#  GSFC-410-MIDEX-003

####### 

####### 

####### 

####### MEDIUM EXPLORER (MIDEX) PROGRAM

######## MIDEX Safety, Reliability & Quality Assurance Requirements

######## Revision A

######## June 25, 2002

Approved by: Prepared by:

Original signed by Original signed by

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Anthony Comberiate Richard Claffy

Explorer Program Manager Mission Assurance Manager

NASA Goddard Space Flight Center

Greenbelt, Maryland

# 

# 

######## Table of Contents

Page

Overview 3

Part 1: GSFC-410-MIDEX-002

\- MIDEX Assurance Requirements 6

Part 2: GSFC-410-MIDEX-001

\- MIDEX Assurance Guidelines 23

# MIDEX Safety, Reliability & Quality Assurance Requirements

## Overview

Reliability considerations for the MIDEX Program are bounded by
programmatic demands for scientific excellence, low cost, and rapid
development. As a result, systems are expected to be predominantly
non-redundant or \"single string.\" However, redundancy is encouraged
where appropriate and where resources allow.

The safety, reliability and quality assurance requirements for the MIDEX
Program will be structured to accept the increased risk that is inherent
in a predominately non-redundant system. Good quality parts and
materials, a limited reliability and quality program, and significant
reliance on the test program will be key factors in balancing
reliability goals against program cost and complexity constraints.

The Proposer has responsibility and control over development of the
instrument(s), the spacecraft, and, generally, the selection of the
launch vehicle. Only limited support is planned by NASA, with emphasis
on those activities that contribute most to product reliability and
integrity. Deliverable documentation is reduced, provided the Proposer
maintains adequate internal records that demonstrate traceability when
needed.

The safety, reliability and quality assurance requirements for the MIDEX
Program recognize a wide variation in complexity, size, and technology
of proposed instruments and spacecraft; these all can affect program
risk and costs. The requirements recognize that there are significant
differences in the availability to investigators of facilities, skills,
and supporting capabilities. The safety, reliability and quality
assurance program ensures that hardware and software are designed,
manufactured, and tested to flight standards, and that drawing and
specification requirements are met. Guidelines and requirements for
conducting an appropriate safety, reliability and quality assurance
program are contained in this document. Part 1 contains MIDEX Assurance
Requirements (MAR). It is expected that these requirements will be
incorporated into the Proposer's contract documents. Part 2 contains
MIDEX Assurance Guidelines (MAG). These guidelines are provided for the
purpose of describing the things that experience has shown result in a
reliable product. They are highly recommended but are not required.

The Proposer should refer to the MAR and MAG in developing his safety,
reliability and quality assurance approach and realistically addressing
the costs associated with these tasks. During the definition phase of
the mission the specific implementation details of the

Proposer's safety, reliability and quality assurance program will be
negotiated. The quality program shall be modeled after ANSI/ASQC
Q9001-1994, \"Quality Systems - Model for Quality Assurance in Design,
Development, Production, Installation, and Servicing\".

As part of the proposal submitted in response to an AO, a brief
two-three page description of the proposed approach to safety,
reliability and quality assurance is required. The description should
reflect the Proposer's understanding of, and approach to, implementing
the safety, reliability and quality assurance requirements/guidelines
contained in the MAR/MAG. The description should also provide the basis
for the safety, reliability and quality assurance costs contained in the
proposal. The Proposer is encouraged to make maximum use of existing
practices and procedures in developing and implementing the safety,
reliability and quality assurance program. For requirements that are not
fully applicable, because of a particular aspect of the instrument or
mission, the Proposer should provide appropriate rationale. The Proposer
may also offer an alternate method of meeting the intent of a
requirement when such a method is better aligned with the manner in
which the total work is to be accomplished. The Proposer must describe
the plans for maintaining adequate internal documentation for all
safety, reliability and quality assurance activities and for providing
NASA with essential deliverable documentation.

######### Part 1

####### MIDEX Assurance Requirements

GSFC-410-MIDEX-002

MEDIUM EXPLORER (MIDEX) PROGRAM

MIDEX ASSURANCE REQUIREMENTS

Rev E

June 25, 2002

**Approved by: Prepared by:**

**\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_**

**Anthony Comberiate Richard Claffy**

**Explorer Program Manager Mission Assurance Manager**

**The purpose of this document is to concisely present the safety and
assurance requirements that are necessary for the MIDEX Project. These
requirements are intended to be incorporated into MIDEX developer
contract documents.**

NASA Goddard Space Flight Center

Greenbelt, Maryland

1.0 Overview

The developer shall plan and implement an organized safety, reliability
and quality assurance (SR&QA) program for flight hardware, software and
ground support equipment. The developer shall support and participate
with the Explorer Project at GSFC in validating and periodically
reviewing the SR&QA program. This document presents a concise statement
of MIDEX minimum requirements. Additional information can be found in
GSFC-410-MIDEX-001, "MIDEX Assurance Guidelines" which is contained in
Part 2 of this document.

In accordance with NASA Headquarters policies for Medium-class
Explorers, a payload classification per NMI 8010.1A is not being issued
for MIDEX. This will permit tailoring of the SR&QA requirements in
accordance with the ISO 9001 series standards, supplemented by mission
assurance guidelines and requirements appropriate for the level of risk
for a program of this scale. The mission assurance program should
augment the project team's overall risk management process. A Continuous
Risk Management (CRM) methodology must be used that identifies existing
or emergent technical and programmatic risks, statuses them, evaluates
mitigation efforts, and retires them or carries residual risks forward.
NASA has instituted the Lessons Learned Information System (LLIS)
database for use by all missions. The Program Office will assist PI
teams to access, scan, and evaluate existing lessons learned entries for
useful guidance during mission development. The PI team will be expected
to provide NASA sufficient information to describe new lessons learned
for entry into the database.

Under this AO, PI teams are free to propose Missions of Opportunity,
investigations that involve missions not funded or managed by OSS. GSFC
recognizes that in this circumstance, the actual scope of work performed
under these requirements by the PI institution may differ significantly
from that of complete and independent PI missions. Therefore, the
requirements in this document apply, but only within the work scope that
is under direct control of the PI institution. Limited applicability is
based on the necessity that host missions maintain their own traditional
systems for managing Science, Engineering, Safety, Reliability, &
Quality Assurance requirements. Furthermore it is reinforced by the fact
that the PI institution will be required by the host to abide by those
requirements and to physically and functionally match all provided
interfaces. No limited applicability is permitted for system safety,
range safety, or personnel safety requirements.

2.0 QUALITY ASSURANCE

2.1 Quality System

During Phase B the developer shall define and implement a quality system
based on ANSI/ASQC Q9001-1994 that properly encompasses MIDEX flight
hardware, software, and Ground Support Equipment. The quality manual, as
required by this standard, shall be provided for GSFC review during
Phase B. An agreement between the Principal Investigator and the
Explorer Program Office on the quality assurance, reviews, safety,
design assurance and verification system to be implemented will be
required prior to the confirmation of the mission.

2.2 Workmanship

The following commercial, or NASA, workmanship standards shall be used
for MIDEX:

• NASA-STD-8739.3: Requirements for Soldered Electrical Connections

• NASA-STD-8739.4: Crimping, Interconnecting Cables, Harness, and Wiring

• NHB 5300.4 (3H): Requirements for Crimping and Wire Wrap

• NHB 5300.4 (3I): Requirements for Printed Wiring Boards

• NHB 5300.4 (3J): Requirements for Conformal Coating and Staking of
Printed Wiring Boards and Electronic Assemblies

• NHB 5300.4 (3K): Design Requirements for Rigid Printed Wiring Boards
and Assemblies

• NHB 5300.4 (3L): Requirements for Electrostatic Discharge Control
(Excluding electrically initiated explosive devices)

The developer shall provide printed wiring board coupons to GSFC, or to
a GSFC approved laboratory for evaluation. Approval shall be obtained
prior to population of printed wiring boards.

2.3 Mission assurance Audits and Reporting

Assurance Status Reports will be part of the regular, monthly reporting
by the Principal Investigator to the Explorer Program Office and will
summarize the status of all assurance activities and report on any
discrepancies (including corrective actions) that could affect the
performance of the investigation.

During all phases of the mission, NASA must be able to assess the
reliability of the mission and understand how the Principal Investigator
is resolving problems. In order to do this, the Principal Investigator
is required to document and report hardware and software failures to the
Explorer Program Office beginning with initial power-up of any flight
component or assembly (including critical GSE). Reporting is to continue
until successful closure by the Principal Investigator\'s Failure Review
Board (FRB).

In order to ensure that the quality system is working the way it is
intended, the Principal Investigator is required to plan and conduct
audits of his/her internal mission assurance systems and those of
his/her subcontractors and suppliers, examining documentation
(processes, procedures, analyses, reports, etc.), operations and
products. The Principal Investigator is required to generate and
maintain a report for each audit. A summary of all audit findings should
be included in the monthly report.

3.0 REVIEWS

The Principal Investigator is encouraged to focus resources from the
beginning and throughout the mission development phase on engineering
working-level reviews (peer reviews) to identify and resolve concerns
prior to formal, system level reviews. The Principal Investigator\'s
quality system is to track and close-out all actions items identified
during these peer reviews to ensure that issues are resolved promptly at
the lowest levels and before system level reviews. A list of action
items/closures for each peer review shall be maintained by the Principal
Investigator\'s quality system and made available during system level
reviews. Any open action items from any peer reviews should be addressed
at the system level reviews.

Peer Review is defined as a detailed independent engineering design
review focused at the Subsystem and box level, conducted informally with
recognized internal or external experts having current detailed
knowledge of the design specialties associated with the item under
review. Primary design documentation, such as drawings, schematics,
wiring diagrams, and analyses are the review vehicles. Its purpose is to
substantiate a detailed understanding of the design's ability to meet
all of its performance and interface requirements, to surface
correctable problems early, and to ensure best known practices are used
that enhance robustness by avoiding known or predictable problems.
Timely, accurate insight, through action item documentation and
follow-up activities, is vital to the process. For each review a written
record must be kept of time, place, and attendees.

Upon request, the Explorer Program Office will supply technical
expertise as required for participation in the areas undergoing peer
reviews.

Unlike the many informal engineering peer reviews that are required
during the project life cycles, there are two semiformal reviews
focusing on requirements and the mission concept. In addition, six
formal system level reviews are required to concentrate on 1) critical
systems; and 2) end-to-end mission level technical, safety, reliability,
flight operations, ground operations, and programmatic issues. If
warranted, additional formal reviews may be required for unusually
complex areas such as safety and/or flight and ground operations. The
following represent the semiformal and formal reviews expected under
this program:

• Requirements Review (Semiformal)

• Concept Review (Semiformal)

• Preliminary Design Review (Formal)

• Critical Design Review (Formal)

• Pre-Environmental Review (Formal)

• Pre-Ship Review (Formal)

-   Operations Readiness Review (Formal)

    • Flight Readiness Review (Formal)

    Semiformal and formal reviews are to be conducted by an Independent
    Integrated Review Team (IIRT) panel populated by the GSFC Systems
    Management Office, NASA approved PI nominees, and independent
    experts agreed upon by the Explorer Program Office and the Systems
    Management Office. The Explorer Program Office must be invited to
    attend all reviews. Copies of the presentation materials must be
    provided to the Explorer Program Office for information. Formal IIRT
    reviews are to be chaired by GSFC's Systems Management Office. It is
    the Principal Investigator\'s responsibility to address all concerns
    and action items identified during these reviews.

    Included in the above list of formal and semiformal reviews is the
    Operations Readiness Review (ORR). This review shall be held with
    GSFC to assess readiness, and to document the final details of the
    approach agreed to be used for flight operations. The result of this
    review shall be reported at the Mission Readiness Review. The
    mission operations agreement reached at the ORR cannot be changed
    without NASA concurrence.

