Search NASA⌕ Search

SEARCH · Search NASA

Results for “cost estimating tools”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 289 records · Page 16

Room to Live: the sizing of Lunar and Martian Habitats

In order for man to return to space or extra terrestrial bodies for long duration missions it is important that adequate habitat volume be defined early to avoid costly delays and redesign. To properly define a habitat volume two major factors need to be considered. The first factor is the free or open space. This is the space that allows the crew room to move about the habitat. This space will vary based on crew size and length of the mission. The second major factor is the stowage space required for equipment and supplies. This includes both fixed volumes and consumables. Fixed volumes include items such as tools, communication equipment, Advanced Life Support (ALS) equipment, and support equipment. Consumables include items like filters, food, water and oxygen. This space is also dependent on crew size and mission length. A review of past missions into alien environments, such as deep sea habitats as well as space based habitats will be used to validate the assumption made in this paper. Once these key factors are defined trades must be run to optimize the overall volume of a habitat. This includes trades of disposable vs. reusable for items such as clothing, dishes, and water. Another factor to consider is the availability of in situ resources to aid in the construction of the habitat structure as well as re-supply of consumable items. A review of past missions into alien environments, such as deep sea habitats as well as space based habitats will be used to validate the assumption made in this paper. The result is a habitat sizing tool to provide a first order estimate of habitat volumes for extended mission to the surface of the moon and Mars.

McGregor, Walter L.↗

Interval Management Display Design Study

In 2012, the Federal Aviation Administration (FAA) estimated that U.S. commercial air carriers moved 736.7 million passengers over 822.3 billion revenue-passenger miles. The FAA also forecasts, in that same report, an average annual increase in passenger traffic of 2.2 percent per year for the next 20 years, which approximates to one-and-a-half times the number of today's aircraft operations and passengers by the year 2033. If airspace capacity and throughput remain unchanged, then flight delays will increase, particularly at those airports already operating near or at capacity. Therefore it is critical to create new and improved technologies, communications, and procedures to be used by air traffic controllers and pilots. National Aeronautics and Space Administration (NASA), the FAA, and the aviation industry are working together to improve the efficiency of the National Airspace System and the cost to operate in it in several ways, one of which is through the creation of the Next Generation Air Transportation System (NextGen). NextGen is intended to provide airspace users with more precise information about traffic, routing, and weather, as well as improve the control mechanisms within the air traffic system. NASA's Air Traffic Management Technology Demonstration-1 (ATD-1) Project is designed to contribute to the goals of NextGen, and accomplishes this by integrating three NASA technologies to enable fuel-efficient arrival operations into high-density airports. The three NASA technologies and procedures combined in the ATD-1 concept are advanced arrival scheduling, controller decision support tools, and aircraft avionics to enable multiple time deconflicted and fuel efficient arrival streams in high-density terminal airspace.

Baxley, Brian T.↗

Aeroelastic Analysis of a Flexible Wing Wind Tunnel Model with Variable Camber Continuous Trailing Edge Flap Design

This paper presents data analysis of a flexible wing wind tunnel model with a variable camber continuous trailing edge flap (VCCTEF) design for drag minimization tested at the University of Washington Aeronautical Laboratory (UWAL). The wind tunnel test was designed to explore the relative merit of the VCCTEF concept for improved cruise efficiency through the use of low-cost aeroelastic model test techniques. The flexible wing model is a 10%-scale model of a typical transport wing and is constructed of woven fabric composites and foam core. The wing structural stiffness in bending is tailored to be half of the stiffness of a Boeing 757-era transport wing while the torsional stiffness is about the same. This stiffness reduction results in a wing tip deflection of about 10% of the wing semi-span. The VCCTEF is a multi-segment flap design having three chordwise camber segments and five spanwise flap sections for a total of 15 individual flap elements. The three chordwise camber segments can be positioned appropriately to create a desired trailing edge camber. Elastomeric material is used to cover the gaps in between the spanwise flap sections, thereby creating a continuous trailing edge. Wind tunnel data analysis conducted previously shows that the VCCTEF can achieve a drag reduction of up to 6.31% and an improvement in the lift-to-drag ratio (L=D) of up to 4.85%. A method for estimating the bending and torsional stiffnesses of the flexible wingUWAL wind tunnel model from static load test data is presented. The resulting estimation indicates that the stiffness of the flexible wing is significantly stiffer in torsion than in bending by as much as 9 to 1. The lift prediction for the flexible wing is computed by a coupled aerodynamic-structural model. The coupled model is developed by coupling a conceptual aerodynamic tool Vorlax with a finite-element model of the flexible wing via an automated geometry deformation tool. Based on the comparison of the lift curve slope, the lift prediction for the rigid wing is in good agreement with the estimated lift coefficients derived from the wind tunnel test data. Due to the movement of the VCCTEF during the wind tunnel test, uncertainty in the lift prediction due to the indicated variations of the VCCTEF deflection is studied. The results show a significant spread in the lift prediction which contradicts the consistency in the aerodynamic measurements, thus suggesting that the indicated variations as measured by the VICON system may not be reliable. The lift prediction of the flexible wing agrees very well with the measured lift curve for the baseline configuration. The computed bending deflection and wash-out twist of the flexible wing also match reasonably well with the aeroelastic deflection measurements. The results demonstrate the validity of the aerodynamic-structural tool for use to analyze aerodynamic performance of flexible wings.

Wind Tunnel↗

Autonomous Formation Flying from Ground to Flight

The cost of on-orbit operations remains a significant and increasingly visible concern in the support of satellite missions. Headway has been made in automating some ground operations; however, increased mission complexity and more precise orbital constraints have compelled continuing human involvement in mission design and maneuver planning operations. AI Solutions, Inc. in cooperation with the National Aeronautics and Space Administration's (NASA) Goddard Space Flight Center (GSFC) has tackled these more complex problems through the development of AutoCon as a tool for an automated solution. NASA is using AutoCon to automate the maneuver planning for the Earth Orbiter-1 (EO-1) mission. AutoCon was developed originally as a ground system tool. The EO-1 mission will be using a scaled version of AutoCon on-board the EO-1 satellite to command orbit adjustment maneuvers. The flight version of AutoCon plans maneuvers based on formation flying algorithms developed by GSFC, JPL, and other industry partners. In its fully autonomous mode, an AutoCon planned maneuver will be executed on-board the satellite without intervention from the ground. This paper describes how AutoCon automates maneuver planning for the formation flying constraints of the EO-1 mission. AutoCon was modified in a number of ways to automate the maneuver planning on-board the satellite. This paper describes how the interface and functionality of AutoCon were modified to support the on-board system. A significant component of this modification was the implementation of a data smoother, based on a Kalman filter, that ensures that the spacecraft states estimated by an on-board GPS receiver are as accurate as possible for maneuver planning. This paper also presents the methodology use to scale the AutoCon functionality to fit and execute on the flight hardware. This paper also presents the modes built that allow the incremental phasing in of autonomy. New technologies for autonomous operations are usually received with significant, and probably appropriate trepidation. A number of safeguards have been designed in both AutoCon and the interfacing systems to alleviate the potential of mission-impacting anomalies from the on-board autonomous system. This paper describes the error checking, input data integrity validation and limits set on maneuvers in AutoCon and the on-board system.

