SEARCH · Search NASA

Results for “ISS Anomaly”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 73 records · Page 4

All sources NASA NTRS DOE OSTI

NASA NTRSDate not supplied

Integrated System for Autonomous and Adaptive Caretaking (ISAAC): Phase 1 Low-Fidelity Demo

This presentation describes the ISAAC phase 1 low-fidelity demonstration results. The demonstration satisfied the milestone from the Gateway-ISAAC Memorandum of Understanding to "Demonstrate spatial and logical data registration between robotics and spacecraft". It integrated many new ISAAC components, including a spatially linked model, Astrobee multi-sensor mapping, and an integrated data interface. It advanced ISAAC key performance parameters related to mapping, in a lab setting. Areas for phase 1 forward work include: improve maturity toward the high-fidelity demo on the ISS; demonstrate mapping with more sensor modalities; expand initial anomaly detection implementation into a flexible framework with multiple detection algorithms for different tasks; begin open source software release process for releasable ISAAC components.

robotics↗

NASA NTRS2026

A Review of Pump Package Assembly Anomalies and Demonstration to Gain Motor Controller Replacement Capability

The International Space Station (ISS) generates heat within the US modules from systems used to operate the station, maintain crew health, and conduct science experiments in the orbiting laboratory. The Internal Thermal Control System (ITCS) collects this heat in water loops and transfers it to the external ammonia system for rejection to space. The ITCS uses six Pump Package Assemblies (PPA) as the motive force to circulate the water within the Lab, Node 2, and Node 3 (Node 1 is parasitic to the Lab and Node 3 ITCS loops). In the life of ISS, 3 PPAs have had to be replaced and 2 PPAs are currently showing signs of degradation. The first PPA to fail in 2003 was due to early coolant chemistry issues; the remaining pump failures and current pump degradations are determined to be related to the Pump/Fan Motor Controller (PFMC), with their individual signatures all being unique to this point. The PFMC of one of the failed PPAs was returned and testing confirmed its sub-components to be the root cause of the PPA failure. Due to the relative size and weight of the standalone PFMC in comparison to the integrated assembly, it is desired, from a launch and on-orbit stowage perspective, to replace the PFMC component of the degraded PPA instead of the entire PPA. The PPA was not designed for this capability, so on the ground demonstrations are planned using crew tools to show that the PFMC can be replaced on-orbit while maintaining full functionality. This paper will focus on the signatures of the two most recent PPA failures and the two PPAs showing signs of degradation, in addition to presenting the findings from the PFMC demonstration effort.

Aaron Rodriguez↗

NASA NTRS2026

A Review of Pump Package Assembly Anomalies and Demonstration to Gain Motor Controller Replacement Capability

Aaron Rodriguez↗

NASA NTRS2022

The Cooling Loop A Anomaly of 2013: A Case Study in Human-Systems Resilience

Throughout the history of human spaceflight, NASA has employed an operational paradigm of 24/7 dependence on experts in Mission Control Center (MCC). In addition to nominal flight control and mission operations, these 85+ experts per shift manage anomaly detection, diagnosis, and response, and support the crew in real-time in performing maintenance and repair, procedure execution, and other complex mission operations. Future long-duration exploration missions (LDEMs) beyond low-Earth orbit (LEO) will not operate successfully using this same Human-Systems Integration Architecture (HSIA) where crew rely on ground controllers, have ready access to resupply, and have a fallback plan of evacuation. As distance from Earth increases and the communication delay grows, crews will need to respond independently and adequately to time-critical vehicle malfunctions. It will not always be sufficient or even possible to ‘safe the system’ and then wait upon ground intervention. A new and radically different HSIA is needed to accommodate the paradigm shift of deep-space travel. Historical International Space Station (ISS) data show that for a 30-day mission, the likelihood of a high-consequence vehicle anomaly of uncertain origin that requires rapid response is greater than 10%. The likelihood of such an event is 50% by the fourth month of the mission, and it grows exponentially with time. Our team has conducted in-depth investigations into these events and their corresponding anomaly resolution activities. Using MCC and Mission Evaluation Room (MER) anomaly resolution artifacts (including meeting summaries, caution and warning data, and ISS daily summaries), we created timelines detailing ground actions and in-orbit events for two significant anomalies. We then mapped these timelines onto Mars transit conditions, introducing a ground-crew communications time delay and shifting immediate response, time-critical task execution, and vehicle commanding to the crew. In detailing successful anomaly resolution in transit to Mars, the timelines highlight where effective resolution requires drastically evolved onboard capabilities. Though this research has yielded a rich data set based on ground response in past missions, there is still insufficient knowledge to assess the potential impact of inflight anomalies on a small autonomous crew on future LDEMs beyond LEO. To begin building an evidence base that will inform future HSIA standards and requirements, we are developing an approach to systematically capture crew anomaly response and procedure execution during early Artemis missions. Being the first human spaceflight beyond LEO since Apollo, early Artemis missions provide a rare and unique opportunity to serve as a testbed for Mars missions. Our work aims to capitalize on planned data collection to derive crew operational responses to anomalous events in real-time. Our team is also researching the level of simulation fidelity required for empirically validating proposed HSIA standards and evaluating HSIA implementations for LDEMs beyond LEO. This work will produce a trade space study of HSIA simulation objectives and fidelity requirements. Ultimately, these research efforts will assist in developing the standards and technologies needed to build a next-generation HSIA for LDEMs beyond LEO.

