Results for “safety systems (spacecraft)” — Page 17

NASA NTRSDate not supplied

A Solar Sail Shape Modeling Approach for Attitude Control Design and Analysis

Solar sails operating in the space environment experience deformations in sail shape that result in relatively large disturbance torques which dictate the required performance of the spacecraft attitude control and momentum management systems. These deformations are driven by thermal loads on the booms (due to uneven solar heating), manufacturing and assembly tolerances, and variations in membrane tension. The Solar Cruiser spacecraft utilizes a four-quadrant sail design with four 30-meter length booms and four triangular sail membranes, creating a square sail structure of >1600 m2. Medium-fidelity mesh models were developed based on a characteristic deformed shape. A series of parametric studies were conducted using this shape paradigm to determine worst-case deformed sail shapes which produce bounding disturbance torques. A large database of shapes was produced, and the forces and moments induced by each individual shape were calculated using a Rios-Reyes reduced order generalized sail model [1]. Two were selected as reference worst-case shapes for the Solar Cruiser mission: one which produced the highest pitch/yaw root-sum-squared (RSS) torque, and one which produced the highest roll torque. The results showed that the worst-case shapes at high solar incidence angles induce significantly higher (2-10x) disturbance torques than an ideal, flat-plate sail. Even with considerable safety margins, assuming an ideal sail is unlikely to sufficiently bound the disturbances, which is critical when designing the attitude control system and sizing actuators. Accurate sail shape modeling methodologies should therefore be employed on future solar sail missions. References [1] L. Rios-Reyes and D. J. Scheeres, “Generalized Model for Solar Sails,” Journal of Spacecraft and Rockets, Vol. 42, Jan. 2005, pp. 182–185, 10.2514/1.9054.

Solar Sail↗

NASA NTRSDate not supplied

TechEdSat 7, 10, 13, 15: Exo-brake Experiments on the ISS, First Virgin Orbit, and First Firefly-Alpha Test Flights.

The TechEdSat flight series (TES-n), developed by the Nano Orbital Workshop (NOW) group at NASA Ames, has been studying cube satellite re-entry technologies with a focus on Exo-Brake drag device research. An exo-atmospheric braking device, the Exo-Brake uses the tenuous upper atmosphere acting in a free molecular flow regime to enable controllable adjustment of the drag profile of the host spacecraft, currently enabling rapid disposal of small spacecraft after mission conclusion, and eventual targeted de-orbit to a desired entry point at the Von Karman line, or approximately 100km in altitude. The TES-7 mission, flown on the first successful Virgin Orbit flight January 17, 2021, was injected into a 500km, 61-degree inclination orbit, with an expected orbital lifetime of approximately ten years. After successful deployment of a unique hydrogen gas-cell inflation design ‘disposal’-type Mylar Exo-Brake intended to rapidly de-orbit the spacecraft, the maximum expected orbital lifetime of the TES-7 spacecraft was successfully reduced from ten years to 1.3 years, an 87% reduction in orbit lifetime via a passive, fuel-less system. The subsequent TES-13 mission utilized a new, less complex ‘disposal’-type Exo-Brake design made from collapsible rigid struts rather than inflated struts to reduce the engineering, construction, and safety complexities introduced by the prior hydrogen gas inflation design. The rigid strut Exo-Brake design is stowed via rotational compression and deploys using only stored spring energy once released via electronic actuator. This new rotation compression storage design has become the new Exo-Brake design standard used on TES missions thanks to its simplicity. Following on the success of this new Exo-Brake design demonstrated by TES-13, the design was further refined to enabled active manipulation of the Exo-Brake effective drag area though a winch-like system. Both the TES-10 and TES-15 spacecraft were equipped with geometrically similar Exo-Brake devices capable of such active drag modulation, with the intent of studying the operational impact of having such devices on cube satellite missions. To increase the survival time of the Exo-Brake at low altitudes and thus gain more experiment time and better guidance capability, TES-15 was equipped with a modulated Exo-Brake constructed from 3M™ Nextel™ 440 ceramic oxide fiber, the same fabric material used in the Space Shuttle TPS system, rather than Mylar. After launching on Alpha Flight 2 October 1st, 2022, Firefly’s first successful launch, TES-15 met the same modulation restrictions as TES-10, with modulation prohibited above 200km to avoid possible collision with other spacecraft. In this case, a low deployment orbit caused an extremely short mission life, which, coupled with delayed spacecraft identification, exacerbated collision concerns and caused performance data of the high-temperature Exo-Brake design to be inconclusive. As such, the Nano Orbital Workshop has taken a new approach of only conducting modulated Exo-Brake research on missions deploying below ISS altitude to avoid collision avoidance restrictions, and is working to improve spacecraft identification and location reporting techniques to increase experiment durations. Upcoming TES mission will therefore use one of two classes of Exo-Brake depending on their target altitude, as to be described in the submission.

