1. NASA MSFC Mission Operations Laboratory MSFC NASA MSFC Mission Operations Laboratory Payload Safing Methods Daniel Massey EO10 (256) 961-0331 Daniel.L.Massey@nasa.gov OC 323

2. NASA MSFC Mission Operations Laboratory MSFC Page 2 Course Objectives  The objective of this course is to detail various methods used to safe payloads.  Three ways to implement Safing are Ground, Crew, and Automatic. An overview of these methods will be presented.  Payload Safing related documentation will also be discussed in this presentation.  Admittedly, some of the Safing methods presented will more than likely not be used, but they are discussed in order to provide an overview of available options.  There may be automated software and/or hardware Safing features built into a payload or rack. This presentation cannot go into all software and/or hardware features for every payload and rack, so please refer to the appropriate training for specific payload or rack Safing design features.  This course is intended to cover technical details at a high level, so please refer to the appropriate coursework for more in depth information on any ISS System discussed within this course.

3. NASA MSFC Mission Operations Laboratory MSFC Page 3 Payload Safing Related Documentation/Training/Tools  AP_HAL6_COLSAFE and AP_HAL6_JEMSAFE Timeliner sequences  CIR CBT  EXPRESS Payload Application  Fault Summary  FIR CBT  Flight Rule B2-357 Equipment Powerdowns for Low Pressure  Flight Rule B19-5 MELFI Power Down Requirements  Flight Rule B19-15 POIC Contingency NASA Payload Rack Deactivation in JEM and Columbus  Flight Rule B19-18 ISS Payload Interruption Constraints  IPV Quick Response folder  LAB EPS PCS Display  MCC-H OPS1 website  MSG 101 MSG Facility Overview  Payload Systems Manual Volume 3: Human Research Facility Power Switch drawings)  Payload Systems Manual Volume 10: Window Observational Research Rack (Power Switch drawings)  PLD REG 2.1.11 NASA Payload Safing Method Priority

4. NASA MSFC Mission Operations Laboratory MSFC Page 4 Payload Safing Related Documentation/Training/Tools (Cont.)  PLD REG 4.5.1 Payload Event Notification  PLD REG 5.31.13 EXPRESS Rack Operations Below 13.9 PSI Cabin Pressure  POH SOP 1.8 Payload Safing Guidelines  POH SOP 1.19 Payload-Generated Cautions and Warnings  POIC Ground Command Procedures Book Volume 3: Payload Procedures, All Flights  PRO Commanding Displays (ER1CMD_NOMINAL, PLSSCMD_O2_OC, USL_SAFE displays)  PRO 205 ISPR Interface Overview  PRO 209 EXPRESS Rack Crew Interface Overview  PRO 231 MELFI Crew Interfaces and Safety Training  PRO 232 MELFI PCS Displays (MELFI PCS displays)  PRO 243 Columbus Module Training and COL NASA ISPR DATA & POWER KEY (Timeliner COL Module Command Request Command path)  PRO 244 Japanese Experiment Module Training and JEM/JEF NASA DATA AND POWER KEY (Timeliner JEM/JEF Module Command Request Command path)

5. NASA MSFC Mission Operations Laboratory MSFC Page 5 Safing Categories/Situations  Safing pretty much breaks down along the following lines:  Ground (i.e. commanding)  Crew  Automatic (e.g. ECW)  This presentation will start out with an overview of safing documentation and proceed to discuss the safing types listed above.  Some situations require quicker safing than others, and some situations are caused by a payload anomaly or are caused by some other event necessitating safing of the payload.  However, the focus of this presentation will be on methods which can be used to achieve safing rather than all triggers that can cause the need to safe payloads.