human-systems integration architecture↗

NASA NTRSDate not supplied

Assessing Urban Heat in the Cincinnati and Covington Area to Inform Local Decision-Makers and Environmental Justice Initiatives

The Urban Heat Island effect is a phenomenon characterized by urban areas experiencing temperatures that are, on average, warmer than surrounding suburban and rural regions. Urban Heat Islands are fueled by expansive impervious surfaces, vehicle emissions, and insufficient urban green space. Densely populated urban centers like the Cincinnati, Ohio and Covington, Kentucky area can experience negative health impacts due to the Urban Heat Island. NASA DEVELOP partnered with Groundwork USA and Groundwork Ohio River Valley to combine environmental education and outreach with technical capacity building in NASA Earth observations. The DEVELOP team used Landsat 5 TM and ISS ECOSTRESS to calculate daytime and nighttime land surface temperature anomalies. The team found that the Cincinnati and Covington area was 8.32°F warmer during the day and 4.97°F warmer at night compared to non-urban areas. The team also ran the Natural Capital Project InVEST Urban Cooling Model to map a heat mitigation index for the study area. The heat mitigation index models the cooling capacity of each pixel and the effect of green spaces on the pixel’s ability to mitigate heat. Results show which communities are most vulnerable to impacts of increased urban heat. The team also assessed alternative tree canopy scenarios with the InVEST model to better understand the effectiveness of potential heat mitigation strategies. Increasing tree canopy cover by 25% in urbanized land cover types was found to reduce mean temperature across the study area by 0.87°F. Combining these results with work from Groundwork’s Climate Safe Neighborhoods program highlights the relationship between extreme heat and historical-race based housing practices in the region. Results provide partners at Groundwork with refined methodologies to support future education and outreach, as well as increase future capacity to NASA Earth observations.

Celeste Gambino↗

NASA NTRSDate not supplied

TSIS-1 Pointing System Performance after 5 Years on ISS

The Total and Spectral Solar Irradiance Sensor-1 (TSIS-1) was installed on the ISS in December 2017, completed its prime 5-year mission in 2023, and is now in extended operations. Within the first year of operations, the paper titled, “Challenges and Solutions for Precision Solar Pointing on the ISS for the TSIS Instrument” was presented at the 2019 IEEE Aerospace Conference. This paper described challenges associated with ISS jitter and structural obscuration along with on-orbit measurements of these phenomenon and how TSIS-1 initially performed in their presence. Since the paper was presented in 2019, TSIS-1 has continued to operate with much success. This paper will provide a 5-year update on the performance of the TSIS-1 pointing system, including additional measurements of ISS base motion jitter, updated ISS obscuration information, data trends that showed slight increases in azimuth motor torque and pointing errors, and a pointing anomaly due to contamination on one of the pointing system sun sensors. These results may help other payload developers better understand the ISS environment and long-term mechanism performance.

Patrick Brown↗

NASA NTRSDate not supplied

Crew Performance Support System to Aid in Anomaly Resolution: Concept of Operations

