1. 1 Shuttle Derived Launch Vehicle Dynamic Abort Risk Evaluator (DARE) Gaspare Maggio Chris Everett Tony Hall – Section Manager – Project Manager – Development Lead

2. 2 Topics to be Discussed DARE Background –DARE Purpose & Scope –Space Shuttle DARE –DARE Methodology –Example Trade Studies (SSME Throttle Up, N z Pullout) DARE Model –Abort Initiators –Pivotal Events –Module Examples –Probabilistic Framework Application to Constellation –CLV Application –Expansion for Lunar Mission

3. 3 DARE dynamically evaluates abort effectiveness –Conditional analysis Given an abort, what is the subsequent probability of abort success/failure Aborts are defined by a failure initiator and failure time –Dynamic evaluation The risk evaluation in DARE is determined both probabilistically & parametrically, accommodating a broad range of initial conditions (vehicle configurations, abort initial conditions) The DARE model accommodates random uncertainties, such as the time of subsequent system failures The current scope of DARE is ascent abort (expandable to other mission phases) –Space Shuttle (heritage capability) –Shuttle-derived Launch Vehicles (new capability) DARE Purpose

4. 4 Background - Shuttle DARE Space Shuttle PRA 1995 –First quantitative probabilistic risk model created for the Space Shuttle –Addressed nominal mission DARE 1997-present –Model to determine abort risks and perform risk trade studies (1995 PRA did not consider abort risks) –Address the need to include abort risk assessment as part of the overall Space Shuttle risk management process –Compliment, and eventually integrate into, nominal-mission Space Shuttle ascent risk analysis Inclusion of Shuttle-Derived Launch Vehicles –New capability: initial development completed May 2005 –DARE  Shuttle & SDLV

5. 5 DARE Contributors Gaspare Maggio, Chris Everett, Sabrina Yazdpour,Tony Hall John Turner

6. 6 DARE Technical Validation Ascent GN&C Abort Panel Review in September 2001 –Monte Carlo simulations for ET separation success rates were incorporated into DARE model and reviewed MFSC SSME Project office, SSME Reliability Estimates Review in July 2002 –SSME Project provided new SSME mean and median estimates for catastrophic and benign shutdown failures Independent assessment of the RTLS risk modeling was performed in October 2001 (Barney B. Roberts, Futron Corp.) –Continue to pursue DARE modeling -- Good decision-support tool for studying mission options to reduce risk Flight Techniques Panel Review in July 2002 –Presented DARE model and overview Integrated Control Board Review in October 2002 –Presented DARE model and overview as well as discussed DARE/SPRA integration Independent Peer Review Report, NASA Office of Safety and Mission Assurance –DARE was independently reviewed by NASA OSMA as a pathfinder

7. 7 Comments of Note from Reviews “The general methodological framework underlying DARE is, as a whole, technically valid” - Independent Peer Review Report, NASA Office of Safety and Mission Assurance, July 2003 “Good decision-support tool for studying mission options to reduce risk” -Barney Roberts, Independent Reviewer, Sept 2001 “This is great stuff!” -Wayne Hale, Integration Control Board Review, October 2002

8. 8 DARE Methodology Identify Abort Initiators Determine Abort Modes / Regions Identify Events that Dominate Abort Risk Produce Results Develop Models / Modules for Significant Events Integrate into Probabilistic Framework Shuttle PRA SDV PRA Customer Needs Flight Rules for Abort Operations Data Gathering Uncertainty Analysis Model Development Identify important abort initiators Characterize abort operations Identify significant abort events Model events within dynamic, probabilistic framework Step 6 Step 5 Step 4 Step 3 Step 2 Step 1

9. 9 Example Shuttle Results

10. 10 DARE Ver. 3.00 STS-111 SSME Throttle-Up Risk Trade TAL (ZZA) @ 104.5%/104.5% 104.5%/106% 104.5%/109% 148 s 136 s 12 124 s 24 A risk trade was performed using DARE to consider the possibility of throttling up the two remaining SSMEs after a first engine shutdown to transition to a TAL abort rather than having to conduct an RTLS

11. 11 1 in 33 RTLS risk dominated by ET separation risk Qbar at separation reduced by increasing load limits during N z Pullout Risk reduction potential quantified ~ 1 in 70 ET Separation Nz Pullout Risk Trade ET separation risk sensitive to Qbar at separation

12. 12

13. 13 Current SDLV configurations modeled in DARE –In-line crew (ILC) 3 CLV configurations –4 segment SRB, J-2 upper stage –5 segment SRB, J-2 upper stage –4 segment SRB, SSME upper stage CEV parametric model –Side-mount crew (SMC) Shuttle derived external tank, dual SRBs, 3 SSME main propulsion Same CEV model as for ILC SDLV Scope