6. NASA MSFC Mission Operations Laboratory MSFC Page 6 Safing Categories/Situations (Cont.)  Situations to keep in mind that can cause a payload and/or rack safing need are:  Depressurization – Flight Rule B2-357 Equipment Powerdowns for Low Pressure and PLD REG 5.31.13 EXPRESS Rack Operations Below 13.9 PSI Cabin Pressure define pressure limitations for many payloads and racks.  Loss of Water Flow – Any prolonged loss of water flow is not good for payloads and racks that need water flow, which would require safing those payloads/racks. A specific case is loss of LTL water flow for MELFI Racks requiring the MELFI Brayton Machine to be powered OFF in the short term and the entire MELFI Rack if the loss of flow persists for greater than 8 hours per Flight Rule B19-5 MELFI Power Down Requirements.  External Payload Contamination Events – Reference PLD REG 4.5.1 Payload event Notification for payloads that need to be notified.  Microgravity Disturbance Events – Reference PLD REG 4.5.1 Payload event Notification for payloads that need to be notified.  Parameter Monitoring – This is a generic term that encompasses ECW and any other means by which parameters are monitored (e.g. Exception Monitoring or User/Cadre member looking at a display). Automatic actions can be defined as in the case of ECW (POH SOP 1.19 Payload- Generated Cautions and Warnings), or ground/crew actions (POH SOP 1.8 Payload Safing Guidelines) can be used.

7. NASA MSFC Mission Operations Laboratory MSFC Page 7 POH SOP 1.8 Safing Overview  POH SOP 1.8 Payload Safing Guidelines addresses Safing that needs to occur “quickly” versus Safing that could be for events happening later (e.g. unanticipated External Payload Contamination Event happening hours later).  A general overview of POH SOP 1.8 is as follows:  Situations may arise on-orbit that compromise established guidelines and constraints (established flight rules, hazard controls, and resource envelopes), threaten harm to the crew, and/or damage to the vehicle. When these types of situations occur, a payload may have to be put into a safed configuration until the anomaly can be isolated and rectified.  The recognition of off-nominal situations may come from many different sources. The primary source for off-nominal situation recognition comes from the payload Users. The payload Users are constantly monitoring their payloads; whereas the POIC cadre personnel are concentrating on NASA payload systems as a whole instead of monitoring individual payloads. On-board software is another resource for off-nominal situation recognition. Payloads may have PES (Payload Executive Software) tables loaded into the PL MDM that automatically safes an experiment should an off-nominal situation occur. In compliance with NASA Payload Regulations, all payloads have safing/quick response procedures defined in the PODF.

8. NASA MSFC Mission Operations Laboratory MSFC Page 8 POH SOP 1.8 Safing Overview (Cont.)  Within the POIC, there are several positions that may recognize an off- nominal condition that requires safing a payload.  The POD has the responsibility of being cognizant of ISS system anomalies that could affect NASA payloads.  The OC directs safing commanding for all payloads in the NASA element and for NASA payloads in or on other ISS elements. If there is a safety of flight issue, OC closely monitors all actions, and interrupts execution if any operational safety hazard control is jeopardized. The OC has the responsibility of ensuring that operations are accomplished in accordance with resource envelopes, flight rules, and payload regulations.  The PRO has the responsibility for monitoring EXPRESS Rack subsystems, MELFI subsystems, EXPRESS Logistics Carrier subsystems, WORF subsystems, PLSS and payload health and status, and the payload-to-PLSS interfaces. In addition, PRO is responsible for the management of the POIC command link to the ISS. The PRO has the responsibility for ensuring all files and products utilized by the PL MDM are resident on-board to support upcoming operations.  The PAYCOM may be notified by the crew that an off-nominal situation has occurred that requires payload safing.  The DMC has the responsibility of monitoring and managing the on- board C&DH and C&T PLSS systems. Anomalies affecting the C&DH or the C&T PLSS systems could require the safing of a payload.

9. NASA MSFC Mission Operations Laboratory MSFC Page 9 POH SOP 1.8 Safing Overview (Cont.)  Once an off-nominal situation is recognized, science capability is preserved on a best effort basis. The POIC cadre immediately concentrates its efforts on attaining a known, safe condition for all affected payloads. Command Users not involved in these efforts are disabled until a stable configuration is achieved. After the payload(s) is safed, the POIC utilizes its on-call support personnel (e.g. POIC SAFETY) for additional analysis and troubleshooting of the anomaly.  The procedure portion of POH SOP 1.8 basically consists of:  Indication of the condition requiring payload safing.  Coordination of payload safing as follows:  For EXPRESS Rack/MELFI Rack/EXPRESS Logistics Carrier/WORF Rack safing, OC coordinates with PRO and users to determine the appropriate action(s) to take.  For HRF/MSG/FCF/MSRR Rack safing, OC coordinates with the facility operator to determine the appropriate action(s) to take.  For safing involving the C&DH and C&T PLSS systems, OC coordinates with DMC and PRO to determine the appropriate action(s) to take.  For safing involving the PLMDM or command link, OC coordinates with PRO to determine the appropriate action(s) to take.  POD announces on the POD loop the need to perform safing/LIS REP provides science priorities to POD/PRO disables all commanders except PRO and DMC.