As missions progress into deep space, communication delays and disruptions will disenable the crew’s reliance on Earth experts. There are also limitations in the amount of data that can be downlinked to the ground. It is prudent to assume that critical, complex vehicle or habitat sub-systems will malfunction at a time when a lunar or Mars’ crew cannot rely on the Earth-Support team to detect, diagnose and resolve the problem and it is impractical to expect a small crew to step-in with the same level of expertise as 50+ authorities. The crew will need novel processes and advanced technological support to independently identify and resolve safety- and time-critical anomalies. That a self-reliant crew is unable to respond appropriately to time-critical anomalies is a significant risk to crew safety and mission success. This risk is driven by several factors; novel and unanticipated anomalies would not have been trained pre-flight, the crew could forget their pre-flight training or spaceflight stressors could impair the crew’s problem-solving ability. At last year’s IWS, Beard reported that a single spaceflight stressor (elevated CO2) could undermine the crew’s ability to independently respond to emergencies. Concept of Operations (ConOps) provide a common view of future system functions to all stakeholders. For the current project, a ConOps was developed that describes the operational processes, practices and capabilities needed by a crew of astronauts on deep space missions to autonomously respond to anticipated and unanticipated anomalies. It is crucial to recognize that, as of August 2018 existing technologies are unable to effectively support crew anomaly response to unanticipated events. “Intelligent technology” has not reached a maturity level that permits generalizing a solution to novel situations. For example, to train intelligent technology requires volumes of data that do not exist. The complexities involved in a manned mission to Mars cannot be compared to sending rovers to Mars using scripted software. This ConOps proposes a Crew Performance Support System (CPSS) that will push NASA and its industry partners toward what will be required for a safe and successful manned mission to Mars. Anomaly resolution during a deep space mission will take place within a dynamic, or changing, context. The figure to the left shows five broad contextual variables: the organizational culture, mission context, system characteristics, team characteristics and individual characteristics. The yellow arrow indicates that spaceflight and task-related stressors can affect system, team and individual crewmember characteristics and therefore anomaly response potential. The figure depicts a protective umbrella of Human-System Integration (HSI) principles that should be instituted during CPSS development including a balanced workload, shared situation awareness and building an appropriate level of trust in the automation. The figure also depicts two interrelated and cooperative components, an HSI Data System and other Enabling Capabilities will be required to support crew anomaly response and Earth-Support situation awareness. As we journey from ISS to Gateway to Mars, multiple, simultaneous and integrated research and development efforts (i.e., support systems co-evolution) must be implemented to meet the problem-solving challenges a self-reliant crew will face on a Mars’ mission. The crossovers between the capabilities are just as important as the discrete capabilities themselves. As the capabilities mature, the lines between the support subdomains will blur and an integrated system will emerge. The ConOps summarizes current knowledge about how highly trained people solve anomalies in safety- and time-critical situations, describes a group of capabilities that could help to reduce the extant risk and documents requirements levied on additional systems that provides critical inputs to the CPSS. Scenarios are used to promote a shared understanding of processes, practices and technological goals needed for safe and productive manned missions beyond LEO.

HSIA risk↗

NASA NTRS2010

ISS Plasma Environment: Status of CCMC Products for ISS Mission Ops

ISS Program currently using FPMU Ne, Te in-situ measurements to support operations and anomaly investigations. Working to acquire alternative data sources if FPMU is not available. Work is progressing on CCMC tools for low Earth orbit ionosphere characterization. Validation against FPMU data required before model output can be used for ISS operational support. MSFC plans to continue comparing CTIP output during FPMU campaigns. Results to date have been useful in identifying ionospheric origins of high latitude charging environments.

Minow, Joseph↗

NASA NTRSDate not supplied

Recovering from On-orbit Anomalies on the Astrobee Free Flyers and its Systems

Since 2019, NASA has been operating three Astrobee free flying robots on board the International Space Station (ISS) providing an autonomous and flexible research platform for national and international payload developers in microgravity and serving as a robotic assistant for astronauts on the ISS. During its use on the ISS, in particular with over 750 hours of free-flyer operation as of March 2022, Astrobee and its Docking Station have encountered multiple software and hardware anomalies. These anomalies were either resolved remotely via software and firmware updates, or, where not possible, with hardware replacements on orbit or by the return of the faulty unit to NASA’s ground facilities for its repair. Despite being inherently designed to be repaired or replaced on orbit, Astrobee and its systems can still suffer anomalies that would be complex enough to disassemble, cause risks of hardware damage, or use excessive crew time to perform the repair in orbit. That was the case for the anomaly the Astrobee unit ‘Honey’ encountered, reason why it needed to be down-massed for repair. One of the most common points of failure was found to be the SD card, which is used for the different Astrobee processors and for the Dock Station. Other comparable SD card anomalies were found also on the Astrobee ground units, which provided useful data in the effort of upgrading their systems. This presentation will focus on 1) The overview of the different faults and anomalies on Astrobee and its systems on orbit and on the ground 2) The processes and procedures implemented to resolve the anomalies 3) The implementation of software updates and hardware upgrades in order to reduce the risk on returning anomalies 4) The lessons learned in increasing Astrobee’s robustness and resilience to such anomalies.

