DARE Dynamic Abort Risk Evaluator Analysis Process Document

Transcription

1 DARE Dynamic Abort Risk Evaluator Analysis Process Document Version 3.0 2/28/07 Safety & Risk Section 350 Broadway 8 th Floor New York, NY SAIC PROPRIETARY INFORMATION. The information contained in this document is proprietary to SAIC. It may not be used by, reproduced for or disclosed to third parties, including subcontractors or teaming partners, without the prior written approval of the SAIC contact identified in the information listed above. Copyrights for this document are owned by Science Applications International Corporation (SAIC). Any person is hereby authorized to view and print these documents subject to the following conditions: 1. The documents may be used for informational purposes only. 2. The documents may not be used for any commercial purposes. 3. Any copy of these documents or portion thereof must include this copyright notice. Note that any product, process or technology described in the documents may be the subject of other Intellectual Property rights reserved by SAIC and are not licensed under this copyright. THIS PUBLICATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. THIS PUBLICATION MAY INCLUDE TECHNICAL INACCURACIES OR TYPOGRAPHICAL ERRORS. CHANGES MAY BE PERIODICALLY INCORPORATED IN NEW EDITIONS OF THIS PUBLICATION. SAIC MAY MAKE CHANGES IN THE PRODUCT(S) AND/OR THE PROGRAM(S) DESCRIBED IN THIS PUBLICATION AT ANY TIME.

2 An Employee-Owned Company Science Applications International Corporation Safety & Risk Section of the Space Technologies Operation 350 Broadway, 8 th Floor New York, New York (212) Fax: (212)

3 1 Introduction Purpose Acronyms and Abbreviations Definitions Design Implementation Tool Structure Input Sheet General Vehicle Characteristics Individual System Characteristics Launch Vehicle Failure Characteristics System Failure Logic Module Pivotal Event Modules Abort Initiating Failure Detected (PEM 1) Abort Method (SWITCH 1) Successful LAS Abort Separation (PEM 2) Orion Engine Abort Separation (PEM 3) Vehicle Stabilization (PEM 4) Abort to Orbit (SWITCH 2) Abort to Orbit (PEM 5) Orion De-Orbit Burn and Re-Entry (PEM 6) CM/SM Separation (PEM 7) Deployment of the Landing System (PEM 8) Landing and Crew Recovery (PEM 9) Monte Carlo Shells Epistemic Uncertainty Aleatory Uncertainty FOM Selection Tool Input and Output Trajectory Sheet Static Data Sheet Failure Time Iteration Sheet Results Storage References Appendix A

4 1 Introduction 1.1 Purpose The Dynamic Abort Risk Evaluator (DARE) is a tool used to assess ascent abort effectiveness. The tool performs a conditional analysis, assuming a launch vehicle failure has occurred, examining the subsequent probability of abort success or failure. The aborts themselves are defined by failure mode and failure time relative to liftoff. A key feature of DARE is the ability to perform a dynamic evaluation, accounting for changes in the probabilities of risk-significant events over time. The model is defined parametrically, allowing it to accommodate a broad range of initial conditions, such as vehicle configurations and abort initial conditions. Additionally, DARE accommodates random uncertainties, such as the time of subsequent system failures. The scope of DARE is the ascent phase of flight, and the tool has historically included the Shuttle, as well as a number of Shuttle-derived vehicles. However, as the Constellation program has matured it has settled on the Ares I Crew Launch Vehicle (CLV) as the means of placing crew into orbit. Therefore, the current version of DARE (v 3.0) is specific to the Ares I. The basic DARE methodology is straightforward: Identify important abort initiators Characterize abort operations Identify significant abort events Model events within a dynamic and probabilistic framework 1.2 Acronyms and Abbreviations ATK ATO CEV DARE ET FOM IVHM LAS LOC LV OMS PEM PRA RAC RCS RSRM RSRB Alliant Techsystems Inc. Abort to Orbit Crew Exploration Vehicle Dynamic Abort Risk Evaluator External Tank Figure of Merit Integrated Vehicle Health Monitoring Launch Abort System Loss of Crew Launch Vehicle Orbital Maneuvering System Pivotal Event Model Probabilistic Risk Assessment Reliability Analysis Center Reaction Control System Reusable Solid Rocket Motor Reusable Solid Rocket Booster 4

5 SSME TNT TPS Space Shuttle Main Engine Trinitrotoluene Thermal Protection System 1.3 Definitions Ascent: Period of time during a spaceflight between launch and main-engine cutoff Abort Lead Time: The time range between abort initiation and accident consequences Critical Distance: The distance from an overpressure source at which a vehicle sees its overpressure limit 2 Design Implementation The DARE tool has been implemented in Microsoft Excel, making use of separate worksheets to classify the tool into multiple system modules. Each of these worksheet modules has standard fields for inputs received by the module and outputs calculated by the module. This helps to clearly display what task is performed by each module. Additionally, each module s functionality is then entirely self-contained within that module, to eliminate confusing links between modules. The Excel implementation also, for ease of use, avoids the use of add-in tools, and minimizes the use of visual basic scripts. The model adheres to an object-oriented design philosophy as much as possible. 3 Tool Structure The operational flow of DARE is centered on its probabilistic framework. This framework consists of a nested Monte Carlo structure, in which an inner aleatory Monte Carlo routine is nested within an outer epistemic Monte Carlo routine. For each iteration of the inner routine, physically random parameters are sampled from their parent distributions and used in the modeling of pivotal abort events. The probabilities of these pivotal events populate an abort event tree, which is used to determine abort effectiveness. As the aleatory Monte Carlo proceeds, a population of abort effectiveness results is produced, from which mean values are taken. These mean values represent the abort effectiveness risk metrics for the given set of epistemically uncertain parameters that was used in the aleatory Monte Carlo. This process is repeated for each iteration of the epistemic Monte Carlo, ultimately producing histogram distributions of abort effectiveness risk metrics, as opposed to the point values produced by the aleatory Monte Carlo alone. It is from these distributions that confidence levels are determined. The metrics are stored, and new uncertain parameters are sampled, repeating the loop until the 5