    Independent NASA IIRT reviews now include the previously separate
    Red Team review activity. A Confirmation Review as described in the
    AO, will also be conducted. (Independent balloon mission reviews
    will be conducted as described in the Balloon SR & QA appendix. A
    more streamlined design review process is envisioned for balloon
    missions that are confirmed at significantly lower budget levels
    and/or which allow multiple flight opportunities. The Explorer
    Program Office, PI, and Systems Management Office will agree upon
    Details of such reviews.) These reviews will be coordinated with the
    Principal Investigator so that they can coincide with other reviews
    when possible. It is the Principal Investigator\'s responsibility to
    address all concerns and action items identified during these
    reviews.

    Red Team reviews, now included within the IIRT construct, have been
    commissioned for all NASA/GSFC missions in response to NASA/HQ
    direction to assess across all flight programs the health and
    thoroughness of institutional internal design review processes. The
    Red Team is a standing body of technical experts who operate under
    Center Director authority in accordance with NASA/HQ direction. They
    utilize standardized criteria to independently and objectively rate
    overall mission risk level and officially report it to the Center
    Director via Program Management Council. Results of these reviews
    are considered a necessary basis for proceeding to launch
    operations.

    4.0 SAFETY

    4.1 General

    The PI is required to plan and implement a system safety program
    that identifies and controls hazards to personnel, facilities,
    support equipment, and the flight system during all stages of the
    mission development, launch, and operations. The program is to
    address hazards in the flight hardware, associated software, ground
    support equipment, and support facilities.

    The NASA requirements translate into a series of specific scheduled
    deliverables, whose nomenclature, relative timing and process flows
    will differ depending on the selected launch method: Expendable
    Launch Vehicle (ELV); or the National Space Transportation System
    (NSTS); or Long Duration Balloons (LDB). Paragraph 4.2 below cites
    the controlling requirements documentation for ELVs. Paragraph 4.3
    cites the requirements that must be met for NSTS launched payloads.
    These documents are extremely detailed and NASA expects them to be
    implemented by the PI team to correctly fit each selected mission.
    To assist PI groups with their system safety cost planning efforts,
    process descriptions and typical processing flow diagrams,
    "Expendable Launch Vehicle (ELV) System Safety Milestones and
    Process Flow" and "National Space Transportation System (NSTS)
    System Safety Milestones and Process Flow" are available in the
    Explorer Program Library. Paragraph 4.4 cites the requirements that
    must be met for National Scientific Balloon Facility (NSBF) launched
    balloon payloads.

    4.2 ELV Payload Requirements

    The PI team's system safety program must meet the system safety
    requirements stated in the applicable launch range safety
    regulation. The top level governing documents are: 1) EWR 127-1,
    "Eastern and Western Range Safety Requirements"; or 2) RSM-93,
    "Range Safety Manual for Goddard Space Flight Center/Wallops Flight
    Facility".

    4.3 NSTS Payload Requirements

    The PI team's system safety program must meet all Space Shuttle
    safety requirements imposed by the Johnson Space Center for NSTS
    payloads. The controlling safety documents are (NHB) 1700.7, "Safety
    Policy and Requirements for Payloads Using the Space Transportation
    System"; and (KHB) 1700.7, "STS Payload Ground Safety Handbook". The
    Space Shuttle Program typically requires 3 safety reviews. Proposers
    are advised that Space Shuttle safety requirements are particularly
    strict and may lead to unexpected design changes, additional test or
    analysis requirements, and associated cost increases. Therefore,
    higher contingency levels are recommended for Shuttle based missions

    4.4 NSBF Requirements

    The PI team's system safety program must meet the system safety
    requirements stated in documents "NASA Balloon Program National
    Scientific Balloon Facility Payload Safety Process" and "NASA
    Balloon Program National Scientific Balloon Facility Ground Safety
    Plan".

    4.5 Ground Operations Procedure Approval

    The PI is additionally required to submit, in accordance with an
    agreed to schedule, all ground operations procedures to be used at
    GSFC facilities, other NASA integration facilities, or the launch
    site, for review and approval by NASA. All hazardous operations, as
    well as the procedures to control them, are to be identified and
    highlighted. All launch site procedures are to comply with the
    applicable launch site safety regulations.

    4.6 Documentation Availability

    All of the ELV and NSTS safety documents cited in this AO can be
    obtained from the following websites:

    http://www.patrick.af.mil/45sw/rangesafety/library.htm

    This is a direct link to the EWR 127-1 document.

    http://jsc-web-pub.jsc.nasa.gov/psrp/

    This is a direct link to the NSTS safety documents.

    http://arioch.gsfc.nasa.gov/302/safety/

    This site provides links to the requirements for the Wallops Flight
    Facility and the Pegasus Launch Vehicle.

    5.0 DESIGN ASSURANCE

    5.1 Parts

    The developer shall implement an appropriate parts program. The
    program will be in place in time to effectively support the
    iterative design and selection processes.

    All parts shall be selected and processed in accordance with GSFC
    311-INST-001, "Instructions for EEE Parts Selection, Screening, and
    Qualification" for Grade 3 quality level. The developer shall
    control the selection, application, evaluation, and acceptance of
    all parts through a parts control board, or another documented
    system of parts control.

    The developer shall maintain a EEE Parts Identification List and
    shall review proposed parts with GSFC.

    5.2 Materials

    The developer shall implement a Materials and Processes program
    beginning at Phase B. Proposed materials and processes shall be
    reviewed with the Explorer Project Materials Consultant. The
    developer shall maintain lists of these items (inorganics and
    metallics, polymerics, lubricants, and processes) and appropriate
    usage records.

    5.3 Reliability

    Early in the program's preliminary design phase, the Principal
    Investigator is required to identify specific reliability concerns
    and the steps being taken to mitigate them. As a minimum, the
    Principal Investigator is to conduct Failure Modes and Effects
    Analysis (FMEA) to a sufficient level of detail that mission
    critical failures are identified and dealt with effectively. Red
    Team reviewers will expect a demonstrated understanding of failure
    modes and effects down to the subsystem level of detail. Strong
    emphasis should be placed on critical single string design features.
    Appropriate use of the analytical tools and techniques collectively
    known as Probabilistic Risk Assessment (PRA) will significantly
    influence NASA's final judgement on the mission's overall
    reliability. These tools can include combinations of FMEA, Fault
    Tree Analysis (FTA), Event Tree Analysis (ETA), Event Sequence
    Diagrams (ESD), Master Logic Diagrams (MLD), or Reliability Block
    Diagrams (RBD). PRA is a systematic, logical, comprehensive
    discipline that periodically blends use of these tools to quantify
    risk and maintain a current state of knowledge about risk of
    failure. Each individual tool provides a graphic representation of a
    complex thought process, which relates causes to outcomes, either
    from a deductive or inductive logic reference frame. Used together,
    the selected tools promote situational awareness regarding
    probabilities of unwanted consequences and the magnitudes of their
    possible impacts.

    It is strongly recommended that the Principal Investigator
    accumulate several hundred hours of error-free operation of the
    integrated spacecraft and instrument(s) prior to the start of
    environmental testing.

    5.4 Contamination

    The Principal Investigator is required to plan and implement a
    contamination control program consistent with the requirements of
    the mission. The plan should address all aspects of contamination
    control throughout the mission, including transportation and launch
    site processing. The contamination control plan should be made
    available to the Explorer Program Office if requested.

    5.5 Software

    The developer shall employ a structured program for the development
    of software. The program shall address appropriate development life
    cycle phases such as: requirements analysis, design, code and unit
    test, integration and build test, performance verification, and
    maintenance. Code produced shall be structured, error-free, and
    maintainable.

    During the preliminary design process, the developer shall establish
    and document software requirements and any appropriate external
    interface specifications and user guides.

    The developer shall participate in a program of internal and
    external software reviews to validate software requirements, design,
    operating characteristics, and external interface requirements. A
    structured software quality assurance effort is required, that
    ensures that requirements are met for software, as rigorously as
    they are for flight hardware. This required effort for software
    could be implemented together with or separate from the hardware
    quality assurance effort. For software QA implementation the PI
    institution may choose to use in-house software expertise from
    individuals not involved in the project, or the Explorer Program
    Office can arrange for specialized software QA support.

    Software related anomalies on several recent NASA missions have
    given rise to new Agency level policy about software Independent
    Verification and Validation (IV&V). As a result of this new
    emphasis, all new NASA/GSFC missions will be required to discuss
    with GSFC IV&V advisors the ground and flight software development
    effort envisioned for the mission. The purpose of these discussions
    is to compare to the planned effort a set of standardized criteria
    now under development for determining the extent, if any, of IV&V
    that will be required for each mission. The official contact person
    for IV&V matters is William Jackson, phone 304-367-8215 or email
    \<Jackson @ orion.ivv.nasa.gov\>.

    6.0 Verification

    The Principal Investigator is required to conduct a verification
    program to ensure that the spacecraft and instrument(s) meet the
    specific mission requirements. It is recommended that the Principal
    Investigator use the Goddard Space Flight Center's General
    Environmental Verification Specification for STS and ELV Payloads,
    Subsystems, and Components (GEVS-SE), available from the Explorer
    Program Office, as a tool and a model to prepare the mission
    verification plan and specification. Refer to the Balloon SR & QA
    appendix and the "Long Duration Balloon Opportunities" documents
    available in the Explorer Program Library to assist with
    verification planning for LDB missions.

    The Principal Investigator is required to prepare and submit
    adequate verification

    documentation including a verification matrix, environmental test
    matrix and verification

    procedures to the Explorer Program Office for review. The ability to
    assemble complete test histories from detailed verification records
    has been proven necessary during recent Red Team activities, and has
    been shown to be supportive of the PRA process.

    7.0 INDEPENDENT MISSION OPERATIONS REQUIREMENTS

    Missions being operated by the PI independent of NASA must meet the
    following additional requirements. After on-orbit checkout, incident
    reports must be provided to the GSFC Space Science Mission
    Operations (SSMO) Project in accordance with "GSFC Flight Program
    Incident Reporting System Guidelines". Weekly orbital status summary
    reports shall be provided to SSMO. It is the PI institution's
    responsibility to contractually ensure the availability of
    spacecraft developer support of anomaly resolution efforts during
    the mission's operational phase. Structured management approaches to
    risk management and orbital mission configuration control must be in
    place during the operational phase. An annual mission risk
    assessment status report shall be provided to SSMO.

    **Appendix**

    Guidance for Proposers of Balloon Missions, Regarding Tailoring of
    the MIDEX Assurance Requirements

    1.0 GENERAL INFORMATION

    This appendix is a supplement for guidance in tailoring the MIDEX
    Assurance Requirements. Henceforth, for sake of distinction, the
    "MIDEX Assurance Requirements" document will simply be referred to
    as the MAR. This appendix will be referred to as the Balloon SR &
    QA.

    It is expected that the Principal Investigator will conform to the
    MAR document when addressing safety, reliability and quality using
    specific alternatives addressed in this appendix. The Explorer
    Program office also anticipates that a considerable amount of
    mission unique tailoring will be implemented when the MAR
    requirements are applied to balloon missions. It is not the purpose
    of this appendix to levy additional requirements on balloon missions
    but rather, to ensure those proposals for all types of missions have
    an equal opportunity to be selected.

    It is understood that balloon missions differ significantly from low
    Earth orbit missions based on the environment and duration of a
    single flight and also the possibility of reflight. It is further
    recognized that significant differences will exist in needed
    environmental verification and qualification testing, as compared to
    longer duration orbital missions. It is the intent of the Explorer
    Program Office that MIDEX balloon missions will meet an adequate set
    of documented SR&QA requirements, to augment science derived
    engineering requirements, therefore increasing the likelihood of
    success. This will later be used as the baseline for measuring
    adequacy of the selected investigation\'s Phase-A effort with
    respect to mission assurance.