International Space Station↗

NASA NTRS2019

The Space Debris Sensor Experiment

The Space Debris Sensor (SDS) is a NASA Class 1E technology demonstration external payload aboard the International Space Station (ISS). With approximately one square meter of detection area, the SDS is attached to the European Space Agency Columbus module facing the ISS velocity vector with minimal obstruction from ISS hardware. The SDS is the first flight demonstration of the Debris Resistive/Acoustic Grid Orbital NASA-Navy Sensor (DRAGONS) technology developed and matured over 10 years by the NASA Orbital Debris Program Office (ODPO), in concert with the DRAGONS consortium, to provide information on the sub-millimeter scale orbital debris environment. The SDS demonstrated the capacity to read 4 resistive grids at 1 Hz, 40 acoustic sensors at 500 kHz, and record and downlink impact data to the ground. Observable and derived data from the SDS could provide information to models that are critical to understanding risks the small debris environment poses to spacecraft in low Earth orbit. The technology demonstrated by the SDS is a major step forward in monitoring and characterizing the space debris environment. This paper will address the technical performance of the SDS during its operational lifetime and its realization of technical and scientific goals. The SDS was intended to operate for 3 years; however, the payload incurred multiple anomalies during its operational life. Subsequently termed “Anomaly #1,” the first was the symptomatic loss of low data rate 1553 channel command and telemetry. The second, Anomaly #2, was loss of all low- and medium-data rate (Ethernet) telemetry. Anomaly #2 proved to be unrecoverable, leading to loss of the payload after approximately 26 days on-board the ISS. Therefore, this paper also addresses the anomalies that occurred during operation of the SDS, their attribution, and their resolution. Lessons learned are described when relevant to anomaly identification, attribution, and resolution.

Anz-Meador, P.↗

NASA NTRS2015

Data Mining and Analysis

The Data Mining project seeks to bring the capability of data visualization to NASA anomaly and problem reporting systems for the purpose of improving data trending, evaluations, and analyses. Currently NASA systems are tailored to meet the specific needs of its organizations. This tailoring has led to a variety of nomenclatures and levels of annotation for procedures, parts, and anomalies making difficult the realization of the common causes for anomalies. Making significant observations and realizing the connection between these causes without a common way to view large data sets is difficult to impossible. In the first phase of the Data Mining project a portal was created to present a common visualization of normalized sensitive data to customers with the appropriate security access. The tool of the visualization itself was also developed and fine-tuned. In the second phase of the project we took on the difficult task of searching and analyzing the target data set for common causes between anomalies. In the final part of the second phase we have learned more about how much of the analysis work will be the job of the Data Mining team, how to perform that work, and how that work may be used by different customers in different ways. In this paper I detail how our perspective has changed after gaining more insight into how the customers wish to interact with the output and how that has changed the product.

iss↗

NASA NTRS2006

Clustering and Recurring Anomaly Identification: Recurring Anomaly Detection System (ReADS)

This viewgraph presentation reviews the Recurring Anomaly Detection System (ReADS). The Recurring Anomaly Detection System is a tool to analyze text reports, such as aviation reports and maintenance records: (1) Text clustering algorithms group large quantities of reports and documents; Reduces human error and fatigue (2) Identifies interconnected reports; Automates the discovery of possible recurring anomalies; (3) Provides a visualization of the clusters and recurring anomalies We have illustrated our techniques on data from Shuttle and ISS discrepancy reports, as well as ASRS data. ReADS has been integrated with a secure online search

McIntosh, Dawn↗

NASA NTRS2016

Simulation of Malfunctions for the ISS Double-Gimbal Control Moment Gyroscope

This paper presents a simplified approach to simulation of malfunctions of the Control Moment Gyroscope (CMG) on board the International Space Station (ISS). These malfunctions will be used as part of flight training of CMG failure scenarios in the guidance navigation control (GNC) subsystem of the Training Systems for 21st Century (TS21) simulator. The CMG malfunctions are grouped under mechanical, thermal and electrical categories. A malfunction can be as simple as one which only affects the telemetry or a complex one that changes the state and behavior of the CMG model. In both cases, the ISS GNC flight software will read the telemetry and respond accordingly. The user executes these malfunctions by supplying conditional data which modify internal model states and then elicit a response as seen on the user displays. Ground operators and crew on board the ISS use CMG malfunction procedures to better understand and respond to anomalies observed within the CMG subsystem.