Chapman, Keith B.↗

Analysis of Aircraft Control Performance using a Fuzzy Rule Base Representation of the Cooper-Harper Aircraft Handling Quality Rating

The Cooper-Harper rating of Aircraft Handling Qualities has been adopted as a standard for measuring the performance of aircraft since it was introduced in 1966. Aircraft performance, ability to control the aircraft, and the degree of pilot compensation needed are three major key factors used in deciding the aircraft handling qualities in the Cooper- Harper rating. We formulate the Cooper-Harper rating scheme as a fuzzy rule-based system and use it to analyze the effectiveness of the aircraft controller. The automatic estimate of the system-level handling quality provides valuable up-to-date information for diagnostics and vehicle health management. Analyzing the performance of a controller requires a set of concise design requirements and performance criteria. Ir, the case of control systems fm a piloted aircraft, generally applicable quantitative design criteria are difficult to obtain. The reason for this is that the ultimate evaluation of a human-operated control system is necessarily subjective and, with aircraft, the pilot evaluates the aircraft in different ways depending on the type of the aircraft and the phase of flight. In most aerospace applications (e.g., for flight control systems), performance assessment is carried out in terms of handling qualities. Handling qualities may be defined as those dynamic and static properties of a vehicle that permit the pilot to fully exploit its performance in a variety of missions and roles. Traditionally, handling quality is measured using the Cooper-Harper rating and done subjectively by the human pilot. In this work, we have formulated the rules of the Cooper-Harper rating scheme as fuzzy rules with performance, control, and compensation as the antecedents, and pilot rating as the consequent. Appropriate direct measurements on the controller are related to the fuzzy Cooper-Harper rating system: a stability measurement like the rate of change of the cost function can be used as an indicator if the aircraft is under control; the tracking error is a good measurement for performance needed in the rating scheme. Finally, the change of the control amount or the output of a confidence tool, which has been developed by the authors, can be used as an indication of pilot compensation. We use a number of known aircraft flight scenarios with known pilot ratings to calibrate our fuzzy membership functions. These include normal flight conditions and situations in which partial or complete failure of tail, aileron, engine, or throttle occurs.

Tseng, Chris↗

Autonomous Formation Flying from the Ground to Flight

The cost of on-orbit operations remains a significant and increasingly visible concern in the support of satellite missions. Headway has been made in automating some ground operations; however, increased mission complexity and more precise orbital constraints have compelled continuing human involvement in mission design and maneuver planning operations. AI Solutions, Inc. in cooperation with the National Aeronautics and Space Administration's (NASA) Goddard Space Flight Center (GSFC) has tackled these more complex problems through the development of AutoCon(TM) as a tool for an automated solution. NASA is using AutoCon(TM) to automate the maneuver planning for the Earth Orbiter-1 (EO-1) mission. AutoCon(TM) was developed originally as a ground system tool. The EO-1 mission will be using a scaled version of AutoCon(TM) on-board the EO-1 satellite to command orbit adjustment maneuvers. The flight version of AutoCon(TM) plans maneuvers based on formation flying algorithms developed by GSFC, JPL, and other industry partners. In its fully autonomous mode, an AutoCon(TM) planned maneuver will be executed on-board the satellite without intervention from the ground. This paper describes how AutoCon(TM) automates maneuver planning for the formation flying constraints of the EO-1 mission. AutoCon(TM) was modified in a number of ways to automate the maneuver planning on-board the satellite. This paper describes how the interface and functionality of AutoCon(TM) were modified to support the on-board system. A significant component of this modification was the implementation of a data smoother, based on a Kalman filter, that ensures that the spacecraft states estimated by an on-board GPS receiver are as accurate as possible for maneuver planning. This paper also presents the methodology used to scale the AutoCon(TM) functionality to fit and execute on the flight hardware. This paper also presents the modes built into the system that allow the incremental phasing in of autonomy. New technologies for autonomous operations are usually received with significant, and probably appropriate, trepidation. A number of safeguards have been designed in both AutoCon(TM) and the interfacing systems to alleviate the potential of mission-impacting anomalies from the on-board autonomous system. This paper describes the error checking, input data integrity validation, and limits set on maneuvers in AutoCon(TM) and the on-board system.

Chapman, Keith B.↗

Probabilistic Risk Assessment Procedures Guide for NASA Managers and Practitioners (Second Edition)

Probabilistic Risk Assessment (PRA) is a comprehensive, structured, and logical analysis method aimed at identifying and assessing risks in complex technological systems for the purpose of cost-effectively improving their safety and performance. NASA's objective is to better understand and effectively manage risk, and thus more effectively ensure mission and programmatic success, and to achieve and maintain high safety standards at NASA. NASA intends to use risk assessment in its programs and projects to support optimal management decision making for the improvement of safety and program performance. In addition to using quantitative/probabilistic risk assessment to improve safety and enhance the safety decision process, NASA has incorporated quantitative risk assessment into its system safety assessment process, which until now has relied primarily on a qualitative representation of risk. Also, NASA has recently adopted the Risk-Informed Decision Making (RIDM) process [1-1] as a valuable addition to supplement existing deterministic and experience-based engineering methods and tools. Over the years, NASA has been a leader in most of the technologies it has employed in its programs. One would think that PRA should be no exception. In fact, it would be natural for NASA to be a leader in PRA because, as a technology pioneer, NASA uses risk assessment and management implicitly or explicitly on a daily basis. NASA has probabilistic safety requirements (thresholds and goals) for crew transportation system missions to the International Space Station (ISS) [1-2]. NASA intends to have probabilistic requirements for any new human spaceflight transportation system acquisition. Methods to perform risk and reliability assessment in the early 1960s originated in U.S. aerospace and missile programs. Fault tree analysis (FTA) is an example. It would have been a reasonable extrapolation to expect that NASA would also become the world leader in the application of PRA. That was, however, not to happen. Early in the Apollo program, estimates of the probability for a successful roundtrip human mission to the moon yielded disappointingly low (and suspect) values and NASA became discouraged from further performing quantitative risk analyses until some two decades later when the methods were more refined, rigorous, and repeatable. Instead, NASA decided to rely primarily on the Hazard Analysis (HA) and Failure Modes and Effects Analysis (FMEA) methods for system safety assessment.