M Murbach↗

NASA NTRSDate not supplied

TechEdSat 7, 10, 13, 15: Exo-brake Experiments on the ISS, First Virgin Orbit, and First Firefly-Alpha Test Flights

The TechEdSat flight series (TES-n), developed by the Nano Orbital Workshop (NOW) group at NASA Ames, has been studying cube satellite re-entry technologies with a focus on Exo-Brake drag device research. An exo-atmospheric braking device, the Exo-Brake uses the tenuous upper atmosphere acting in a free molecular flow regime to enable controllable adjustment of the drag profile of the host spacecraft, currently enabling rapid disposal of small spacecraft after mission conclusion, and eventual targeted de-orbit to a desired entry point at the Von Karman line, or approximately 100km in altitude. The TES-7 mission, flown on the first successful Virgin Orbit flight January 17, 2021, was injected into a 500km, 61-degree inclination orbit, with an expected orbital lifetime of approximately ten years. After successful deployment of a unique hydrogen gas-cell inflation design ‘disposal’-type Mylar Exo-Brake intended to rapidly de-orbit the spacecraft, the maximum expected orbital lifetime of the TES-7 spacecraft was successfully reduced from ten years to 1.3 years, an 87% reduction in orbit lifetime via a passive, fuel-less system. The subsequent TES-13 mission utilized a new, less complex ‘disposal’-type Exo-Brake design made from collapsible rigid struts rather than inflated struts to reduce the engineering, construction, and safety complexities introduced by the prior hydrogen gas inflation design. The rigid strut Exo-Brake design is stowed via rotational compression and deploys using only stored spring energy once released via electronic actuator. This new rotation compression storage design has become the new Exo-Brake design standard used on TES missions thanks to its simplicity. Following on the success of this new Exo-Brake design demonstrated by TES-13, the design was further refined to enabled active manipulation of the Exo-Brake effective drag area though a winch-like system. Both the TES-10 and TES-15 spacecraft were equipped with geometrically similar Exo-Brake devices capable of such active drag modulation, with the intent of studying the operational impact of having such devices on cube satellite missions. To increase the survival time of the Exo-Brake at low altitudes and thus gain more experiment time and better guidance capability, TES-15 was equipped with a modulated Exo-Brake constructed from 3M™ Nextel™ 440 ceramic oxide fiber, the same fabric material used in the Space Shuttle TPS system, rather than Mylar. After launching on Alpha Flight 2 October 1st, 2022, Firefly’s first successful launch, TES-15 met the same modulation restrictions as TES-10, with modulation prohibited above 200km to avoid possible collision with other spacecraft. In this case, a low deployment orbit caused an extremely short mission life, which, coupled with delayed spacecraft identification, exacerbated collision concerns and caused performance data of the high-temperature Exo-Brake design to be inconclusive. As such, the Nano Orbital Workshop has taken a new approach of only conducting modulated Exo-Brake research on missions deploying below ISS altitude to avoid collision avoidance restrictions, and is working to improve spacecraft identification and location reporting techniques to increase experiment durations. Upcoming TES mission will therefore use one of two classes of Exo-Brake depending on their target altitude, as to be described in the submission.

Marcus Murbach↗

NASA NTRS1980

A new phase for NASA's communications satellite program

NASA's research in communications satellite technology is discussed, including orbit-efficient techniques and applications by the commercial sector. Attention is given to expanding the capacities of the C-band (6-4 GHz) and the Ku-band (14-11 GHz), opening the Ka-band (30/20 GHz), broadly applied 're-use' of the spectrum, and developing multibeam spacecraft antennas with on-board switching. Increasing wideband services in video, high-speed data, and voice trunking is considered, as are narrow-band systems that may be used for data collection or public safety, with possible expansion to a thin-route satellite system. In particular, communication for medical, disaster, or search-and-rescue emergencies may be met by the integration of a satellite service with land mobile communications via terrestrial radio links. Also considered is a large geostationary platform providing electrical power, thermal rejection, and orbital station-keeping for many communications payloads.