Inampudi, Ravi↗

NASA NTRS2008

"Built-In" Action/Issues Tracking and Post-Ops Analysis Tool for Realtime Console Operations

Marshall Space Flight Center's (MSFC) Payload Operations Integration Center (POIC) for the International Space Station (ISS) uses a number of formal databases to manage and track flight plan changes, onboard and ground equipment anomalies, and other events. However, individual console positions encounter many action items and/or occurrences that don't fit neatly into the databases, and while console logs are comprehensive, manual or automated searches do not always yield consistent results. The Payload Communications Manager (PAYCOM) team, whose members speak directly with the ISS onboard crew with respect to NASA payload operations, has found a creative way to reformat a mandatory Daily Report to organize action items, standing reminders, significant events, and other comments. While the report keeps others appraised of PAYCOMs activities and issues of the moment, the format makes it easy to capture very brief summaries of the items in a "Roll Off Matrix", including start and stop dates, resolution, and possible applicability to future ops. The matrix provides accountability for all action items, gives direct insight into the issues surrounding various payloads and methods of dealing with them, yields indirect information on PAYCOM priorities and processes, and provides a roadmap that makes it easier to get back to extensive details if needed. This paper describes how the ISS PAYCOM Daily Report and Roll Off Matrix are organized, used, and inter-related to each other and the PAYCOM operations log. While the application is for a manned vehicle, the concepts could apply in a wide spectrum of operational settings.

Scott, David W.↗

NASA NTRS2010

International Space Station Powered Bolt Nut Anomaly and Failure Analysis Summary

A key mechanism used in the on-orbit assembly of the International Space Station (ISS) pressurized elements is the Common Berthing Mechanism (CBM). The mechanism that effects the structural connection of the CBM halves is the Powered Bolt Assembly. There are sixteen Powered Bolt Assemblies per CBM. The CBM has a bolt which engages a self aligning Powered Bolt Nut (PBN) on the mating interface; see Figure 1. The Powered Bolt Assemblies are preloaded to approximately 19 kilo pounds (KIPs) prior to pressurization of the CBM. The PBNs mentioned below, manufactured in 2009, will be used on ISS future missions. An on orbit functional failure of this hardware would be unacceptable and in some instances catastrophic due to the failure of modules to mate and seal the atmosphere, risking loss of crew and ISS functions. The manufacturing processes which create the PBNs need to be strictly controlled. Functional (torque vs. tension) acceptance test failures will be the result of processes not being strictly followed. Without the proper knowledge of thread tolerances, fabrication techniques, and dry film lubricant application processes, PBNs will be, and have been manufactured improperly. The knowledge gained from acceptance test failures and the resolution of those failures, thread fabrication techniques and thread dry film lubrication processes can be applied to many aerospace mechanisms to enhance their performance. Test data and manufactured PBN thread geometry will be discussed for both failed and successfully accepted PBNs.

Sievers, Daniel E.↗

NASA NTRS2010

International Space Station Powered Bolt Nut Anomaly and Failure Analysis Summary

A key mechanism used in the on-orbit assembly of the International Space Station (ISS) pressurized elements is the Common Berthing Mechanism. The mechanism that effects the structural connection of the Common Berthing Mechanism halves is the Powered Bolt Assembly. There are sixteen Powered Bolt Assemblies per Common Berthing Mechanism. The Common Berthing Mechanism has a bolt which engages a self aligning Powered Bolt Nut (PBN) on the mating interface (Figure 1). The Powered Bolt Assemblies are preloaded to approximately 84.5 kN (19000 lb) prior to pressurization of the CBM. The PBNs mentioned below, manufactured in 2009, will be used on ISS future missions. An on orbit functional failure of this hardware would be unacceptable and in some instances catastrophic due to the failure of modules to mate and seal the atmosphere, risking loss of crew and ISS functions. The manufacturing processes that create the PBNs need to be strictly controlled. Functional (torque vs. tension) acceptance test failures will be the result of processes not being strictly followed. Without the proper knowledge of thread tolerances, fabrication techniques, and dry film lubricant application processes, PBNs will be, and have been manufactured improperly. The knowledge gained from acceptance test failures and the resolution of those failures, thread fabrication techniques and thread dry film lubrication processes can be applied to many aerospace mechanisms to enhance their performance. Test data and manufactured PBN thread geometry will be discussed for both failed and successfully accepted PBNs.