14. 14 SDLV Abort Initiators Functional Failure/Shutdown (US) Catastrophic Fire/Explosion (US) OMS Failure to Function (CV SEP) TVC Catastrophic Failure (SRB) Booster Separation Motor Failure (SRB SEP) Interstage Separation Motor Failure (SRB SEP) Booster Separation Bolts Failure (SRB SEP) CV Separation Motor Failure (CV SEP) RSRM Propellant Failure RSRM Flex Bearing Joint Failure RSRM Nozzle Joint 1 Failure RSRM Nozzle Joint 5 Failure RSRM Other Joint Failure RSRM Structural Failure RSRM Thermal Failure RSRM Nozzle Failure SSME Shutdown SSME Turbopump Failure SSME Nozzle Failure SSME Main Combustion Chamber Failure SSME Other Catastrophic Failure MPS Functional Failure MPS Catastrophic Failure FCS Functional Failure APU Catastrophic Failure SSME Failure to MECO SRB Functional Failure SRB Catastrophic Failure SRB Separation Functional Failure SRB Separation Catastrophic Failure RSRM Functional Failure RSRM Motor Propellant Failure RSRM Nozzle Failure RSRM Nozzle Phenolics Failure RSRM Other Insulation Failure RSRM Structural Failure RSRM OPT Joint Failure RSRM Flex Bearing Joint Failure RSRM Other Joint Failure RSRM Nozzle Joint 1 Failure RSRM Nozzle Joint 5 Failure RSRM Other Nozzle Joint Failure Side-Mount Vehicle*In-Line Vehicle* *Abort initiator identification and consolidation is subject to the fidelity of the PRA used to identify the failure modes. In the case of the SDLV PRA, In-Line upper-stage failures have all been grouped into a common failure mode. Additionally, some abort initiators they may be consolidated due to commonalities on one vehicle, may not necessarily share those commonalities on another vehicle. Relevant abort initiators were transferred and modified from Space Shuttle PRA

15. 15 Pivotal Events Ascent abort pivotal events are identified in a master abort event tree and evaluated in event-specific modules

16. 16 Example Module: Separation Failure Separation failure occurs if any of the following failures occurs: –Failure of separation mechanisms –Failure of the CEV to survive increased dynamic pressure associated with abort velocity –Failure of the CEV to survive the accident environment existing in the vicinity of the LV

17. 17 Example: RSRM Joint Failure Separation Failure Example Failure to survive accident environment stresses The event, “Failure to survive accident environment stresses” considers the various ways that each initiating event might unfold, producing a spectrum of possible environments Accident Characteristics

18. 18 Separation Distance Critical Distance Separation Failure Example Failure to survive accident stresses (continued) The CEV survives the accident stresses if it reaches a critical distance from the exploding launch vehicle.

19. 19 DARE Probabilistic Framework Dynamic abort risk evaluation is accomplished by developing the abort model within a fully probabilistic framework –Uncertainties can be associated with any modeling parameter –Statistics can be obtained on any calculated result DARE handles both modeling uncertainty and random uncertainty –Modeling uncertainty describes lack of knowledge about the events being modeled, e.g.: IVHM reliability LES reliability Landing system reliability –Random uncertainty describes variability in the events being modeled, e.g.: CEV/LV separation distance Accident propagation paths Abort effectiveness is expressed as a probability and an associated confidence: P(successful abort) @ confidence level

20. 20

21. 21 DARE Example Results Pivotal Event Breakdown Mean Value 5 th Percentile 95 th Percentile Key Mean Value 5 th Percentile 95 th Percentile Key Landing and recovery modules currently contain static placeholder values Separation failure is the event with the greatest expected risk… …and the greatest uncertainty

22. 22 Integrated Abort Effectiveness Overall 85% Crew Escape Effectiveness LOM LOC DARE was applied to the ILC SDLV Top-Level PRA to estimate overall CEV abort effectiveness for this configuration –Rough analysis For each failure mode, abort effectiveness was assessed at the midpoint of the exposure duration 5 th, 50 th & 95 th percentiles were used to estimate failure-mode- specific abort effectiveness densities A few failure modes are assessed conservatively due to lack of detection lead time data Result: 85% mean abort effectiveness for ILC J-2S

23. 23

24. 24 DARE as a Living Tool DARE has been designed to maximize “plug and play” capability, allowing the most current data and models to be integrated into the analysis framework Evolving Architectures Master Abort Event Tree Pivotal Events Vehicle / Element Set Risks & Uncertainties Results DARE Integration of the best available Data and Models

25. 25 Is a particular LOC requirement reasonable and achievable? –e.g. 99% abort effectiveness at 80% confidence System options –LES motor pusher/tractor –Reentry/landing systems Biconic/ballistic –TPS type Ablative/tile Performance characteristics –LES acceleration –Overpressure tolerance –Dynamic pressure tolerance –LES burn time Concept of operations –Escape tower jettison time –ATE/ATO interface Requirements Development Support LES Acceleration (m/s 2 ) LES Burn Time (sec) Overpressure Design Limit (psi) Requirements Surface e.g. 99% reliability @ 80% confidence Above surface: Requirement met Below surface: Requirement not met

26. 26 Identify and reduce the largest inhibitors of abort effectiveness Identify and reduce the largest uncertainties in abort effectiveness …Failure mode Y… Identify the Sources of Risk & Uncertainty Pivotal Event W… …Mitigate propagation to system X …Increase detection lead time …Focus analysis on event Z

27. 27 Risk Informed Abort Development What are the significant abort-initiating failures? Failure Mode N Failure Mode 2 Failure Mode 1 … Prioritized Initiators Failure Mode 2 When can Failure Mode 1 occur? Abort Initial Conditions Locations Trajectories Damage States Accident Progression Phenomenological Modeling Probabilistic Risk Assessment What are the abort options? Abort Design Abort Mode 1,1 Abort Mode 1,2 Abort Mode 1,M … How effective is the abort? Abort Risk Assessment Iterate

28. 28 Conclusions DARE is a proven, effective tool-based process for evaluating abort effectiveness DARE is designed to capture the best data and models available throughout NASA DARE supports risk informed decision making throughout all stages of program development –Conceptual –Preliminary design –Testing and evaluation –Operations The dynamic DARE framework supports rapid analysis of system and operational trades DARE is a living process that will remain current and productive throughout Constellation life

29. 29