January 2015 

NASA/TM2015-218676/Volume II 

NESC-RP-14-00929 

 

Review of Exploration Systems Development 

(ESD) Integrated Hazard Development Process 

Appendices 

Michael D. Smiles/NESC 

Langley Research Center, Hampton, Virginia 

Michael P. Blythe 

Johnson Space Center, Houston, Texas 

Bohdan Bejmuk 

Analytical Mechanics Associates, Houston, Texas 

Nancy J. Currie/NESC 

Langley Research Center, Hampton, Virginia 

Robert C. Doremus 

Johnson Space Center, Houston, Texas 

Jennifer C. Franzo 

Stennis Space Center, Mississippi 

Mark W. Gordon 

Kennedy Space Center, Florida 

Tracy D. Johnson 

Marshall Space Flight Center, Huntsville, Alabama 

Mark M. Kowaleski 

Glenn Research Center, Cleveland, Ohio 

Jeffrey R. Laube 

The Aerospace Corporation, Houston, Texas 
NASA STI Program . . . in Profile

Since its founding, NASA has been dedicated to the 

advancement of aeronautics and space science. The 

NASA scientific and technical information (STI) 

program plays a key part in helping NASA maintain 

this important role. 

The NASA STI program operates under the 

auspices of the Agency Chief Information Officer. 

It collects, organizes, provides for archiving, and 

disseminates NASA’s STI. The NASA STI 

program provides access to the NTRS Registered 

and its public interface, the NASA Technical 

Reports Server, thus providing one of the largest 

collections of aeronautical and space science STI in 

the world. Results are published in both non-NASA 

channels and by NASA in the NASA STI Report 

Series, which includes the following report types: 

x TECHNICAL PUBLICATION. Reports of 

completed research or a major significant phase 

of research that present the results of NASA 

Programs and include extensive data or 

theoretical analysis. Includes compilations of 

significant scientific and technical data and 

information deemed to be of continuing 

reference value. NASA counter-part of peerreviewed formal professional papers but has 

less stringent limitations on manuscript length 

and extent of graphic presentations. 

x TECHNICAL MEMORANDUM. Scientific 

and technical findings that are preliminary or of 

specialized interest, e.g., quick release reports, 

working papers, and bibliographies that contain 

minimal annotation. Does not contain extensive 

analysis. 

x CONTRACTOR REPORT. Scientific and 

technical findings by NASA-sponsored 

contractors and grantees. 

x CONFERENCE PUBLICATION. 

Collected papers from scientific and 

technical conferences, symposia, seminars, 

or other meetings sponsored or 

co-sponsored by NASA. 

x SPECIAL PUBLICATION. Scientific, 

technical, or historical information from 

NASA programs, projects, and missions, 

often concerned with subjects having 

substantial public interest. 

x TECHNICAL TRANSLATION. 

English-language translations of foreign 

scientific and technical material pertinent to 

NASA’s mission.

Specialized services also include organizing 

and publishing research results, distributing 

specialized research announcements and feeds, 

providing information desk and personal search 

support, and enabling data exchange services. 

For more information about the NASA STI 

program, see the following: 

x Access the NASA STI program home page 

at http://www.sti.nasa.gov

x E-mail your question to help@sti.nasa.gov

x Phone the NASA STI Information Desk at 

757-864-9658 

x Write to: 

 NASA STI Information Desk 

 Mail Stop 148 

 NASA Langley Research Center 

 Hampton, VA 23681-2199
National Aeronautics and 

Space Administration 

Langley Research Center 

Hampton, Virginia 23681-2199 

 

January 2015 

NASA/TM2015-218676/Volume II 

NESC-RP-14-00929 

 