6 desired number of loop iterations has been completed. The model is structured in a way that allows any modeling parameter to be extracted in this manner, enabling a comprehensive probabilistic view of the analysis. Of course, the baseline risk metric is abort effectiveness itself. The Monte Carlo structure is implemented using a short Visual Basic macro. Figure 1 diagrams the tool structure and information flow between modules. 0 LOC e i LOC 1 1 LOC 0 0 s j 1 LOC i x 1 x 2 x n Figure 1: DARE Data Flow 3.1 Input Sheet The input sheet is the first sheet in the workbook and it provides the primary DARE userinterface, where the system and scenario to be analyzed is defined. The input worksheet is broken down into three types of informational input: general vehicle characteristics, individual system characteristics and launch vehicle failure characteristics. 6

7 3.1.1 General Vehicle Characteristics In this section the user selects from basic features to define the size and specifications of the vehicle. DARE allows for modeling of one baseline launch vehicle configuration: The Ares I Crew Launch Vehicle. The Ares I Crew Launch Vehicle configuration consists of a 5 segment Shuttle SRB-derived first stage and a J-2 engine based second stage. The first stage is identical to a nominal four-segment Shuttle booster, however with an additional center segment added for increased thrust. The upper stage is a single J-2X engine configuration. The upper stage is topped with the detachable, Apollostyle Orion Crew Exploration Vehicle (CEV) which provides crew abort capability during the ascent phase with the Launch Abort System (LAS). The Orion vehicle utilizes a small on-board engine for orbital insertion and circularization. The trajectory of this vehicle is substantially different from a nominal shuttle trajectory, and is discussed further in section 3.7. DARE suggests a standard sizing (diameter) and mass for the Orion based on the planned vehicle dimensions. The user, however, has the ability to override the defaults and add different values for diameter and mass if they choose. In addition to sizing, the vehicle type is selected here; either In-Line Crew or Side Mount Crew. Finally, in this section the user must define, through numerical input, the Orion blast overpressure tolerance and maximum dynamic pressure tolerance. LAS Orion Upper Stage First Stage Individual System Characteristics This section allows users to define the specifics of the major vehicle systems. Largely these are configuration options for systems such as the OMS or Landing System, for which the specific options are discussed later in this document. There are, however, several unique numerical data inputs which are used as input parameters to crucial escape calculations: Launch Abort System (LAS) Acceleration (Gs) LAS Burn Time (s) LAS Jettison Time (s) Orion Main Engine (ME) Thrust (lbf) Orion ME V (ft/s) Orion ME Abort Burn Time (s) Nominal Reusable Solid Rocket Motor (RSRM) Chamber Pressure (psf) RSRM Case Burst Pressure (psf) 7

8 3.1.3 Launch Vehicle Failure Characteristics This section is for specifying details of the abort-initiating failure to be analyzed. Here, the user inputs the time into ascent of the failure, and DARE determines based on the failure time, the failure altitude and the abort mode. Three abort modes are possible: abort with immediate return to ground using LAS propulsion, abort with immediate return using Orion ME propulsion, and abort to orbit using Orion ME propulsion. Further information regarding the specifics of the abort modes will be presented in section 3.3. This section is also where the abort-initiating failure mode is identified. While DARE results are conditional, and thus do not account for the probability of launch vehicle failure, the failure mode determines abort details such as blast overpressure which directly affect abort effectiveness. The list of available failure modes originates from the DAC-1A Initial Reliability Analysis Report for the Crew CLV (Reference 1). The list represents the top-level failures identified in the report. A total of 19 failure modes are available for the Ares I. 3.2 System Failure Logic Module The system failure logic module contains the structural framework of the abort scenarios, identifying at a functional level all relevant sequences of events that occur following the abort-initiating failure, up to and including recovery. An event-tree-based system failure logic module has been used to organize the relationships between the pivotal events involved in an abort. The event tree contains the following pivotal events: Abort Initiating Failure Detected Orion abort method is LAS Successful LAS abort separation Successful Orion ME abort separation Orion successfully stabilizes after separation Abort mode is abort to orbit Abort to orbit successful Successful Orion de-orbit burn and re-entry Successful CM/SM separation Orion successfully deploys landing system Successful landing and safe crew recovery The module s input field contains pivotal event probabilities, used to populate the necessary fields on the event tree, and the necessary Orion configuration parameters necessary to complete the logic. 8