10. NASA MSFC Mission Operations Laboratory MSFC Page 10 POH SOP 1.8 Safing Overview (Cont.)  POD directs OC to coordinate with PRO/Cadre members/crew to safe the affected payload:  Time permitting, OC directs the user to safe their individual payloads.  If time does not permit, OC directs PRO to safe payload(s) via commanding or an automated procedure to safing.  After the payload is safed, OC announces on the POD loop that the payload(s) has been safed.  POD notifies PRO that unaffected payload commanding may resume.  OC assigns a PAR.  OC coordinates with User, LIS REP, TCO, PREP Team, and/or PPM to update OSTPV for the safed payload until operations for that payload can resume.  After approval by POD, PAYCOM lets the crew know when normal operations may resume.

11. NASA MSFC Mission Operations Laboratory MSFC Page 11 PLD REG 2.1.11 Overview  PLD REG 2.1.11 NASA Payload Safing Method Priority states: When a situation requires payload safing, consideration will be given to preserving research capability. All NASA powered payloads shall provide the POIC with payload safing procedures. Methods to perform payload safing are (in order of preference):  Ground-Commanded Procedure performed by PI/PD  Ground-Commanded Procedure Performed by POIC  Crew Manual Procedure  Ground Commanded or Timeliner initiated payload rack power- down by MCC-H, POIC, Columbus-Control Center (COL-CC) or Space Integrated Promotion Center (SSIPC)

12. NASA MSFC Mission Operations Laboratory MSFC Page 12 Other Safing Considerations  Safing a payload should be highly considered if the payload had an off nominal situation prior to losing Fire Detection and Suppression (FDS). This is advisable because if the payload is in an off nominal state on top of losing FDS, then the payload could trend in a direction where FDS would be needed to help quickly safe the payload.  After a payload safing, please consult Flight Rule B19-18 ISS Payload Interruption Constraints to let POD know of any power off time limit for the payload that was safed.  Granted the POIC is all about science and wants to obtain as much science as possible, but we do not need to power something back up that required safing without having extended PAR analysis/discussion.  Whether a payload has a power off time constraint or not, it does not need to be powered back on unless and until the condition that caused the payload to be safed is fully understood and it is deemed safe to proceed with operations.

13. NASA MSFC Mission Operations Laboratory MSFC Page 13 Other Safing Considerations (Cont.)  Enabled versus Suppressed versus Inhibited – This terminology is sometimes mistakenly used. So, we need to define what is meant by each in terms of ECW messages in general and specifically for the AAA Underspeed and Smoke Detection Monitoring Cautions. When the Cautions involving AAA Underspeed and Smoke Detection monitoring occur and are:  Enabled, an audible alarm will sound for the crew, and the associated messages will show up for the crew on the PCS and in Fault Summary during S Band AOSes on the ground.  Suppressed, an audible alarm will not sound for the crew, but the associated messages will show up for the crew on the PCS and in Fault Summary during S Band AOSes on the ground.  Inhibited, an audible alarm will not sound for the crew nor will the associated messages show up for the crew on the PCS. However, the messages will show up in Fault Summary during S Band AOSes on the ground.

14. NASA MSFC Mission Operations Laboratory MSFC Page 14 Other Safing Considerations (Cont.)  Please keep in mind that:  AAA Underspeed monitoring is typically inhibited in the LAB, but AAA Underspeed monitoring is typically enabled for NASA Payload Racks in the Columbus Module and JEM (except for MELFI 1 and 2 in the JEM).  If a Rack has a AAA Fan or other type of fan used for FDS (e.g. HRF Rack mixing Fan), and AAA Underspeed monitoring is Enabled prior to power being pulled from the Rack, then for the Columbus module and JEM the following will happen:  Columbus Module: crew will see a “ISPR XX Fan Fail – COL” Caution message on PCS (POIC will see same message in Fault Summary during S Band AOS), and crew will hear an audible alarm.  JEM: crew will see a “ISPR XX AAA Spd Low – JPM” Caution message on PCS (POIC will see same message in Fault Summary during S Band AOS), and crew will hear an audible alarm. The reason for these messages/alarms is because the AAA Fan or other Fan type is monitored to make sure it is still functional. For RPM drops below a defined threshold, the AAA is assumed to be failed which in turn compromises FDS for that Rack.

