The JPL Lessons Learned Process: An Effective Countermeasure Against Avoidable Risk
Explore the source record for details and available documents.
SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Explore the source record for details and available documents.
The potential for errors in engineering judgement arguably present the highest level of risk when applied to interplanetary spaceflight. JPL has been refining its lessons learned process to optimize the collection and transfer of critical success factors applicable to current and future spaceflight projects.
This slide presentation reviews the work of the Flight testing Automatic Collision Avoidance Technology/Fighter Risk Reduction Project (ACAT/FRRP). The goal of this project is to develop common modular architecture for all aircraft, and to enable the transition of technology from research to production as soon as possible to begin to reduce the rate of mishaps. The automated Ground Collision Avoidance System (GCAS) system is designed to prevent collision with the ground, by avionics that project the future trajectory over digital terrain, and request an evasion maneuver at the last instance. The flight controls are capable of automatically performing a recovery. The collision avoidance is described in the presentation. Also included in the presentation is a description of the flight test.
This paper describes the ideal space survivability of ultra long life systems in the context of ideality of risk avoidance.
Increasing activity in space is gradually increasing the amount of orbital debris in low earth orbit. As the debris increases, the environmental risk (hypervelocity collisions) associated with spaceflight also increases. Debris larger than 10 cm can typically be detected and tracked sufficiently to allow risk avoidance to be achieved by maneuvering to safe distances. Risk reduction for objects smaller than I cm may be accomplished through shielding. However, intermediate sized debris remains a problem. A convenient risk reduction solution has been identified using modem laser technology. In this approach, a relatively low energy laser facility operating near e equator may significantly reduce the amount of intermediate sized debris (1 - 10 cm) in a few years of operation. A sufficiently intense laser pulse arriving at a debris objects surface will ablate a micro-thin layer of material. As this hot gas rapidly expands away from the object, a small change in momentum is imparted. The momentum change for one pulse is insignificant. However, since the laser can provide 10-1000 pulses per second over several minutes, the cumulative effect is substantive. The object's perigee may be lowered in this manner into atmosphere where it will be vaporized. This same technique may be employed on a larger scale for risk reduction in asteroids, meteoroids, and comets colliding with the Earth at hypervelocities.
The end-to-end verification of a spacecraft photovoltaic power generation system requires light! A lowcost, portable, and end-to-end photovoltaic-system test appropriate for NASA's new generation of Class D missions is presented. High risk, low-cost, and quick-turn satellites rarely have the resources to execute the traditional approaches from higher-class (A-C) missions. The Class D approach, as demonstrated on the Lunar Atmospheric and Dust Environment Explorer (LADEE), utilizes a portable, metalhalide, theatre lamp for an end-to-end photovoltaic system test. While not as precise and comprehensive as the traditional Large Area Pulsed Solar Simulator (LAPSS) test, the LADEE method leverages minimal resources into an ongoing assessment program that can be applied through numerous stages of the mission. The project takes a true Class D approach in assessing the technical value of a costly, highfidelity performance test versus a simpler approach with less programmatic risk. The resources required are a fraction of that for a LAPSS test, and is easy to repeat due to its portability. Further, the test equipment can be handed down to future projects without building an on-site facility. At the vanguard of Class D missions, the LADEE team frequently wrestled with and challenged the status quo. The philosophy of risk avoidance at all cost, typical to Class A-C missions, simply could not be executed. This innovative and simple testing solution is contextualized to NASA Class D programs and a specific risk encountered during development of the LADEE Electrical Power System (EPS). Selection of the appropriate lamp and safety concerns are discussed, with examples of test results. Combined with the vendor's panellevel data and periodic inspection, the method ensures system integrity from Integration and Test (I&T) through launch. Following launch, mission operations tools are utilized to assess system performance based on a scant amount of available data.