Stamatelatos,Michael↗

Improving Project Management with Simulation and Completion Distribution Functions

Despite the critical importance of project completion timeliness, management practices in place today remain inadequate for addressing the persistent problem of project completion tardiness. A major culprit in late projects is uncertainty, which most, if not all, projects are inherently subject to. This uncertainty resides in the estimates for activity durations, the occurrence of unplanned and unforeseen events, and the availability of critical resources. In response to this problem, this research developed a comprehensive simulation based methodology for conducting quantitative project completion time risk analysis. It is called the Project Assessment by Simulation Technique (PAST). This new tool enables project stakeholders to visualize uncertainty or risk, i.e. the likelihood of their project completing late and the magnitude of the lateness, by providing them with a completion time distribution function of their projects. Discrete event simulation is used within PAST to determine the completion distribution function for the project of interest. The simulation is populated with both deterministic and stochastic elements. The deterministic inputs include planned project activities, precedence requirements, and resource requirements. The stochastic inputs include activity duration growth distributions, probabilities for events that can impact the project, and other dynamic constraints that may be placed upon project activities and milestones. These stochastic inputs are based upon past data from similar projects. The time for an entity to complete the simulation network, subject to both the deterministic and stochastic factors, represents the time to complete the project. Repeating the simulation hundreds or thousands of times allows one to create the project completion distribution function. The Project Assessment by Simulation Technique was demonstrated to be effective for the on-going NASA project to assemble the International Space Station. Approximately $500 million per month is being spent on this project, which is scheduled to complete by 2010. NASA project stakeholders participated in determining and managing completion distribution functions produced from PAST. The first result was that project stakeholders improved project completion risk awareness. Secondly, using PAST, mitigation options were analyzed to improve project completion performance and reduce total project cost.

Cates, Grant R.↗

Mars Sample Return Using Commercial Capabilities: Mission Architecture Overview

Mars Sample Return (MSR) is the highest priority science mission for the next decade as recommended by the recent Decadal Survey of Planetary Science. This paper presents an overview of a feasibility study for an MSR mission. The objective of the study was to determine whether emerging commercial capabilities can be used to reduce the number of mission systems and launches required to return the samples, with the goal of reducing mission cost. We report the feasibility of a complete and closed MSR mission design using the following scenario that covers three synodic launch opportunities, beginning with the 2022 opportunity: A Falcon Heavy injects a SpaceX Red Dragon capsule and trunk onto a Trans Mars Injection (TMI) trajectory. The capsule is modified to carry all the hardware needed to return samples collected on Mars including a Mars Ascent Vehicle (MAV), an Earth Return Vehicle (ERV), and hardware to transfer a sample collected in a previously landed rover mission to the ERV. The Red Dragon descends to land on the surface of Mars using Super Sonic Retro Propulsion (SSRP). After previously collected samples are transferred to the ERV, the single-stage MAV launches the ERV from the surface of Mars. The MAV uses a storable liquid bi-propellant propulsion system to deliver the ERV to a Mars phasing orbit. After a brief phasing period, the ERV, which also uses a storable bi-propellant system, performs a Trans Earth Injection (TEI) burn. Upon arrival at Earth, the ERV performs Earth and lunar swing-bys and is placed into a lunar trailing circular orbit - an Earth orbit, at lunar distance. A later mission, using Dragon and launched by a Falcon Heavy, performs a rendezvous with the ERV in the lunar trailing orbit, retrieves the sample container and breaks the chain of contact with Mars by transferring the sample into a sterile and secure container. With the sample contained, the retrieving spacecraft makes a controlled Earth re-entry preventing any unintended release of pristine martian materials into the Earth's biosphere. The analysis methods employed standard and specialized aerospace engineering tools. Mission system elements were analyzed with either direct techniques or by using parametric mass estimating relationships (MERs). The architecture was iterated until overall mission convergence was achieved on at least one path. Subsystems analyzed in this study include support structures, power system, nose fairing, thermal insulation, actuation devices, MAV exhaust venting, and GN&C. Best practice application of loads, mass growth contingencies, and resource margins were used. For Falcon Heavy capabilities and Dragon subsystems we utilized publically available data from SpaceX, published analyses from other sources, as well as our own engineering and aerodynamic estimates. Earth Launch mass is under 11 mt, which is within the estimated capability of a Falcon Heavy, with margin. Total entry masses between 7 and 10 mt were considered with closure occurring between 9 and 10 mt. Propellant mass fractions for each major phase of the EDL - Entry, Terminal Descent, and Hazard Avoidance - have been derived. An assessment of the effect of the entry conditions on the thermal protection system (TPS), currently in use for Dragon missions, shows no significant stressors. A useful payload mass of 2.0 mt is provided and includes mass growth allowances for the MAV, the ERV, and mission unique equipment. We also report options for the MAV and ERV, including propulsion systems, crewed versus robotic retrieval mission, as well as direct Earth entry. International planetary protection policies as well as verifiable means of compliance will have a large impact on any MSR mission design. We identify areas within our architecture where such impacts occur. We also describe preliminary compliance measures that will be the subject of future work. This work shows that emerging commercial capabilities as well as new methodologies can be used to efficiently support an important planetary science objective. The work also has applications for human exploration missions that use propulsive EDL techniques

Red Dragon↗

Bringing Together Users and Developers of Forest Biomass Maps

Forests store carbon and thus represent important sinks for atmospheric carbon dioxide. Reducing uncertainty in current estimates of the amount of carbon in standing forests will improve precision of estimates of anthropogenic contributions to carbon dioxide in the atmosphere due to deforestation. Although satellite remote sensing has long been an important tool for mapping land cover, until recently aboveground forest biomass estimates have relied mostly on systematic ground sampling of forests. In alignment with fiscal year 2010 congressional direction, NASA has initiated work toward a carbon monitoring system (CMS) that includes both maps of forest biomass and total carbon flux estimates. A goal of the project is to ensure that the products are useful to a wide community of scientists, managers, and policy makers, as well as to carbon cycle scientists. Understanding the needs and requirements of these data users is helpful not just to the NASA CMS program but also to the entire community working on carbon-related activities. To that end, this meeting brought together a small group of natural resource managers and policy makers who use information on forests in their work with NASA scientists who are working to create aboveground forest biomass maps. These maps, derived from combining remote sensing and ground plots, aim to be more accurate than current inventory approaches when applied at local and regional scales. Meeting participants agreed that users of biomass information will look to the CMS effort not only to provide basic data for carbon or biomass measurements but also to provide data to help serve a broad range of goals, such as forest watershed management for water quality, habitat management for biodiversity and ecosystem services, and potential use for developing payments for ecosystem service projects. Participants also reminded the CMS group that potential users include not only public sector agencies and nongovernmental organizations but also the private sector because much forest acreage in the United States is privately held and needs data for forest management. Additional key outcomes identified by meeting participants include the following: (1) Priority should be given to building into the biomass product ease of use and low costs (including costs of hardware, software, and analysis requirements), (2) CMS products should also be relevant to other biomass measures for forest watershed management, habitat protection for biodiversity, and assessment of markets for ecosystem services, (3) CMS leadership should engage with the Subsidiary Body for Scientific and Technological Advice of the United Nations Framework Convention on Climate Change as they establish measuring, reporting, and verification standards, and (4) CMS leadership should continue to keep sister agencies and other organizations informed as CMS develops, particularly via the agencies active in the U.S. Global Change Research Program Carbon Cycle Interagency Working Group (U.S. Geological Survey, U.S. Department of Agriculture, and National Oceanic and Atmospheric Administration) and nongovernmental organizations.

