyzed to determine if the data should be combined statistically. Statistical testing of the data's standard deviations and means (F and t testing, respectively) determined if data sets were significantly different at a 95-percent confidence level. If two data sets were found to be significantly different, these families of data were not combined for statistical purposes. This methodology produced three separate statistical data families of shear plate data. For each population, a P99.1/50 (probability/confidence) per-separation-nut firing level was calculated. By using the binomial distribution, Lewis researchers determined that this pernut firing level was equivalent to a P95/50 per-flight confidence level. The overall envelope of the per-flight P95/50 levels led to Lewis' recommended EOS interface shock endurance specification. A similar methodology was used to develop Lewis' recommended EOS mission assurance levels. The available test data for the EOS mission are significantly larger than for a normal mission, thus increasing the confidence level in the calculated expected shock environment. Lewis significantly affected the EOS mission by properly employing statistical analysis to the data. This analysis prevented a costly requalification of the spacecraft's instruments, which otherwise would have been exposed to significantly higher test levels.
The theory of System Health Management (SHM) and of its operational subset Fault Management (FM) states that FM is implemented as a "meta" control loop, known as an FM Control Loop (FMCL). The FMCL detects that all or part of a system is now failed, or in the future will fail (that is, cannot be controlled within acceptable limits to achieve its objectives), and takes a control action (a response) to return the system to a controllable state. In terms of control theory, the effectiveness of each FMCL is estimated based on its ability to correctly estimate the system state, and on the speed of its response to the current or impending failure effects. This paper describes how this theory has been successfully applied on the National Aeronautics and Space Administration's (NASA) Space Launch System (SLS) Program to quantitatively estimate the effectiveness of proposed abort triggers so as to select the most effective suite to protect the astronauts from catastrophic failure of the SLS. The premise behind this process is to be able to quantitatively provide the value versus risk trade‐off for any given abort trigger, allowing decision makers to make more informed decisions. All current and planned crewed launch vehicles have some form of vehicle health management system integrated with an emergency launch abort system to ensure crew safety. While the design can vary, the underlying principle is the same: detect imminent catastrophic vehicle failure, initiate launch abort, and extract the crew to safety. Abort triggers are the detection mechanisms that identify that a catastrophic launch vehicle failure is occurring or is imminent and cause the initiation of a notification to the crew vehicle that the escape system must be activated. While ensuring that the abort triggers provide this function, designers must also ensure that the abort triggers do not signal that a catastrophic failure is imminent when in fact the launch vehicle can successfully achieve orbit. That is, the abort triggers must have low false negative rates to be sure that real crew‐threatening failures are detected, and also low false positive rates to ensure that the crew does not abort from non‐crew‐threatening launch vehicle behaviors. The analysis process described in this paper is a compilation of over six years of lessons learned and refinements from experiences developing abort triggers for NASA's Constellation Program (Ares I Project) and the SLS Program, as well as the simultaneous development of SHM/FM theory. The paper will describe the abort analysis concepts and process, developed in conjunction with SLS Safety and Mission Assurance (S&MA) to define a common set of mission phase, failure scenario, and Loss of Mission Environment (LOME) combinations upon which the SLS Loss of Mission (LOM) Probabilistic Risk Assessment (PRA) models are built. This abort analysis also requires strong coordination with the Multi‐Purpose Crew Vehicle (MPCV) and SLS Structures and Environments (STE) to formulate a series of abortability tables that encapsulate explosion dynamics over the ascent mission phase. The design and assessment of abort conditions and triggers to estimate their Loss of Crew (LOC) Benefits also requires in‐depth integration with other groups, including Avionics, Guidance, Navigation and Control(GN&C), the Crew Office, Mission Operations, and Ground Systems. The outputs of this analysis are a critical input to SLS S&MA's LOC PRA models. The process described here may well be the first full quantitative application of SHM/FM theory to the selection of a sensor suite for any aerospace system.