The end-to-end verification of a spacecraft photovoltaic power generation system requires light! A low-cost, portable, and end-to-end photovoltaic-system test appropriate for NASAs new generation of Class D missions is presented. High risk, low-cost, and quick-turn satellites rarely have the resources to execute the traditional approaches from higher-class (A-C) missions. The Class D approach, as demonstrated on the Lunar Atmospheric and Dust Environment Explorer (LADEE), utilizes a portable, metal-halide, theatre lamp for an end-to-end photovoltaic system test. While not as precise and comprehensive as the traditional Large Area Pulsed Solar Simulator (LAPSS) test, the LADEE method leverages minimal resources into an ongoing assessment program that can be applied through numerous stages of the mission. The project takes a true Class D approach in assessing the technical value of a costly, high-fidelity performance test versus a simpler approach with less programmatic risk. The resources required are a fraction of that for a LAPSS test, and is easy to repeat due to its portability. Further, the test equipment can be handed down to future projects without building an on-site facility.At the vanguard of Class D missions, the LADEE team frequently wrestled with and challenged the status quo. The philosophy of risk avoidance at all cost, typical to Class A-C missions, simply could not be executed. This innovative and simple testing solution is contextualized to NASA Class D programs and a specific risk encountered during development of the LADEE Electrical Power System (EPS). Selection of the appropriate lamp and safety concerns are discussed, with examples of test results. Combined with the vendors panel-level data and periodic inspection, the method ensures system integrity from Integration and Test (IT) through launch. Following launch, mission operations tools are utilized to assess system performance based on a scant amount of available data.
Single-event gate rupture (SEGR) is a potentially catastrophic failure mechanism of power MOSFETs biased in the off-state. In part due to the severity of-SEGR consequences and in part due to the difficulty of accurated SEGR rate estimation, SEGR mitigation me1hodologies emphasize risk avoidance, using heavy-ion accelerator testing to define safe operating conditions for a surface-incident linear energy transfer {LET). This "safe-operating area" (SOA) within which the device may be biased without experiencing SEGR is then often derated by a prescribed factor to ensure low risk of SEGR. Although research in 1996 indicated that such LET-based SEGR hardness requiremen1s could provide false assurance of safe operation unless one also considered· ion energy], most mission SEGR requirements are still specified in terms of surface-incident LET. Moreover, terrestrial SEGR tests at a given surface-incident LET are limited by the small number of ion species and energies available at heavy-ion accelerators. In comparison, the on-orbit radiation environment is composed of all of the naturally-occurring elements with peak fluxes at nearly GeV/nucleon energies. The primary objective of this study is to examine whether typical derating of high-energy heavy-ion accelerator test data bounds the risk for SEGR from higher-energy on-orbit ions with the mission LET requirement.
Complicated mission design problems require innovative computational solutions. As spacecraft depart from a proposed Gateway in a Near Rectilinear Halo Orbit (NRHO), recontact analysis is required to avoid risk of collision and ensure safe operations. Escape dynamics from NRHOs are governed by multiple gravitational bodies, yielding a trajectory design space that is exhaustively large. This paper summarizes the recontact analysis for departure from the NRHO and describes how the Deep Space Trajectory Explorer (DSTE) trajectory design software incorporates high performance cloud computing to compute and visualize the orbit design space. Recent focus on exploration missions to cislunar space has kindled accelerated interest in multibody orbit solutions. Trajectory analysis in the presence of multiple gravity fields is complex, and innovative computational tools are needed to simplify complicated design spaces, to generate large quantities of data quickly, and to visualize the output for user accessibility. The Gateway mission is a prime example. The Gateway1 is proposed as a human outpost in deep space. The current baseline orbit for the Gateway is a Near Rectilinear Halo Orbit (NRHO) near the Moon.2 The NRHO exists in a regime that experiences the gravitational effects of the Earth and the Moon simultaneously, complicating orbit analysis. The mission design process benefits greatly from updated computational tools for multibody missions like the Gateway. As an example, consider the problem of assessing the risk of collision in an NRHO. As a staging location to missions to the lunar surface and beyond the Earth-Moon system, the Gateway will experience spacecraft and other objects regularly arriving and departing. Departing objects potentially include spent logistics modules, visiting crew vehicles, debris objects, wastewater particles, and cubesats. Each departure is governed by the dynamics of the Gateway orbit and the surrounding dynamical environment. Over time, any unmaintained object in such an orbit eventually departs due to the small instabilities associated with the NRHOs. A