9 The module s output field contains the overall Loss of Crew (LOC) probability generated by the system logic, as well as the individual pivotal event probabilities. The standard pivotal event probabilities displayed are conditional values, which depend on the successful completion of prior events. The system logic used is largely based on that used in the CV model, with some appropriate changes made to the event tree structure. Modifications to the system logic can be made without significant impact to other modules in DARE (although the addition of a pivotal event would necessitate the addition of a corresponding pivotal event module). Figure 2 displays the event tree logic used in DARE. Event Name PEM 1 SWITCH 1 PEM 2 PEM 3 PEM 4 SWITCH 2 PEM 5 PEM 6 PEM 7 PEM 8 PEM 9 End State Name Abort Success Loss of Crew Successful CEV CEV successfully Successful CEV CEV successfully Successful landing Abort Initiating CEV abort method Successful LAS ME abort stabilizes after Abort mode is Abort to orbit de-orbit burn and Successful deploys landing and safe crew Event Desc. Failure Detected is LAS? abort separation separation separation abort to orbit successful re-entry CM/SM separation system recovery End State Desc. Event Prob E E E E E E E E E E E-01 Total 1 in in Event Time E E E-01 Time Units Yes Yes Yes Yes Yes Yes Initiating Event E E E E E E-01 1 in E E E E E E E E-01 Abort Success E-01 No No No No No E-03 1 in 4, E E-04 of Loss Crew E E-06 1 in 546, E E-06 Loss of Crew E E-05 1 in 157, E E-06 Loss of Crew E E-01 1 in E E-01 Loss of Crew E-01 No Yes Yes Yes Yes Yes Yes Yes Yes E E E E E E E E E-01 N/A E E E E E E E E E E+00 Abort Success E+00 No No No No No No No E-03 N/A E E+00 Loss of Crew E E-06 N/A E E+00 Loss of Crew E E-06 N/A E E+00 Loss of Crew E E-04 N/A E E+00 Loss of Crew E E-04 N/A E E+00 Loss of Crew E+00 No Yes Yes Yes E E E E-01 N/A E E E E E+00 Abort Success E+00 No No No E-03 N/A E E+00 Loss of Crew E E-06 N/A E E+00 Loss of Crew E E-06 N/A E E+00 Loss of Crew E E-05 N/A E E+00 Loss of Crew E E+00 N/A E E+00 Loss of Crew E E-05 1 in 73, E E-05 Loss of Crew E-05 Figure 2: DARE Master Abort Event Tree 3.3 Pivotal Event Modules Multiple pivotal event modules (PEMs) are used to calculate the pivotal event probabilities in the system failure logic module. There is one module corresponding to each event on the event tree, each containing static data, inputs, outputs, and calculation cells, and all are completely updateable for potential further refinement in the future if additional data and analyses become available. Each module s input field contains any relevant inputs which are necessary to perform the calculation task of the module. This includes: user input parameters, any relevant 9

10 epistemic and stochastically uncertain parameters, as well as any relevant trajectory information. Each module s output field contains the calculated pivotal event probability provided by the module, as well as any other relevant lower-level probabilities, such as subsystem or component level failure probabilities Abort Initiating Failure Detected (PEM 1) This module models the event that the abort-initiating failure of the launch vehicle is not detected by the vehicle s Integrated Vehicle Health Management (IVHM) system. The probability of this event is calculated using a constant mean failure probability with a lognormal epistemic uncertainty distribution. The failure probability data comes from the SAIC CV Module and is based on Apollo CES data (Reference 2) Abort Method (SWITCH 1) DARE employs a switch event on the System Failure Logic Model to determine the Orion abort propulsion method. The switch simply compares the time of vehicle failure against the user-defined time of Launch Abort System (LAS) jettison. The LAS is the primary abort propulsion method, and after it is jettisoned abort is provided with Orion engine propulsion. The switch returns a one or zero to apply the correct failure logic Successful LAS Abort Separation (PEM 2) The pivotal event model for Successful LAS Abort Separation addresses the capability of the primary launch abort system to remove the Orion from the failing launch vehicle. The primary obstacle to surviving separation is overcoming any overpressure stresses that may be present due to an exploding launch vehicle. Other stresses, such as debris and dynamic pressure, are present but are typically not as dangerous as overpressure. Thus the module for PEM 2 has four components: Nominal Abort Failure, Failure to Survive Explosive Overpressure, Failure to Survive Accident Debris, and Failure to Survive Dynamic Pressure. The separation failure event is modeled as the occurrence of any of the four. Nominal abort failure This is the event that the abort fails due to failure of the separation mechanisms. It is not a function of any trajectory parameter and is independent of the specific abort-initiating failure. It is calculated using constant mean failure probabilities with lognormal epistemic uncertainty distributions for each of five different launch escape configurations 10