15. NASA MSFC Mission Operations Laboratory MSFC Page 15 Other Safing Considerations (Cont.)  Smoke Detection Monitoring is normally inhibited until shortly after power is applied to a Rack or just before power is removed to a Rack location having a smoke detector regardless of module. So, outside of times just before Rack activation or deactivation, Smoke Detection is typically Enabled regardless of Module for Racks having Smoke Detectors (e.g. MELFI Racks do not have Smoke Detectors).  If a Rack has a Smoke Detector (e.g. EXPRESS Rack), and Smoke Detection monitoring is not inhibited prior to power being pulled from the Rack, then by Module, the following will happen:  LAB: crew will see a “Rack Smoke Detector LAB1XX Fail – LAB” Caution message on PCS (POIC will see same message in Fault Summary during S Band AOS), and crew will hear an audible alarm.  Columbus Module: crew will see a “ISPR XX Smoke Detector Fail – COL” Caution message on PCS (POIC will see same message in Fault Summary during S Band AOS), and crew will hear an audible alarm.  JEM: crew will see a “ISPR XX SD Fail – JPM” Caution message on PCS (POIC will see same message in Fault Summary during S Band AOS), and crew will hear an audible alarm. The reason for these messages/alarms is because the Smoke Detector is being monitored to make sure it is still functional. For an abrupt Smoke Detector power loss, the Smoke Detector is assumed to be failed which in turn compromises FDS for that Rack.

16. NASA MSFC Mission Operations Laboratory MSFC Page 16 Other Safing Considerations (Cont.)  So, why do we care whether AAA Underspeed and Smoke Detection Monitoring is enabled, suppressed, or inhibited?  We care because:  Ground commanding to safe a Rack might not allow enough time to inhibit AAA Underspeed (Columbus Module and JEM only) and Smoke Detection Monitoring (all modules) resulting in Caution messages/alarms.  Crew Rack safing using a PCS display by simply opening RPCs or using the Rack Power Switch (RPS) would result in AAA Underspeed (Columbus Module and JEM only) and Smoke Detection Monitoring (all modules) Caution messages/alarms.  As a review for the two cases immediately above,  these Cautions would be seen and an audible alarm would occur onboard if they are Enabled,  these Cautions would be seen onboard and no onboard audible alarms would occur if they are Suppressed, and  these Cautions would neither be seen nor would they ring an audible alarm onboard if they are Inhibited.

17. NASA MSFC Mission Operations Laboratory MSFC Page 17 Other Safing Considerations (Cont.) In the MCC-H OPS1 website, C&W can be selected within the Systems tab. ECW message information can be entered in the search field to in turn determine whether an ECW message is Enabled, Inhibited, or Suppressed by Rack location per the “Pri” column.

18. NASA MSFC Mission Operations Laboratory MSFC Page 18 Other Safing Considerations (Cont.) In the MCC-H OPS1 website, C&W can be selected within the Systems tab. ECW message information can be entered in the search field to in turn determine whether an ECW message is Enabled, Inhibited, or Suppressed by Rack location per the “Pri” column.

19. NASA MSFC Mission Operations Laboratory MSFC Page 19 Other Safing Considerations (Cont.) Caution Message in Fault Summary for EXPRESS Rack 1 (LAB1O2) Smoke Detector Fail that can be seen during S Band AOSes.

20. NASA MSFC Mission Operations Laboratory MSFC Page 20 Ground Safing Methods  EXPRESS Rack Nominal Commanding displays can be used to turn Payloads OFF and is used for Nominal (i.e. graceful) shutdowns.

21. NASA MSFC Mission Operations Laboratory MSFC Page 21 Ground Safing Methods (Cont.)  EXPRESS Rack PLSS Commanding displays can be used to turn Payloads and Racks OFF by simply opening a Rack’s RPCs (i.e. non graceful shutdowns).