Dement, D. K.↗

NASA NTRS1988

Life sciences - On the critical path for missions of exploration

Life sciences are important and critical to the safety and success of manned and long-duration space missions. The life science issues covered include gravitational physiology, space radiation, medical care delivery, environmental maintenance, bioregenerative systems, crew and human factors within and outside the spacecraft. The history of the role of life sciences in the space program is traced from the Apollo era, through the Skylab era to the Space Shuttle era. The life science issues of the space station program and manned missions to the moon and Mars are covered.

Sulzman, Frank M.↗

NASA NTRS2001

Effect of Slow External Flow on Flame Spreading over Solid Material: Opposed Spreading over Polyethylene Wire Insulation

The effect of slow external flow on solid combustion is very important from the view of fire safety in space because the solid material in spacecraft is generally exposed to the low air flow for ventilation. Further, the effect of low external flow on fuel combustion is generally fundamental information for industrial combustion system, such as gas turbine, boiler incinerator and so on. However, it is difficult to study the effect of low external flow on solid combustion in normal gravity, because the buoyancy-induced flow strongly disturbs the flow field, especially for low flow velocity. In this research therefore, the effect of slow external flow on opposed flame spreading over polyethylene (PE) wire insulation have been investigated in microgravity. The microgravity environment was provided by Japan Microgravity Center (JAMIC) in Japan and KC-135 at NASA GRC. The tested flow velocity range is 0-30cm/s with different oxygen concentration and inert gas component.

Fujita, O.↗

NASA NTRS2002

Air Purification in Closed Environments: An Overview of Spacecraft Systems

The primary goal for a collective protection system and a spacecraft environmental control and life support system (ECLSS) are strikingly similar. Essentially both function to provide the occupants of a building or vehicle with a safe, habitable environment. The collective protection system shields military and civilian personnel from short-term exposure to external threats presented by toxic agents and industrial chemicals while an ECLSS sustains astronauts for extended periods within the hostile environment of space. Both have air quality control similarities with various aircraft and 'tight' buildings. This paper reviews basic similarities between air purification system requirements for collective protection and an ECLSS that define surprisingly common technological challenges and solutions. Systems developed for air revitalization on board spacecraft are discussed along with some history on their early development as well as a view of future needs. Emphasis is placed upon two systems implemented by the National Aeronautics and Space Administration (NASA) onboard the International Space Station (ISS): the trace contaminant control system (TCCS) and the molecular sieve-based carbon dioxide removal assembly (CDRA). Over its history, the NASA has developed and implemented many life support systems for astronauts. As the duration, complexity, and crew size of manned missions increased from minutes or hours for a single astronaut during Project Mercury to days and ultimately months for crews of 3 or more during the Apollo, Skylab, Shuttle, and ISS programs, these systems have become more sophisticated. Systems aboard spacecraft such as the ISS have been designed to provide long-term environmental control and life support. Challenges facing the NASA's efforts include minimizing mass, volume, and power for such systems, while maximizing their safety, reliability, and performance. This paper will highlight similarities and differences among air purification systems. Additional information is included in the original extended abstract.

Perry, Jay L.↗

NASA NTRS2018

Innovations in Spacecraft Proximity & Navigation Lighting

New spacecraft bound for the Moon and Mars should be exploring lighting technologies that can reduce safety risks while increasing capability. The operational lighting environment for these new missions will not have the forgiving 90 minute orbit of the International Space Station. Advances in solid state lighting and optics design are yielding new form factors for lamps that have the potential to reduce operational risk for both humans and imaging systems that are impacted by high contrast lighting environments. This project evaluated light source form factors and control innovations for spacecraft exterior proximity and navigation lighting by building a demonstration test rig and testing the effectiveness of the light sources and their controls to increase visibility and usability.