Forest↗

Trajectory Engineering with Modular Patched Conics for Entry Systems and TPS (TEMPEST)

Brief Presenter Biography (35 word limit): Bohdan Wesely is an Aerospace Engineer in the Entry Systems and Technology Division at Ames. He has worked on a variety of projects for NASA including integrated TPS (thermal protection system) flight hardware deliveries and testing services for commercial partners. Introduction: TEMPEST is a new trajectory analysis framework that is designed to fill the gap between dedicated flight mechanics tools and aerothermal and TPS sizing tools. The project started as an SJSU master’s thesis and has since evolved into a general conceptual design tool capable of studying a wide variety of entry problems. Development is ongoing in the Entry Systems and Technology Division at NASA ARC. Why TEMPEST: Space missions involving entry into a planetary atmosphere involve a series of unique requirements across multiple disciplines. Whether it is traditional entry descent and landing (EDL), or aerocapture, the vehicle must navigate to its target landing location or orbit state, and the TPS must protect the payload during entry. The design process typically involves iterative handoffs between various flight mechanics, flow solver, and material response level tools. During the early conceptual phase, a wide variety of feasible trajectories are simulated in a Monte Carlo scenario which broadly satisfy the mission or landing requirements. Next, computational fluid dynamics (CFD), direct simulation Monte Carlo (DSMC), and other flow solver analyses are performed at various key trajectory points to generate an aero-database, heating and TPS design requirements also emerge at this stage. At this point, with updated aerodynamics from the various flow solvers, trajectories can be re-run, this in turn can change the required freestream conditions for the CFD tools, and as a project progresses, these analyses converge, and uncertainty is reduced. However, there is always a “hand-off” occurring between two inherently coupled phenomena. Analysis Description: One of the goals with TEMPEST is to use a variety of first principles estimation methods coupled with an atmosphere model to predict vehicle aerothermodynamics across the entire flight regime while propagating a 3 or 6 degree of freedom (DoF) trajectory. Aerodynamics methods include modified Newtonian, Maxwell and Cercignani- Lampis-Lord (CLL) for continuum, transitional, and free molecular flow regimes. Aerothermodynamics include boundary layer and reference enthalpy methods, and Mutation++ for non-equilibrium chemistry modeling. TEMPEST is also capable of stitching multiple trajectory segments together to study mission scenarios like multi-pass aerocapture and aero-gravity assists. Most of the program is implemented in MATLAB using modern system objects, it relies on several C++ shared libraries for supporting tools like Gmsh, the Global Reference Atmospheric Model (GRAM), and Mutation++. The various first principles aerothermal estimation methods are discretized across either a structured axisymmetric panel mesh or an unstructured tri-mesh generated from an open-source tool such as Gmsh, this allows solutions on the same mesh to be compared across tools such as CB-Aero. CFD Coupling. A physics-aware, gaussian process CFD anchoring scheme is proposed to adjust the various first principles methods as a CFD database is populated. One goal for this anchoring module is to inform the project where CFD should be run. Full knowledge of the entire trajectory, atmosphere, and aerothermodynamics allows for easier identification of high sensitivity areas and uncertainty quantification. While the first principles effects are well known and proven accurate in existing tools such as CB- Aero and Cart3D, a physics aware CFD anchoring scheme increases tool credibility across a project lifecycle. Material Response Modeling. Correct TPS sizing is critical for optimizing mass for science payloads and ensuring mission success. The process typically involves a thermal analysis along the trajectory with surface heating environments as a boundary condition. Several design constraints are maximum bondline temperature and maximum recession with various margining techniques. The material response tool FIAT, developed out of NASA Ames, is currently being integrated into the TEMPEST environment. TPS recession, shape change, mass loss, and mass property alteration are all factors that can perturb an entry trajectory. For missions like Mars 2020, recession was minimal and was safely handled separately as a post process. For missions such as Jupiter Galileo with a high TPS mass fraction or asteroid entries, recession plays a major role. The proposed fully coupled scheme is to use an epoch-based approach where the trajectory integration is halted after a recession threshold, the energy balance and FIAT are solved at each panel, the mesh, aerodynamics, and mass properties are updated, and the trajectory continues. Several computational tradeoffs have been made during the development of TEMPEST to limit the cost of a single trajectory and preserve its utility as a conceptual, rapid iteration tool. Conclusion: Development of TEMPEST is ongoing and the project is still in its infancy. This talk aims to showcase its unique capabilities to support future NASA entry systems missions.

Bohdan O Wesely↗

Visioning a Global Carbon Monitoring System That Can Quantify and Attribute Ocean Carbon Dioxide Removal: Where Are We Now and How Might We Get There?

As atmospheric greenhouse gas concentrations and the resulting social costs rise, it is increasingly important to conduct research on technical approaches to remove carbon dioxide from the atmosphere at the gigaton scale. One highly uncertain but perhaps plausible solution is ocean carbon dioxide (CO2) removal (CDR), which encompasses a suite of proposed techniques for increasing the net flux of CO2 from the atmosphere to the ocean. As reflected in a 2022 National Academy of Sciences report, interest in ocean CDR is rapidly growing, and new stakeholders from a wide range of fields want access to air-sea CO2 flux and ocean carbon information to understand the potential risks and benefits of ocean CDR. Moreover, there is an urgent need for research to develop a scientific basis to support these societal needs. At the same time, there is a growing need to vision a global carbon monitoring system that can quantify natural and anthropogenic perturbations in the air-sea CO2 flux to quantify and attribute the impacts of ocean CDR efforts on the ocean carbon sink. Here, we propose to present nascent efforts at the Ames Research Center to leverage NASA's unique remote sensing and computational capabilities and expertise in basic and applied Earth science to meet the needs of the ocean CDR stakeholder community as represented by the OceanVisions network. Specifically we aim to develop a global ocean CDR scenario explorer with two objectives: 1) to make quantitative estimates of the air-sea CO2 flux and its uncertainty more accessible to a wide range of users, and 2) to enable these diverse users to interactively explore the uncertain impacts on air-sea CO2 fluxes in a wide range of ocean CDR scenarios. The information would be provided to users via a public graphical user interface, and the results would be based on a new synthesis of scientific observations and knowledge in a global ocean mixed layer inverse model run on supercomputers. The proposed tool aims to fill a unique and valuable niche for users and the scientific community by balancing tradeoffs between user interests, scientific knowledge, and technical capabilities. We will conclude by visioning the potential implications for a global carbon monitoring system in a world with gigaton scale ocean CDR.