22. NASA MSFC Mission Operations Laboratory MSFC Page 22 Ground Safing Methods (Cont.) This is a large display so, only half of it is shown on this slide. The Rack Shutdown commanding button opens all SSPCs (Solid State Power Controllers) for an EXPRESS Rack (payloads and all others (e.g. water valves, AAA, RIC, etc…). The Smoke Detection Inhibit button commands to inhibit Rack smoke detection to avoid ringing an alarm on ISS. PRO cannot disable Rack Smoke detection in the JEM and Columbus modules. If the Rack Shutdown button is hit without COL/JAXA inhibiting Smoke Detection, an alarm will sound on ISS. The Safe All Payloads button commands to open all SSPCs to each payload. The Stop Mode button commands to stop the Brayton Machine in a MELFI Rack. The Safing and Main buttons open the Safing (i.e. Aux) and Main RPCs in the LAB. PRO cannot command directly to the RPCs in the JEM and PDUs in the Columbus module.

23. NASA MSFC Mission Operations Laboratory MSFC Page 23 Ground Safing Methods (Cont.) The Rack Shutdown commanding button opens all SSPCs for an EXPRESS Rack (payloads and all others (e.g. water valves, AAA, RIC, etc…). The Smoke Detection Inhibit button commands to inhibit Rack smoke detection to avoid ringing an alarm on ISS. PRO cannot disable Rack Smoke detection in the JEM and Columbus modules. If the Rack Shutdown button is hit without COL/JAXA inhibiting Smoke Detection, an alarm will sound on ISS. The Safe All Payloads button commands to open all SSPCs to each payload. The Stop Mode button commands to stop the Brayton Machine in a MELFI Rack. The Safing and Main buttons open the Safing (i.e. Aux) and Main RPCs in the LAB. PRO cannot command directly to the RPCs in the JEM and PDUs in the Columbus module. This is a large display so, only half of it is shown on this slide.

24. NASA MSFC Mission Operations Laboratory MSFC Page 24 Ground Safing Methods (Cont.) This is a large display, and I could not fit all that needed to be discussed on the previous 2 slides. Each powered payload will have a button to open the SSPC in order to power it OFF. The asterisk beside a payload’s button means that there are commands in addition to opening the SSPC that will execute for that payload’s deactivation.

25. NASA MSFC Mission Operations Laboratory MSFC Page 25 Ground Safing Methods (Cont.)  PRO has several Ground Command Procedures (GCPs) that can be used for safing, and they are broadly categorized into Rack/Facility and Payload Safing procedures.  Rack/Facility level GCPs include varying combinations of steps including inhibiting AAA Underspeed and Smoke Detection Monitoring, but these GCPs do call out inhibiting AAA Underspeed monitoring and smoke detection monitoring prior to removing Rack power.  Please remember per the discussion on slides 13 – 19 that if time does not permit for Inhibiting AAA Underspeed (Columbus Module and JEM) and Smoke Detection monitoring, then messages on the PCS (onboard) / Fault Summary (ground) and an onboard audible alarm results.  PRO cannot remove Rack power from Racks in the Columbus Module (i.e. open PDUs) or JEM (i.e. open RPCs) nominally, so PRO has to rely on Columbus and JEM Flight controllers to perform this commanding (refer to timeliner sequence section on succeeding slides for special circumstances under which PRO can indirectly command to these items).

26. NASA MSFC Mission Operations Laboratory MSFC Page 26 Ground Safing Methods (Cont.)  PRO has two GCPs for EXPRESS/WORF Rack Safing which are Semi Time Critical Safing (> 5 minutes) and Time Critical Safing (< 5 minutes). The difference between these GCPs is that the Time Critical Safing (< 5 minutes) GCP does not have the PRO select the Safe All Payloads button to open all payload SSPCs and shutdown the ELC before pressing with EXPRESS Rack deactivation steps.  If the ELC was powered for Time Critical Safing (< 5 minutes), then we would need the crew to power off the ELC as soon as possible after the GCP was completed.  Many payloads have Safing GCPs that may include several commands beyond just disabling power, but time may not allow for completion of all graceful commands.