separation maneuver speeds the departure from the NRHO, but the effects of the maneuver on the spacecraft behavior depend on the location, magnitude, and direction of the burn. Escape dynamics from the NRHO with regard to these maneuver options open up an enormous potential trajectory design space where subtle changes in input can produce dramatically large changes in the results. Any departing object must avoid recontacting the Gateway as it leaves the lunar vicinity, and a recontact analysis thus involves a significant number of computations and extensive output data. To explore the dynamics of this extensive design space, the Deep Space Trajectory Explorer3 (DSTE) trajectory design software incorporates new High Performance Computing (HPC) services and novel interactive visualizations. This paper details the HPC and cloud infrastructure techniques that are implemented in the DSTE, applying the new capabilities to analysis of recontact risk with the Gateway in NRHO. NEAR RECTILINEAR HALO ORBITS The Gateway is planned to fly in a lunar NRHO as its baseline orbit. The NRHO families of orbits are subsets of the larger halo families, which originate from planar orbits near the L1 and L2 libration points; the Earth-Moon L2 halo family appears in Figure 1. Each halo orbit is perfectly periodic in the Circular Restricted 3-Body Problem (CR3BP) and becomes a quasi-periodic orbit in a higher fidelity ephemeris force model. The NRHOs are defined as those members of the halo family with bounded stability properties;2 they pass near the Moon at perilune and are nearly polar. Families exist with apolunes located both above the lunar north pole and above the lunar south pole; the Gateway is planned to reside in a southern L2 NRHO in a 9:2 resonance with the lunar synodic period. The 9:2 NRHO is characterized by a period of about 6.5 days, a perilune radius of about 3,500 km, and an apolune radius of about 71,000 km; it is strongly affected by the gravity of both the Earth and the Moon simultaneously. This NRHO offers extended communications with assets on the south pole of the Moon,4 as well as low-cost orbit maintenance and attitude control,5 favorable eclipse avoidance properties,6 and inexpensive transfers from Earth and to other destinations.5,7 The NRHO portion of the southern L2 halo family is highlighted in black in Figure 1, and the 9:2 NRHO appears in blue.
Microtechnology has the potential for a beneficial impact on both launch and space flight operations because of savings in mass, power consumption, volume and low cost manufacturing and testing. Less apparent, but equally valuable, are the advantages in reliability to be gained by increased redundancy and the reduction of complexity in the fabrication process. However, a successful program for the development and insertion of these technologies will need to consider the conservatism of the aerospace community. This is more true of government space programs where success is measured by a lack of launch failures and less true of commercial ventures where success may be measured by other criteria. This paper presents a strategy for evolving microtechnology in space systems that fits both the government's risk avoidance culture, and parallels the expected development of microtechnology applications in space systems.
In a Stirling Radioisotope Power System (RPS), heat must be continuously removed from the General Purpose Heat Source (GPHS) modules to maintain the modules and surrounding insulation at acceptable temperatures. The Stirling convertor normally provides this cooling. If the Stirling convertor stops in the current system, the insulation is designed to spoil, preventing damage to the GPHS at the cost of an early termination of the mission. An alkali-metal Variable Conductance Heat Pipe (VCHP) can be used to passively allow multiple stops and restarts of the Stirling convertor. In a previous NASA SBIR Program, Advanced Cooling Technologies, Inc. (ACT) developed a series of sodium VCHPs as backup cooling systems for Stirling RPS. The operation of these VCHPs was demonstrated using Stirling heater head simulators and GPHS simulators. In the most recent effort, a sodium VCHP with a stainless steel envelope was designed, fabricated and tested at NASA Glenn Research Center (GRC) with a Stirling convertor for two concepts; one for the Advanced Stirling Radioisotope Generator (ASRG) back up cooling system and one for the Long-lived Venus Lander thermal management system. The VCHP is designed to activate and remove heat from the stopped convertor at a 19 degC temperature increase from the nominal vapor temperature. The 19 degC temperature increase from nominal is low enough to avoid risking standard ASRG operation and spoiling of the Multi-Layer Insulation (MLI). In addition, the same backup cooling system can be applied to the Stirling convertor used for the refrigeration system of the Long-lived Venus Lander. The VCHP will allow the refrigeration system to: 1) rest during transit at a lower temperature than nominal; 2) pre-cool the modules to an even lower temperature before the entry in Venus atmosphere; 3) work at nominal temperature on Venus surface; 4) briefly stop multiple times on the Venus surface to allow scientific measurements. This paper presents the experimental results from integrating the VCHP with an operating Stirling convertor and describes the methodology used to achieve their successful combined operation.