    2.0 QUALITY ASSURANCE

    2.1 Quality System

    During Phase B, the PI must implement a quality system. It is
    desired, but not required, that this be based on ISO-9001. The
    system is to be documented in a quality manual and/or implementation
    plan. This quality system should be based on the flight duration (21
    days for LDB flights), the flight environment and number of required
    re-flights.

    2.2 Workmanship Standards

    Same as the MAR.

    2.3 Mission Assurance Audits and Reporting

    Same as the MAR, Section 2.3. In addition, program management of
    NASA's Long Duration Balloon missions is performed by the Balloon
    Program Office (Code 820) located at the Wallops Flight Facility.
    Together with the National Scientific Balloon Facility (NSBF), who
    supports balloon launch and flight operations, the Balloon Program
    Office oversees certain audit and reporting functions which include
    but are not limited to:

```{=html}
<!-- -->
```
-   Completion of the NSBF LDB Flight Application.

-   Establishing concise and achievable flight success criteria.

-   Insuring gondola structural certification.

-   Insuring thermal compatibility with NSBF flight systems.

-   Insuring integration with NASA LDB flight support systems.

-   Insuring LDB mission planning that is consistent with established
    operational and safety guidelines.

-   Review of responses to actions assigned from reviews, as described
    in the following section.

    **3.0 REVIEWS**

    Same as the MAR, Section 3.0. A test plan is required in the
    Critical Design Review. Balloon missions could have elaborate
    re-flight or multiple flight plans. These must be reflected in the
    test plan.

    In addition, the Balloon Program Office will conduct the following
    independent reviews. These reviews will be coordinated with the PI
    so that they can coincide with other reviews.

-   Mission Initiation Conference (Semiformal) -- This review will be
    conducted after submission of the NSBF LDB Flight Application. It
    will include the Principle Investigator's team and representatives
    from the Explorer Program Office, Balloon Program Office and the
    NSBF. Although the feasibility of each candidate mission's
    requirements will be reviewed prior to Phase-A, this *Mission
    Initiation Conference* will focus upon specific flight support
    requirements for the purpose of insuring assignments and tasks are
    properly assigned and being worked toward the program schedule
    requirements.

-   Mission Readiness Review (Formal) -- This review is conducted
    immediately after completion of integration and testing of the PI's
    gondola and instrumentation with the NSBF flight support systems.
    This is a balloon program review required by NASA HQ prior to
    shipment to the remote launch site. The purpose of this review is to
    assess the readiness of the integrated payload (this does not
    include a review of the merits of the science instrument or other
    MIDEX mandated conformance reviews.) This review will focus upon the
    readiness and completeness of the science instrument, flight support
    systems, ground support systems, and Mission & Operations plans. The
    objective at the time of this review is that all systems be
    integrated, tested, and definitions / configurations /
    certifications are complete.

-   Flight Readiness Review (Semiformal) -- The Balloon Mission &
    Operations Management conducts this review at the launch site. The
    purpose of this review is to establish that all pre-flight readiness
    preparations are complete and to insure that both science and NSBF
    support personnel clearly understand the script for the launch,
    flight, and recovery operations.

-   Post Flight Review (Semiformal) -- This review is conducted by both
    the NSBF Mission & Operations Management and by the NASA Balloon
    Program Office. It will review all phases of the NSBF pre-flight
    support, launch, flight and recovery operations. Solicitation of PI
    comments and recommendations are the main focus of this review.

    **4.0** **SAFETY**

    The PI is required to plan and implement a system safety program
    that identifies and controls hazards to personnel, facilities,
    support equipment, and the flight system during all stages of the
    mission development, launch, and operations. The program is to
    address hazards in the flight hardware, associated software, ground
    support equipment, and support facilities.

    The PI team's system safety program must meet the system safety
    requirements stated in documents "NASA Balloon Program National
    Scientific Balloon Facility Payload Safety Process" and "NASA
    Balloon Program National Scientific Balloon Facility Ground Safety
    Plan." Balloon Flight Operations & Mission Safety is managed by the
    NASA Balloon Program Office, who will insure compliance in
    accordance with science mission objectives. These safety documents
    are available from Explorer Program Library.

    **5.0 DESIGN ASSURANCE**

    5.1 Electrical, Electromechanical, and Electronic (EEE) Parts

    Same as the MAR, Section 5.1 with the following revision.

    The Principal Investigator is required to implement an appropriate
    EEE parts program consistent with the proposed balloon mission
    concept for a Small Explorer mission. A LDB mission will typically
    be less than 21 days duration; however, the payload could be
    retrieved, refitted, and re-flown several times. Based on this, high
    quality commercial / industrial grade parts could be used on a
    balloon flight provided they are tested, inspected, properly stored
    and properly handled.

    High voltage components must be operated through the entire pressure
    range, ground to float, to insure arcing does not cause latent
    damage or permanent failures. All parts should be life tested based
    on mission duration and pressure, and thermally tested through the
    entire balloon environment range, ground to float. Balloon systems
    can potentially impose high static electricity buildup on the
    balloon and parachute. Balloon electronic support and
    instrumentation systems must incorporate proper grounding and
    shielding to mitigate risks associated with potential static
    discharges.

    As a minimum, life cycle thermal testing should verify that all
    systems will continue to operate for the entire flight duration as
    bounded by nominal thermal hot and cold cases and thermal cycling.
    And demonstrate that all systems will recover and operate
    successfully after undergoing predicted thermal extreme hot and cold
    cases. Any operational mode that is tailored to accommodate any
    thermal operational limitation of the scientific instrument(s) must
    be indicated in the test plans and operations plans.

    5.2 Materials

    Same as the MAR, Section 5.2.

    5.3 Reliability

    Same as the MAR, Section 5.3 with the following amendments.

    Balloon missions are unique in that payloads are normally recovered
    in such a condition that lends itself toward quick refurbishment and
    reflight. The Principal Investigator is encouraged to design the
    payload to survive landing and be capable of re-flight. As with any
    flight, there is always the risk of damage to the payload to such an
    extent as to make quick refurbishment impossible. To this extent,
    the Principle Investigator is encouraged to consider the
    availability of a backup payload or critical spares. By careful
    planning and by taking advantage of the multiple flight
    opportunities that may become available, for some instruments, LDB
    missions can offer an overall success rate that rivals that of
    expendable launch vehicles carrying space-rated instrumentation.

    Balloon payloads do not experience the acoustics/vibration of a
    rocket launch and do not need to be designed or tested for these.
    Instead, LDB mission specific attributes that should be factored
    into every design are risks of high voltage arcing induced by a
    residual atmosphere environment, longer thermal dwell times (day /
    night / earth albedo), and survivability of mechanical shock loads
    during parachute opening and payload impact at the end of each
    flight. It is the Principal Investigator's responsibility to test
    for these.

    5.3.1 Test Flight

    Principle Investigators are encouraged to fly new balloon borne
    instruments on a short duration test flight for the purpose of
    verifying all elements of payload and mission operability. However,
    a short duration test flight is not a suitable substitute for
    thermal-vacuum qualification tests. Short test flights cannot be
    guaranteed to subject the payload to the environmental extremes that
    are likely to be encountered on a LDB mission.

    5.3.2 Thermal Qualification

    The Principal Investigator is required to provide a plan for
    implementing environmental testing that is appropriate to his/her
    mission. Thermal-vacuum testing must be conducted in such a manner
    as to demonstrate not only the thermal model, but also to provide
    system qualification. Thermal qualification testing for balloon
    missions can be more extreme than that required for ELV or NSTS
    systems because of the dwell times, albedo, etc. Balloons can be
    subject to several hours of daylight receiving direct solar and
    reflected (albedo) radiation. The night time environment can last
    several hours which includes not only cold sky, but also
    contribution from cold cloud tops, albedo, etc.

    As part of Phase B, the Principle Investigator must provide a
    detailed thermal analysis. In turn, the NSBF's thermal analyst will
    use this information to insure close-coupled NSBF flight support
    systems are operating within proper limits and to insure the PI's
    instrument is not adversely affected by NSBF support systems.
    Principle Investigators are advised to schedule the services of a
    thermal analyst from the beginning through the final design
    configuration phase in order to be responsive to addressing
    configuration changes that might arise during the development,
    fabrication, and integration phases.

    Thermal "Worst Case" limits for nominal (operational limits) and
    maximum (survival limits) for articles exposed to both earth and sky
    are listed below. These are provided only to lend an appreciation
    for the possible extreme thermal environment that may be
    encountered. For example, cloud top temperatures for typhoons can
    expose the payload to --90C temperatures for a relatively short
    period. But the nominal cold extreme is --65C. Depending upon the
    terrain over which the balloon is flying, cold limits for any
    particular night may be warmer than those listed here. Conversely,
    high albedo during daytime can expose parts of the payload to +55C.
    But nominal upper limits are +40C or less. Passive and/or active
    thermal controls may be required in order to operate under these
    conditions.

```{=html}
<!-- -->
```
-   For articles exposed to external ambient

```{=html}
<!-- -->
```
-   Cold Case Temperatures: Operational down to --65C (nighttime)

    Survive down to --90C (2-hour duration)

-   Hot Case Temperatures: Operational up to +40C (daytime)

    Survive up to +55C (2-hour duration)

```{=html}
<!-- -->
```
-   Unique Cases/Specialty Hardware

```{=html}
<!-- -->
```
-   Photo Voltaics (PV) should operate up to +75C and survive up to
    +90C. Higher ratings for photo voltaics are due to the solar
    orientation and the color/material absorptivity properties. Designs
    must account for thermal emissions off the backsides of PV cells.
    Similarly, any other unique material properties have to be evaluated
    on a per case basis as the above limits are stated only to provide
    for general planning consideration and not as absolute limits for
    all cases.

    The balloon payload environment is close-coupled with earth albedo.
    Because of the wide latitude in payload geometry, attitude control,
    packaging, coatings, modes of operation, and various thermal control
    options, balloon payload designs must be tailored based upon each
    mission's requirements and constraints. For approved LDB missions,
    the NASA balloon program will assist with providing environmental
    data, for a particular flight scenario, for use in thermal analysis.

    5.3.3 Random Vibration/Shock Tests

    In flight, balloon payloads will not experience the vibration levels
    encountered on ELV or NSTS missions. However, Principle
    Investigators must provide documentation of test methods and results
    and/or inspections, practices and records, which clearly demonstrate
    the mechanical integrity of wiring, circuit boards, and mechanical
    assemblies. Essentially, this is a "proof of workmanship"
    verification. Low-level three-axis random vibration testing at
    sub-system levels may be considered as an acceptable means for
    verification. However, the Balloon Program Office imposes no
    standards for vibration testing.

    Typically, prior to flight, the most severe mechanical shock loads
    experienced by balloon payloads are those encountered during
    shipment, particularly over-the-road. Along with overall payload
    design considerations, the PI must plan for proper shipping
    containers that will be accommodated by commercial carriers.
    Shipping includes over-the-road, sea, and turbo-prop air transport.
    Handling by NSBF at the launch site is normally a smooth transition
    from the payload preparation facility to the launch site. However,
    track-wheel vehicles are a mainstay support vehicle used with NSBF
    Antarctica flight operations.

    At the end of the flight, shock loads associated with parachute
    opening and payload impact on the ground are the most severe
    mechanical loads associated with any balloon flight. The NSBF has
    established mechanical certification criteria, which is available as
    an appendix to the LDB Flight Application Form that can be obtained
    off the NSBF web site at
    http://master.nsbf.nasa.gov/pub/ldb-fy2000.pdf. This requirement
    stipulates a 10g structural loading requirement at the gondola
    vertical suspension point and 5g off-axis horizontal loading. Albeit
    these requirements are established for gondola structures, but when
    planning for the contingency of a quick turnaround of the payload
    for possible reflight, designers are advised not to reduce these
    load requirements when applying how they translate back into their
    design of internal component shock load integrity for such items as
    circuit boards, gimbal mountings, cable harnesses, connectors, etc.

    5.4 Contamination

    Same as the MAR, Section 5.4.