27. NASA MSFC Mission Operations Laboratory MSFC Page 27 Ground Safing Methods (Cont.)  PRO cannot command to either the PDUs that power NASA Racks in the Columbus module or the RPCs that power NASA Racks in the JEM.  However, there are circumstances under which PRO can indirectly command to the PDUs that power our Racks in the Columbus module or the RPCs that power our Racks in the JEM, using timeliner bundles per Flight Rule B19-15 POIC Contingency NASA Payload Rack Deactivation in JEM and Columbus.  There is one timeliner sequence for each NASA Rack in the Columbus Module and JEM.  The commands kicked off by each sequence are called Command Request Commands (CRCs). CRCs are initiated on the PLMDM and are sent to the C&CMDM. After reaching the C&CMDM, they are routed as follows by module:  Columbus Module: MMC (Mission Management Computer) to DMC (Data Management Computer), which in turn commands the PDU(s) open  JEM: JCP (JEM Control Processor) to DIU (Data Interface Unit), which in turn commands the RPC(s) open  If the bundles are initiated without smoke detection being inhibited by PRO’s COL/JAXA counterparts, an alarm will sound onboard after the commands to open the PDU(s) or RPC(s) are sent. Because time is of the essence for safing purposes and per Flight Rule B19-15 (see next slide), the likelihood of ringing an alarm is high when executing these bundles.

28. NASA MSFC Mission Operations Laboratory MSFC Page 28 Ground Safing Methods (Cont.)  Flight Rule B19-15 states: POIC HAS THE AUTHORITY TO SAFE NASA PAYLOAD RACK(S) BY GROUND COMMANDING IN THE EVENT OF AN OFF NOMINAL SITUATION REQUIRING IMMEDIATE RACK POWER DOWN, AND UNDER ANY OF THE FOLLOWING CONDITIONS: A. POIC CANNOT ESTABLISH COMMUNICATION WITH SSIPC/COL-CC. B. SSIPC/COL-CC COMMAND UPLINK CAPABILITY IS LOST. C. SSIPC/COL-CC REQUEST POIC IMMEDIATELY SAFE NASA RACKS.

29. NASA MSFC Mission Operations Laboratory MSFC Page 29 Ground Safing Methods (Cont.)  The Columbus timeliner sequences PRO can send if the conditions in Flight Rule B19-15 are met are listed below.

30. NASA MSFC Mission Operations Laboratory MSFC Page 30 Ground Safing Methods (Cont.)  The JEM timeliner sequences PRO can send if the conditions in Flight Rule B19-15 are met are listed below.

31. NASA MSFC Mission Operations Laboratory MSFC Page 31 Ground Safing Methods (Cont.)  SPARTAN can open (i.e. power OFF) RPCs as needed.  Please keep in mind that per the discussion on slides 13 – 19, if time does not permit for Inhibiting AAA Underspeed (Columbus Module and JEM) and Smoke Detection monitoring, then messages on the PCS (onboard) / Fault Summary (ground) and an audible alarm onboard results.

32. NASA MSFC Mission Operations Laboratory MSFC Page 32 Crew Safing Methods  The crew can be directed to use Safing procedures in the Quick Response folder.  There has been discussion about moving any Safing procedures from the Quick Response folder to the appropriate payload folder, but for now the Quick Response folder is still available for use.

33. NASA MSFC Mission Operations Laboratory MSFC Page 33 Crew Safing Methods (Cont.)  The crew can open (i.e. power OFF) RPCs as needed (PCS display on board matches SPARTAN’s ground display).  Please keep in mind that per the discussion on slides 13 – 19, if time does not permit for Inhibiting AAA Underspeed (Columbus Module and JEM) and Smoke Detection monitoring, then messages on the PCS (onboard) / Fault Summary (ground) and an audible onboard alarm results.

34. NASA MSFC Mission Operations Laboratory MSFC Page 34 Crew Safing Methods (Cont.)  The crew can open the EXPRESS Application from the EXPRESS Laptop Computer (ELC) and launch the EXPRESS EPS P/L Power display.

35. NASA MSFC Mission Operations Laboratory MSFC Page 35 Crew Safing Methods (Cont.)  After the Locker / Drawer Power button is selected (see previous slide), the Locker/Drawer Power window comes up and the appropriate locker or drawer can be powered OFF. Since the ELC these screen shots were taken from was not hooked up to an EXPRESS Rack, “unconfigured” is displayed for all lockers/drawers.