11 and one separation mechanism. The specific launch escape configuration is chosen based on three user defined inputs: Launch Escape Propulsion Type (Pusher, Tractor) Location (External, Internal) Propellant Type (Solid, Liquid) The failure probability data comes from the SAIC CV Module which models the system functions necessary for crew escape, such as pyrotechnic separation bolts and escape motor ignition. The data is based on Apollo CES data, RL-10 data, and Shuttle PRA Version 1 data (Reference 2). Failure to survive explosive overpressure This is the event that the abort fails due to an accident-induced explosive overpressure exceeding the Orion overpressure tolerance limits. Modeling this condition relies on three main components: a Separation Distance component that determines how far away the Orion is from the Ares I when the explosive overpressure is experienced; an Accident Environment Characterization component that determines the stresses that are present in the vicinity of the launch vehicle as a result of the failure, and a Survivability component that matches the Orion survivability limits to the accident-induced stresses at the separation distance, to determine whether or not the Orion survives those stresses. Separation Distance Separation distance is a measure of abort performance that determines the location of the Orion relative to the launch vehicle at the time that accident consequences are produced. It is a function of abort lead time, Orion acceleration, Orion abort motor burn time, launch vehicle acceleration, launch vehicle pitch angle, and the initial separation distance provided by vehicle geometry. Abort lead time is defined as the time between abort initiation and accident consequences, and is largely a characteristic of the IVHM s ability to detect early indications of the given failure mode. Orion acceleration is a user input parameter, as is burn-time. Launch vehicle acceleration and pitch angle at a specific time are determined by the trajectory database for the specific vehicle type. The abort lead time is specific to the failure mode being analyzed. Separation distance is calculated based on two distinct phases of Orion flight: powered escape and ballistic trajectory. Powered escape is simply the region of abort during which the launch abort system motor is operating (i.e. LAS burn time). The tool models this as a straight line of flight at constant acceleration, at the Ares I angle of flight. Ballistic trajectory occurs after the LAS burn time has elapsed. It is modeled as a parabolic trajectory with an initial velocity and angle of flight, and is only under the influence of gravity. Figure 3 represents the two phases of Orion escape flight. 11

12 θ Powered Escape Ballistic Trajectory θ Figure 3: Orion Separation Escape Trajectory Included in the separation distance calculation is an allowance for the potential continuing forward acceleration of the launch vehicle. In DARE each vehicle failure mode is identified as either one which facilitates vehicle shutdown prior to abort, or one which leaves the launch vehicle providing continued thrust after abort. The following assumptions were used in the classification of continued thrust: The first stage cannot terminate thrust Catastrophic upper stage failures do not provide ample time for vehicle shutdown prior to abort If the vehicle is determined to have continued thrust after failure detection, then the Ares I is assumed to continue at the same acceleration and pitch angle experienced at separation. If the vehicle does not provide continued thrust the Ares I is assumed to continue at the same initial velocity and pitch angle experienced at separation. The distance between both vehicles is calculated using Cartesian coordinates with the origin at the point of Orion separation. Figure 4 displays Orion separation distance from the launch vehicle with respect to time into abort for one particular run of DARE. Note that for this example case, separation distance initially increases as the escape motor is burning (3 seconds), then it decreases as the Orion slows under the force of gravity while the Ares I continues forward, and eventually begins to increase again as the Orion s altitude drops below that of the Ares I. This phenomenon varies with flight angle. 12

13 1400 Separation Distance (ft) Figure 4: Example Separation Distance Time into Abort (s) There is some inherent initial separation distance to be considered for each failure mode. For example, an RSRM rupture is initially at least ~70-80 ft away from the Orion, based on the height of the upper-stage segment. In DARE, this initial separation distance is calculated on a failure-mode specific basis, and factored into the separation distance calculations which govern abort success. Accident Environment Characterization In order to contextualize the separation distance of the Orion, the accident environment surrounding the failed vehicle must be characterized. Since DARE is concerned with abort effectiveness conditional on a given failure mode and time, it is first necessary to recognize that the abort-initiating failure may only be the first in a cascade of failures, and that this cascade may happen in a number of different ways. For example, an RSRM joint failure may result in RSRM rupture or it may only produce a joint leak. To capture these possibilities within DARE, each abort-initiating failure mode has a separation event tree of uniform structure that allows a number of subsequent events to be modeled probabilistically. In all, three subsequent events leading to four possible end states are available for each initiator. An example separation event tree is shown in Figure 5. 13

14 Event Descr: RSRM Explosion Event Name: Event Prob: 0%-20% 1 Initiating Event Y Y RSRM Explosion Causes Upper-Stage Explosion 25%-75% RSRM Does Not Explode But Causes Upper Stage Explosion 0 RSRM and US Explode N Only RSRM Explodes N Y Only US Explodes Figure 5: Example Failure Propagation Event Tree N Nominal Abort Each end state in a failure propagation event tree consists of a probability of occurrence (conditional on the initiating failure mode), a detection lead time, and an accident environment. As can be seen in figure 5, the accident environment is a function of the particular failures that occur along the path from the initiator, and can emanate from multiple sources. The overpressure shock wave is due to propellant explosion or large-scale thrust chamber pressure release, and produces an expanding shell of compressed air in all directions. The overpressure wave is strongest at its point of origin and weakens as it expands outward, so that when the wave reaches the separated capsule, the capsule encounters the overpressure seen at that distance. Calculation of overpressure is accomplished via a TNT equivalent model, i.e. the energy of the blast is translated into an equivalent quantity of TNT, which allows the use of well-developed TNT overpressure equations. DARE is concerned with two types of explosion: solid motor case and liquid fuel. For solid motor rupture, an Alliant Techsystems Inc. (ATK) briefing (Reference 3) gave the equation, assuming adiabatic, isentropic expansion, as: M PV o o = 1 1 γ P P o γ 1 γ E 7 Where: M = lbm TNT equivalent P o = motor pressure V o = motor free volume P = ambient pressure γ = specific heat ratio = 1.14 To determine the TNT equivalent load from liquid propellant, the DOD Explosives Safety Board recommends 14% of the total propellant load (for LH2/LOX) (Reference 4). Both TNT equivalent equations take time into flight as a parameter, since liquid propellant masses and RSRM chamber volume 14