Review of Exploration Systems Development 

(ESD) Integrated Hazard Development Process 

Appendices 

Michael D. Smiles/NESC 

Langley Research Center, Hampton, Virginia 

Michael P. Blythe 

Johnson Space Center, Houston, Texas 

Bohdan Bejmuk 

Analytical Mechanics Associates, Houston, Texas 

Nancy J. Currie/NESC 

Langley Research Center, Hampton, Virginia 

Robert C. Doremus 

Johnson Space Center, Houston, Texas 

Jennifer C. Franzo 

Stennis Space Center, Mississippi 

Mark W. Gordon 

Kennedy Space Center, Florida 

Tracy D. Johnson 

Marshall Space Flight Center, Huntsville, Alabama 

Mark M. Kowaleski 

Glenn Research Center, Cleveland, Ohio 

Jeffrey R. Laube 

The Aerospace Corporation, Houston, Texas 
Available from: 

NASA STI Program / Mail Stop 148 

NASA Langley Research Center 

Hampton, VA 23681-2199 

Fax: 757-864-6500 

The use of trademarks or names of manufacturers in the report is for accurate reporting and does not 

constitute an official endorsement, either expressed or implied, of such products or manufacturers by the 

National Aeronautics and Space Administration. 
NASA Engineering and Safety Center 

Technical Assessment Report

Document #: 

NESC-RP14-00929 

Version: 

1.0

Title:

Review of ESD Integrated Hazard Development Process 

Page #: 

1 of 112

NESC Request No.: TI-14-00929, Volume I I 

Review of Exploration Systems Development (ESD) 

Integrated Hazard Development Process

Volume 2: Appendices 

November 20, 2014

 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

2 of 112

NESC Request No.: TI-14-00929, Volume II 

Table of Contents 

Appendix A. Interviews Conducted and Documents Reviewed .............................................................. 3

Appendix B. “Integrated Hazard Analysis Deep Dive” Presentation to ESD Management .................... 5

Appendix C. ESD Cross Program Safety and Mission Assurance Plan (ESD 10010) .......................... 56

Appendix D. Hazard Analysis Comparison ......................................................................................... 106
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

3 of 112

NESC Request No.: TI-14-00929, Volume II 

Appendix A. Interviews Conducted and Documents Reviewed 

Interviews conducted by the assessment team included: 

• Exploration Systems Development (ESD) personnel: 

– Integrated Hazard Analysis Working Group (IHAWG) Chairman 

– System Safety Functional Area Lead 

– Chief Safety and Mission Assurance (S&MA) Officer (CSO) 

– Crew Survivability Integrated Task Team (ITT) Lead 

– Multi-Purpose Crew Vehicle (MPCV)/Space Launch System (SLS) Abort Integration 

Team (MSAIT) ITT Lead 

• Stakeholders: 

– ESD Chief Engineer – Paul McConnaughey 

– NASA Chief Engineer – Ralph Roe 

– Chief, S&MA – Terry Wilcutt 

– Director, NASA Engineering and Safety Center (NESC) – Tim Wilson 

– ESD Deputy Associate Administrator – Dan Dumbacher 

– ESD Assistant Deputy Associate Administrator – Bill Hill 

– Former Chief, S&MA, Current Aerospace Safety Advisory Panel Member – 

Bryan O’Connor

ESD and Program documentation reviewed by the assessment team included:

• “Integrated Hazard Analysis Deep Dive” presentation

• Program documentation 

– Cross-Program S&MA Plan (ESD 10010) 

– ESD Systems Safety Analysis Report (10015) 

– IHAWG Task Agreement 

– IHAWG Guidance for Analysis Causes 

– Ground Systems Development and Operations (GSDO) S&MA Plan 

(GSDO-LN-1036) 

– Multi-Purpose Crew Vehicle (MPCV) S&MA Plan (MPCV 70294) 

– SLS S&MA Plan (SLS-PLAN-013) 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

4 of 112

NESC Request No.: TI-14-00929, Volume II 

– SLS Abort Triggers Definition Document (SLS-SPEC-197) 

– GSDO Top Level Operational Hazard Analysis Fault Tree 

– MPCV Master Hazards List 

– SLS Master Hazards List (SLS-RPT-076) 

– ESD Risk Management Plan (ESD 10003) 

– ESD Implementation Plan (ESD 10001) 

– Charter for the ESD Control Board (ESD-MD-12002) 