36. NASA MSFC Mission Operations Laboratory MSFC Page 36 Crew Safing Methods (Cont.)  The crew can open the EXPRESS Application from the EXPRESS Laptop Computer (ELC) and launch the EXPRESS Comm P/L Comm display.

37. NASA MSFC Mission Operations Laboratory MSFC Page 37 Crew Safing Methods (Cont.)  After the Locker / Drawer Comm button is selected (see previous slide), the Locker/Drawer Comm window comes up and the appropriate locker or drawer’s Comm can be disabled. Since the ELC these screen shots were taken from was not hooked up to an EXPRESS Rack, “unconfigured” is displayed for all lockers/drawers. Granted this is a cleanup step, but it is good to know that power and comm are completed in two separate crew steps in the EXPRESS Application.

38. NASA MSFC Mission Operations Laboratory MSFC Page 38 Crew Safing Methods (Cont.)  The crew can open the EXPRESS Application from the EXPRESS Laptop Computer (ELC) and launch the EXPRESS EPS SSPCM Control display.

39. NASA MSFC Mission Operations Laboratory MSFC Page 39 Crew Safing Methods (Cont.)  After the SSPCM Actual Condition button is selected (see previous slide), different Rack Subsystem SSPC Channels can be turned OFF.

40. NASA MSFC Mission Operations Laboratory MSFC Page 40 Crew Safing Methods (Cont.)  The MELFI Rack has several displays available for use on a PCS. The Freezer Mode can be changed via the MELFI Health and Status display as shown below.

41. NASA MSFC Mission Operations Laboratory MSFC Page 41 Crew Safing Methods (Cont.) If the crew selects Stop Mode on the MELFI Health and Status display (see previous page), then the MELFI: Confirm Stop Mode window to the right is launched. If the crew selects yes, then the MELFI Rack will transition to the Stop Mode, which causes the MELFI Rack’s Brayton Machine to be powered OFF. If the crew selects Standby Mode on the MELFI Health and Status display (see previous page), then the MELFI: Confirm Standby Mode window to the right is launched. If the crew selects yes, then the MELFI Rack Dewars will be turned OFF. The Brayton Machine must be turned OFF prior to all Dewars being turned OFF because at least one Dewar set to -95 C has to be operational at all times the Brayton Machine is ON.

42. NASA MSFC Mission Operations Laboratory MSFC Page 42 Crew Safing Methods (Cont.)  The MELFI: Dewar Control PCS display can be used to deactivate a Dewar by changing the State from On to Off. Please keep in mind that if the Brayton Machine is ON, then a maximum of 3 of 4 Dewars can be turned OFF because one Dewar set at -95 C must remain on for the Brayton Machine to work.

43. NASA MSFC Mission Operations Laboratory MSFC Page 43 Crew Safing Methods (Cont.) The crew can open (i.e. power OFF) both RPCs (LAB or JEM) or PDUs (COL) for any Rack location using the Rack Power Switch (RPS). Please keep in mind that per the discussion on slides 13 – 19 that if time does not permit for Inhibiting AAA Underspeed (Columbus Module and JEM) and Smoke Detection monitoring, then messages on the PCS (onboard) / Fault Summary (ground) and an onboard audible alarm results. Note: “LAB/CAM” indicates that the On/Off functionality is identical for both LAB & CAM payload racks. The On/Off functionality is reversed for JEM/Columbus payload racks. CAM stands for Centrifuge Accommodations Module, which is a cancelled element of the ISS. Latching switch nominally remains in “ON” position. Switch is thrown to “OFF” position by crewmembers to command open all RPC power feeds to rack regardless of current position (open or closed). RPS monitoring for particular rack must be enabled for rack safing to work.

