Safety Design for Space Systems

About the EditorsForewordPrefaceContributors1 Introduction to Space Safety1.1 NASA and Safety1.2 Definition of Safety and Risk1.3 Managing Safety and Risk1.4 The BookReferences2 The Space Environment: Natural and Induced2.1 The Atmosphere2.1.1 Composition2.1.2 Atomic Oxygen2.1.3 The Ionosphere2.2 Orbital Debris and Meteoroids2.2.1 Orbital Debris2.2.2 Meteoroids2.3 Microgravity2.3.1 Microgravity Defined2.3.2 Methods of Attainment2.3.3 Effects on Biological Processes and Astronaut Health2.3.4 Unique Aspects of Travel to the Moon and Planetary BodiesRecommended Reading2.4 Acoustics2.4.1 Acoustics Safety Issues2.4.2 Acoustic Requirements2.4.3 Compliance and Verification2.4.4 Conclusion and RecommendationsRecommended Reading2.5 Radiation2.5.1 Ionizing Radiation2.5.2 Radio-Frequency Radiation2.6 Natural and Induced Thermal Environments2.6.1 Introduction to the Thermal Environment2.6.2 Spacecraft Heat0Transfer Considerations2.6.3 The Natural Thermal Environment2.6.4 The Induced Thermal Environment2.6.5 Other Lunar and Planetary Environment Considerations2.7 Combined Environmental Effects2.7.1 Introduction to Environmental Effects2.7.2 Combined Environments2.7.3 Combined Effects2.7.4 Ground Testing for Space SimulationReferences3 Overview of Bioastronautics3.1 Space Physiology3.1.1 Muscular System3.1.2 Skeletal System3.1.3 Cardiovascular and Respiratory Systems3.1.4 Neurovestibular System3.1.5 Radiation3.1.6 Nutrition3.1.7 Immune System3.1.8 Extravehicular Activity3.2 Short- and Long-Duration Mission Effects3.2.1 Muscular System3.2.2 Skeletal System3.2.3 Cardiovascular and Respiratory Systems3.2.4 Neurovestibular System3.2.5 Radiation3.2.6 Nutrition3.2.7 Immune System3.2.8 Extravehicular Activity3.3 Health Maintenance3.3.1 Preflight Preparation3.3.2 In-Flight Measures3.3.3 In-Flight Medical Monitoring3.3.4 Postflight Recovery3.4 Crew Survival3.4.1 Overview of Health Threats in Spaceflight3.4.2 Early Work3.4.3 Crew Survival on the Launch Pad, at Launch, and during Ascent3.4.4 On-Orbit Safe Haven and Crew Transfer3.4.5 Entry, Landing, and Postlanding3.5 ConclusionReferences4 Basic Principles of Space Safety4.1 The Cause of Accidents4.2 Principles and Methods4.2.1 Hazard Elimination and Limitation4.2.2 Barriers and Interlocks4.2.3 Fail-Safe Design4.2.4 Failure and Risk Minimization4.2.5 Monitoring, Recovery, and Escape4.2.6 Crew Survival Systems4.3 The Safety Review Process4.3.1 Safety Requirements4.3.2 The Safety Panels4.3.3 The Safety Reviews4.3.4 NonconformancesReferences5 Human-Rating Concepts5.1 Human Rating Defined5.1.1 Human-Rated Systems5.1.2 The NASA Human-Rating and Process5.1.3 The Human-Rating Plan5.1.4 The NASA Human-Rating Certification Process5.1.5 Human Rating in Commercial Human Spaceflight5.2 Human-Rating Requirements and Approaches5.2.1 Key Human-Rating Technical Requirements5.2.2 Programmatic Requirements5.2.3 Test Requirements5.2.4 Data RequirementsReferences6 Life-Support Systems Safety6.1 Atmospheric Conditioning and Control6.1.1 Monitoring Is the Key to Control6.1.2 Atmospheric Conditioning6.1.3 Carbon Dioxide Removal6.2 Trace-Contaminant Control6.2.1 Of Tight Buildings and Spacecraft Cabins6.2.2 Trace-Contaminant Control Methodology6.2.3 Trace-Contaminant Control Design Considerations6.3 Assessment of Water Quality