Global↗

Mars Sample Return Using Commercial Capabilities: Mission Architecture Overview

Mars Sample Return (MSR) is the highest priority science mission for the next decade as recommended by the recent Decadal Survey of Planetary Science. This paper presents an overview of a feasibility study for a MSR mission. The objective of the study was to determine whether emerging commercial capabilities can be used to reduce the number of mission systems and launches required to return the samples, with the goal of reducing mission cost. The major element required for the MSR mission are described and include an integration of the emerging commercial capabilities with small spacecraft design techniques; new utilizations of traditional aerospace technologies; and recent technological developments. We report the feasibility of a complete and closed MSR mission design using the following scenario that covers three synodic launch opportunities, beginning with the 2022 opportunity: A Falcon Heavy injects a SpaceX Red Dragon capsule and trunk onto a Trans Mars Injection (TMI) trajectory. The capsule is modified to carry all the hardware needed to return samples collected on Mars including a Mars Ascent Vehicle (MAV); an Earth Return Vehicle (ERV); and hardware to transfer a sample collected in a previously landed rover mission to the ERV. The Red Dragon descends to land on the surface of Mars using Supersonic Retro Propulsion (SRP). After previously collected samples are transferred to the ERV, the single-stage MAV launches the ERV from the surface of Mars to a Mars phasing orbit. The MAV uses a storable liquid, pump fed bi-propellant propulsion system. After a brief phasing period, the ERV, which also uses a storable bi-propellant system, performs a Trans Earth Injection (TEI) burn. Once near Earth the ERV performs Earth and lunar swing-bys and is placed into a Lunar Trailing Orbit (LTO0 - an Earth orbit, at lunar distance. A later mission, using a Dragon and launched by a Falcon Heavy, performs a rendezvous with the ERV in the lunar trailing orbit, retrieves the sample container and breaks the chain of contact with Mars by transferring the sample into a sterile and secure container. With the sample contained, the retrieving spacecraft, makes a controlled Earth re-entry preventing any unintended release of pristine Martian materials into the Earth's biosphere. Other capsule type vehicles and associated launchers may be applicable. The analysis methods employed standard and specialized aerospace engineering tools. Mission system elements were analyzed with either direct techniques or by using parametric mass estimating relationships (MERs). The architecture was iterated until overall mission convergence was achieved on at least one path. Subsystems analyzed in this study include support structures, power system, nose fairing, thermal insulation, actuation devices, MAV exhaust venting, and GN&C. Best practice application of loads, mass growth contingencies, and resource margins were used. For Falcon Heavy capabilities and Dragon subsystems we utilized publically available data from SpaceX; published analyses from other sources; as well as our own engineering and aerodynamic estimates. Earth Launch mass is under 11 mt, which is within the estimated capability of a Falcon Heavy, with margin. Total entry masses between 7 and 10 mt were considered with closure occurring between 9 and 10 mt. Propellant mass fractions for each major phase of the EDL - Entry, Terminal Descent, and Hazard Avoidance - have been derived. An assessment of the entry conditions on the thermal protection system (TPS), currently in use for Dragon missions, has been made. And shows no significant stressors. A useful mass of 2.0 mt is provided and includes mass growth allowances for the MAV, the ERV, and mission unique equipment. We also report on alternate propellant options for the MAV and options for the ERV, including propulsion systems; crewed versus robotic retrieval mission; as well as direct Earth entry. International Planetary Protection Policies as well as verifiable means of compliance will have a large impact on any MSR mission design. We identify areas within our architecture where such impacts occur. This work shows that emerging commercial capabilities can be used to effectively integrated into a mission to achieve an important planetary science objective.

Mars Sample Return↗

Investigating Low-Altitude Constellations of Ad-Hoc Lunar PNT System for Distributed Spacecraft Autonomy