Clark, Toni A.↗

NASA NTRS1998

Comparative Soot Diagnostics: 1 Year Report

The motivation for the Comparative Soot Diagnostics (CSD) experiment lies in the broad practical importance of understanding combustion generated particulate. Depending upon the circumstances, particulate matter can affect the durability and performance of combustion equipment, can be a pollutant, can be used to detect fires and, in the form of soot, can be the dominant source of radiant energy from flames. Bright sooty fires are desirable for efficient energy extraction in furnaces and power equipment. In contrast, soot-enhanced radiation is undesirable in many propulsion systems (e.g. jet engines). The non-buoyant structure of most flames of practical interest (turbulent) makes understanding of soot processes in low gravity flames important to our ability to predict fire behavior on earth. These studies also have direct applications to fire safety in human-crew spacecraft, since smoke is the indicator used for automated detection in current spacecraft. In addition, recent tests conducted on MIR showed that a candle in a truly quiescent spacecraft environment can burn for tens of minutes. Consequently, this test and many earlier tests have demonstrated that fires in spacecraft can be considered a credible risk. In anticipation of this risk, NASA has included fire detectors on Skylab, smoke detectors on the Space Shuttle (STS), and smoke detectors in the design for the International Space Station (ISS). In the CSD experiment, these smoke detectors were tested using, quasi-steady, low-gravity, particulate generating materials. Samples of the particulate were also obtained from these low-gravity sources. This experiment provides the first such measurements aimed toward understanding of soot processes here on earth and for the testing and design of advanced spacecraft smoke detection systems. This paper describes the operation and preliminary results of the CSD experiment which was was conducted in the Middeck Glovebox Facility (MGBX) on USMP-3. The objectives of CSD are to examine the particulate emission from a variety of pyrolyzing and combusting sources and to quantify the performance of several particulate-sensing diagnostic techniques. This paper presents the results of the microgravity portion of the CSD experiment. The results include the temporal response of the detectors and average sizes of the primary and aggregate particles captured on the thermophoretic probes. Complete assessment of the microgravity data and its combination with the normal-gravity data are still in process.

Urban, David L.↗

NASA NTRS1987

A knowledge-based system for monitoring the electrical power system of the Hubble Space Telescope

The design and the prototype for the expert system for the Hubble Space Telescope's electrical power system are discussed. This prototype demonstrated the capability to use real time data from a 32k telemetry stream and to perform operational health and safety status monitoring, detect trends such as battery degradation, and detect anomalies such as solar array failures. This prototype, along with the pointing control system and data management system expert systems, forms the initial Telemetry Analysis for Lockheed Operated Spacecraft (TALOS) capability.

Eddy, Pat↗

NASA NTRSDate not supplied

Gateway Autonomy for Enabling Deep Space Exploration

The Gateway spacecraft is an important stepping-stone to exploration of the solar system, integrating commercial and international partners into a tightly coupled system, enabling cislunar activities, and implementing key technologies for missions to Mars. Autonomy is a capability area necessary to handle long communication outages where intervention from Earth is impossible, to prepare to operate with long communication delays that will be common in interplanetary travel, and to make spaceflight more affordable and accessible by reducing sustaining operations costs. The Gateway Concept of Operations states that one of Gateway’s goals is to “focus on infrastructure and systems that will allow autonomous operations aboard the Gateway with robotics, automated systems, advanced communications, and distributed computing.” Gateway’s Vehicle Systems Manager (VSM) and associated Autonomous Spacecraft Management Architecture (ASMA) are key products towards delivering autonomous capability. The primary functions of the control architecture are Mission Management and Timeline Execution, Resource Management, Fault Management, and Vehicle Control and Operation (VCO). In each of these areas, there is an initial level of capability to be delivered at launch, with plans to continue development and grow to greater capability. The initial deployment of VSM will focus on maintaining vehicle safety by focusing on full fault management capabilities and deploying only enough resource and timeline planning functionality to support that. The final deployment of VSM will add significant planning and control optimization functionality to support nominal operations for up to 21 days without ground support, even accommodating fault and failure conditions. While the VSM is the vehicle-level representation of autonomous reasoning, distributed automation is essential to provide the right scope and abstraction of information to process. Module and system support of automation and simplicity of interfaces are two important design paradigms that Gateway is focusing on to garner a systems approach to autonomy. Distribution of reasoning can increase complexity, so Gateway is also taking a strict hierarchical approach to information flow and decision making. VSM is not the only capability necessary to achieve an autonomous spacecraft. Robotics support for maintenance of the spacecraft will be essential to provide continued vehicle functionality even when crew is not present. Technical and programmatic challenges exist when implementing autonomous robotics operations. These challenges include sufficient network flexibility to support data transfer to the rest of the vehicle to coordinate module-to-module robotic walk-offs and finding the proper interfaces to allow sufficient dexterity. Communication system upgrades planned for Gateway include Delay Tolerant Networking to best utilize the complex network of relays that will be part of mature cislunar operations. Distributed computing and management will provide failure tolerance, robustness, and growth of capabilities while still allowing significant reuse of heritage software on heritage systems as well as reuse of common applications across a spacecraft to minimize new development, but this requires adherence to key standards and interfaces. The Gateway program has demonstrated significant progress towards these capabilities and has identified challenges other spacecraft developers should be aware of from the start.