44. NASA MSFC Mission Operations Laboratory MSFC Page 44 Crew Safing Methods (Cont.) The crew can open (i.e. power OFF) both RPCs (LAB or JEM) or PDUs (COL) for any Rack location using the Rack Power Switch (RPS). Please keep in mind that per the discussion on slides 13 – 19 that if time does not permit for Inhibiting AAA Underspeed (Columbus Module and JEM) and Smoke Detection monitoring, then messages on the PCS (onboard) / Fault Summary (ground) and an onboard audible alarm results. Note: The On/Off functionality is reversed from US LAB for JEM/ Columbus payload racks. Latching switch nominally remains in “ON” position. Switch is thrown to “OFF” position by crewmembers to command open all power feeds to rack regardless of current position (open or closed). RPS monitoring for particular rack must be enabled for rack safing to work. JEM/COL ON OFF

45. NASA MSFC Mission Operations Laboratory MSFC Page 45 Crew Safing Methods (Cont.) Disclaimer: The remaining Crew Safing Methods slides contain pictures/drawings of several Rack specific power switches. Please refer to Phase III Self Studies for pictures/drawings of payload specific power switches. The methods depicted in the pictures/drawings are not meant to replace simply having the crew power OFF a Rack using an RPS to quickly safe a Rack/Payload. However, these pictures/drawings are only meant to show possibilities for powering different Rack/Payload components OFF using Rack specific power switches. Please only use these pictures/drawings as a discussion starting point for Safing purposes with the Rack/Facility operator before using them as a Safing option and only after all Ground or other quicker Crew (e.g. RPS) Safing options are exhausted.

46. NASA MSFC Mission Operations Laboratory MSFC Page 46 Crew Safing Methods (Cont.) EXPRESS Upper and Lower Connector Panels

47. NASA MSFC Mission Operations Laboratory MSFC Page 47 Crew Safing Methods (Cont.) WORF FRONT CONNECTOR PANEL – On front exterior of WORF WORF MAIN CAMERA CONNECTOR PANEL – In WORF Internal Volume WORF AUXILARY PANEL 1 – In WORF Internal Volume

48. NASA MSFC Mission Operations Laboratory MSFC Page 48 Crew Safing Methods (Cont.) HRF Left Rack Control Panel ↑ HRF Right Rack Control Panel ↓

49. NASA MSFC Mission Operations Laboratory MSFC Page 49 Crew Safing Methods (Cont.) MELFI Electronics Unit MELFI Rack Interface Unit (RIU) Switch Box – When Main and Aux switches are switched to OFF, the Main and Aux RPC power is interrupted from entering the MELFI Rack, however, the Main and Safing RPCs remain closed.

50. NASA MSFC Mission Operations Laboratory MSFC Page 50 Crew Safing Methods (Cont.) CIR EPCU Power Switch

51. NASA MSFC Mission Operations Laboratory MSFC Page 51 Crew Safing Methods (Cont.) FIR EPCU Power Switch

52. NASA MSFC Mission Operations Laboratory MSFC Page 52 Crew Safing Methods (Cont.) MSG CMP Power Switches

53. NASA MSFC Mission Operations Laboratory MSFC Page 53 Crew Safing Methods (Cont.) MSG Video Drawer Power Switches

54. NASA MSFC Mission Operations Laboratory MSFC Page 54 Crew Safing Methods (Cont.) MSG Power Distribution & Conversion Box Switches protected by a bracket

55. NASA MSFC Mission Operations Laboratory MSFC Page 55 Crew Safing Methods (Cont.) MSG Remote Power Distribution Assembly Power Switches

56. NASA MSFC Mission Operations Laboratory MSFC Page 56 Automatic Safing Methods  Payload or Rack Hardware can be designed to safe a Payload or Rack in the event a limit is exceeded (e.g. MELFI Thermal Switches will open to not allow power to be applied to the Rack if MELFI subsystem temps are too high).  Payload or Rack specific software can be designed to deactivate itself or portions of itself if a parameter(s) it monitors goes out of limits (e.g. PAR EMCS-SW-0002).  Parameter monitoring limits can also be setup in the Limit Check Definition Table (LCDT) on the PLMDM for parameters such as current draw, temperature, and pressure.  When a limit is reached, automatic commanding safing actions can be defined to turn the payload OFF within a Rack.  The LCDT can also be setup to monitor a Rack, and if limit(s) for that Rack are exceeded, the PLMDM can send request(s) to the C&CMDM to open the power feeds (i.e. RPCs) for a Rack location (e.g. MELFI Racks).

57. NASA MSFC Mission Operations Laboratory MSFC Page 57 Questions?