    5.5 Software

    Same as the MAR, Section 5.5.

    **6.0** **Verification**

    The Principal Investigator is required to conduct a verification
    program to ensure that the gondola and instrument(s) meet the
    specific mission requirements.

    The Principal Investigator is required to prepare and submit
    adequate verification documentation including a verification matrix,
    environmental test matrix and verification procedures to the
    Explorer Program Office for review.

####### Part 2 {#part-2 .unnumbered}

MIDEX Assurance Guidelines

GSFC-410-MIDEX-001

MEDIUM EXPLORER (MIDEX) PROGRAM

MIDEX ASSURANCE

GUIDELINES

Rev C

November 28, 1997

Approved by: Prepared by:

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

James S. Barrowman Richard Claffy

Explorer Project Manager Flight Assurance Manager

NASA Goddard Space Flight Center

Greenbelt, Maryland

**TABLE OF CONTENTS**

**Section Page**

Preface iv

**SECTION 1: OVERVIEW**

1.1 OVERVIEW 1-1

1.2 USE OF MULTI-MISSION OR PREVIOUSLY DESIGNED, FABRICATED

OR FLOWN HARDWARE 1-1

1.3 SR&QA VERIFICATION 1-1

1.4 REFERENCED DOCUMENTS (Exhibit A) 1-2

1.5 GLOSSARY (Exhibit B) 1-2

**SECTION 2: REVIEWS**

2.1 GENERAL 2-1

**SECTION 3: VERIFICATION**

3.1 GENERAL 3-1

3.2 ENVIRONMENTAL TEST PROGRAM 3-1

3.3 DEMONSTRATION OF FAILURE-FREE OPERATION 3-2

3.4 VERIFICATION DOCUMENTATION 3-2

3.4.1 Verification Matrix 3-3

3.4.2 Environmental Test Matrix 3-3

3.4.3 Environmental Verification Specification 3-3

3.4.4 Verification Procedures 3-3

**SECTION 4: SYSTEM SAFETY**

4.1 GENERAL 4-1

**SECTION 5: EEE PARTS PROGRAM**

5.1 GENERAL 5-1

5.2 EEE PARTS SELECTION 5-1

5.2.1 EEE PARTS IDENTIFICATION LIST (PIL) 5-3

5.3 OTHER PARTS 5-3

5.3.1 EEE Parts Control and Approval 5-3

5.3.1.1 EEE Parts Specifications 5-3

5.3.2 EEE Parts Screening 5-4

5.3.3 EEE Part Qualification 5-4

5.3.4 Hybrid Microcircuits 5-4

5.3.5 Magnetic Devices 5-5

5.4 DESTRUCTIVE PHYSICAL ANALYSIS (DPA) 5-5

5.5 PARTICLE IMPACT NOISE DETECTION (PIND) TEST 5-5

5.6 DERATING 5-5

5.7 PARTS AGE CONTROL 5-6

5.8 RADIATION HARDNESS 5-6

5.9 ALERTS 5-6

**Section Page**

**SECTION 6: MATERIALS AND PROCESSES**

6.1 GENERAL 6-1

6.2 MATERIALS SELECTION 6-1

6.2.1 Inorganic and Metallic Materials 6-1

6.2.2 Polymeric Materials 6-1

6.2.3 Lubrication 6-2

6.2.4 Flammability 6-2

6.2.5 Vacuum Outgassing 6-2

6.2.6 Shelf-Life-Limited Materials 6-3

6.2.7 Fasteners 6-3

6.3 PROCESS SELECTION 6-4

6.4 PROCUREMENT 6-4

6.4.1 Purchased Raw Materials 6-4

6.4.2 Raw Materials Used in Purchased Products 6-4

6.5 GIDEP ALERTS 6-4

6.6 MATERIALS AND PROCESS LISTS 6-5

**SECTION 7: DESIGN ASSURANCE AND RELIABILITY**

7.1 GENERAL 7-1

7.2 DESIGN TRADEOFFS 7-1

7.3 RELIABILITY CONCERNS AND MITIGATIONS 7-1

7.4 LIMITED LIFE ITEMS 7-1

**SECTION 8: QUALITY ASSURANCE**

8.1 GENERAL 8-1

8.2 QUALITY MANUAL 8-1

8.3 QA SYSTEM AUGMENTATION 8-2

8.3.1 Workmanship Standards 8-2

8.3.2 Failures 8-3

8.4 REWORK 8-3

**SECTION 9: CONTAMINATION CONTROL**

9.1 GENERAL 9-1

9.2 CONTAMINATION ALLOWANCE OR TARGET 9-1

9.3 CONTAMINATION CONTROL 9-1

**SECTION 10: SOFTWARE DEVELOPMENT**

10.1 GENERAL 10-1

10.2 SOFTWARE DOCUMENTATION 10-1

10.3 SOFTWARE REVIEWS 10-1

10.4 PERFORMANCE VERIFICATION 10-2

10.5 CONFIGURATION MANAGEMENT 10-2

**EXHIBIT A: REFERENCED DOCUMENTS**

**EXHIBIT B: GLOSSARY**

PREFACE

This MIDEX Assurance Guidelines (MAG) document provides guidelines and
recommendations for elements of quality assurance that are important to
consider in any space flight assurance program. These guidelines are
provided to assist potential developers in estimating the cost of their
expected assurance efforts and to assist development of their own
Safety, Reliability and Quality Assurance (SR&QA) system.

This document also provides a basis and context for understanding any
associated MIDEX requirements defined in Part 1, GSFC-410-MIDEX-002,
"MIDEX Assurance Requirements (MAR)". The MAG and MAR are mission
specific companion documents to be used in conjunction with the generic
ANSI/ASQC 9001-1994 Quality Systems Model to provide a properly
tailored, comprehensive SR&QA management system for MIDEX.

It is GSFC's experience that control of processes, intelligent selection
of parts and materials, and thorough testing at all levels of assembly
significantly increase the chance of success. Developers will be given
significant flexibility in developing and tailoring their overall
quality system, and should carefully consider the experience summarized
by this document.

## SECTION 1 {#section-1-1 .unnumbered}

##  {#section-5 .unnumbered}

##  {#section-6 .unnumbered}

## OVERVIEW {#overview-1 .unnumbered}

# 1.1 OVERVIEW  {#overview-2 .unnumbered}

#  {#section-7 .unnumbered}

# Responsibility for implementation of the program defined in this document varies according to the mission implementation mode, i.e., NASA-provided spacecraft or Principal Investigator (PI) mode, and level of hardware provided (complete flight system, spacecraft, instrument, component, etc.). However, each MIDEX mission, spacecraft, and instrument hardware developer should plan and implement an organized Safety, Reliability and Quality Assurance (SR&QA) Program in accordance with the guidelines of this document that encompasses flight hardware, software, and ground support equipment.  {#responsibility-for-implementation-of-the-program-defined-in-this-document-varies-according-to-the-mission-implementation-mode-i.e.-nasa-provided-spacecraft-or-principal-investigator-pi-mode-and-level-of-hardware-provided-complete-flight-system-spacecraft-instrument-component-etc..-however-each-midex-mission-spacecraft-and-instrument-hardware-developer-should-plan-and-implement-an-organized-safety-reliability-and-quality-assurance-srqa-program-in-accordance-with-the-guidelines-of-this-document-that-encompasses-flight-hardware-software-and-ground-support-equipment. .unnumbered}

In accordance with NASA Headquarters policies for Medium-class
Explorers, a payload classification per NMI 8010.1A is not being used
for MIDEX. This should permit tailoring of the SR&QA requirements to the
ISO9001 series standards and any other mission assurance guidelines and
requirements appropriate for the level of risk for a program of this
scale.

# 1.2 USE OF MULTI-MISSION OR PREVIOUSLY DESIGNED, FABRICATED, OR FLOWN HARDWARE  {#use-of-multi-mission-or-previously-designed-fabricated-or-flown-hardware .unnumbered}

#  {#section-8 .unnumbered}

# Developers may choose to use previously designed, fabricated, or flown hardware without necessarily repeating all the tasks required for original qualification. Such hardware should have demonstrated compliance by way of previous flight or multi-mission history and should comply with the environmental requirements of the mission. Maintenance of original documentation is critical in the re-use of qualified hardware. {#developers-may-choose-to-use-previously-designed-fabricated-or-flown-hardware-without-necessarily-repeating-all-the-tasks-required-for-original-qualification.-such-hardware-should-have-demonstrated-compliance-by-way-of-previous-flight-or-multi-mission-history-and-should-comply-with-the-environmental-requirements-of-the-mission.-maintenance-of-original-documentation-is-critical-in-the-re-use-of-qualified-hardware. .unnumbered}

# 1.3 SR&QA VERIFICATION {#srqa-verification .unnumbered}

It is recommended that the developer, together with GSFC, periodically
validate the developer's overall SR&QA program. The intent of these
validations should be to inform the developer, technical officer,
Systems Assurance Manager (SAM), PI, and/or the project, of potential
problems, questions, or concerns. If necessary, the developer, upon
request, should provide GSFC or designated assurance representatives,
with assurance and safety documents, and access needed to support these
assurance and safety activities.

# 1.4 REFERENCED DOCUMENTS (Exhibit A) {#referenced-documents-exhibit-a .unnumbered}

Documents referred to in this guidelines package are summarized in
Exhibit A, which also provides information on where the documents may be
obtained. The listed documents are provided for guidance. The extent of
applicability of each document is described in the associated
paragraph(s) listed in Exhibit A.

# 1.5 GLOSSARY (Exhibit B)  {#glossary-exhibit-b .unnumbered}

#  {#section-9 .unnumbered}

# Exhibit B defines terms used in this document. {#exhibit-b-defines-terms-used-in-this-document. .unnumbered}

#  {#section-10 .unnumbered}

#  {#section-11 .unnumbered}

## SECTION 2 {#section-2-1 .unnumbered}

##  {#section-12 .unnumbered}

##  {#section-13 .unnumbered}

## REVIEWS {#reviews .unnumbered}

2.1 GENERAL

The objectives of the MIDEX review program are to:

-   assure that the spacecraft, instrument(s) and supporting designs are
    consistent with the mission objectives

-   assure that the characteristics of the systems are carefully
    examined to develop the best approach consistent with existing
    constraints and available resources

-   provide means of periodic evaluation of the hardware, software and
    ground support against mission criteria

-   assure that end-item deliverables (systems and subsystems) meet the
    MIDEX requirements for performance, schedule and cost

Accordingly, the developer should plan and implement an appropriate
review program. Refer to Part 1 for the MIDEX project requirements.

## SECTION 3  

## VERIFICATION  

# 3.1 GENERAL

> A verification program should be conducted to ensure that the
> spacecraft, where produced separately from scientific instrument
> hardware (science payload), and the instruments themselves meet the
> specified mission requirements. The governing philosophy for MIDEX is
> that a complete and thorough verification program covering the
> component and assembly level is absolutely essential to achieving the
> compressed integration and test program needed to control cost and
> schedule, while providing confidence that all mission requirements
> have been met. The verification program should consist of a series of
> analyses, functional demonstrations, physical property measurements,
> alignments, calibrations, tests (performance and environmental),
> simulations, etc., that combine to demonstrate compliance with
> hardware/software engineering specifications derived from mission
> requirements.