– Joint Program Control Board Charter (JPCB 0001) 

– Cross-program Ascent Aborts Analysis Methodology (MPCV 72519) 

– Orion MPCV Crew Survival Analysis Exploration Mission 2 Reference Missions 

(MPCV 72532) 

– Orion MPCV Vehicle Integration Control Board/Joint Integration Control Board 

Charter (MPCV 0074) 

– SLS Chief Engineer Control Board/Joint Integration Control Board Charter 

– Selected Cause Records and Cause Trees 

Other documentation reviewed by the assessment team included:

• Prior human spaceflight (HSF) program related documentation 

– Apollo Safety Program Plan 

– KSC Apollo Safety Systems Program Plan 

– Apollo Failure Mode Effects and Criticality Analysis procedure 

– Shuttle Integrated Hazard Report IPYR-01, Pyrotechnic System Malfunction 

• Tim Wilson’s integration white paper “Improving Exploration Systems Integration, 

29 January 2014”

 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

5 of 112

NESC Request No.: TI-14-00929, Volume II 

Appendix B. “Integrated Hazard Analysis Deep Dive” 

Presentation to ESD Management 

National Aeronautics and Space Administration

Integrated Hazard Analysis Deep Dive

January 2014

IHAWG/Jeff Williams
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

6 of 112

NESC Request No.: TI-14-00929, Volume II 

Purpose

• Provide overview of ESI Integrated Hazard Analysis approach, 

structure, and content.

• Discuss selected details of IHA.

• Discuss forward work.

2

Agenda

• Approach to ESI IHA:

• Benefits and limitations of hazard analysis

• IHAWG Org

• Scope – What’s in and what’s out

• Methodology – Non-traditional approach: advantages, disadvantages, and lessons learned

• Development and review for PDR

• Deliveries for major program & integrated milestones

• Top-level view of the IHA:

• Major hazardous conditions (by area).

• Major causes for hazardous conditions

• Slices of the IHA:

• High risk hazard cause summary

• Elevated Watch Items

• Deep dive into areas of interest

• Success stories:

• Known areas where IHA impacted design

• Final IHA status for GSDO PDR

• Forward Work for IHAWG:

• Model restructuring

• Getting to Orion delta-PDR and ESI Design-to Sync

3
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

7 of 112

NESC Request No.: TI-14-00929, Volume II 

Approach to IHA

4

BENEFITS AND LIMITATIONS OF HAZARD 

ANALYSIS

Approach to ESI IHA

5
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

8 of 112

NESC Request No.: TI-14-00929, Volume II 

Approach to ESI IHA: Benefits & Limitations of HA

• Why we do Hazard Analysis:

• Influence Design and Operations

• Identify, Communicate, Mitigate, and Accept Risk

• Identify Hazard Controls for “Posterity” – Relate selected design and operational 

parameters to hazard controls to assure retention.

• Limitations of HA:

• Primarily Qualitative – no cumulative assessment of risk

• Can’t capture all the unknowns

6

ESI IHA ORGANIZATION

Approach to ESI IHA

7
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

9 of 112

NESC Request No.: TI-14-00929, Volume II 

Approach to ESI IHA: ESI IHA Organization

8

Quality Assurance

Integrated Hazards

Crew Survivability Assessment

FMEA/CIL 

Probabilistic Risk Assessment

Cross-Program System Integration (CSI) Paul McConnaughey

Marshall Smith

Program SE&I Leads Gary Lyles - SLS

John McCullough - Orion

Phil Weber - GSDO

Ad Hoc Teams Technical Performance Assessments, D&C, 

Operability, Tech Planning, Natural 

Environments, Facilities...