15 change with time as do atmospheric conditions. These values are determined at the time of failure. Once the TNT equivalent weight has been calculated, the relationship between separation distance and overpressure is determined. The basic equation from Lee s Loss Prevention in Process Industries (Reference 5) is as follows: [ ln( P) ( ln( P) ) ] X = M exp + Where: X = distance in ft. M = lbm TNT equivalent P = overpressure, psi To take into account the effects of altitude, the above equation was solved for P and augmented with an additional factor g(altitude) derived by regression analysis on the ATK results: exp g = 2E 5 A The final equation relating TNT equivalent, altitude, separation distance and overpressure is: X = M 1 3 P exp ln exp R P ln exp E 5 A 2E 5 A 2 Where: R = reflected wave distance reduction factor The prior equation from Lee s includes the overpressure contribution from the reflected wave, and is appropriate for ground level explosions. For airborne explosions Lee s recommends that the distance be reduced by a factor of The diminution of the reflected wave contribution as a function of altitude is fairly complex, since the reflected wave travels faster through the heated air than the initial wave, and can catch up to it, producing a Mach stem combined wave. DARE linearly increases R from a factor of 1 at ground level to 1.26 at 1000 ft. After 1000ft, the vehicle is considered to be outside of the influence of reflected blast waves, so R = 1.26 throughout. 15

16 Survivability To determine if a vehicle will survive an accident environment the Orion overpressure design limit must exceed the overpressure created at the separation distance for that accident environment. For each iteration of a tool run, the distance associated the Orion overpressure design limit is compared to the Orion separation distance, for each of the end states in the failure propagation event tree. If this distance is less than the separation distance, an end-state factor of zero is applied to the branch probability of that end state, to denote that that Orion failure has not occurred. Otherwise, the branch probability of the end state is included in the overall end-state risk. All of the end state risks are totaled to determine the overall risk of surviving accident overpressure stress. Failure to Survive Accident Debris This component of the vehicle separation module analyzes the potential for debris generated by the accident environment to come in contact with the Orion during abort. The debris model is based on the debris model used in Shuttle DARE, which calculates the probability of a catastrophic debris strike from an exploding Shuttle External Tank (ET) on the aborting Shuttle. This Shuttle model was simply scaled to be applicable to the Ares I. The scaling makes the assumption that the Shuttle debris hit probability at a given distance is based on an omnidirectional fragment field and an average Shuttle cross section of half the black tile area, and calculates a nominal fragment density that would give rise to the given hit probability. The nominal fragment density is then scaled by the ratio of Ares I upper stage MPS mass to the mass of the ET to get an adjusted fragment density and an Orion hit probability given the adjusted fragment density and Orion cross section is calculated. Figure 6 shows the change in probability of debris hit provided by the scaling. 16

17 Debris Model Comparison 100% 90% Probability of Debris Impact Failure 80% 70% 60% 50% 40% 30% 20% Shuttle CEV 10% 0% Figure 6: DARE Debris Model Comparison Failure to Survive Dynamic Pressure Separation Distance (ft) This component of the vehicle separation module examines the increased dynamic pressure loading that is encountered by the Orion due to abort. Dynamic pressure is a function of velocity and air density. Thus, there is always an increase in dynamic pressure associated with the increased velocity of abort, and this increase varies with the time into ascent of the abort initiation. DARE calculates the final dynamic pressure at the end of the abort burn, based on initial velocity of the Ares I, abort burn-time, and Orion acceleration. This value is compared to a user defined dynamic pressure limit, and if it exceeds the survivability limit, the probability of failure to survive dynamic pressure equals one Orion Engine Abort Separation (PEM 3) The pivotal event model for Successful Orion ME Abort Separation addresses the capability of the Orion orbital engine to remove the capsule from the failing launch vehicle. The model is patterned after the one contained in PEM 2, and is identical to it in many ways. It has four components, Nominal Abort Failure, Failure to Survive Explosive Overpressure, Failure to Survive Accident Debris, and Failure to Accelerate Beyond Launch Vehicle (LV), and the failure event is modeled as the occurrence of any of the four. 17