In this study, we examine a low-altitude Lunar Position, Navigation, and Timing (LPNT) constellations and the localization performance of Centralized Extended Kalman Filter (CEKF) and Decentralized Extended Kalman Filter (DEKF) algorithms. The primary investigation involves a 100-node swarm operating at a 100 km altitude, in contrast to previous studies that examined a 21-node asset in a frozen-orbit at 5,500 km. The autonomous operation of large-scale swarm is based on two-way Inter-Satellite Link (ISL) measurements, which involve pseudoranges and relative velocities among swarm nodes. We perform a numerical assessment of the two filtering approaches, utilizing ‘fully sampled’ measurements from all available assets as well as ‘two ISL’ measurements where each spacecraft is restricted to only two antennas. This research includes an analysis of CEKF under 2-ISL constraints and evaluates the performance of DEKF in a 100-node swarm, which has not been explored in previous studies. In addition, we examine the impact of increasing the sampling frequency for DEKF, showing that the update cycle can be shortened from a 10-minute interval. A novel approach for ‘2-ISL limited’ DEKF will also be introduced, using a matching formulation that exhaustively enumerates all potential matches. This study provides valuable insights into large-scale distributed swarm operations, considering various filter configurations, sampling frequencies, matching strategies, and scalability of CEKF and DEKF for low-altitude LPNT applications. The Lunar PNT technology plays a key role in providing reliable and robust navigation services on the Moon's surface and the South pole, where the primary Lunar missions are planned. To support upcoming Lunar missions, including small satellites from NASA's Commercial Lunar Payload Services program, the Lunar PNT system must be adaptable to smaller platforms like CubeSats. Driven by the growing involvement of public and private exploration partnerships, the traditional low Earth orbit missions are shifting to beyond geosynchronous orbit [1]. These upcoming missions aim to foster a sustainable and innovative exploration program, in collaboration with commercial and international partners, to facilitate human expansion throughout the solar system and return new knowledge and opportunities to Earth [2]. As part of this trend, there are increasing efforts to utilize science missions in Lunar orbit to develop a non-dedicated and ad-hoc PNT network system. Two traditional approaches, the Deep Space Network (DSN) and the weak signal Global Positioning System (GPS), are established deep-space navigation technologies for missions beyond the geosynchronous orbit. Beginning in 1958, the DSN was developed to communicate with the Explorer 1 spacecraft based on the use of radiometric tracking in spacecraft navigation [3]. The DSN is capable of providing nearly unfettered coverage to spacecraft beyond low-Earth orbit (LEO), however, increased space mission volume has created concerns about future expectations of DSN usage for spacecraft navigation [4]. For cislunar mission applications, the position accuracy using DSN achieves 100 m (3σ) with at least three geometrically diverse ground stations when using radiometric tracking alone [5]. The DSN's dependence on Earth-based ground stations restricts its operational capabilities to periods of Earth visibility. This limitation, coupled with its poor localization performance, renders the DSN unsuitable for future lunar missions that demand continuous tracking and precise positioning. To satisfy the increasing requirements of DSN in Lunar applications, spacecrafts are also required to improve their onboard antenna power and efficiency of the transmission. However, there is an important aggregate cost trade between adding capabilities to every spacecraft and adding to a capacity on the ground that serves multiple spacecraft [6]. A weak GPS system can provide PNT service while the user spacecraft is bound to the Moon, leveraging a single, steerable high gain antenna with the relatively narrow beam which includes all the sources in its field of view [7]. However, the higher the altitude the receiver is above the GPS constellations, the poorer and the weaker are the relative geometry and the received signal powers, respectively, leading to a significant navigation accuracy reduction [8]. The transmitted power becomes weaker with increasing distance from the Earth as well as signals tracked from one of the side lobes of the GPS antenna pattern. As a results, the number of visible satellites and relative geometric condition of the GPS satellites at very high altitude drops dramatically and reduces the navigation solution accuracy. Therefore, the weak GPS system is also not an ideal way to provide PNT service to upcoming Lunar missions when considering its limited geometric condition and the recued navigation accuracy. Another navigation approach on the Moon is being developed, similar to the Global Navigation Satellite System (GNSS) on Earth, aiming to offer navigation service with continuous 24/7 coverage across the entire Lunar surface. For example, lunar communications relay and navigation systems (LCRNS) by NASA and Lunar navigation satellite systems (LNSS) by JAXA are designed to serve as dedicated Position, Navigation, and Timing (PNT) systems for the Moon. However, designing a dedicated LNSS and PNT service involves additional challenges, which are unique to the lunar environment, including limited payload capacity for the CubeSat platform, i.e., the size, weight, and power (SWaP) of the onboard clock, limited lunar ground monitoring stations, and limited financial investment as compared to the legacy Earth-GPS [9]. NASA’s focus on utilizing CubeSat platforms on the Moon leads to an alternative Lunar navigation platform that leverages the existing Lunar science and exploration assets. The small satellites used in Lunar missions can be used to create a low-cost, autonomous, ad-hoc, and on-demand mission-centric Lunar PNT swarm capable of providing PNT services to these low-cost lunar missions [10]. As upcoming Lunar missions will often operate at low-altitude about 30 km to 100 km for scientific observations and mapping purposes, the low-altitude orbital constellations could be employed to create an ad-hoc Lunar PNT system. However, several issues must be addressed, such as the instability of these orbits, which often require maintenance or are only suitable for short-duration missions, operating for fewer than 90 days. Additionally, at an altitude of 100 km, the satellites have a limited period during which they are above the horizon and capable of providing PNT service to users. The implementation of a non-dedicated, ad-hoc Lunar navigation constellation facilitates on-demand PNT services. A preliminary study of ad-hoc Lunar PNT system was conducted using 21 spacecraft in 5,5000 km altitude frozen orbits to test its feasibility and a basic performance of orbital asset localization among ad-hoc Lunar constellations in small satellites format [10]. These swarm assets are designed for autonomous localization with minimal Earth interaction, reducing dependency on bandwidth and ground resources. The design in [10] demonstrated the feasibility of a decentralized PNT approach, specifically employing a DEKF approach for state estimation, which helps minimize onboard operating costs. The DEKF method distributes computation across individual satellites, which lightens the computational load while maintaining accuracy in orbit ephemeris and clock offsets, similar to centralized systems [11]. In a follow-on study [12], each spacecraft was limited to 2 communications antennae, forcing the selection of measurements and scheduling spacecraft activities to perform the measurements. A matching algorithm is implemented to select the best measurements and schedule position estimation updates. The decentralized localization performance is also investigated with increasing levels of network degradation for swarm assets considering the impact of intermittent and permanent communication failure, to demonstrate the robustness and fidelity of the decentralized Lunar PNT service [13]. This study confirmed that the ad-hoc PNT constellations in frozen orbit are highly robust and resilient to communication failures. However, unlike frozen orbit swarm assets, the low-altitude satellites have a limited ground view at an altitude of 100 km, where the ad-hoc Lunar constellation consists of 98 low-altitude satellites, evenly distributed across seven circular polar orbital planes, alongside two satellites in a frozen orbit at an altitude of 5,500 km (Figure 1). Therefore, the number of satellites visible to ground users is significantly limited in low-altitude orbit constellations. As each visibility of a spacecraft remains intact for only a few ticks before it moves out of the field of view, the ground user encounters challenges in maintaining continuous navigation service, resulting in sparse availability and provision of Lunar PNT system. Consequently, service availability is primarily restricted to the Lunar South Pole region (Figure 2). Given these limitations and concerns, the localization performance of low-altitude swarm assets will be assessed in this study. We focus on the investigation of the localization performance of low-altitude swarm assets and ground users near the Lunar South Pole. The overall flow of the Lunar PNT simulation incorporates the DEKF approach of asset localization and the weighted least-squares approach in user localization (Figure 3). The autonomous Lunar PNT simulation is primarily implemented in MATLAB, where the DEKF based on the matching scheduler is implemented with Google’s OR-tools as a model builder and Gurobi optimization tool as a backend solver. The General Mission Analysis Tool (GMAT) is utilized to generate ephemeris data for swarm assets, and accounts for satellite orbital details, mass, and perturbations like solar radiation pressure and drag coefficients. Each ephemeris dataset is produced in the Moon International Celestial Reference Frame (ICRF) inertial coordinate system. For state estimation, the distributed swarm assets rely on two-way Inter-Satellite Link (ISL) measurements, which involve tracking pseudoranges and relative velocities between visible satellites and anchor nodes during each observation. Numerical evaluations of the decentralized localization process are conducted to demonstrate the feasibility of the low-altitude PNT system in providing reliable navigation services. The main approach involves using DEKF and CEKF to localize 100 satellites in low-altitude constellations, where the CEKF is implemented to serve as a baseline for comparing the performance of distributed algorithms. In both cases, we evaluate ‘fully sampled’ measurements from all available assets, and ‘two ISL’ measurements when spacecraft are constrained to have only two antennas. We test four estimation techniques: CEKF fully sampled, CEKF two ISL, DEKF fully sampled, and DEKF two ISL filters. As the DEKF update cycle is comprised of network setup, communication, and computations, a global broadcast network and 2-way ISL network setup will take from 4 to 6 minutes as maximum [12]. In this simulation, the DEKF update cycle is set to 10 minutes, including a 4-minute latency for obtaining and computing the actual measurement updates. We experiment an increased update cycle to demonstrate the feasibility and evaluate the impact on localization performance using various tuning values for measurement noise covariances (Figures 4 and 5). By comparing centralized and decentralized approaches using a matching algorithm, we analyze the influence of cross-correlation factors in the covariance matrix, assuming 100% reliability of all assets and measurements. The increased frequency and the adjustments of tuning parameters reveal distinct error patterns between the two scenarios. The localization accuracy of the swarm assets and ground users is assessed by taking the median error across 100 assets and one ground user (84.9°S, 137.5°E) over 7-day simulation period (Table 1). Since the user localization accuracy is significantly affected by the performance of the swarm assets, it is crucial to maintain high localization accuracy within the swarm. This study will continue to explore decentralized filtering for autonomous LPNT operations, with further investigation of an 'iterative' matching approach which enumerates every valid matching pair, planned for the following month.