in the Spacecraft Environment: Mitigating Health and Safety Concerns6.3.1 Scope of Water Resources Relevant to Spaceflight6.3.2 Spacecraft Water Quality and the Risk-Assessment Paradigm6.3.3 Water-Quality Monitoring6.3.4 Conclusions and Future Directions6.4 Waste Management6.5 Summary of Life-Support SystemsReferences7 Emergency Systems7.1 Space Rescue7.1.1 Legal and Diplomatic Basis7.1.2 The Need for Rescue Capability7.1.3 Rescue Modes and Probabilities7.1.4 Hazards in the Different Phases of Flight7.1.5 Historic Distribution of Failures7.1.6 Historic Rescue Systems7.1.7 Space Rescue Is Primarily Self-Rescue7.1.8 Limitations of Ground-Based Rescue7.1.9 The Crew Return Vehicle as a Study in Space Rescue7.1.10 Safe Haven7.1.11 Conclusions7.2 Personal Protective Equipment7.2.1 Purpose of Personal Protective Equipment7.2.2 Types of Personal Protective EquipmentReferences8 Collision Avoidance Systems8.1 Docking Systems and Operations8.1.1 Docking Systems as a Means for Spacecraft Orbital Mating8.1.2 Design Approaches Ensuring Docking Safety and Reliability8.1.3 Design Features Ensuring the Safety and Reliability of Russian Docking Systems8.1.4 Analyses and Tests Performed for the Verification of Safety and Reliability of Russian Docking Systems8.2 Descent and Landing Systems8.2.1 Parachute Systems8.2.2 Known Parachute Anomolies and Lessons LearnedReferences9 Robotic-Systems Safety9.1 Generic Robotic Systems9.1.1 Controller and Operator Interface9.1.2 Arms and Joints9.1.3 Drive System9.1.4 Sensors9.1.5 End Effector9.2 Space Robotics Overview9.3 Identification of Hazards and Their Causes9.3.1 Electrical and Electromechanical Malfunctions9.3.2 Mechanical and Structural Failures9.3.3 Failure in the Control Path9.3.4 Operator Error9.3.5 Other Hazards9.4 Hazard Mitigation in Design9.4.1 Electrical and Mechanical Design and Redundancy9.4.2 Operator Error9.4.3 System Health Checks9.4.4 Emergency Motion Arrest9.4.5 Proximity Operations9.4.6 Built-in Test9.4.7 Safety Algorithms9.5 Hazard Mitigation through Training9.6 Hazard Mitigation for Operations9.7 Case Study: Understanding Canadarm2 and Space Safety9.7.1 The Canadarm29.7.2 Cameras9.7.3 Force Moment Sensor9.7.4 Training9.7.5 Hazard Concerns and Associated Hazard Mitigation9.8 SummaryReferences10 Meteoroid and Debris Protection10.1 Risk-Control Measures10.1.1 Maneuvering10.1.2 Shielding10.2 Emergency-Repair Considerations for Spacecraft Pressure-Wall Damage10.2.1 Balanced Mitigation of Program Risks10.2.2 Leak-Location System and Operational-Design Considerations10.2.3 Ability to Access the Damaged Area10.2.4 Kit Design and Certification Considerations (1 Is Too Many, 100 Are Not Enough)10.2.5 Recertification of the Repaired Pressure Compartment for Use by the CrewReferences11 Noise-Control Design11.1 Introduction11.2 Noise-Control Plan11.2.1 Noise-Control Strategy11.2.2 Acoustic Analysis11.2.3 Testing and Verification11.3 Noise-Control Design Applications11.3.1 Noise Control at the Source11.3.2 Path-Noise Control11.3.3 Noise Control in the Receiving Space11.3.4 Postdesign Noise Mitigation11.4 Conclusions and RecommendationsRecommended ReadingReferences12 Materials Safety12.1 Toxic Off-Gassing12.1.1 Materials Off-Gassing Controls12.1.2 Materials Testing12.1.3 Spacecraft Module Testing12.2 Stress-Corrosion Cracking12.2.1 