18 Nominal abort failure This is the event that the abort fails due to failure of the separation mechanisms. It is identical in structure to the equal component in PEM 2, with sub components for booster separation and launch abort propulsion. Booster separation is again modeled with pyrotechnic bolts. It is identical to, but not epistemically correlated with, the probability distribution used in PEM 2. Correlation is not necessary as for each run of DARE, only PEM 2 or PEM 3 is utilized, and never both. The probability of nominal failure of the launch abort propulsion is identical and epistemically correlated to the probability of failure of one burn of the Orion engine, as used in PEMs 5 and 6. The modeling is explained further in section Failure to survive explosive overpressure This is the event that the abort fails due to explosive overpressures exceeding the Orion strength limits. It is modeled identical to the equal component in PEM 2. Failure to survive accident debris This component of the vehicle separation module analyzes the potential for debris generated by the accident environment to come in contact with the Orion during abort. It is modeled identical to the equal component in PEM 2. Failure to accelerate beyond launch vehicle This component of the vehicle separation module analyzes the potential for the Orion to not provide adequate acceleration to escape from the launch vehicle, and suffers a failure from re-contact. This is a unique consideration given to Orion engine aborts, because the engine s thrust limit is commonly low enough to create an insufficient acceleration to out-run a launch vehicle which is still accelerating. Like with PEM 2, each vehicle failure mode is identified as either one which facilitates vehicle shutdown prior to abort, or one which leaves the launch vehicle providing continued thrust after abort. However, for this special case if the vehicle is determined to have continued thrust after failure detection, then the Orion acceleration is compared against the vehicle s acceleration, as provided by trajectory information. If the vehicle s acceleration exceeds the aborting capsule, the probability of failure to accelerate beyond the launch vehicle is set to one. If the Orion s acceleration exceeds the launch vehicle, or if the launch vehicle does not provide continued thrust, the probability of failure is set to zero. 18

19 3.3.5 Vehicle Stabilization (PEM 4) This event models the condition that the Orion will not be able to achieve stable flight after separation. The probability of stabilization failure is calculated as a failure to achieve proper entry orientation or a failure to control vehicle pitch. Failure to achieve proper entry orientation is determined using constant mean failure probabilities with lognormal epistemic uncertainty distributions for one of five different user-defined entry orientation mechanism configurations: Canards RCS Control Surfaces Canards with RCS-backup None Failure to control vehicle pitch is determined in the same way using three user-defined pitch control options: Motor RCS Motor with RCS backup The failure probability data comes from the SAIC CV Module and is based on Shuttle PRA Version 1, Reliability Analysis Center (RAC), and SAIC data (Reference 2) Abort to Orbit (SWITCH 2) DARE employs a switch event on the System Failure Logic Model to allow for Orion abort to orbit (ATO). The switch simply compares the altitude of vehicle failure against a trajectory calculation which determines if the Orion s on-board propellant will provide sufficient V to achieve an abort to orbit. Both the V available and the ATO altitude are input by the user. The V calculation behind this switch is actually a three step process. The first step uses the altitude, ascent angle, and inertial velocity of the Orion at the point of Ares I failure, and determines the increase in inertial velocity that is needed to raise the apogee of the trajectory to the ATO altitude. This increase is V 1. The analysis assumes that the velocity increase is impulsive, i.e. it is due to a high thrust acting over a short time. This approximation is reasonable in cases where the ascent angle is near zero, such that the Orion engine is not substantially fighting gravity. This condition is met for the default Ares I ISS trajectory included in the tool, and it is expected to hold for Ares I trajectories in general. DARE indicates on the input sheet whether or not the force of gravity in opposition to the direction of thrust exceeds 1% of the thrust. If so, the analyst may want to consider overriding the ATO switch based on off line analysis. 19

20 The second calculation step finds the V needed for circularization of the Orion s orbit once it reaches it apogee from the initial burn, assuming a standard Hohmann maneuver. This velocity is V 2. The component of gravitational force in the direction of thrust is zero by definition for Hohmann maneuvers. A third velocity, V 3, is needed for the deorbit burn. This velocity is also calculated using a standard Hohmann maneuver, given a target perigee stored in DARE as static data (the default value is 60 mi, consistent with Shuttle deorbit trajectories). The perigee is stored as static data and can be modified if desired. The sum of V 1, V 2, and V 3 is the total V needed for a complete ATO. Comparing this against the available V to determine if ATO is possible, the ATO switch returns a one or zero to apply the correct failure logic Abort to Orbit (PEM 5) This event models the situation where the Orion cannot perform the abort-to-orbit burn. ATO burn failure constitutes an engine failure within the Orion. Probability of engine failure is calculated using constant mean failure probabilities with lognormal epistemic uncertainty distributions for six different engine configurations based on the following user inputs: Number of Engines (1-2) Number of Supplies (1-2) Supply Interconnection with RCS (Y/N) The resultant failure probability is a per-burn failure probability which is ultimately scaled by the Number of Buns for ATO, a user-defined input. The failure probability data comes from the SAIC CV Module and is based on adaptations of Shuttle PRA Version 1 OMS/RCS data (Reference 2). Although ATO burn failure is not a major driver of overall risk, the assumption that abort failure directly results from ATO failure is very conservative. In reality, ATO failure may simply prevent an abort to orbit and drive the Orion to an abort to Earth instead, depending on the particular engine failure mode Orion De-Orbit Burn and Re-Entry (PEM 6) This event models the situation where the Orion cannot perform the de-orbit burn or reenter into the atmosphere successfully. De-orbit burn failure constitutes an Orion engine failure, and is modeled identical to, and is epistemically correlated with, the OMS failure rates in PEM 5. Probability of re-entry failure is based on Thermal Protection System (TPS) failure. TPS failure probability is calculated using constant mean failure probabilities with lognormal epistemic uncertainty distributions for six different userdefined TPS options: 20