This report contains information about the tasks I have completed and the valuable experience I have gained at NASA. The report is divided into two different sections followed by a program summary sheet. The first section describes the two reports I have completed for the Office of Mission Assurance (OMA). I describe the approach and the resources and facilities used to complete each report. The second section describes my experience working in the Receipt Inspection/Quality Assurance Lab (RI/QA). The first report described is a Product Assurance Plan for the Gas Permeable Polymer Materials (GPPM) mission. The purpose of the Product Assurance Plan is to define the various requirements which are to be met through completion of the GPPM mission. The GPPM experiment is a space payload which will be flown in the shuttle's SPACEHAB module. The experiment will use microgravity to enable production of complex polymeric gas permeable materials. The second report described in the first section is a Fracture Analysis for the Mir Environmental Effects Payload (MEEP). The Fracture Analysis report is a summary of the fracture control classifications for all structural elements of the MEEP. The MEEP hardware consists of four experiment carriers, each of which contains an experiment container holding a passive experiment. The MEEP hardware will be attached to the cargo bay of the space shuttle. It will be transferred by Extravehicular Activity and mounted on the Mir space station. The second section of this report describes my experiences in the RVQA lab. I listed the different equipment I used at the lab and their functions. I described the extensive inspection process that must be completed for spaceflight hardware. Included, at the end of this section, are pictures of most of the equipment used in the lab. There is a summary sheet located at the end of this report. It briefly describes the valuable experience I have gained at NASA this summer and what I will be able to take with me as I return to college. I briefly discuss the experiences I mentioned in the previous three paragraphs along with training classes I attended and courses I completed at the Learning Lab.
The National Aeronautics and Space Administration (NASA) Expendable Launch Vehicle (ELV) payload space flight missions involve cooperative work between NASA and partners including spacecraft (or payload) contractors, universities, nonprofit research centers, Agency payload organization, Range Safety organization, Agency launch service organizations, and launch vehicle contractors. The role of NASA's Safety and Mission Assurance (SMA) Directorate is typically fairly straightforward, but when a mission's partnerships become more complex, to realize cost and science benefits (e.g., multi-agency payload(s) or cooperative international missions), the task of ensuring payload safety becomes much more challenging. This paper discusses lessons learned from NASA safety professionals working multiple-agency missions and offers suggestions to help fellow safety professionals working multiple-agency missions.
As the space business rapidly evolves to accommodate a lower cost model of development and operation via concepts such as commercial space and small spacecraft (aka, CubeSats and swarms), traditional EEE parts screening and qualification methods are being scrutinized under a risk-reward trade space. In this presentation, two basic concepts will be discussed: (1) The movement from complete risk aversion EEE parts methods to managing and/or accepting risk via alternate approaches; and, (2) A discussion of emerging assurance methods to reduce overdesign as well emerging model based mission assurance (MBMA) concepts. center dot Example scenarios will be described as well as consideration for trading traditional versus alternate methods.
The attached presentation is a summary of how mission assurance is supported by model-based representations of spacecraft systems that can define sub-system functionality and interfacing, reliability parameters, as well as detailing a new paradigm for assurance, a model-centric and not document-centric process.
Prior to a spacecraft launch, program mission assurance standards dictate that the flight battery power system should comply with mission requirements under the intended operating conditions. Ground life cycle testing (LCT) combined with an analysis on the electrical power system (EPS) battery is an empirical method used to demonstrate compliance to satellite service life requirements. The LCT compliance method adopted by the aerospace industry is based on demonstrating a space battery's life expectancy as a part of battery qualification. Real-time cell and lithium-ion battery (LIB) LCT data are commonly used for model inputs to EPS power and energy balance analyses, in LIB reliability analysis estimates, and to support on-orbit spacecraft mission life extension opportunities. This chapter describes the LCT planning steps, process approach, and analysis techniques commonly used to qualify space LIB power systems.
This slide presentation reviews the interactions between the scientist and engineers doing research and technology and the software developers and others who are doing software assurance. There is a discussion of the role of the Safety and Mission Assurance (SMA) in developing software to be used for research and technology, and the importance of this role as the technology moves to the higher levels of the technology readiness levels (TRLs). There is also a call to change the way the development of software is developed.
Cyber threats to operational technology demand more than traditional IT defenses—they require full-spectrum mission assurance. Cyber-Informed Engineering (CIE) is an approach that embeds engineered controls into system design to ensure critical functions remain safe and reliable, even under attack. Unlike conventional cybersecurity tools, engineered controls act directly on physical processes to prevent unacceptable outcomes such as equipment damage or mission failure. This session will outline the CIE framework and share examples of consequence-based design that deliver true resilience, not just fail-safe behaviors. Attendees will learn how to integrate these principles into the engineering lifecycle to support resilient-by-design architectures and inform emerging standards. This talk sets the stage for the panel discussion on advancing CIE across sectors as digital and physical systems converge.