In a Stirling Radioisotope Power System (RPS), heat must be continuously removed from the General Purpose Heat Source (GPHS) modules to maintain the modules and surrounding insulation at acceptable temperatures. The Stirling convertor normally provides this cooling. If the Stirling convertor stops in the current system, the insulation is designed to spoil, preventing damage to the GPHS at the cost of an early termination of the mission. An alkali-metal Variable Conductance Heat Pipe (VCHP) can be used to passively allow multiple stops and restarts of the Stirling convertor. In a previous NASA SBIR Program, Advanced Cooling Technologies, Inc. (ACT) developed a series of sodium VCHPs as backup cooling systems for Stirling RPS. The operation of these VCHPs was demonstrated using Stirling heater head simulators and GPHS simulators. In the most recent effort, a sodium VCHP with a stainless steel envelope was designed, fabricated and tested at NASA Glenn Research Center (GRC) with a Stirling convertor for two concepts; one for the Advanced Stirling Radioisotope Generator (ASRG) back up cooling system and one for the Long-lived Venus Lander thermal management system. The VCHP is designed to activate and remove heat from the stopped convertor at a 19 degC temperature increase from the nominal vapor temperature. The 19 degC temperature increase from nominal is low enough to avoid risking standard ASRG operation and spoiling of the Multi-Layer Insulation (MLI). In addition, the same backup cooling system can be applied to the Stirling convertor used for the refrigeration system of the Long-lived Venus Lander. The VCHP will allow the refrigeration system to: 1) rest during transit at a lower temperature than nominal; 2) pre-cool the modules to an even lower temperature before the entry in Venus atmosphere; 3) work at nominal temperature on Venus surface; 4) briefly stop multiple times on the Venus surface to allow scientific measurements. This paper presents the experimental results from integrating the VCHP with an operating Stirling convertor and describes the methodology used to achieve their successful combined operation.
In a Stirling Radioisotope Power System (RPS), heat must be continuously removed from the General Purpose Heat Source (GPHS) modules to maintain the modules and surrounding insulation at acceptable temperatures. The Stirling convertor normally provides this cooling. If the Stirling convertor stops in the current system, the insulation is designed to spoil, preventing damage to the GPHS at the cost of an early termination of the mission. An alkali-metal Variable Conductance Heat Pipe (VCHP) can be used to passively allow multiple stops and restarts of the Stirling convertor. In a previous NASA SBIR Program, Advanced Cooling Technologies, Inc. (ACT) developed a series of sodium VCHPs as backup cooling systems for Stirling RPS. The operation of these VCHPs was demonstrated using Stirling heater head simulators and GPHS simulators. In the most recent effort, a sodium VCHP with a stainless steel envelope was designed, fabricated and tested at NASA Glenn Research Center (GRC) with a Stirling convertor for two concepts; one for the Advanced Stirling Radioisotope Generator (ASRG) back up cooling system and one for the Long-lived Venus Lander thermal management system. The VCHP is designed to activate and remove heat from the stopped convertor at a 19 degC temperature increase from the nominal vapor temperature. The 19 degC temperature increase from nominal is low enough to avoid risking standard ASRG operation and spoiling of the Multi-Layer Insulation (MLI). In addition, the same backup cooling system can be applied to the Stirling convertor used for the refrigeration system of the Long-lived Venus Lander. The VCHP will allow the refrigeration system to: 1) rest during transit at a lower temperature than nominal; 2) pre-cool the modules to an even lower temperature before the entry in Venus atmosphere; 3) work at nominal temperature on Venus surface; 4) briefly stop multiple times on the Venus surface to allow scientific measurements. This paper presents the experimental results from integrating the VCHP with an operating Stirling convertor and describes the methodology used to achieve their successful combined operation.