What Is Stress-Corrosion Cracking?12.2.2 Prevention of Stress-Corrosion Cracking12.2.3 Testing Materials for Stress-Corrosion Cracking12.2.4 Design for Stress-Corrosion Cracking12.4.5 Requirements for Spacecraft Hardware12.4.6 Stress-Corrosion Cracking in Propulsion Systems12.3 ConclusionsReferences13 Oxygen-Systems Safety13.1 Oxygen Pressure System Design13.1.1 Introduction13.1.2 Design Approach13.1.3 Oxygen-Compatibility Assessment Process13.2 Oxygen Generators13.2.1 Electrochemical Systems for Oxygen Production13.2.2 Solid Fuel Oxygen Generators (Oxygen Candles)References14 Avionics Safety14.1 Introduction to Avionics Safety14.2 Electrical Grounding and Electrical Bonding14.2.1 Defining Characteristics of an Electrical-Ground Connection14.2.2 Control of Electric Current14.2.3 Electrical Grounds Can Be Signal-Return Paths14.2.4 Where and How Electrical Grounds Should Be Connected14.2.5 Defining Characteristics of an Electrical Bond14.2.6 Types of Electrical Bonds14.2.7 Electrical-Bond Considerations for Dissimilar Metals14.2.8 Electrical-Ground and -Bond Connections for ShieldsRecommended Reading14.3 Safety-Critical Computer Control14.3.1 Partial Computer Control14.3.2 Total Computer Control: Fail Safe14.4 Circuit Protection: Fusing14.4.1 Circuit-Protection Methods14.4.2 Circuit Protectors14.4.3 Design Guidance14.5 Electrostatic-Discharge Control14.5.1 Fundamentals14.5.2 Various Levels of Electrostatic Discharge Concern14.6 Arc Tracking14.6.1 A New Failure Mode14.6.2 Characteristics of Arc Tracking14.6.3 Likelihood of an Arc-Tracking Event14.6.4 Prevention of Arc Tracking14.6.5 Verification of Protection and Management of Hazards14.6.6 Summary14.7 Corona Control in High-Voltage Systems14.7.1 Associated Environments14.7.2 Design Criteria14.7.3 Verification and Testing14.8 Extravehicular-Activity Considerations14.8.1 Displays and Indicators Used in Space14.8.2 Mating and Demating of Powered Connectors14.8.3 Single-Strand Melting Points14.8.4 Battery Removal and Installation14.8.5 Computer or Operational Control of Inhibits14.9 Spacecraft Electromagnetic-Interference and Electromagnetic-Compatibility Control14.9.1 Electromagnetic-Compatibility Needs for Space Applications14.9.2 Basic Electromagnetic-Compatibility Interactions and aSafety Margin14.9.3 Mission-Driven Electromagnetic-Interference Design:The Case for Grounding14.9.4 Electromagnetic-Compatibility Program for Spacecraft14.10 Design and Testing of Safety-Critical Circuits14.10.1 Safety-Critical Circuits: Conducted Mode14.10.2 Safety-Critical Circuits: Radiated Mode14.11 Electrical Hazards14.11.1 Introduction14.11.2 Electrical Shock14.11.3 Physiological Considerations14.11.4 Electrical Hazard Classification14.11.5 Leakage Current14.11.6 Bioinstrumentation14.11.7 Electrical-Hazard Controls14.11.8 Verification of Electrical-Hazard Controls14.11.9 Electrical-Safety Design Considerations14.12 Avionics Lessons Learned14.12.1 Electronic Design14.12.2 Physical Design14.12.3 Materials and Sources14.12.4 Damage Avoidance14.12.5 System AspectsReferences15 Software-System Safety15.1 Introduction15.2 The Software Safety Problem15.2.1 System Accidents15.2.2 The Power and Limitations of Abstraction from Physical Design15.2.3 Reliability versus Safety for Software15.2.4 Inadequate System Engineering15.2.5 Characteristics