There is an increased need for onboard decision-making capabilities in cyber-physical systems be it in energy, automotive, aviation, space, or other industries as they aim for increased efficiency, resiliency, and mission assurance capabilities. Emerging next-gen technologies such as multi-rover planetary missions, distributed satellites, unmanned ground and aerial vehicle operations and smart grid systems rely on in-time risk assessment and autonomous decision-making. One critical piece of the autonomy puzzle is reliable prediction of system behavior under time-varying and potentially uncertain environmental conditions. Further, if agent states change during operation such as initiation of faults or degradation, reliable diagnostic tools need to be investigated. In this tutorial, we will revise approaches that integrates existing physics-based and data-driven models of agents interacting with probability models of the environment and component operation state. Role of existing PHM methodologies as they feed into decision-making under uncertainty will be studied. Balancing critical trade-offs between high-fidelity prognostic models, prediction time-horizons and the computational requirements for in-time cost-effective decision-making will be discussed through the implementation of surrogate models. Finally, the audience will be introduced to a real-time application of in-time trajectory planning of an unmanned aerial system (UAS) based on its PHM assessments under uncertain and varying wind conditions.
Long duration crews have inhabited the ISS since November of 2000. The favorable medical outcomes of its missions can be largely attributed to sustained collective efforts of all ISS Partners medical organizations. In-flight medical monitoring and support, although crucial, is just a component of the ISS system of Joint Medical Operations. The goal of this work is to review the principles, design, and function of the multilateral medical support of the ISS Program. The governing documents, which describe the relationships among all ISS partner medical organizations, were evaluated, followed by analysis of the roles, responsibilities, and decision-making processes of the ISS medical boards, panels, and working groups. The degree of integration of the medical support system was evaluated by reviewing the multiple levels of the status reviews and mission assurance activities carried out throughout the last six years. The Integrated Medical Group, consisting of physicians and other essential personnel in the mission control centers represents the front-line medical support of the ISS. Data from their day-to-day activities are presented weekly at the Space Medicine Operations Team (SMOT), where known or potential concerns are addressed by an international group of physicians. A broader status review is conducted monthly to project the state of crew health and medical support for the following month, and to determine measures to return to nominal state. Finally, a comprehensive readiness review is conducted during preparations for each ISS mission. The Multilateral Medical Policy Board (MMPB) issues medical policy decisions and oversees all health and medical matters. The Multilateral Space Medicine Board (MSMB) certifies crewmembers and visitors for training and space flight to the Station, and physicians to practice space medicine for the ISS. The Multilateral Medical Operations Panel (MMOP) develops medical requirements, defines and supervises implementation of operational countermeasures, environmental monitoring, medical care, and emergency medical services. MMOP assures the medical readiness of the Station for each subsequent mission or critical event. All boards and panels have functioned effectively and without interruptions even in various challenging circumstances. Based on the experience of the authors, consensus has prevailed as the primary nature of decisions made by all ISS medical groups, at all levels. The six first years of piloted operation have demonstrated the ability of the ISS medical authority groups and the medical infrastructure to implement medical policies and requirements, effectively interface with non-medical groups, and maintain the health and productivity of the crew in an integrated, multilaterally coordinated fashion. The medical support system appears to be mature and ready for further expansion of all Partners roles, and for the anticipated increase in the size of ISS crews.
The constraints of future Exploration Missions will require unique integrated system health management capabilities throughout the mission. An ambitious launch schedule, human-rating requirements, long quiescent periods, limited human access for repair or replacement, and long communication delays, all require an integrated approach to health management that can span distinct, yet interdependent vehicle subsystems, anticipate failure states, provide autonomous remediation and support the Exploration Mission from beginning to end. Propulsion is a critical part of any space exploration mission, and monitoring the health of the propulsion system is an integral part of assuring mission safety and success. Health management is a somewhat ubiquitous technology that encompasses a large spectrum of physical components and logical processes. For this reason, it is essential to develop a systematic plan for propulsion health management system development. This paper provides a high-level perspective of propulsion health management systems, and describes a logical approach for the future planning and early development that are crucial to planned space exploration programs. It also presents an overall approach, or roadmap, for propulsion health management system development and a discussion of the associated roadblocks and challenges.