Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.



Published on

Published in: Technology
  • Be the first to comment

  • Be the first to like this


  1. 1. "Requirements Driven versus Risk Informed Design"Requirements Driven versusRisk Informed DesignRandy RustSR&QA Lead,Altair ProjectJohnson Space Center Sensitive But Unclassified– For NASA Internal Use Only
  2. 2. Transportation Components of Program Constellation Earth Departure Stage Crew Exploration VehicleHeavy LiftLaunchVehicle Lunar Crew Launch Lander Vehicle 2
  3. 3. Typical Lunar Reference Mission MOON Vehicles are not to scale. Ascent Stage100 km Lander Performs LOI ExpendedLow LunarOrbit Earth Departure Stage Expended ServiceLow ModuleEarth ExpendedOrbit EDS, Lander CEV Direct Entry Land Landing EARTH 3
  4. 4. Altair Lunar Lander♦ 4 crew to and from the surface • Seven days on the surface • Lunar outpost crew rotation♦ Global access capability♦ Anytime return to Earth♦ Capability to land 14 to 17 metric tons of dedicated cargo♦ Airlock for surface activities♦ Descent stage: • Liquid oxygen / liquid hydrogen propulsion♦ Ascent stage: • Hypergolic Propellants or Liquid oxygen/methane 4
  5. 5. Design Approach♦ Project examined the multitude of concepts developed in the post-ESAS era, took lessons learned and began to develop a real design.♦ Altair took a true risk informed design approach, starting with a minimum functionality design and adding from there to reduce risk.♦ Lunar Design Analysis Cycle (LDAC) 1 developed a “minimum functional” vehicle. • “Minimum Functionality” is a design philosophy that begins with a vehicle that will perform the mission, and no more than that • Does not consider contingencies • Does not have added redundancy (“single string” approach) • Provides early, critical insight into the overall viability of the end-to-end architecture • Provides a starting point to make informed cost/risk trades and consciously buy down risk • A “Minimum Functionality” vehicle is NOT a design that would ever be contemplated as a “flyable” design!♦ LDAC-2 determined the most significant contributors to loss of crew (LOC) and the optimum cost/risk trades to reduce those risks.♦ LDAC-3 (current LDAC) is assessing biggest contributors to loss of mission (LOM) and optimum cost/risk trades to reduce those risks.♦ Goal of the design process is to do enough real design work to understand and develop the requirements for SRR. 5
  6. 6. Lander Design Analysis Cycle 1 ♦ Lander design process kicked off with Design Analysis Cycle 1 ♦ Took a “minimal functionality” approach for LDAC-1 ♦ LDAC-1 completed November 2007 Jun 07 Sept 07 Dec 07 Mar 08 Jun 08 Sept 08 Dec 08 Mar 09 Jun 09 Sept 09 CxP LCCR LDAC-1 Minimum Functional VehicleIn-House Design LDAC-2 Safety / Reliability Upgrades (LOC) Effort Upgraded Flyable Vehicle LDAC-3 Additional safety, reliability and functionality (LOM); Global access LDAC-4 Upgraded Flyable Vehicle Close the gap with the CARD LDAC-X Requirements Development 6
  7. 7. New Philosophy Needed♦ For previous programs and projects, the general thought was to apply a failure tolerance philosophy • One failure tolerant for loss of mission failures, and two failure tolerant to prevent loss of crew.♦ For the Lander, where mass is extremely critical, this philosophy alone will not yield an optimal design solution. • There are ways other than redundancy to improve reliability and still reduce the risk of loss of crew.♦ We needed a new philosophy where we could develop a spacecraft that provides a required level of safety for the crew and is reliable enough to perform the mission. • Defined the minimum set of functions necessary to accomplish the mission objectives. • Made it work. Created the simplest & lowest mass conceptual design of the contemplated system. • Consistent with NESC RP-06-108, Design, Development, Test, and Evaluation (DDT&E) Considerations for Safe and Reliable Human Rated Spacecraft Systems) 7
  8. 8. LDAC-1 Starting Point♦ ‘Hard’ Requirements • 4 Crew • 7 Day Sortie • 210 Day Outpost • Airlock (implemented on sortie mission only) • CxP transportation architecture − 8.4 meter shroud, TLI Loads, Lander performs LOI burn, CEV IRD, etc • Control Mass − Total Lander mass at TLI for crewed missions: 45,000 kg − Total Lander mass at TLI for cargo missions: 53,600 kg♦ 3 DRMs with Mission Timelines and Functional Allocations • Sortie Mission to South Pole − 4 Crew / 7 Days on Surface / No support from surface assets − No restrictions on ‘when’ (accommodating eclipse periods) • Outpost Mission to South Pole − 4 Crew with Cargo Element (LAT Campaign option 2) − Outpost provides habitation on surface (down and out) − 210 Days with surface support (power) • Cargo Mission to South Pole − Short duration, large payload♦ One Lander design, with variants (kits) if required for the different DRMs 8