of Embedded Software15.3 Current Practice15.3.1 System Safety15.4 Best Practice15.4.1 Management of Software-Intensive, Safety-Critical Projects15.4.2 Basic System Safety-Engineering Practices and Their Implications for Software-Intensive Systems15.4.3 Specifications15.4.4 Requirements Analysis15.4.5 Model-Based Software Engineering and Software Reuse15.4.6 Software Architecture15.4.7 Software Design15.4.8 Design of Human-Computer Interaction15.4.9 Software Reviews15.4.10 Verification and Assurance15.4.11 Operations15.5 SummaryReferences16 Battery Safety16.1 Introduction16.2 General Design and Safety Guidelines16.3 Battery Types16.4 Battery Models16.5 Hazard and Toxicity Categorization16.6 Battery Chemistry16.6.1 Alkaline Batteries16.6.2 Lithium Batteries16.6.3 Silver Zinc Batteries16.6.4 Lead Acid Batteries16.6.5 Nickel Cadmium Batteries16.6.6 Nickel Metal Hydride Batteries16.6.7 Nickel Hydrogen Batteries16.6.8 Lithium-Ion Batteries16.7 Storage, Transportation, and HandlingReferences17 Mechanical-Systems Safety17.1 Safety Factors17.1.1 Types of Safety Factors17.1.2 Safety Factors Typical of Human-Rated Space Programs17.1.3 Things That Influence the Choice of Safety Factors17.2 Spacecraft Structures17.2.1 Mechanical Requirements17.2.2 Space-Mission Environment and Mechanical Loads17.2.3 Project Overview: Successive Designs and Iterative Verification of Structural Requirements17.2.4 Analytical Evaluations17.2.5 Structural Test Verification17.2.6 Spacecraft Structural-Model Philosophy17.2.7 Materials and Processes17.2.8 Manufacturing of Spacecraft Structures17.3 Fracture Control17.3.1 Basic Requirements17.3.2 Implementation17.3.3 Summary17.4 Pressure Vessels, Lines, and Fittings17.4.1 Pressure Vessels17.4.2 Lines and Fittings17.4.3 Space Pressure-Systems Standards17.4.4 Summary17.5 Composite Overwrapped Pressure Vessels17.5.1 The Composite Overwrapped Pressure-Vessel System17.5.2 Monolithic Metallic Pressure-Vessel Failure Modes17.5.3 Composite Overwrapped Pressure-Vessel Failure Modes17.5.4 Composite Overwrapped Pressure-Vessel Impact Sensitivity17.5.5 Summary17.6 Structural Design of Glass and Ceramic Components for Space-System Safety17.6.1 Strength Characteristics of Glass and Ceramics17.6.2 Defining Loads and Environments17.6.3 Design Factors17.6.4 Meeting Life Requirements with Glass and Ceramics17.7 Safety Critical Mechanisms17.7.1 Designing for Failure Tolerance17.7.2 Design and Verification of Safety-Critical Mechanisms17.7.3 Reduced Failure Tolerance17.7.4 Review of Safety-Critical MechanismsReferences18 Containment of Hazardous Materials18.1 Toxic Materials18.1.1 Fundamentals of Toxicology18.1.2 Toxicological Risks to Air Quality in Spacecraft18.1.3 Risk-Management Strategies18.2 Biohazardous Materials18.2.1 Microbiological Risks Associated with Spaceflight18.2.2 Risk-Mitigation Approaches18.2.3 Major Spaceflight-Specific Microbiological Risks18.3 Shatterable Materials18.3.1 Shatterable Materials in a Habitable Compartment18.3.2 Program Implementation18.3.3 Containment Concepts for Internal Equipment18.3.4 Containment Concepts for Exterior Equipment18.3.5 General Comments about Working with Shatterable Materials18.4 Containment Design Approach18.4.1 Fault Tolerance18.4.2 Design for Minimum Risk18.5 Containment Design Methods18.5.1 Containment