21 TPS Tiles Ablative TPS Blanket TPS Rapid Turnaround TPS Durable Acreage Ceramic TPS Durable Acreage Metallic TPS The TPS failure probabilities provided are per square foot, and multiplied by the base area of the Orion (also a user input). The failure probability data comes from the SAIC CV Module and is based on the Shuttle PRA Version 1 data (Reference 2). The potential significance of black zones to abort risk was studied as part of the construction of DARE. The most comprehensive examination of black zones for exploration architectures that was found in the literature was that of ESAS Part 5, Crew Exploration Vehicle (Reference 6). Section 5.4, Ascent Abort Analyses for the CEV, concluded that the load durations for the worst-case ballistic aborts are well within crew limits for escape and that maximum surface temperatures are within the single mission limits for TPS materials developed for the Shuttle and X-38 (although the report also states that higher fidelity aeroheating analyses are needed to confirm this data). Consequently, it appears that black zones are not considered to be an abort risk driver for Orion, and no black zone model will be incorporated into DARE at this time CM/SM Separation (PEM 7) For any abort utilizing the Orion engine for propulsion, the abort vehicle is made up of two separable components: the service module (SM) and the command module (CM). The SM contains the propulsive elements necessary for orbital flight, and the CM acts as a crew module, where astronauts will control the functions provided by the SM. These two modules are separated prior to capsule landing, as only the CM is equipped with heat shielding and a landing system. The separation does not contain a propulsive element, only a mechanism to physically separate the modules from each other. The event calculates the probability of failure of the separation mechanism. It is modeled identical to, and is epistemically correlated with, the separation failure rates in PEM 2 and Deployment of the Landing System (PEM 8) Successful deployment of the Orion Landing system models a failure of either the Orion stabilization system, or the Orion landing system. The stabilization system is calculated using constant mean failure probabilities with lognormal epistemic uncertainty distributions for seven different user-defined options: Drogue Chute Kite RCS 21

22 Control Surfaces Drogue Chute with RCS backup Kite with RCS backup None Failure of the landing system also employs similar mean probabilities and uncertainties, but with 22 total configuration options based on the following user inputs: Landing System (Parachutes, parafoil) Number of parachutes (1-4, if parachutes selected) Number of parachutes needed to function (1-4, if parachutes selected) Backup chute available (Y/N) Failure probability data comes from the SAIC CV Module and is based on Apollo data, Shuttle PRA Version 1 data, and other sources (Reference 2) Landing and Crew Recovery (PEM 9) Due to a current lack of modeling, pivotal event model 9 currently uses point-value estimates of 1/10,000 and 1/1,000 for failure of a touchdown (ground) and recovery and failure of a splashdown (water) and recovery, respectively. These are thought to be reasonable stand-in values until such time when geographically based models are developed. 3.4 Monte Carlo Shells Two separate Monte Carlo modules, Epistemic and Aleatory, have been created for uncertainty sampling. These two modules are structurally similar; however they are populated with different uncertain parameters to be sampled, which will produce distributions of the desired Figures of Merit (FOMs). Each Monte Carlo module has capability to sample the set of input parameters and write the sampled values an output area from which they will be used to calculate results. The modules are also capable of retrieving results from relevant system failure logic output fields, and updating a histogram with the results. For every desired FOM calculated, the modules output the following desired statistical parameters once the sampling is complete: Mean 5 th Percentile (Epistemic only) 50 th Percentile (Epistemic only) 95 th Percentile (Epistemic only) 22

23 It is possible to suppress the sampling of any uncertain parameter by substitution of a constant value instead. In order to do this, the user must simply select Constant Value instead of Random Value in the uncertain parameter s field, and then input the constant value for calculation. Figure 7 shows an example of how the uncertain parameters are represented in the uncertainty sheets: Parameter Parameter Source Constant Value Random Value Random Hard Copy Final Value PEM 1 IVHM Failure Random Value E E E-05 PEM 2 Bolts Constant Value 2.00E E E E-04 LES T,E,S Random Value E E E-04 LES P,E,S Random Value E E E-04 LES P,E,L Random Value E E E-03 LES P,I,S Random Value E E E-03 LES P,I,L Random Value E E E-03 Motor Random Value E E E-04 RCS Random Value E E E-03 Motor/RCS-backup Random Value E E E-09 Event Probability P1 Constant Value E E E-01 Event Probability P2 Constant Value E E E-01 Event Probability P3 Random Value E E+00 Figure 7: Portion of Epistemic Uncertainty Worksheet 0.00E+00 The only mechanical difference between the aleatory and epistemic Monte Carlo sheets is that the epistemic sheet has percentile values, and the aleatory sheet has only the mean. The averages over all iterations from the aleatory worksheet become the values for the current iteration on the epistemic worksheet. Therefore, the FOMs in the aleatory sheet must be the same FOMs as in the epistemic sheet. The Monte Carlo modules are configured such that uncertainty can be calculated for any parameter in the DARE workbook. The parameters currently calculated are discussed in the following subsections. Monte Carlo sampling of a given uncertain parameter is accomplished by first generating a uniformly uncertain number U between zero and one, and using this number in the inverse distribution function of the uncertain parameter to obtain a random value for that parameter. This ensures that the samples selected reflect the assigned distribution. Figure 8 illustrates the method. 23