# 

# 3.2 ENVIRONMENTAL TEST PROGRAM

> All flight hardware should be subjected to an environmental test
> program sufficient to demonstrate design qualification and to test for
> workmanship. Functional testing should be performed before, during,
> and after certain environmental tests, as appropriate.
>
> The General Environmental Verification Specification for STS & ELV
> Payloads, Subsystems, and Components (GEVS-SE) may be used as a guide
> for developing the environmental test portion of the verification
> program. Alternative methods that demonstrate compliance with mission
> requirements while integrating adequate safety margins could also be
> used.
>
> Prototype and protoflight hardware should undergo appropriate
> qualification tests to demonstrate compliance with the design
> requirements. Flight, flight spare, follow-on, and re-flight hardware
> should undergo flight-like acceptance test levels.
>
> The following tests are recommended as a baseline for MIDEX; specific
> requirements for each MIDEX spacecraft, instrument and component will
> be negotiated by the MIDEX Project at GSFC. Functional tests should be
> performed before, during, and after tests as appropriate.
>
> [Spacecraft]{.underline}
>
> Strength (static or quasi-static), Low level (Pogo) Sine Vibration,
> Random Vibration, Acoustics, EMI/EMC, Thermal Vacuum/Thermal Balance,
> Mass Properties, Deployment (where applicable), Magnetics (where
> applicable). Accelerometers should be mounted on the hardware to
> document the vibration exposure experienced during test. Repeated
> functional tests should be used to demonstrate the growing maturity of
> spacecraft subsystems, and to baseline performance status before each
> environmental test. Several comprehensive performance test
> demonstrations should be performed to verify full mission hardware
> compliance, compatibility, and operability.
>
> [Instruments and Components]{.underline}
>
> Sine Vibration, Random Vibration, Strength, EMI/EMC, Thermal
> Vacuum/Thermal Balance, Mass Properties, Acoustics (where applicable),
> Deployment (where applicable), and Magnetics (where applicable).
> Functional tests are also considered a vital part of the verification
> program at these levels of assembly.
>
> The GEVS-SE document described above is a useful guide for the design
> of these tests.

# 

# 3.3 DEMONSTRATION OF FAILURE-FREE OPERATION

> At the conclusion of the verification program, instruments and
> spacecraft components should have demonstrated a period of
> failure-free operation. This benchmark is usually 100 hours of failure
> free operation. The demonstration may be performed at the subsystem
> level when the time period of demonstration cannot be practically
> accomplished at the system level of assembly. Failure-free operation
> during the thermal-vacuum test is often included as part of the
> demonstration. Major hardware changes during or after the failure-free
> period are usually taken to invalidate any previous demonstration.

3.4 VERIFICATION DOCUMENTATION

Verification documentation should provide the following information:

> \- An overall verification approach
>
> \- Engineering requirements flowdown and basis for verification method
> (test or analysis)
>
> \- Tracking of accomplishments of tests and analyses against those
> planned
>
> \- Definition of specific environments for each test
>
> \- Advanced planning details of each test

Sections 3.4.1 through 3.4.4 describe the forms of documentation
normally used to provide this information. Any proposed alternative form
that provides this information should also be acceptable. Use of
existing documentation practices or systems is encouraged.

3.4.1 Verification Matrix

> The developer should have a verification matrix or equivalent system
> that shows the flowdown of requirements and the method of
> verification.

3.4.2 Environmental Test Matrix

> The hardware developer should have an environmental test matrix or
> equivalent that summarizes all tests that will be performed, showing
> the test and the level of assembly. Tests on engineering models
> performed to satisfy qualification requirements should be included in
> this matrix. This matrix could be combined with the verification
> matrix on a common database.
>
> The environmental test matrix should be current and should be
> available at the flight assurance and project reviews.

3.4.3 Environmental Verification Specification

> A verification specification is normally prepared, to define the
> specific environmental parameters associated with the planned
> environmental tests. Payload peculiarities and interactions with the
> launch vehicle should be considered in defining these environmental
> parameters. These special interactions may include subjects like
> detuning of resonances, EMI/EMC effects, pyrotechnic firing
> disturbances, etc.

3.4.4 Verification Procedures

Detailed (step-by-step) verification procedures should be prepared for
each test and analysis. The developer should maintain as-run
verification procedures, as well as all test and analysis data.

## SECTION 4 

## 

## SYSTEM SAFETY  

# 4.1 GENERAL 

Launch sites require verification of compliance to specific safety
requirements. Accordingly, the developer should plan and implement an
appropriate system safety program. Refer to Part 1 for the MIDEX project
requirements.

## Section 5

## 

## 

## Electrical, Electronic, and Electromechanical (EEE)

## 

## Parts Control

# 5.1 GENERAL 

> The selection and use of parts is a major contributor to the quality
> and reliability of space flight hardware. This section provides
> recommendations that, based on GSFC experience, are considered
> important for a good parts program. The developer should establish a
> parts program consistent with this section.
>
> For effective use of parts information, it is strongly recommended
> that the developer use a qualified parts engineer, especially during
> those periods when designs are being developed and parts are being
> selected. Direct interaction with designers allows for effective use
> of judgment in considering known parts problems, parts failure modes,
> determining between commercial and special parts, parts availability,
> risks and benefits of new parts, screening, test, and burn-in methods,
> etc.
>
> Review of the proposed parts with the Explorer Project at GSFC can
> make NASA experience available to the developer and so better ensure
> acceptability for space flight use.

# 

# 5.2 EEE PARTS SELECTION

> In general, all parts should be selected and processed in accordance
> with GSFC 311-INST-001, "Instructions for EEE Parts Selection,
> Screening, and Qualification" for Grade 3 quality level. As an
> additional aid in selecting parts for MIDEX hardware, the following
> guidelines are offered. Parts selected and procured as specified below
> are considered acceptable by the Explorer Project at GSFC.

a\. Parts listed in the GSFC Preferred Parts List (PPL), or the NASA
Standard Electrical, Electronic, and Electromechanical (EEE) Parts List
(NSPL), MIL-STD-975. Where differences in requirements exist between the
PPL and the NSPL, the PPL should take precedence. Parts should be
procured in accordance with the appropriate specification designated for
that part.

> b\. MIL-M-38510, Class B or better microcircuits procured from a
> Qualified Products List (QPL) supplier. PIND testing is highly
> recommended.
>
> c\. MIL-I-38535, Class Q or better microcircuits procured from a
> Qualified Manufacturers\' List (QML) supplier. PIND testing is highly
> recommended.
>
> d\. MIL-H-38534, Class H or better hybrid microcircuits procured from
> a Qualified Manufacturers\' List (QML) supplier.
>
> e\. Standard Military Drawing (SMD) microcircuits procured from an
> authorized supplier as listed in the SMD. It is strongly recommended
> that microcircuits procured to SMD\'s be subjected to PIND testing in
> accordance with section 5.5.
>
> f\. Microcircuits compliant with paragraph 1.2.1 of MIL-STD-883 and
> procured from manufacturers having QPL or QML status for parts of the
> same technology. Parts procured from manufacturers without QPL or QML
> status should be procured with lot specific or generic Group C Quality
> Conformance Inspection (QCI) data within one year of the lot date code
> of the parts being procured. MIL-STD-883 compliant microcircuits
> should be subjected to PIND testing in accordance with section 5.5.
>
> g\. Manufacturers\' in-house high reliability processed parts provided
> all screening tests listed in Appendix C of the PPL have been
> satisfied. The high reliability process flow should be that formally
> documented by the manufacturer in cases where changes would require a
> revision to the flow documentation. Tests not included in the
> manufacturer\'s high reliability flow must be performed by the
> manufacturer, an independent test facility, or by the developer. Parts
> procured in this section should be procured with lot specific or
> generic Group C Quality Conformance Inspection (QCI) data within one
> year of the lot date code of the parts being procured. If not included
> in the manufacturer\'s high reliability test flow, the parts should be
> subjected to PIND testing in accordance with section 5.5.
>
> h\. MIL-S-19500, JANTX, JANTXV and JANS semiconductors procured from a
> QPL listed supplier. It is preferred that semiconductors be procured
> to JANTXV level or better. Any semiconductor that has an internal
> cavity should be subjected to PIND testing in accordance with section
> 5.5.
>
> i\. Established Reliability (ER) passive components procured from a
> QPL listed supplier for the appropriate military specification. Only
> ER parts within the minimum and maximum value ranges specified in the
> PPL should be considered acceptable.
>
> j\. Parts procured to a GSFC S-311 specification from a GSFC approved
> source.

# 5.2.1 EEE PARTS IDENTIFICATION LIST (PIL)

> The developer in accordance with the developer's configuration control
> system should maintain an EEE Parts Identification List (PIL).
> Maintenance of this list in a computer compatible form is recommended.
>
> The PIL normally is compiled by component and includes information
> such as: part number, part name, manufacturer, manufacturer\'s generic
> part number, specifications, quantities, lot date code, and part use
> locations to the subassembly level.

# 5.3 OTHER PARTS

> Any parts not meeting the criteria specified in section 5.2 should be
> selected and controlled in accordance with sections 5.3.1 through
> 5.3.5.

# 5.3.1 EEE Parts Control and Approval

> The developer should document the selection, application, evaluation,
> and acceptance of parts selected from other than the sources defined
> in section 5.2. The use of a developer parts control board is
> recommended as a mechanism to document and accomplish parts selection,
> acceptance, qualification, etc.

# 5.3.1.1 EEE Parts Specifications

> Developer controlled procurement and screening specifications should
> be prepared for all parts in this category. These specifications
> should fully identify the item being procured and should include
> physical, electrical, and environmental test requirements and quality
> assurance provisions necessary to control manufacture and acceptance.
> Screening requirements designated for the part can be included in the
> procurement specification. They should specify test conditions,
> failure criteria, and lot rejection criteria. For lot acceptance or
> rejection, the Percentage of Defectives Allowable (PDA) in a screened
> lot should be in accordance with that prescribed in the closest
> military part specification.

# 5.3.2 EEE Parts Screening

> All parts selected should receive 100 percent screening in accordance
> with GSFC 311-INST-001, "Instructions for EEE Parts Selection,
> Screening and Qualification". The Grade 3 quality level should apply.
> Parts selected in accordance with 5.2 herein are considered to have
> met the requirements of 311-INST-001, except for PIND testing which is
> strongly recommended as specified above. The developer need not repeat
> tests performed by the manufacturer. If parts are not procured by
> government controlled specifications, the required screening should be
> specified in the developer's Source Control Drawings used to procure
> the parts to assure testing is performed by the parts manufacturers.
> Otherwise, the developer should arrange for the appropriate screens to
> be performed after receipt of the parts.

# 5.3.3 EEE Part Qualification

> Qualification testing should not be required unless deemed necessary
> as a result of part failure history, GIDEP Alerts, or a new technology
> part with no flight history. If needed**,** the primary part
> qualification should consist of either the manufacturer's lot specific
> or generic QCI test data within one year of the lot date code of the
> procured parts**.** The test data should be procured with the parts
> and reviewed for acceptability by the developer**.** If QCI data is
> not available, a lot specific steady state life test in accordance
> with MIL-STD-883, Method 5005 should be performed. The minimum sample
> size for life testing should be 12 pieces.

# 5.3.4 Hybrid Microcircuits

> Hybrid microcircuits should be designed and procured in accordance
> with MIL-H-38534, Level H. Any hybrid not fully conforming to
> MIL-H-38534 should receive Destructive Physical Analysis (DPA) in
> accordance with section 5.4.

# 5.3.5 Magnetic Devices

> Selection and approval of magnetic devices should be in accordance
> with the applicable military specification. Materials used in the
> manufacture of magnetic devices should be consistent with any program
> requirements for outgassing.

# 5.4 DESTRUCTIVE PHYSICAL ANALYSIS (DPA)

> Except as otherwise specified in section 5.3.2, a DPA should not be
> required unless it is deemed necessary as indicated by failure
> history, GIDEP Alerts, or other similar concerns. If DPA is needed,
> GSFC S-311-M-70, Destructive Physical Analysis Procedures can be used
> to define DPA tests, procedures, sample sizes, and acceptance
> criteria.