Molly Anderson↗

NASA NTRSDate not supplied

Gateway Autonomy for Enabling Deep Space Exploration

The Gateway spacecraft is an important stepping-stone to exploration of the solar system, integrating commercial and international partners into a tightly coupled system, enabling cislunar activities, and implementing key technologies for missions to Mars. Autonomy is a capability area necessary to handle long communication outages where intervention from Earth is impossible, to prepare to operate with long communication delays that will be common in interplanetary travel, and to make spaceflight more affordable and accessible by reducing sustaining operations costs. The Gateway Concept of Operations states that one of Gateway’s goals is to “focus on infrastructure and systems that will allow autonomous operations aboard the Gateway with robotics, automated systems, advanced communications, and distributed computing.” Gateway’s Vehicle Systems Manager (VSM) and associated Autonomous Spacecraft Management Architecture (ASMA) are key products towards delivering autonomous capability. The primary functions of the control architecture are Mission Management and Timeline Execution, Resource Management, Fault Management, and Vehicle Control and Operation (VCO). In each of these areas, there is an initial level of capability to be delivered at launch, with plans to continue development and grow to greater capability. The initial deployment of VSM will focus on maintaining vehicle safety by focusing on full fault management capabilities and deploying only enough resource and timeline planning functionality to support that. The final deployment of VSM will add significant planning and control optimization functionality to support nominal operations for up to 21 days without ground support, even accommodating fault and failure conditions. While the VSM is the vehicle-level representation of autonomous reasoning, distributed automation is essential to provide the right scope and abstraction of information to process. Module and system support of automation and simplicity of interfaces are two important design paradigms that Gateway is focusing on to garner a systems approach to autonomy. Distribution of reasoning can increase complexity, so Gateway is also taking a strict hierarchical approach to information flow and decision making. VSM is not the only capability necessary to achieve an autonomous spacecraft. Robotics support for maintenance of the spacecraft will be essential to provide continued vehicle functionality even when crew is not present. Technical and programmatic challenges exist when implementing autonomous robotics operations. These challenges include sufficient network flexibility to support data transfer to the rest of the vehicle to coordinate module-to-module robotic walk-offs and finding the proper interfaces to allow sufficient dexterity. Communication system upgrades planned for Gateway include Delay Tolerant Networking to best utilize the complex network of relays that will be part of mature cislunar operations. Distributed computing and management will provide failure tolerance, robustness, and growth of capabilities while still allowing significant reuse of heritage software on heritage systems as well as reuse of common applications across a spacecraft to minimize new development, but this requires adherence to key standards and interfaces. The Gateway program has demonstrated significant progress towards these capabilities and has identified challenges other spacecraft developers should be aware of from the start.

Molly Anderson↗

NASA NTRS1994

The development of an Infrared Environmental System for TOPEX Solar Panel Testing

Environmental testing and flight qualification of the TOPEX/POSEIDON spacecraft solar panels were performed with infrared (IR) lamps and a control system that were newly designed and integrated. The basic goal was more rigorous testing of the costly panels' new composite-structure design without jeopardizing their safety. The technique greatly reduces the costs and high risks of testing flight solar panels.

environmental simulation solar panel thermal testi↗

NASA NTRS2009

Topics on Test Methods for Space Systems and Operations Safety: Applicability of Experimental Data

This viewgraph presentation reviews topics on test methods for space systems and operations safety through experimentation and analysis. The contents include: 1) Perception of reality through experimentation and analysis; 2) Measurements, methods, and correlations with real life; and 3) Correlating laboratory aerospace materials flammability data with data in spacecraft environments.