In a Stirling Radioisotope Power System (RPS), heat must be continuously removed from the General Purpose Heat Source (GPHS) modules to maintain the modules and surrounding insulation at acceptable temperatures. The Stirling convertor normally provides this cooling. If the Stirling convertor stops in the current system, the insulation is designed to spoil, preventing damage to the GPHS at the cost of an early termination of the mission. An alkali-metal Variable Conductance Heat Pipe (VCHP) can be used to passively allow multiple stops and restarts of the Stirling convertor. In a previous NASA SBIR Program, Advanced Cooling Technologies, Inc. (ACT) developed a series of sodium VCHPs as backup cooling systems for Stirling RPS. The operation of these VCHPs was demonstrated using Stirling heater head simulators and GPHS simulators. In the most recent effort, a sodium VCHP with a stainless steel envelope was designed, fabricated and tested at NASA Glenn Research Center (GRC) with a Stirling convertor for two concepts; one for the Advanced Stirling Radioisotope Generator (ASRG) back up cooling system and one for the Long-lived Venus Lander thermal management system. The VCHP is designed to activate and remove heat from the stopped convertor at a 19 C temperature increase from the nominal vapor temperature. The 19 C temperature increase from nominal is low enough to avoid risking standard ASRG operation and spoiling of the Multi-Layer Insulation (MLI). In addition, the same backup cooling system can be applied to the Stirling convertor used for the refrigeration system of the Long-lived Venus Lander. The VCHP will allow the refrigeration system to: 1) rest during transit at a lower temperature than nominal; 2) pre-cool the modules to an even lower temperature before the entry in Venus atmosphere; 3) work at nominal temperature on Venus surface; 4) briefly stop multiple times on the Venus surface to allow scientific measurements. This paper presents the experimental results from integrating the VCHP with an operating Stirling convertor and describes the methodology used to achieve their successful combined operation.
In a Stirling Radioisotope Power System (RPS), heat must be continuously removed from the General Purpose Heat Source (GPHS) modules to maintain the modules and surrounding insulation at acceptable temperatures. The Stirling convertor normally provides this cooling. If the Stirling convertor stops in the current system, the insulation is designed to spoil, preventing damage to the GPHS at the cost of an early termination of the mission. An alkali-metal variable conductance heat pipe (VCHP) can be used to passively allow multiple stops and restarts of the Stirling convertor by bypassing the heat during stops. In a previous NASA Small Business Innovation Research (SBIR) Program, Advanced Cooling Technologies, Inc. (ACT) developed a series of sodium VCHPs as backup cooling systems for the Stirling RPS. In 2012, one of these VCHPs was successfully tested at NASA Glenn Research Center with a Stirling convertor as an Advanced Stirling Radioisotope Generator (ASRG) backup cooling system. The prototype; however, was not optimized and did not reflect the final heat rejection path. ACT through further funding has developed a semioptimized prototype with the finalized heat path for testing at Glenn with a Stirling convertor. The semioptimized system features a two-phase radiator and is significantly smaller and lighter than the prior prototype to reflect a higher level of flight readiness. The VCHP is designed to activate and remove heat from the GPHS during stoppage with a small temperature increase from the nominal vapor temperature. This small temperature increase from nominal is low enough to avoid risking standard ASRG operation and spoiling of the multilayer insulation (MLI). The VCHP passively allows the Stirling convertor to be turned off multiple times during a mission with potentially unlimited off durations. Having the ability to turn the Stirling off allows for the Stirling to be reset and reduces vibrations on the platform during sensitive measurements or procedures. This paper presents the design of the VCHP and its test results with a Stirling convertor at Glenn. Tests were carried for multiple on and off cycles to demonstrate repeatability. The impacts associated with the addition of the VCHP to the system are also addressed in terms of mass and additional heat losses due to the presence of the VCHP.
We develop methods for bounding part-to-part variation in TID data. When used in conjunction with statistical radiation environment models, these methods allow development of RHA that deliver estimated piece part reliability for any desired confidence level, moving beyond risk avoidance methodologies based on radiation design margin. Two methods are developed, and their results compared for realistic data.
We develop methods for bounding part-to-part variation in TID data. When used in conjunction with statistical radiation environment models, these methods allow development of RHA that deliver estimated piece part reliability for any desired confidence level, moving beyond risk avoidance methodologies based on radiation design margin. Two methods are developed, and their results compared for realistic data.
The proposed Gateway spacecraft in a Near Rectilinear Halo Orbit (NRHO) will be a human outpost in cislunar space. The baseline mission may experience the deployment of visiting vehicles, cubesats, and on-orbit debris. Departure from the NRHO and cislunar space is nontrivial due to the complex gravitational environment that persists in and around Gateway. Long-term disposal orbits in heliocentric space offer safe destinations for deployed objects. To mitigate risks associated with conjunctions between Gateway and deployed objects, strategies to identify risk-avoidant paths to heliocentric space are necessary for Gateway mission operations.