Yeji Kim↗

Future of Fuel Savings

Using automation to free up controllers for more strategic management of air traffic is one approach being studied by NASA as it seeks to boost airspace system capacity and efficiency, thereby saving fuel. Heinz Erzberger, a NASA Ames Research Center senior scientist, says the Advanced Airspace Concept (AAC) has been studied for several years. It could increase efficiency 15% by providing optimal routes that cut airlines direct operating costs. A 25% increase in landings on existing runways could follow an important benefit. AAC is one of the efforts to be reviewed by the Joint Planning and Development Organization, an FAA-led initiative by six federal agencies to redesign the U.S. air transportation system by 2025. The main goal is to triple air traffic capacity within 20 years to avert the sort of gridlock that would make fuel consumption only one of many travel nightmares. The automated system approach would allow aircraft to fly optimal trajectories. A trajectory would be defined in the standard three dimensions and eventually include the fourth, time. The management of air traffic by the data-linked exchange of trajectories would start at high altitude and eventually move down to lower altitudes. The automated concept is an outgrowth of the type of tools developed by NASA for use by FAA controllers in managing traffic flows over the years, including ones that optimize routings for the best fuel burn. But AAC would push automation further to reduce workload so controllers can focus on "solving strategic control problems, managing traffic flow during changing weather and ... other unusal events." One key component, the automated trajectory server (ATS), is a ground systems that would rely on software to manage flight path requests from aircrews and controllers. But, Erzberger acknowledges, "The FAA's current plan for upgrades to air traffic services does not include [allowing] the future ground system to issue separation-critical clearances of trajectory changes autonomously to aircraft via data link without explicit approval of a controller," as the AAC proposes. The AAC enables pilots or controllers to data link requests for a trajectory change to the ATS for approval after they are deconflicted with the paths of other aircraft. To divert around storms, for example, pilots could data link their trajectory preference to the ATS. Since several aircraft might request similar routes, the computer would then have to suggest alternatives. This could be accomplished without pilot-controller radio calls, a big bottleneck now. The ATS would have a built-in conflict monitor to call for a resolution (turn, climb or descend), when loss of separation is likely in 1-20 min. The AAC system would reduce controller errors by 90%, according to NASA Ames estimates. The AAC would have a back-up program to assure separation-Tactical Separation Assurance (TSAFE). It s designed to detect short-term traffic conflicts within 3-4 min. of loss of separation. The last line of defense would still be provided by traffic alert & collision avoidance systems (TCAS).

Hughes, David↗

Application of Design of Experiments and Surrogate Modeling within the NASA Advanced Concepts Office, Earth-to-Orbit Design Process

Decisions made during early conceptual design have a large impact upon the expected life-cycle cost (LCC) of a new program. It is widely accepted that up to 80% of such cost is committed during these early design phases. Therefore, to help minimize LCC, decisions made during conceptual design must be based upon as much information as possible. To aid in the decision making for new launch vehicle programs, the Advanced Concepts Office (ACO) at NASA Marshall Space Flight Center (MSFC) provides rapid turnaround pre-phase A and phase A concept definition studies. The ACO team utilizes a proven set of tools to provide customers with a full vehicle mass breakdown to tertiary subsystems, preliminary structural sizing based upon worst-case flight loads, and trajectory optimization to quantify integrated vehicle performance for a given mission. Although the team provides rapid turnaround for single vehicle concepts, the scope of the trade space can be limited due to analyst availability and the manpower requirements for manual execution of the analysis tools. In order to enable exploration of a broader design space, the ACO team has implemented an advanced design methods (ADM) based approach. This approach applies the concepts of design of experiments (DOE) and surrogate modeling to more exhaustively explore the trade space and provide the customer with additional design information to inform decision making. This paper will first discuss the automation of the ACO tool set, which represents a majority of the development effort. In order to fit a surrogate model within tolerable error bounds a number of DOE cases are needed. This number will scale with the number of variable parameters desired and the complexity of the system's response to those variables. For all but the smallest design spaces, the number of cases required cannot be produced within an acceptable timeframe using a manual process. Therefore, automation of the tools was a key enabler for the successful application of an ADM approach to an ACO design study. Following the overview of the tool set automation, an example problem will be given to illustrate the implementation of the ADM approach. The example problem will first cover the inclusion of ground rules and assumptions (GR&A) for a study. The GR&A are very important to the study as they determine the constraints within which a trade study can be conducted. These trades must ultimately reconcile with the customer's desired output and any anticipated "what if" questions. The example problem will then illustrate the setup and execution of a DOE through the automated ACO tools. This process is accomplished more efficiently in this work by splitting the tools into two separate environments. The first environment encompasses the structural optimization and mass estimation tools, while the second is focused on trajectory optimization. Surrogate models are fit to the outputs of each environment and are "integrated" via connection of the surrogate equations. Throughout this process, checks are implemented to compare the output of the surrogates to the output of manually run cases to ensure that the error of the final surrogates is at an acceptable level. The conclusion of the example problem demonstrates the utility of the ADM based approach. Using surrogate models gives the ACO team the ability to visualize vehicle sensitivities to various design parameters and identify regions of interest within the design space. The ADM approach can thus be used to inform concept down selection and isolate promising vehicle configurations to be explored in more detail through the manual design process. In addition it provides the customer with an almost instantaneous turnaround on any ''what if" questions that may arise within the bounds of the surrogate model. This approach ultimately expands the ability of the ACO team to provide its customer with broad and rapid turnaround trade studies for launch vehicle conceptual design. The ability to identify a selection of designs which can meet the customer requirements will help ensure lower LCC of launch vehicle designs originating from ACO.

Zwack, Mathew R.↗

Application of Design of Experiments and Surrogate Modeling within the NASA Advanced Concepts Office, Earth-to-Orbit Design Process