Hirsch, David B.↗

NASA NTRS2006

Pumped Fluid Loop Heat Rejection and Recovery Systems for Thermal Control of the Mars Science Laboratory

This viewgraph presentation reviews the heat rejection and heat recovery system for thermal control of the Mars Science Laboratory (MSL). The MSL mission will use mechanically pumped fluid loop based architecture for thermal control of the spacecraft and rover. The architecture is designed to harness waste heat from an Multi Mission Radioisotope Thermo-electric Generator (MMRTG) during Mars surface operations for thermal control during cold conditions and also reject heat during the cruise aspect of the mission. There are several test that are being conducted that will insure the safety of this concept. This architecture can be used during any future interplanetary missions utilizing radioisotope power systems for power generation.

mechanical pump fluid loop↗

NASA NTRS1998

Adsorption Processes in Spacecraft Environmental Control and Life Support Systems

The environmental control and life support system on a spacecraft must maintain a safe and comfortable environment in which the crew can live and work. The system's functions include supplying the crew with oxygen and water as well as removing carbon dioxide, water vapor, and trace contaminants from cabin air. Although open-loop systems have been used in the past, logistics and safety factors of current and future missions in space make near-complete recycling of the cabin's air and water imperative. The recycling process may include separation and reduction of carbon dioxide, removal of trace gas-phase contaminants, recovery and purification of humidity condensate, purification and polishing of wastewater streams, and other processes. Several of these operations can be performed totally or in part by adsorption processes. These processes are frequently good candidates to perform separations and purifications in space due to their gravity independence, high reliability, relatively high energy efficiency, design flexibility, technological maturity, and regenerability. For these reasons, adsorption has historically played a key role in life support on U.S. and Russian piloted spacecraft. This article focuses on three current spacecraft life support applications that often use adsorption technology: gas-phase trace contaminant control, carbon dioxide removal from cabin air, and potable water recovery from waste streams. In each application, adsorption technology has been selected for use on the International Space Station. The requirements, science, and hardware for each of these applications are discussed. Eventually, human space exploration may lead to construction of planetary habitats. These habitats may provide additional opportunities for use of adsorption processes, such as control of greenhouse gas composition, and may have different requirements and resources available to them, such as gases present in the planetary atmosphere. Adsorption separation and purification processes can be expected to continue to fulfill environmental control and life support needs on future missions.

Bauman, Liese Dall↗

NASA NTRS2023

Adaptive Independent Verification and Validation (IV&V) Reduces Risk of Software Impacting Safety in Artemis Missions

The National Aeronautics and Space Administration (NASA) is asking more of its human spaceflight programs than ever before through the collective Artemis Missions. The NASA Independent Verification and Validation (IV&V) Program contributes to NASA’s human spaceflight goals by providing IV&V services for NASA’s critical spacecraft and ground software. The IV&V Program is tasked with providing assurance from both individual and integrated mission software perspectives. The Artemis IV&V organization is actively supporting six distinct development efforts: Orion, the Space Launch System (SLS), Exploration Ground Systems (EGS), Mission Control Center (MCC), the Lunar Gateway, and the Human Landing System (HLS), representing a wide diversity of developer organizations, management structures, and development approaches. With much of this extremely complex flight and ground software being essential to human safety both on the ground and in space, Artemis IV&V is likewise challenged to provide more value-added assurance to future Artemis missions within a constrained budget. To meet this challenge, Artemis IV&V employs a variety of novel and evolving “Adaptive IV&V” approaches for planning and executing IV&V analysis to increase both the efficiency and effectiveness of the IV&V Program’s assurance activities, and to address the difficulties imposed by assuring software for a large, highly integrated, multi-mission enterprise managed and executed by physically and organizationally distinct programs. Instilling agile principles like iterative planning cycles, self-organizing teams, and regular retrospectives, into IV&V planning and execution has led to a more rapid turnaround of a minimum viable assurance product and allowed for increased alignment of assurance activities with development progress. Adopting an assurance case methodology has led to greater consistency and clearer communication of assurance design and provided a foundation for long-term maintenance of assurance plans, products, and results across missions. The IV&V-developed Assurance / Safety Case Analytical Network (A-SCAN) framework and tool has enabled the quantification and tracking of system/software risk and confidence. These confidence measures provide a means to repeatedly express the impact of planned and completed assurance work and the remaining residual risk. Applied as part of a “Follow-the-Risk” organizational ethos, this allows consistent rightsizing of analysis rigor and intensity commensurate with the perceived risk of defects, as well as appropriate targeting of the highest risk areas of the software to find safety issues before they can manifest. Finally, the development of the IV&V Advanced Risk Reduction Integrated Software Test and Operations Tri-program Lightweight Environment (ARRISTOTLE), an integrated software-only simulation of Orion, SLS, and EGS systems, has made it possible to independently test integrated pad and flight scenarios and inject faults to observe how the Artemis multi-program, mission software behaves in degraded modes and in response to hazards. These adaptive IV&V investments have enabled Artemis IV&V to become more efficient and effective in IV&V planning and execution and respond more readily to changes in the risk landscape, increasing the breadth and depth of risk reduction possible within the available resources. Residual risk tracking allows IV&V to communicate more effectively with stakeholders, both internal and external at all levels, and inform key decision-making personnel. This evolving assurance design approach provides IV&V surety that work is performed in the highest risk, most value-added areas of the software, to keep our astronauts and ground crews safe and ensure mission success.