# 5.5 PARTICLE IMPACT NOISE DETECTION (PIND) TEST

It is strongly recommended that all microcircuits and semiconductors
with an internal cavity and a package style other than ceramic dual in
line packages be subjected to PIND testing in accordance with
311-INST-001. PIND testing should be performed by the manufacturer as
part of the screening flow or by the developer after receipt of the
parts. Lot jeopardy is not recommended. However, any lot exceeding 25
percent PIND failures should receive particle capture and analysis to
identify the particles\' conductive properties. Acceptance or rejection
of these lots should be based on the result of the analysis

# 5.6 DERATING

> All parts should be used in accordance with the derating guidelines
> specified in GSFC PPL, Appendix B or equivalent developer procedures.

# 

# 5.7 PARTS AGE CONTROL

> Parts drawn from controlled storage more than 7 years after the last
> full screen should be subjected to a full rescreen and sample DPA.
> (For increased reliability, GSFC normally rescreens parts after 5
> years of storage.) Reduced testing such as Product Verification
> Testing (PVT) or sample screening could be performed instead if it is
> deemed adequate for the particular part type. Parts stored in
> uncontrolled conditions where they were exposed to the elements or
> sources of contamination should not be used.

# 

# 

# 5.8 RADIATION HARDNESS

All parts should be selected to meet the mission application in the
predicted radiation environment. The radiation environment consists of
two separate effects, those of Total Ionizing Dose (TID) and Single
Event Effects (SEE). Each part should be analyzed with respect to both
of these effects. Additional radiation testing is sometimes necessary to
properly qualify parts. The Explorer Project at GSFC can offer to any
MIDEX participant the benefit of cumulative parts radiation testing
database information, as well as assistance in predicting radiation
severity, for parts selection purposes, of selected or candidate orbital
geometries.

# 

# 5.9 ALERTS

> The Explorer Project at GSFC can provide the developer with selected
> Government Industry Data Exchange Program (GIDEP) Alerts and
> Safe-Alerts that document problems with parts, materials, processes
> and safety. Typically, these alerts deal with specific vendors,
> model/part ID numbers, date codes, and serial numbers. This is a
> fundamental reason that Parts Identification Lists (PILs) are strongly
> recommended, and that the level of configuration detail is critical.
> With this information, it can be immediately determined whether an
> alert is applicable to MIDEX, or more commonly, provide confidence
> that it is not.

## SECTION 6

## 

## MATERIALS AND PROCESSES

# 6.1 GENERAL

> The developer should implement a Materials and Processes (M&P) Program
> beginning at the design stage of the hardware. The program can help
> ensure the safety and success of the mission by the appropriate
> selection, processing, inspection, and testing of the materials
> employed to meet the operational requirements for MIDEX.
>
> Review of the proposed materials and processes with the Explorer
> Project at GSFC can make NASA experience available to the developer
> and so better ensure acceptability for space flight use.

# 6.2 MATERIALS SELECTION 

> In order to anticipate and minimize materials problems during hardware
> development and operation, the developer, when selecting materials,
> should consider potential problem areas**.** Some of these are
> radiation effects, thermal cycling, stress corrosion cracking,
> galvanic corrosion, hydrogen embrittlement, lubrication, contamination
> of cooled surfaces, composite materials, atomic oxygen, useful life,
> vacuum outgassing, toxic offgassing, flammability and fracture
> toughness. Specific selection guidelines are discussed below.

# 6.2.1 Inorganic and Metallic Materials

The criteria specified in MSFC‑SPEC‑522B can be used to determine that
metallic materials meet stress corrosion cracking criteria. Table I
materials are strongly preferred. The proposed use of Table II and Table
III materials should receive careful consideration and should be
discussed with the Explorer Project at GSFC.

# 6.2.2 Polymeric Materials

> Because of low temperature related damage concerns during test and
> on-orbit operation, it is strongly recommended that Uralane products
> be used for conformal coating applications instead of Solithane.
> Uralane does not experience glass transition at common operating
> temperatures so it does not unduly stress the materials it coats in
> the way that Solithane can.

# 6.2.3 Lubrication

Lubricants should be selected for use on the basis of the specific
application, including compatibility with the anticipated environment
and contamination effects. NASA TM 82275 and 82276 are available for
guidance in selecting lubricants and ball bearings.

# 6.2.4 Flammability

Consideration of material flammability should be a criterion for
materials selection. **([For Space Shuttle payloads the consideration of
material flammability is mandatory.) ]{.underline}**GSFC materials
flammability database information and consultation will be provided on
request. The chief focus on flammability as a materials consideration
should be on external and uncontained surfaces such as blankets or
coverings (base material plus coating materials combined behavior) and
their relative proximity to possible ignition sources of either
electrical, chemical, or mechanical origin.

# 6.2.5 Vacuum Outgassing

> If material vacuum outgassing data is needed, it should be determined
> by testing in accordance with ASTM E‑595 to ensure compatibility with
> other spaceflight evaluation data bases. In general, a material is
> qualified on a product‑by‑product basis. Lot testing may be
> appropriate for any material for which lot variation is suspected.
> Normally, only materials that meet the criteria of ASTM E‑595 \[i.e.,
> have a total mass loss (TML) \<1.00 percent and a collected volatile
> condensable mass (CVCM) \<0.10 percent\] are used for space systems
> unless application considerations dictate otherwise. These levels
> should serve as the baseline for MIDEX; however, mission specific
> targets should be established when actual system architectures are
> better defined. Information on many materials is available in
> \"Outgassing Data for Selecting Spacecraft Materials,\" NASA Reference
> Publication 1124, Rev 3, Goddard Space Flight Center, Greenbelt,
> Maryland, November 1993.

# 

# 6.2.6 Shelf‑Life‑Limited Materials

> Polymeric materials that have a limited shelf‑life should be
> controlled to prevent use beyond expiration dates. Important items
> include the start date (manufacturer\'s processing, shipment date, or
> date of receipt, etc.), the storage conditions associated with a
> specified shelf‑life, and expiration date. Materials such as o‑rings,
> rubber seals, tape, uncured polymers, lubricated bearings and paints
> should be included. The use of materials whose date code has expired
> usually requires demonstration by means of appropriate tests that the
> properties of the materials have not been compromised for their
> intended use. When a limited‑life piece part is installed in a
> subassembly, the subassembly item should be included in the
> Limited‑Life List, section 7.4.

# 6.2.7 Fasteners

> To limit potential fastener problems, especially in critical areas,
> the developer should comply with the procurement documentation and
> independent test requirements for flight hardware and critical ground
> support equipment fasteners contained in GSFC S‑313‑100, \"Goddard
> Space Flight Center Fastener Integrity Requirements\" or equivalent
> measures described in developer internal documentation:
>
> In general, single point failure fasteners should be obtained from
> GSFC approved manufacturers and with the manufacturer's material test
> reports; be 5mm in diameter or larger, and be subjected to screening
> tests independent of the manufacturer (visual, tensile, 100 percent
> NDE, 100 percent hardness, and 100 percent dimensional)
>
> Redundant load path fasteners 5mm in diameter or larger can be
> procured from any responsible manufacturer or distributor with the
> manufacturer's material test reports. These fasteners should be
> subjected to independent lot sample screening tests (visual, tensile,
> and dimensional)
>
> Fasteners less than 5mm in diameter need no manufacturer's test
> reports and need only be independently screened for visual defects.
>
> Refer to S-313-100 for specific details including those for rivets and
> other special fasteners.
>
> Fasteners made of plain carbon or low alloy steel should be protected
> from corrosion. When plating is specified, it should be compatible
> with the space environment. On steels harder than RC 33, plating
> should be applied by a process that is not embrittling to the steel.

# 6.3 PROCESS SELECTION 

> Manufacturing processes (e.g., lubrication, heat treatment, welding,
> chemical or metallic coatings), should be carefully selected to
> prevent any unacceptable material property changes that could cause
> adverse effects on materials applications.

# 6.4 PROCUREMENT 

# 6.4.1 Purchased Raw Materials

> Each lot of raw materials purchased by the developer should be
> accompanied by the results of nondestructive chemical and physical
> tests specific to the lot. The developer should maintain these data.

# 6.4.2 Raw Materials Used in Purchased Products

> The developer should require that the supplier meet the
> recommendations of section 6.4.1 and provide, on request, the results
> of acceptance tests and analyses performed on raw materials.

# 6.5 GIDEP ALERTS

> The developer should keep materials selection and usage records
> sufficient to determine applicability of any Government Industry Data
> Exchange Program (GIDEP) alerts related to materials used for MIDEX.

6.6 MATERIALS AND PROCESS LISTS

> The developer should maintain lists of inorganic and metallic
> materials, polymeric materials, lubricants, and processes to be used
> for MIDEX. The equivalent GSFC forms 18-59A, B, C, and D define
> information considered important. The developer may wish to have one
> master materials usage list to include this information. It is
> recommended that the list(s) be maintained in a computer compatible
> form.

## 

## SECTION 7

## 

## DESIGN ASSURANCE AND RELIABILITY

# 7.1 GENERAL 

> The developer should include reliability considerations as part of the
> design process. This should begin at the earliest stages of the
> program.

# 7.2 DESIGN TRADEOFFS

> Design tradeoffs should address reliability considerations, including
> evaluation of alternative designs, functional redundancy, etc.
>
> Absolute system or component reliability estimates may not be needed
> for MIDEX. However, in evaluating the reliability of two or more
> competitive system level designs, a comparison of the relative
> numerical reliabilities, derived using consistent methodology and
> data, is highly recommended for internal use. Consistent methodology
> and data should be used so that the relative magnitudes of each result
> can be compared.

# 7.3 RELIABILITY CONCERNS AND MITIGATIONS

> Early in the program, the developer should identify specific
> reliability concerns and the steps being taken to mitigate them. The
> analysis of likely failure modes may not be needed. As a minimum
> analysis effort, the Developer should conduct a Failure Modes and
> Effects Analysis (FMEA) at the interface level between the instrument
> and spacecraft. The Developer may, if necessary, seek assistance from
> the MIDEX Project.

# 7.4 LIMITED LIFE ITEMS

> Limited life items should be identified on a limited life list. The
> list should include the expected life and the rationale for the
> selection of each item. Limited life items include all hardware that
> is subject to degradation due to age, operating time, or cycles, such
> that its expected useful life is less than twice the required life,
> when fabrication, test, storage, and mission operation are combined.
> The developer should maintain a record of total operating times for
> these items.

## SECTION 8

## 

## 

## QUALITY ASSURANCE

# 8.1 GENERAL

For past Explorer missions, the Project Office at GSFC has always
identified detailed quality system (SPAR, PAR) requirements and
specified precisely how they were to be accomplished. In an effort to
remove non-value-added requirements, and to emphasize the use of
existing commercial practices and standards, NASA has committed to
transitioning its quality assurance policy to align with the
International Organization for Standardization (ISO) 9000 standards.
These standards provide a good checklist of what is needed for a quality
program, but allow significant flexibility to the developer in
determining which requirements actually apply and how they are
implemented. This allows for the use of a single generic quality system
at a university or commercial firm that is not specifically or
exclusively tied to the Explorer Project at GSFC.

> This approach, combining developer flexibility and responsibility, is
> considered appropriate for the kind of teaming efforts that will be
> formed for MIDEX. It also puts the NASA and university communities in
> step with internationally accepted methods of quality management,
> which will facilitate future commerce in the aerospace industry for
> NASA and PIs. Eventually, visible and tangible compliance with ISO
> 9000 standards will become a prerequisite for entry into the
> competitive market place.
>
> Accordingly, the baseline quality system for MIDEX should be the
> United States implementation of ISO 9000 as defined by ANSI/ASQC
> Q9001-1994. It is intended that this will allow the developer greater
> control over the quality system and the ability to concentrate on
> value-added quality activities.
>
> As part of Phase B activities, the developer should define and
> implement a quality system, based on ANSI/ASQC Q9001-1994 that
> properly encompasses MIDEX flight hardware and software. Complete and
> immediate compliance with this standard may not be possible, but a
> workable system created along these lines is important.

# 8.2 QUALITY MANUAL

> To facilitate development or definition of the quality system, a
> Quality Manual should be completed during Phase B. This should be a
> brief, top-level management system document that includes the
> following:
>
> 1\) Introduction (title, scope, table of contents, and organization
> introduction).