Sievers, Daniel E.↗

NASA NTRSDate not supplied

Towards a Combined Low-Earth Orbit Lightning Climatology: Current Work and Assessing South Atlantic Anomaly Influence

This presentation discusses the current status and ongoing work towards a low-Earth orbit (LEO) lightning climatological product that includes both Lightning Imaging Sensors (LIS) and the Optical Transient Detector (OTD). The project builds upon the work by Cecil et al. (2014) to include the LIS on the International Space Station (ISS), featuring additional inter-instrumental comparisons to more accurately depict the unique capabilities of each instrument. A closer examination of the interference from the South Atlantic Anomaly (SAA) was also conducted on all three LEO sensors. The SAA is a region of the magnetosphere roughly spanning the south-central Atlantic wherein the inner Van Allen radiation belts are closer to Earth than anywhere else, subjecting spacecraft in LEO to significantly higher radiation flux levels. This radiation can produce interference with the LIS and OTD instruments, manifesting as non-lightning luminous events. While these events can be identified easily enough, they can occur in such quantities that they overwhelm the sensors’ processors and effectively ‘blind’ them. This is called the First-In First-Out (FIFO) buffer overflow, and this blinded time reduced the instruments’ view-time as a result. The FIFO overflow and view-time can reliably be used to track the SAA interference (Clark et al. 2024), which allows for the lightning counts attributable to the SAA to be assessed. The impact that the SAA had on the quality of observations from the LEO lightning instrumentation and the significance for the resulting climatological products was investigated. Substantial areas of interference were identified for all three instruments using the view-time and quality flags, each with a unique shape and temporal evolution. The temporal evolution and general region affected are of particular importance when constructing a climatological product, as there are notable reductions to view-time over prolonged periods across a lightning-rich region. However, a temporal element also makes isolating the subsequent impact on the lightning signal significantly more challenging. Lightning counts in this region are highly seasonal and exhibit inter-annual variability, which is compounded by the nature of LEO observations. This study includes preliminary analysis of the impact that the SAA has on the lightning counts given the notable impact shown in the metadata.

Austin G Clark↗

NASA NTRS2007

NASA's Software Safety Standard

NASA relies more and more on software to control, monitor, and verify its safety critical systems, facilities and operations. Since the 1960's there has hardly been a spacecraft launched that does not have a computer on board that will provide command and control services. There have been recent incidents where software has played a role in high-profile mission failures and hazardous incidents. For example, the Mars Orbiter, Mars Polar Lander, the DART (Demonstration of Autonomous Rendezvous Technology), and MER (Mars Exploration Rover) Spirit anomalies were all caused or contributed to by software. The Mission Control Centers for the Shuttle, ISS, and unmanned programs are highly dependant on software for data displays, analysis, and mission planning. Despite this growing dependence on software control and monitoring, there has been little to no consistent application of software safety practices and methodology to NASA's projects with safety critical software. Meanwhile, academia and private industry have been stepping forward with procedures and standards for safety critical systems and software, for example Dr. Nancy Leveson's book Safeware: System Safety and Computers. The NASA Software Safety Standard, originally published in 1997, was widely ignored due to its complexity and poor organization. It also focused on concepts rather than definite procedural requirements organized around a software project lifecycle. Led by NASA Headquarters Office of Safety and Mission Assurance, the NASA Software Safety Standard has recently undergone a significant update. This new standard provides the procedures and guidelines for evaluating a project for safety criticality and then lays out the minimum project lifecycle requirements to assure the software is created, operated, and maintained in the safest possible manner. This update of the standard clearly delineates the minimum set of software safety requirements for a project without detailing the implementation for those requirements. This allows the projects leeway to meet these requirements in many forms that best suit a particular project's needs and safety risk. In other words, it tells the project what to do, not how to do it. This update also incorporated advances in the state of the practice of software safety from academia and private industry. It addresses some of the more common issues now facing software developers in the NASA environment such as the use of Commercial-Off-the-Shelf Software (COTS), Modified OTS (MOTS), Government OTS (GOTS), and reused software. A team from across NASA developed the update and it has had both NASA-wide internal reviews by software engineering, quality, safety, and project management. It has also had expert external review. This presentation and paper will discuss the new NASA Software Safety Standard, its organization, and key features. It will start with a brief discussion of some NASA mission failures and incidents that had software as one of their root causes. It will then give a brief overview of the NASA Software Safety Process. This will include an overview of the key personnel responsibilities and functions that must be performed for safety-critical software.

Ramsay, Christopher M.↗