Environments18.5.2 Design of Containment Systems18.6 Safety Controls18.6.1 Proper Design18.6.2 Materials Selection18.6.3 Materials Compatibility18.6.4 Proper Workmanship18.6.5 Proper Loading or Filling18.6.6 Fracture Control18.7 Safety Verifications18.7.1 Strength Analysis18.7.2 Qualification Tests18.7.3 Acceptance Tests18.7.4 Proof-Tests18.7.5 Qualification of Procedures18.8 ConclusionsReferences19 Failure-Tolerance Design19.1 Safe19.1.1 Order of Precedence19.2 Hazard19.2.1 Hazard Controls19.2.2 Design to Tolerate Failures19.3 Hazardous Functions19.3.1 Must-Not-Work Hazardous Function19.3.2 Must-Work Hazardous Function19.4 Design for Minimum Risk19.5 ConclusionsReferences20 Propellant-Systems Safety20.1 Solid-Propulsion Systems Safety20.1.1 Solid Propellants20.1.2 Solid-Propellant Systems for Space Applications20.1.3 Safety Hazards20.1.4 Handling, Transport, and Storage20.1.5 Inadvertent Ignition20.1.6 Safe Ignition-Systems Design20.1.7 Conclusions20.2 Liquid-Propellant Propulsion-Systems Safety20.2.1 Planning20.2.2 Containment Integrity20.2.3 Thermal Control20.2.4 Materials Compatibility20.2.5 Contamination Control20.2.6 Environmental Considerations20.2.7 Engine and Thruster Firing Inhibits20.2.8 Heightened Risk (Risk Creep)20.2.9 Instrumentation and Telemetry Data20.2.10 End-to-End Integrated Instrumentation, Controls andRedundancy Verification20.2.11 Qualification20.2.12 Total Quality Management (ISO 9001 or Equivalent)20.2.13 Preservicing Integrity Verification20.2.14 Propellants Servicing20.2.15 Conclusions20.3 Hypergolic Propellants20.3.1 Materials Compatibility20.3.2 Material Degradation20.3.3 Hypergolic-Propellant Degradation20.4 Propellant Fire20.4.1 Hydrazine and Monomethylhydrazine Vapor20.4.2 Liquid Hydrazine and Monomethylhydrazine20.4.3 Hydrazine and Monomethylhydrazine Mists,Droplets, and SpraysReferences21 Pyrotechnic Safety21.1 Pyrotechnic Devices21.1.1 Explosives21.1.2 Initiators21.2 Electroexplosive Devices21.2.1 Safe Handling of Electroexplosive Devices21.2.2 Designing for Safe Electroexplosive-Device Operation21.2.3 Pyrotechnic Safety of Mechanically InitiatedExplosive DevicesReferences22 Extravehicular-Activity Safety22.1 Extravehicular-Activity Environment22.1.1 Definitions22.1.2 Extravehicular-Activity Space Suit22.1.3 Sensory Degradation22.1.4 Maneuvering and Weightlessness22.1.5 Glove Restrictions22.1.6 Crew Fatigue22.1.7 Thermal Environment22.1.8 Extravehicular-Activity Tools22.2 Suit Hazards22.2.1 Inadvertent Contact Hazards22.2.2 Area of Effect Hazards22.3 Crew Hazards22.3.1 Contamination of the Habitable Environment22.3.2 Thermal Extremes22.3.3 Lasers22.3.4 Electrical Shock and Molten Metal22.3.5 Entrapment22.3.6 Emergency Ingress22.3.7 Collision22.3.8 Inadvertent Loss of Crew22.4 ConclusionsReferences23 Emergency, Caution, and Warning System23.1 System Overview23.2 Historic NASA Emergency, Caution, and Warning Systems23.3 Emergency, Caution, and Warning System Measures23.3.1 Event-Classification Measures23.3.2 Sensor Measures23.3.3 Data-System Measures23.3.4 Annunciation Measures23.4 Failure Isolation and RecoveryReferences24 Laser Safety24.1 Background24.1.1 Optical Spectrum24.1.2 Biological Effects24.2 Lasers Characteristics24.2.1 Laser Principles24.2.2 Laser Types24.3 Laser Standards24.3.1 NASA Johnson Space Center Requirements24.3.2 