  9. 9. Results of LDAC1 Sortie Variant Outpost Variant 45,000 kg 45,000 kg Descent Module Descent Module Ascent Module Ascent Module Airlock Avionics Power Mass Available for Payload Structures and MechanismsManagers Reserve Propulsion Thermal Control Life Support Cargo Variant Other 53,600 kg Non-Propellant Fluids Descent Module Cargo on Upper Deck Propellant Sortie Mission Lander Mass distribution 9
  10. 10. Lander Design Analysis Cycle 2 ♦ LDAC2s focus was to buy down the Loss of Crew (LOC) safety risks in the point of departure design. ♦ LDAC2 completion date was May 2008. Jun 07 Sept 07 Dec 07 Mar 08 Jun 08 Sept 08 Dec 08 Mar 09 Jun 09 Sept 09 CxP LCCR LDAC-1 Minimum Functional VehicleIn-House Design LDAC-2 Safety / Reliability Upgrades (LOC) Effort Upgraded Flyable Vehicle LDAC-3 Additional safety, reliability and functionality (LOM); Global access LDAC-4 Upgraded Flyable Vehicle Close the gap with the CARD LDAC-X Requirements Development 10
  11. 11. Overview of LDAC-2 risk buy back process System Teams DAC1 Vehicle Top Risks Develop Options & Baseline LOC Divided into 33 Tasks Safety estimates LOC For Each Option Task Options Chosen By Mass ∆ and LOC ∆ Task’s Option LOC System Level Rolled Up DAC2Rolled Up to System Level to Vehicle Level Baseline LOC 11
  12. 12. Example Risk Buyback Task: #33, Improve Comm System Reliability♦ Purpose: Improve Comm System Reliability to be able to update the state vector♦ Brief description of problem addressed by your task • There are currently 6 single point failures that could cause loss of the state vector input to the bus to the flight computer. This study identifies several options increase communications reliability. • Inability to obtain state vector results in LOC for ascent.Proposed Solutions: • (A) Redundancy with 2 SDRs (instead of XPDR’s), cross-strapped to single diplexer/antenna pair (common EVA comm) • (B1) PA/LNA Bypass (with switches) • (B2) PA/LNA Bypass (with cables - IFM) • (C) Redundancy with 1 XPDR & 1 Dissimilar comm system • (D) Redundancy with 2 XPDRs, cross-strapped to single diplexer/antenna pair • (E1) Full Redundancy with 2 SDRs strings (common EVA comm) • (E2) Full Redundancy with 2 XPDRs strings • (E3) Full Redundancy, 1 XPDR & 1 SDR strings (common EVA comm) 12
  13. 13. Example Risk Buyback Task: #33, Improve Comm System Reliability Graphical Summary of Options (Baseline) (D) (E1) (B2) (E2) (E3) (C)Top Contenders: 13
  14. 14. Another Example: Active Thermal L D A C 2 T h erm al S y s tem  O p tio n s  (D elta Mas s  V s . L O C ) vs. LOC) (Unallocated Differential 1.00E ‐01 B as eline L D A C 1_delta O ption A 1 dual internal loop O ption A 1f dual internal loop O ption B 1 dual c ritic al c omponents   O ption C 1 emergenc y  loop  O ption C 1f emergenc y  loop P robability O ption D 1 s ublimator driven 1.00E ‐02 c oldplate  O ption E 1 fully  redundant loops   O ption E 1fh fully  redundant loops   O ption E 1f fully  redundant loops   O ption F 1 s ingle loops  with redundant c omponents O ption G 1 mix  and matc h  O ption G 1f mix  and matc h  1.00E ‐03 0 100 200 300 400 500 600 700 UnallocatedDe lta  Ma ss (K g .) (kg) Differential 14
  15. 15. LDAC-2 Overview♦ The initial Lander Design and Analysis Cycles (May-November 2007) created a “minimal functionality” lander design that serves as a baseline upon which to add safety, reliability and functionality back into the design with known changes to performance, cost and risk.♦ LDAC-2 completed in May 2008. Goal was to “buy down” Loss of Crew (LOC) risks.♦ “Spent” approximately 1.3 t to buy down loss of crew (LOC) risks.♦ “Spent” an additional 680kg on design maturity. P a y lo a d M a s s to S u rfa c e - C re w S o rtie LO C (45.0 m t c ontrol m as s ; perform anc e reflec ts M G A and P M R ) 0 .1 7 0 .1 6 6 4000 3651 CA RD s p e c 0 .1 2 3500 p a y lo a d ma s s C AR D S p e c P LO C 3000 0 .0 7 B o tto ms -u p L D AC P L O C 2500 DA C p a y lo a d ma s s 0 .0 2 0 .0 0 5 2000kg 0 .0 0 4 0 .0 0 4 1671 1500 Pa ra me tric f u lly -0 .0 3 L D AC -1 1 1 /0 7 L D AC 2 * 0 5 /0 8 f u n c tio n a l 1000 p a y lo a d ma s s LDAC 500 500 500 0 * Note: Based on simplified models that address identified risks. LD A C -1 LD A C -2 11/07 5/08 D A C /D a te 15
  16. 16. Lessons Learned During Risk Buy-down♦ Full redundancy was usually heaviest, frequently NOT most effective for improving LOC • Conclusion may be different for LOM♦ Quantitative risk tool was necessary to inform good design decisions • Always necessary to correlate engineering judgment with tool results • Tool forces team to reconsider • However, cannot rely solely on tool results. Must be able to technically explain decision.♦ A risk tool the designers can interact with is a significant aid – improves tool and design • e.g., when a result did not correlate with engineering experience, designers could easily understand model in tool. Sometimes changed model and sometimes did not.♦ Designing for minimum risk • results in lower weight design • is much harder and time consuming than simply adding redundancy • But, design team ends up much more intelligent on risk and design drivers♦ Design for Minimum Risk is the way to go if you are trying to build a smart design team 16