24 1 F(A j ) U 0 A j Figure 8: Illustration of Monte Carlo sampling of uncertain parameter Aj Common cause can be modeled a number of ways in DARE. It can be modeled phenomenologically by explicitly including the causal factor (say, temperature) in the aleatory Monte Carlo, then using that parameter in the modeling of a number of events whose outcome depends on its value, thus producing a causal connection between the events. It can be also be modeled empirically by including, in a number of event models, a threshold-based common cause failure basic event, where every common cause failure is linked to the same random number generated in the aleatory Monte Carlo. Currently, DARE does not contain any of this type of common cause modeling, but the capability is there Epistemic Uncertainty Epistemic uncertainty is associated with most of PEMs in DARE. This is due largely to the use of data from the SAIC s CV module, which calculated off-line mean probability of failure values, with accompanying error factors. This includes all of the uncertainty calculation for PEMs 1 and 4-8, as well as the uncertainty associated with nominal abort failure in PEMs 2 and 3. In the epistemic Monte Carlo, these values are sampled from parent lognormal distributions, with means and standard deviations defined for each parameter, as static data. Also currently calculated in the epistemic worksheet are the event probabilities P1, P2, and P3 that populate the failure propagation event tree, where: P1 = The probability of subsequent event 1 conditional on the abort-initiating event P2 = The probability of subsequent event 2 conditional on subsequent event 1, and P3 = The probability of subsequent event 3 conditional on the non-occurrence of subsequent event 1 24

25 The data for each of these probabilities consists of upper and lower bounds, between which the epistemic Monte Carlo samples uniformly. The table containing these probability bounds can be seen in Appendix A. Finally, the epistemic uncertainty worksheet plays a part in determining the abort lead time values for each iteration of a run. Abort lead time is the most complex uncertain parameter, since it has both epistemic uncertainty and aleatory uncertainty. For each accident, the fundamental lead time data is the minimum and maximum realistic abort lead times. It is reasonable to associate aleatory uncertainty to abort lead time, since one would not expect a given failure mode to be detected at exactly the same time relative to accident consequences for every occurrence of that failure. It is also reasonable to associate epistemic uncertainty with abort lead time, since it is reasonable to believe that the lead times would tend to cluster somewhere within the broad ranges given by the data, although it is not known exactly where or how wide that cluster might be. Abort lead time is therefore modeled as a uniform aleatory distribution that falls somewhere within the range defined by the data. The specific mean and width of the aleatory distribution are uncertain and are therefore treated as the epistemic uncertainties in the model. To implement this, DARE s epistemic uncertainty sheet uniformly samples a mean value for the aleatory distribution from a range given by static data, and then uniformly samples a width parameter in the range from zero to the maximum width that can fit within the data range given the sampled mean. Figure 9 illustrates this process. 25

26 Determine Mean Parameter Mean Parameter Abort Lead Time Range Determine Width Parameter Mean Parameter Width Parameter Abort Lead Time Range Distribution Established Distribution Abort Lead Time Range Figure 9: Generation of epistemically uncertain abort lead time distribution The desired result of this calculation is to approximately model, with enough epistemic iterations of the tool, every possible uniform distribution that exists within the original abort lead time range. Epistemic correlation is accomplished by applying the same randomly generated, uniformly uncertain number to multiple epistemically uncertain parameter distributions. This ensures that the same random value is used as the input for the sampling of multiple uncertain parameters, and effectively correlates them on a percentile basis, i.e. for a given epistemic iteration, all parameters sharing a common random input will be at the same percentile of their parent densities. This is a generalization of the correlation class as defined in traditional tools such as SAPHIRE, which requires identical parent densities for correlated parameters. A current example of this practice in DARE is PEMs 5 and 6, in which the sampled probabilities of orbital engine failure are correlated, ensuring that 26

27 for a given epistemic iteration, the reliability of the engine as used for ATO is the same as the reliability of the engine as used for deorbit burn Aleatory Uncertainty Aleatory uncertainties are reflected in the failure probabilities of PEMs 1 and 4-8 and, as discussed in the previous section, abort lead time. Since the aleatory uncertainties of PEMs 1 and 4-8 do not change as a function of flight conditions (i.e. they are not dynamic), DARE incorporates the event probabilities as static data, leaving their derivation in off-line models (as mentioned above, further pivotal event modeling activities may bring dynamic modeling to these events, particularly for PEM 9). Therefore, the only parameters currently included in the aleatory Monte Carlo are abort lead time, which is sampled from the uniform distribution established in the epistemic Monte Carlo, and initial separation distance, which is sampled from a uniform distribution defined by the minimum and maximum initial separation distances for a given failure mode. As discussed in section 3.3.2, the abort lead time is a crucial parameter in the determination of separation failure, and the aleatory uncertainty in abort lead time and initial separation distance are currently the only uncertainties involved in determining the failure to survive explosive overpressure. Figure 10 illustrates how aleatory uncertainty in these metrics translates into the probability to survive explosive overpressure. Additional aleatory uncertainties, such as in the TNT equivalent, may be modeled in future revisions to DARE Critical Distance Separation Distance (ft) Distance (ft) (ft) Separation Distance Time into Abort (s) Time into Abort (s) Abort Lead Time Uncertainty Time of Abort (s) (s) Figure 10: Translation of abort lead time uncertainty into probability of surviving explosive overpressure. 3.5 FOM Selection The FOM selection sheet is where the user can select which FOMs for DARE to report. The sheet features a standard input field, which is populated with some of the most common FOMs and their values. The tool, however, is flexible such that the value of any 27