2\) The quality policy and objectives of the organization.

3\) Description of the organization, responsibilities, and authorities
(with or without a flowchart).

> 4\) A description of the elements of the quality system.
>
> If requested, The Explorer Project at GSFC can provide informal
> working level assistance for interpreting the ANSI/ASQC Q9001-1994
> requirements for MIDEX and for development of the Quality Manual.

# 8.3 QA SYSTEM AUGMENTATION

# 8.3.1 Workmanship Standards

Paragraph 4.9, Process Control of ANSI/ASQC Q9001-1994, should be
augmented to include the use of several commercial specifications and
NASA handbooks, as appropriate, in procurement and fabrication
activities. These documents define appropriate workmanship standards:

> ANSI/J-STD-001 (or NHB 5300.4(3A‑2)) for high reliability soldering of
> electrical connections. This should include the applicable standards
> ANSI/J-STD-002 through -006 as needed

###  NHB 5300.4(3G) for interconnecting cables, harnesses, and wiring

#### 

####  NHB 5300.4(3H) for crimping

#####  NHB 5300.4(3J) for conformal coating and staking

###### 

######  IPC-D-275 (or NHB 5300.4(3K)) for design of printed wiring boards and assemblies

#####  EIA-625 (or NHB 5300.4(3L)) for ESD control

> In addition, printed wiring boards should be procured and fabricated
> in accordance with ANSI/IPC RB276 (Class 3) and GSFC S-312-P-003.
> Printed wiring board coupons should be provided to the Explorer
> Project at GSFC, or to a GSFC approved laboratory, for evaluation. In
> either case, the specimen preparation (potting, polishing, baking,
> etc.) should be done in accordance with GSFC practice guidelines.
> Evaluation results should be based on a conservative interpretation of
> ANSI/IPC RB276 (Class 3) and GSFC S-312-P-003 acceptance criteria. The
> basis for this recommendation is that past and present GSFC missions
> have experienced a significant pattern of bare printed wiring board
> internal trace to barrel plating bond failures, too often uncovered
> after population with flight parts, usually during component/system
> level environmental testing or during integration and test. These
> defects are readily detected and screened out at the bare board level,
> where the cost and schedule impact is minimal. As such, no boards
> should be populated prior to completion of the coupon tests. Schedules
> should allow for time, generally 2-3 weeks, to accomplish these
> evaluations.

# 8.3.2 Failures

> Paragraph 4.13.2 of ANSI/ASQC Q9001-1994 should be augmented to define
> failure reporting system needs.
>
> Any departure, or suspected departure, from design, performance,
> testing, or handling requirements that affects the function of flight
> equipment should be immediately documented. Failures in ground support
> equipment which interfaces with flight equipment as well as any other
> malfunction that could compromise mission objectives should be
> immediately documented.
>
> Failures (departures from requirements discovered in the functioning
> or operating of hardware or software) should be documented. Formal,
> internal reporting of failures should begin with the first power
> application at the lowest level of assembly or the first operation of
> a mechanical item. Failures should be reported to the Explorer Project
> at GSFC as required by the MIDEX Project Office.

# 8.4 REWORK

> The possibility of adverse effects on hardware and reliability should
> be considered prior to initiating any rework efforts. For example,
> case by case reviews of solder connections have demonstrated that
> rework solely for cosmetic reasons is frequently counter productive.

## SECTION 9

## 

## 

## CONTAMINATION CONTROL

# 9.1 GENERAL

> The contamination requirements baseline for MIDEX should be taken to
> be that systems will be assembled in clean and orderly work areas,
> normally defined as class 300,000 areas, unless more stringent
> requirements are needed and identified. (Space Shuttle Payloads may
> have more stringent requirements imposed upon them.)
>
> The developer should identify contamination requirements and establish
> and maintain a contamination control program consistent with these and
> mission requirements. Contaminants are defined as those materials,
> either at a molecular or particulate level, whose presence degrades
> mission performance. The source of these contaminants may be the
> hardware itself, the test facilities, or the environments to which the
> hardware is exposed.

It is suggested that the developer\'s program first define the specific
cleanliness requirements needed and then set forth the approaches to
meeting them. The program should then implement the control and
monitoring activities specified by the approaches. The program should be
documented by a Contamination Control Plan (CCP), or other equivalent
means.

# 9.2 CONTAMINATION ALLOWANCE OR TARGET

> As a basis for contamination control activities, the developer should
> establish a contamination allowance, or target, for performance
> degradation of any contamination-sensitive hardware such that, even in
> the degraded state, the hardware will meet an acceptable level of its
> mission objectives. The contamination allowances should be established
> initially, to the extent possible, during the early design phase in
> preparation for the PDR and should be updated as needed.

# 9.3 CONTAMINATION CONTROL

> The developer should delineate the measures to be taken to ensure that
> the contamination allowances established under section 9.2 are not
> exceeded. These measures could include inspections, tests, and
> analyses (including associated implementing and controlling
> documentation) for measuring and maintaining the levels of cleanliness
> required during the various phases of the hardware life.
>
> The developer should identify contamination controls to be exercised
> during applicable bake-outs and in the preparation of the
> thermal-vacuum chamber and the necessary fixtures and stimuli for
> system-level tests. Operational procedures that will be followed to
> minimize the potential contamination hazard from pumpdown through
> return to ambient conditions should also be identified. In cases where
> localized hardware contamination protection is needed, a practical
> solution may be a dry gas purge.
>
> Because they can be a source of contamination themselves, special
> consideration should be given to materials and equipment used in
> cleaning, handling, testing, packaging, and bagging (e.g., antistatic
> film materials).

## SECTION 10

## 

## SOFTWARE DEVELOPMENT

# 10.1 GENERAL

> The developer should employ a structured program for the development
> of software**.** The program should recognize the phases of the
> development life cycle (requirements analysis, design, code and unit
> test, integration and build test, performance verification, and
> maintenance) and utilize appropriate mechanisms to facilitate the
> development effort and ensure the quality of the product. These
> mechanisms include documentation, reviews, verification activities,
> and configuration management. The program should encompass instrument
> flight software and firmware, ground test equipment software, and any
> software related to mission operations. Science and data analysis
> software are normally excluded from these requirements.

# 10.2 SOFTWARE DOCUMENTATION

> The developer should establish and document software requirements and,
> where appropriate, external interface specifications and users\'
> guides. Design documentation should also be prepared, but this
> documentation may be less formal and internally controlled. The
> developer should establish and document its software verification
> program as discussed in Section 10.4 below.

# 10.3 SOFTWARE REVIEWS

> The developer should participate in a program of internal and external
> software reviews designed to validate the software requirements,
> design and operating characteristics, verify external interface
> requirements, and produce structured, error-free, maintainable code.
>
> The developer should prepare for and participate in any project-level
> Software Requirements or design reviews. The complexity and
> criticality of the software and the extent of its external interfaces
> should determine the extent and formality of the reviews. For example,
> the requirements review could range from circulation of a document for
> comments to a formal presentation.
>
> The developer should establish a program of internal reviews designed
> to verify adherence to development standards and design guidelines,
> testing adequacy, and to verify whether the design satisfies the
> requirements. These internal reviews should consist of status and
> technical reviews, including design and code walkthrough peer reviews.
>
> Software requirements, design, management, and developmental status
> should be included as part of any GSFC formal design reviews.

# 10.4 PERFORMANCE VERIFICATION

> The developer should conduct a software test program to demonstrate
> the performance adequacy of the software. This program should
> encompass testing at the build or release level, and system-level
> testing of the product. The verification documentation should include
> test plans and procedures, and a Software Test Matrix, or equivalent
> document(s) that show(s) the software requirements, tests to be run to
> satisfy the requirements, and results.

# 10.5 CONFIGURATION MANAGEMENT

> The developer should employ a software configuration management
> process to manage requirements, code, documentation, and data, and to
> track and report on the status of changes to them. The process should
> include a means to record, track and disposition identified
> discrepancies in the product (i.e., non-conformance control). The
> process should also include a mechanism for referring to the project
> for approval of any change requests that will affect schedule, cost,
> function, or external interfaces.

## EXHIBIT A

## REFERENCED DOCUMENTS

## 

EXHIBIT A: APPLICABLE DOCUMENTS

PARAGRAPH DOCUMENT TITLE AVAILABLE

NO. NO. FROM

SECTION 3

3.2 GEVS-SE General Environmental Note 5

Verification Specification

for STS and ELV Payloads,

Subsystems and Components

(January 1990)

SECTION 5

5.2; 5.3.2; GSFC 311-INST-001 Instructions for EEE Parts Note 5

5.5 Selection, Screening, and

Qualification

5.2; 5.6 GSFC PPL 20 GSFC Preferred Parts List Note 5

5.2 MIL-STD-975 NASA Standard Electrical, Note 1, 3 or 5 Electronic, and
Electromechanical (EEE) Parts List

5.2 MIL-M-38510 General Specification for Note 3

Microcircuits

5.2 MIL-I-38535 General Specification for Note 3

Integrated Circuits (Microcircuits)

Manufacturing

5.2; 5.3.4 MIL-H-38534 General Specification for Hybrid Note 3

Microcircuits

5.2; 5.3.3 MIL-STD-883 Test Methods and Procedures for Note 3

Microelectronics

5.2 MIL-S-19500 General Specification for Note 3

Semiconductor Devices

5.4 GSFC S-311-M-70 Specification for Destructive Note 5 Physical
Analysis (DPA)

SECTION 6

6.2.1 MSFC-SPEC-522B Design Criteria for Controlling Note 1, 3 or 6

Stress Corrosion Cracking

6.2.3 NASA-TM 82275 An Evaluation of Liquid and Note 2

(GSFC Mtr. No. Grease Lubricants for

313-003) Spacecraft Applications

\*-81N71132

6.2.3 NASA-TM 82276 Quality Features of Spacecraft Note 2

(GSFC Mtr. No. Ball Bearing Systems

755-013)

\*-81N71205

6.2.5 ASTM E-595 Standard Test Methods for Total Note 9

Mass Loss and Collected Volatile

Condensable Materials from

Outgassing in a Vacuum

Environment.