Gerek A Whitman↗

NASA NTRS2023

Adaptive Independent Verification and Validation (IV&V) Reduces Risk of Software Impacting Safety in Artemis Missions

The National Aeronautics and Space Administration (NASA) is asking more of its human spaceflight programs than ever before through the collective Artemis Missions. The NASA Independent Verification and Validation (IV&V) Program contributes to NASA’s human spaceflight goals by providing IV&V services for NASA’s critical spacecraft and ground software. The IV&V Program is tasked with providing assurance from both individual and integrated mission software perspectives. The Artemis IV&V organization is actively supporting six distinct development efforts: Orion, the Space Launch System (SLS), Exploration Ground Systems (EGS), Mission Control Center (MCC), the Lunar Gateway, and the Human Landing System (HLS), representing a wide diversity of developer organizations, management structures, and development approaches. With much of this extremely complex flight and ground software being essential to human safety both on the ground and in space, Artemis IV&V is likewise challenged to provide more value-added assurance to future Artemis missions within a constrained budget. To meet this challenge, Artemis IV&V employs a variety of novel and evolving “Adaptive IV&V” approaches for planning and executing IV&V analysis to increase both the efficiency and effectiveness of the IV&V Program’s assurance activities, and to address the difficulties imposed by assuring software for a large, highly integrated, multi-mission enterprise managed and executed by physically and organizationally distinct programs. Instilling agile principles like iterative planning cycles, self-organizing teams, and regular retrospectives, into IV&V planning and execution has led to a more rapid turnaround of a minimum viable assurance product and allowed for increased alignment of assurance activities with development progress. Adopting an assurance case methodology has led to greater consistency and clearer communication of assurance design and provided a foundation for long-term maintenance of assurance plans, products, and results across missions. The IV&V-developed Assurance / Safety Case Analytical Network (A-SCAN) framework and tool has enabled the quantification and tracking of system/software risk and confidence. These confidence measures provide a means to repeatedly express the impact of planned and completed assurance work and the remaining residual risk. Applied as part of a “Follow-the-Risk” organizational ethos, this allows consistent rightsizing of analysis rigor and intensity commensurate with the perceived risk of defects, as well as appropriate targeting of the highest risk areas of the software to find safety issues before they can manifest. Finally, the development of the IV&V Advanced Risk Reduction Integrated Software Test and Operations Tri-program Lightweight Environment (ARRISTOTLE), an integrated software-only simulation of Orion, SLS, and EGS systems, has made it possible to independently test integrated pad and flight scenarios and inject faults to observe how the Artemis multi-program, mission software behaves in degraded modes and in response to hazards. These adaptive IV&V investments have enabled Artemis IV&V to become more efficient and effective in IV&V planning and execution and respond more readily to changes in the risk landscape, increasing the breadth and depth of risk reduction possible within the available resources. Residual risk tracking allows IV&V to communicate more effectively with stakeholders, both internal and external at all levels, and inform key decision-making personnel. This evolving assurance design approach provides IV&V surety that work is performed in the highest risk, most value-added areas of the software, to keep our astronauts and ground crews safe and ensure mission success.

Gerek Whitman↗