Decisions made during early conceptual design have a large impact upon the expected life-cycle cost (LCC) of a new program. It is widely accepted that up to 80% of such cost is committed during these early design phases.1 Therefore, to help minimize LCC, decisions made during conceptual design must be based upon as much information as possible. To aid in the decision making for new launch vehicle programs, the Advanced Concepts Office (ACO) at NASA Marshall Space Flight Center (MSFC) provides rapid turnaround pre-phase A and phase A concept definition studies. The ACO team utilizes a proven set of tools to provide customers with a full vehicle mass breakdown to tertiary subsystems, preliminary structural sizing based upon worst-case flight loads, and trajectory optimization to quantify integrated vehicle performance for a given mission.2 Although the team provides rapid turnaround for single vehicle concepts, the scope of the trade space can be limited due to analyst availability and the manpower requirements for manual execution of the analysis tools. In order to enable exploration of a broader design space, the ACO team has implemented an Advanced Design Methods (ADM) based approach. This approach applies the concepts of Design of Experiments (DOE) and surrogate modeling to more exhaustively explore the trade space and provide the customer with additional design information to inform decision making. This paper will first discuss the automation of the ACO tool set, which represents a majority of the development e ort. In order to t a surrogate model within tolerable error bounds a number of DOE cases are needed. This number will scale with the number of variable parameters desired and the complexity of the system's response to those variables. For all but the smallest design spaces, the number of cases required cannot be produced within an acceptable timeframe using a manual process. Therefore, automation of the tools was a key enabler for the successful application of an ADM approach to an ACO design study. Following the overview of the tool set automation, an example problem will be given to illustrate the implementation of the ADM approach. The example problem will first cover the inclusion of Ground Rules and Assumptions (GR&A) for a study. The GR&A are very important to the study as they determine the constraints within which a trade study can be conducted. These trades must ultimately reconcile with the customer's desired output and any anticipated \what if" questions. The example problem will then illustrate the setup and execution of a DOE through the automated ACO tools. This process is accomplished more efficiently in this work by splitting the tools into two separate environments. The first environment encompasses the structural optimization and mass estimation tools, while the second is focused on trajectory optimization. Surrogate models are t to the outputs of each environment and are integrated via connection of the surrogate equations. Throughout this process, checks are implemented to compare the output of the surrogates to the output of manually run cases to ensure that the error of the final surrogates is at an acceptable level. The conclusion of the example problem demonstrates the utility of the ADM based approach. Using surrogate models gives the ACO team the ability to visualize vehicle sensitivities to various design parameters and identify regions of interest within the design space. The ADM approach can thus be used to inform concept down selection and isolate promising vehicle configurations to be explored in more detail through the manual design process. In addition it provides the customer with an almost instantaneous turnaround on any \what if" questions that may arise within the bounds of the surrogate model. This approach ultimately expands the ability of the ACO team to provide its customer with broad and rapid turnaround trade studies for launch vehicle conceptual design. The ability to identify a selection of designs which can meet the customer requirements will have the potential to lower LCC of launch vehicle designs originating from ACO.

Zwack, Mathew R.↗

NASA System Safety Handbook: System Safety Framework and Concepts for Implementation - Volume 1

System safety assessment is defined in NPR 8715.3C, NASA General Safety Program Requirements as a disciplined, systematic approach to the analysis of risks resulting from hazards that can affect humans, the environment, and mission assets. Achievement of the highest practicable degree of system safety is one of NASA's highest priorities. Traditionally, system safety assessment at NASA and elsewhere has focused on the application of a set of safety analysis tools to identify safety risks and formulate effective controls.1 Familiar tools used for this purpose include various forms of hazard analyses, failure modes and effects analyses, and probabilistic safety assessment (commonly also referred to as probabilistic risk assessment (PRA)). In the past, it has been assumed that to show that a system is safe, it is sufficient to provide assurance that the process for identifying the hazards has been as comprehensive as possible and that each identified hazard has one or more associated controls. The NASA Aerospace Safety Advisory Panel (ASAP) has made several statements in its annual reports supporting a more holistic approach. In 2006, it recommended that "... a comprehensive risk assessment, communication and acceptance process be implemented to ensure that overall launch risk is considered in an integrated and consistent manner." In 2009, it advocated for "... a process for using a risk-informed design approach to produce a design that is optimally and sufficiently safe." As a rationale for the latter advocacy, it stated that "... the ASAP applauds switching to a performance-based approach because it emphasizes early risk identification to guide designs, thus enabling creative design approaches that might be more efficient, safer, or both." For purposes of this preface, it is worth mentioning three areas where the handbook emphasizes a more holistic type of thinking. First, the handbook takes the position that it is important to not just focus on risk on an individual basis but to consider measures of aggregate safety risk and to ensure wherever possible that there be quantitative measures for evaluating how effective the controls are in reducing these aggregate risks. The term aggregate risk, when used in this handbook, refers to the accumulation of risks from individual scenarios that lead to a shortfall in safety performance at a high level: e.g., an excessively high probability of loss of crew, loss of mission, planetary contamination, etc. Without aggregated quantitative measures such as these, it is not reasonable to expect that safety has been optimized with respect to other technical and programmatic objectives. At the same time, it is fully recognized that not all sources of risk are amenable to precise quantitative analysis and that the use of qualitative approaches and bounding estimates may be appropriate for those risk sources. Second, the handbook stresses the necessity of developing confidence that the controls derived for the purpose of achieving system safety not only handle risks that have been identified and properly characterized but also provide a general, more holistic means for protecting against unidentified or uncharacterized risks. For example, while it is not possible to be assured that all credible causes of risk have been identified, there are defenses that can provide protection against broad categories of risks and thereby increase the chances that individual causes are contained. Third, the handbook strives at all times to treat uncertainties as an integral aspect of risk and as a part of making decisions. The term "uncertainty" here does not refer to an actuarial type of data analysis, but rather to a characterization of our state of knowledge regarding results from logical and physical models that approximate reality. Uncertainty analysis finds how the output parameters of the models are related to plausible variations in the input parameters and in the modeling assumptions. The evaluation of unrtainties represents a method of probabilistic thinking wherein the analyst and decision makers recognize possible outcomes other than the outcome perceived to be "most likely." Without this type of analysis, it is not possible to determine the worth of an analysis product as a basis for making decisions related to safety and mission success. In line with these considerations the handbook does not take a hazard-analysis-centric approach to system safety. Hazard analysis remains a useful tool to facilitate brainstorming but does not substitute for a more holistic approach geared to a comprehensive identification and understanding of individual risk issues and their contributions to aggregate safety risks. The handbook strives to emphasize the importance of identifying the most critical scenarios that contribute to the risk of not meeting the agreed-upon safety objectives and requirements using all appropriate tools (including but not limited to hazard analysis). Thereafter, emphasis shifts to identifying the risk drivers that cause these scenarios to be critical and ensuring that there are controls directed toward preventing or mitigating the risk drivers. To address these and other areas, the handbook advocates a proactive, analytic-deliberative, risk-informed approach to system safety, enabling the integration of system safety activities with systems engineering and risk management processes. It emphasizes how one can systematically provide the necessary evidence to substantiate the claim that a system is safe to within an acceptable risk tolerance, and that safety has been achieved in a cost-effective manner. The methodology discussed in this handbook is part of a systems engineering process and is intended to be integral to the system safety practices being conducted by the NASA safety and mission assurance and systems engineering organizations. The handbook posits that to conclude that a system is adequately safe, it is necessary to consider a set of safety claims that derive from the safety objectives of the organization. The safety claims are developed from a hierarchy of safety objectives and are therefore hierarchical themselves. Assurance that all the claims are true within acceptable risk tolerance limits implies that all of the safety objectives have been satisfied, and therefore that the system is safe. The acceptable risk tolerance limits are provided by the authority who must make the decision whether or not to proceed to the next step in the life cycle. These tolerances are therefore referred to as the decision maker's risk tolerances. In general, the safety claims address two fundamental facets of safety: 1) whether required safety thresholds or goals have been achieved, and 2) whether the safety risk is as low as possible within reasonable impacts on cost, schedule, and performance. The latter facet includes consideration of controls that are collective in nature (i.e., apply generically to broad categories of risks) and thereby provide protection against unidentified or uncharacterized risks.

Dezfuli, Homayoon↗