ANSI Standard Z136-124.3.3 Russian Standard24.4 Lasers Used in Space24.4.1 Radars24.4.2 Illumination24.4.3 Sensors24.5 Design Considerations for Laser Safety24.5.1 Ground Testing24.5.2 Unique Space Environment24.6 ConclusionsReferences25 Crew Training Safety: An Integrated Process25.1 Training the Crew for Safety25.1.1 Typical Training Flow25.1.2 Principles of Safety Training for the DifferentTraining Phases25.1.3 Specific Safety Training for DifferentEquipment Categories25.1.4 Safety Training for Different Operations Categories25.2 Safety during Training25.2.1 Overview25.2.2 Training-, Test-, or Baseline-Data Collection Model versusFlight Model: Type, Fidelity, Source, Origin, and Category25.2.3 Training Environments and Facilities25.2.4 Training Models, Test Models, and Safety Requirements25.2.5 Training-Model, Test-Model, and Baseline-Data CollectionEquipment-Utilization Requirements25.2.6 Qualification and Certification of Training Personnel25.2.7 Training- and Test-Model Documentation25.3 Training Development and Validation Process25.3.1 The Training Development Process25.3.2 Training-Review Process25.3.3 The Role of Safety in the Training Development andValidation Processes25.3.4 Feedback to the Safety Community from the Training Development andValidation Processes25.4 ConclusionReferences26 Safety Considerations in the Ground Environment26.1 A Word about Ground Support Equipment26.2 Documentation and Reviews26.3 Roles and Responsibilities26.4 Contingency Planning26.5 Failure Tolerance26.6 Training26.7 Hazardous Operations26.8 Tools26.9 Human Factors26.10 Biological Systems and Materials26.11 Electrical26.12 Radiation26.13 Pressure Systems26.14 Ordinance26.15 Mechanical and Eelectromechanical Devices26.16 Propellants26.17 Cryogenics26.18 Oxygen26.19 Ground Handling26.20 Software Safety26.21 Summary27 Fire Safety27.1 Characteristics of Fire in Space27.1.1 Overview of Low-Gravity Fire27.1.2 Fuel and Oxidizer Supply and Flame Behavior27.1.3 Fire Appearance and Signatures27.1.4 Flame Ignition and Spread27.1.5 Summary of Low-Gravity Fire Characteristics27.2 Design for Fire Prevention27.2.1 Materials Flammability27.2.2 Ignition Sources27.3 Spacecraft Fire Detection27.3.1 Prior Spacecraft Systems27.3.2 Review of Low-Gravity Smoke27.3.3 Spacecraft Atmospheric Dust27.3.4 Sensors for Fire Detection27.4 Spacecraft Fire Suppression27.4.1 Spacecraft Fire-Suppression Methods27.4.2 Considerations for Spacecraft Fire SuppressionReferences28 Safe-without-Services Design29 Probabilistic Risk Assessment with Emphasis on Design29.1 Basic Elements of Probabilistic Risk Assessment29.1.1 Identification of Initiating Events29.1.2 Application of Event-Sequence Diagrams and Event Trees29.1.3 Modeling of Pivotal Events29.1.4 Linkage and Quantification of Accident Scenarios29.2 Construction of a Probabilistic Risk Assessment forDesign Evaluations29.2.1 Uses of Probabilistic Risk Assessment 2.9.2 Reference Mission29.3 Relative-Risk Evaluations29.3.1 Absolute- versus Relative-Risk Assessments29.3.2 Roles of Relative-Risk Assessments in Design Evaluations29.3.3 Quantitative Evaluations29.4 Evaluations of the Relative Risks of Alternative Designs29.4.1 Overview of the Probabilistic Risk-AssessmentModels Developed29.4.2 Relative-Risk Comparisons of the Alternative DesignsReferencesIndex