6.2.5 NASA RP-1124 Outgassing Data for Selecting Note 2

\*-94N21889 Spacecraft Materials

6.2.7 GSFC S-313-100 Goddard Space Flight Center Note 5

Fastener Integrity Requirements

SECTION 8

8.1; 8.2; ANSI/ASQC Quality Systems-Model for Note 5, 10 or 11

8.3.1; 8.3.2 Q9001-1994 Quality Assurance in Design,

Development, Production,

Installation, and Servicing

8.3.1 NHB 5300.4 (3A-2) Requirements for Soldered Note 2, 5 or 8

\*-93N12674 Electrical Connections

8.3.1 NHB 5300.4 (3G) Requirements for Inter- Note 2, 5 or 8

\*-85N72711 connecting Cables, Harnesses,

and Wiring

8.3.1 NHB 5300.4 (3H) Requirements for Crimping and Note 2, 5 or 8

\*-94N71048 Wire Wrap

8.3.1 NHB 5300.4 (3J) Requirements for Conformal Note 2, 5 or 8

\*-94N71696 Coating and Staking of Printed

Wiring Boards and Electronic

Assemblies

8.3.1 NHB 5300.4 (3K) Design Requirements for Rigid Note 2, 5 or 8

\*-86N27577 Printed Wiring Boards and

Assemblies

8.3.1 NHB 5300.4 (3L) Requirements for Electrostatic Note 2 or 5

Discharge Control

8.3.1 GSFC S-312-P-003 Procedure Specification for Rigid Note 5

Printed Boards for Space

Applications and other High

Reliability Uses

8.3.1 ANSI/J-STD-001 Requirements for Soldered Note 12

Electrical and Electronic

Assemblies

8.3.1 ANSI/J-STD-002 Solderability Tests for Component Note 12

Leads, Terminations, Lugs,

Terminals, and Wires

8.3.1 ANSI/J-STD-003 Solderability Tests for Printed Note 12

Boards

8.3.1 ANSI/J-STD-004 Requirements for Solder Fluxes Note 12

8.3.1 ANSI/J-STD-005 Requirements and Test Methods Note 12

for Solder Paste

8.3.1 ANSI/J-STD-006 Requirements for Solder Alloys Note 12

8.3.1 ANSI/IPC RB276 Qualification and Performance Note 12

Specification for Rigid and

Printed Boards

NOTES (SOURCES):

1 \-- Superintendent of Documents, U.S. Government Printing Office,
Washington, DC, 20402

2 \-- NASA Scientific and Technical Information Facility, P.O. Box 8757,
BWI Airport, Maryland, 21240

3 \-- Department of the Navy, Naval Publications & Forms Center, 5801
Tabor Avenue, Philadelphia, PA, 19120

4 \-- NASA/Lyndon B. Johnson Space Center, Publication Control Office,
Houston, TX, 77058

5 \-- NASA, MIDEX Project Office, Code 410, Goddard Space Flight Center,
Greenbelt, MD, 20771

6 \-- NASA/Marshall Space Flight Center, Marshall Documentation,
Huntsville, AL, 35812

7 \-- National Technical Information Service, Springfield, VA, 22161

8 \-- NASA Information Center, Code DB-4, NASA Headquarters, Washington,
D.C. 20546 Phone (202) 453-1000)

9 \-- American Society for Testing & Materials (ASTM), 1916 Race St.,
Philadelphia, PA. 19103-1187

10\-- American Society for Quality Control (ASQC), 611 East Wisconsin
Ave., Milwaukee, WI. 53202-4606

11\-- American National Standards Institute (ANSI), 11W. 42nd St., 13th
Floor, New York, NY. 10036

12\-- Institute for Interconnecting and Packaging Electronic Circuits,
7380 N. Lincoln Ave., Lincolnwood, IL. 60646

\*-NASA STI (Note 2) Recon Number: can be ordered individually from NASA
STI by these numbers.

## EXHIBIT B

## GLOSSARY

EXHIBIT B: GLOSSARY

[Acceptance Test]{.underline}: The process that demonstrates that
hardware is acceptable for flight. It also serves as a quality control
screen to detect deficiencies and is normally used to provide the basis
for delivery for an item under terms of a contract.

[Assembly]{.underline}: A functional subdivision of a component,
consisting of parts or subassemblies that perform functions necessary
for the operation of the component as a whole. Examples are a power
amplifier and a gyroscope.

[Audit]{.underline}: A review of the contractor\'s or subcontractor\'s
documentation or hardware to verify that it complies with project
requirements.

[Critical]{.underline}: A potential failure effect which would result in
a significant (as defined by the project) performance degradation of an
item of hardware or a mission.

[Collected Volatile Condensable Material (CVCM)]{.underline}: The
quantity of outgassed matter from a test specimen that condenses on a
collector maintained at a specific constant temperature for a specified
time.

[Component]{.underline}: A functional subdivision of a subsystem,
generally a self-contained combination of items performing a function
necessary for the subsystem\'s operation. Examples are transmitters,
gyro packages, actuators, motors, batteries.

[Configuration]{.underline}: The functional and physical characteristics
of parts, assemblies, equipment of systems, or any combination of these
which are capable of fulfilling the fit, form and functional
requirements defined by performance specifications and engineering
drawings.

[Configuration Management]{.underline}: The systematic control and
evaluation of all changes to baseline documentation and subsequent
changes to that documentation which define the original scope of effort
to be accomplished (contract and reference documentation) and the
systematic control, identification, status accounting, and verification
of all configuration items.

[Derating]{.underline}: The reduction of the rating of a device to
improve reliability or to permit operation at high ambient temperatures.

[Designated Representative]{.underline}: An individual (such as a NASA
plant representative), firm (such as an assessment contractor),
Department of Defense (DOD) plant representative, or other government
representative designated and authorized by NASA to perform a specific
function of NASA. As related to the contractor\'s effort, this may
include evaluation, assessment, design review participation, and
review/approval of certain documents or actions.

[Destructive Physical Analysis (DPA)]{.underline}: An internal
destructive examination of a finished part or device to assess design,
workmanship, assembly, and any other processing associated with
fabrication of the part.

[Electromagnetic Compatibility (EMC)]{.underline}: The condition that
prevails when various electronic devices are performing their functions
according to design in a common electromagnetic environment.

[Electromagnetic Interference (EMI)]{.underline}: Electromagnetic energy
that interrupts, obstructs, or otherwise degrades or limits the
effective performance of electrical equipment.

[Failure:]{.underline} See Nonconformance.

[Failure Modes, Effects Analysis (FMEA)]{.underline}: The study of a
system and working interrelationships or its elements to determine ways
in which failures can occur (failure modes),and effects of each
potential failure on the system element in which it occurs.

[Functional Tests]{.underline}: The operation of a unit in accordance
with a defined operational procedure to determine whether performance is
within the specified requirements.

[Hardware]{.underline}: Physical items of equipment. As used in this
document, there are two major categories of hardware as follows:

> 1\. [Non Flight Hardware]{.underline}: Development hardware not
> intended to fly, or hardware of flight design but found to be of
> unsuitable quality for flight use, or hardware intended for use on the
> ground.
>
> a\. [Prototype Hardware]{.underline}: Hardware of a new design that is
> subject to a design qualification test program, but is not intended
> for flight.
>
> 2\. [Flight Hardware]{.underline}: Hardware to be used operationally
> in space. It includes flight instruments (experiments) and/or
> spacecraft hardware.
>
> a\. [Protoflight Hardware]{.underline}: Flight hardware of a new
> design that is subject to a test program, by exposure to design
> qualification levels and durations equivalent to a flight acceptance
> test program.
>
> b\. [Follow-On Hardware]{.underline}: Flight hardware built in
> accordance with a design that has been qualified either as prototype
> or as protoflight hardware; follow-on hardware is subject to a flight
> acceptance test program.
>
> c\. [Space Hardware]{.underline}: Hardware that has been proven in a
> design qualification test program and that is subject to a flight
> acceptance test
>
> program and that is used to replace flight hardware which is no longer
> acceptable for flight.
>
> d\. [Reflight Hardware]{.underline}: Flight hardware that has been
> used operationally in space and is to be reused in the same way; the
> verification program to which it is subject depends on its past
> performance, current status, and the upcoming mission.

[Inspection]{.underline}: The process of measuring, examining, gauging,
or otherwise comparing an article or service with specified
requirements.

[Instrument]{.underline}: A subsystem consisting of sensors and
associated hardware for making measurements or observations in space.
The flying portion of a flight experiment.

[Margin]{.underline}: The amount by which hardware capability exceeds
requirements.

[Monitor]{.underline}: To keep track of the progress of a performance
assurance activity. The person monitoring need not be present at the
scene during the entire course of the activity, but will review
resulting data or other associated documentation (see Witness).

[Nonconformance]{.underline}: A condition of any hardware, software,
material, or service in which one or more characteristics do not conform
to requirements. As applied in quality assurance, nonconformances fall
into two categories \-- discrepancies and failures. A discrepancy is a
departure from specification that is detected during inspection or
process control testing, etc., while the hardware or software is not
functioning or operating. A failure is a departure from specification
that is discovered in the functioning or operation of the hardware or
software.

[Part]{.underline}: A hardware element that is not normally subject to
further subdivision or disassembly without destruction of designed use.
Examples are bolts, diodes, resistors, etc.

[Performance Verification]{.underline}: Determination by test, analysis,
or a combination of the two that the spacecraft can operate as intended
in a particular mission. This includes being satisfied that the design
of the spacecraft or element has been qualified and that the particular
item has been accepted as true to the design and ready for flight
operations.

[Qualification]{.underline}: The process of demonstrating that a given
design and manufacturing approach will produce hardware that will meet
all performance specifications when subjected to defined conditions more
severe than those expected to occur during its intended use.

[Redundancy (of design)]{.underline}: The use of more than one
independent means of accomplishing a given function.

[Repair]{.underline}: The article is to be modified by established
(customer approved where required) standard repairs or specific repair
instructions which are designed to make the article suitable for use,
but which will result in a departure from the original specification.

[Rework]{.underline}: Return for completion of operations per drawing.
The article is to be reprocessed to conform to the original
specifications or drawings.

[Single Point Failure]{.underline}: A single element of hardware, which
if it fails, would result in the loss of mission objectives or the
hardware, as defined for the specific application or project for which a
single point failure analysis is performed.

[Spacecraft]{.underline}: An integrated assemblage of subsystems
designed to perform a specified mission in space.

[Subassembly]{.underline}: A subdivision of an assembly. Examples are
wire harnesses and populated printed circuit boards.

[Subsystem]{.underline}: A functional subdivision of a spacecraft
consisting of two or more components. Examples are attitude control,
electrical power subsystems, and instruments.

[Thermal Balance Test]{.underline}: A test conducted to verify the
adequacy of the thermal design and the capability of the thermal control
system to maintain thermal conditions within established mission limits.

[Total Mass Loss (TML)]{.underline}: Total mass of material outgassed
from a specimen that is maintained at a specified constant temperature
and operating pressure for a specified time.

[Verification]{.underline}: See Performance Verification.

[Vibroacoustics]{.underline}: An environment induced by high-intensity
acoustic noise associated with various segments of the flight profile,
it manifests itself throughout the payload in the form of directly
transmitted acoustic excitation and as structure-borne random vibration
excitation.

[Witness]{.underline}: A personal, on-the-scene observation of a
performance assurance activity with the purpose of verifying compliance
with project requirements. (see Monitor).

[Common Terms not included in MAG:]{.underline}

[Catastrophic]{.underline}: A potential failure effect that would result
in complete loss of an item of hardware or a mission or result in
serious injury to personnel. e.g., loss of ability to recover science
data would be catastrophic to an instrument mission.

[Configuration Control]{.underline}: The systematic evaluation,
coordination, and formal approval/disapproval of proposed changes and
the implementation of all approved changes to the design and production
of an item, the configuration of which has been formally approved by the
contractor or by the purchaser, or both.

[Design Specification]{.underline}: Generic designation for a
specification which describes functional and physical requirements for
an article, usually at the component level or higher levels of assembly.
In its initial form, the design specification is a statement of
functional requirements with only general coverage of physical and test
requirements. The design specification evolves through the project life
cycle to reflect progressive refinements in performance, design,
configuration, and test requirements. In many projects the end-item
specifications serve all the purposes of design specifications for the
contract and items. Design specifications provide the basis for
technical and engineering management control.

[Discrepancy]{.underline}: See Nonconformance.

[Effectivity:]{.underline} The point (in configuration evolution) at
which a change or action becomes applicable to the hardware or software.

[Electromagnetic Susceptibility]{.underline}: Undesired response by a
component, subsystem, or system to conducted or radiated electromagnetic
emissions.

[End-to-End Tests]{.underline}: Tests performed on the integrated ground
and flight system, including all elements of the payload, its control,
communications, and data processing to demonstrate that the entire
system is operating in a manner to fulfill all mission requirements and
objectives.

[Similarity, Verification By]{.underline}: A procedure of comparing an
item verified. Configuration, test data, application and environment
should be evaluated. It should be determined that design differences are
insignificant, environmental stress will not be greater in the new
application, and that manufacturer and manufacturing methods are the
same.

[Temperature Cycle]{.underline}: A transition from some initial
temperature condition to temperature stabilization at one extreme and
then to temperature stabilization at the opposite extreme and returning
to the initial temperature condition.

[Temperature Stabilization]{.underline}: The condition that exists when
the rate of change of temperatures has decreased to the point where the
test item may be expected to remain

within the specified test tolerance for the necessary duration or where
further change is considered acceptable.