System Integration

Jessica Parsons

Integrated Design 

and Analysis

Joe Brunty

Mission Management

Jon Lenius

System Safety

Jeff Hamilton

System Engineering

Tim Finkel

Integrated Launch Criteria

Mission Integration

Flight Test Working Group

Comm/Network

Range Safety

Imagery

Cross Program Integration Team (CPIT) Leadership Marshall Smith, Dave Thelen - ESD

Nick Cummings - GSDO

Wayne Jermstad - Orion

Gary Langford - SLS

Interfaces

Interface Working 

Groups

Orion to GSDO 

MS to SLS

MS to GSDO

SLS to GSDO 

Orion to SLS

OMRS

Integrated Avionics and Software

Integrated Test & Checkout

Logistics Integration

Ground H/W Integration

Human Health & 

Performance 

Integration

ESI V&V

ConOps & 

Requirements

Data Integration

Integrated Drawing Management

Human Rating

Flight Certification 

Steve Bauder - Risk Manager

Arlene Moore – PP&C Manager

Mike Jones – SE&I Schedule

Michele DiGiuseppe – CM/DM

Ascent Performance/GNC

Aborts

ETE Mission 

Performance

Loads

Induced 

Environments

Aero

Thermal

Acoustics

Aerothermal

Shock & Vibe

Debris

Approach to ESI IHA: IHAWG Organization (Membership)

• Per IHAWG Task Agreement, IHAWG membership includes:

• Core members:

• CSI - IHAWG Lead

• GSDO, Orion & SLS SMA 

• GSDO, Orion & SLS Engineering 

• Ad hoc members:

• Health and Medical TA

• Crew Office

• Mission Operations

• HQ Office of S&MA

• ESD Chief Engineer

9

Reps are from center line orgs

• Reps from other System Safety Functional Area ITTs

• Discipline experts

• Safety Panel Chairs

• Center S&MA Reps and Safety Engineers

• Contractor Reps
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

10 of 112

NESC Request No.: TI-14-00929, Volume II 

Approach to ESI IHA: ESI IHA Organization

10

IHAWG

IHA Architecture Team IHA Cause Teams

Program Engineering & S&MA

IHAWG Lead

Program Engineering

Program S&MA

Others as required

IHAWG Structure

IHAAT coordinates development of Cause Trees.

Recommends program assignments for tree and 

cause development.

Cause Teams develop causes.

IHAWG provides overall leadership. 

Program reps assign resources to Cause and 

Cause Tree development. 

IHAWG reviews products prior to release.

ESI IHA SCOPE

Approach to ESI IHA

11
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

11 of 112

NESC Request No.: TI-14-00929, Volume II 

Approach to ESI IHA: ESI IHA Scope

• ESI IHA scope is established by ESD 10010, ESD S&MA Plan (section 4.1.2):

• What makes an integrated hazard or hazard cause:

• More than one program contributes to a cause, control, or verification.

• Example: During cryo loading, GSDO controls SLS tank pressure and SLS has 

independent pressure relief 

• More than one program contributes to the analysis of the system effect, the 

interactions/interfaces, and interdependencies of the hazard.

• Example: All 3 Programs contribute to integrated loads analyses 

• IHA timeframe: Pre-launch cryo loading start to post-flight crew egress.

• EM-1 & EM-2

12

Approach to ESI IHA: ESI IHA Scope

• What is IHA:

• Any failures during otherwise nominal operations that result in loss of or injury to crew or loss of 

mission. 

• Post T-0, crew injuries are either catastrophic (result in permanent disability) or critical (loss 

of mission if injury requires more than first aid).

• Error in analysis, design, or operation that may cause hazard within IHA timeframe.

• Hazards imposed by nominal system behavior during integrated operations (e.g., build-up of 

hazardous gases due to allowable leakage from more than one program).

• Hazards associated with on-pad engine shut-down.

• Hazards imposed by the presence of emergency systems (e.g., abort systems).

• What is not IHA:

• Loss of crew/vehicle during use of emergency system or operation. Æ Failure to abort or 

perform emergency egress when needed or failure to survive abort/emergency egress are 

exempted from HA by the ESD S&MA Plan.

• IHA Causes do capture potential crew survival methods in the Crew Survival Notes field.

• Interfaces between an individual Program and external entity such as those between SLS and 

Range Safety.

• Interfaces between Program elements that do not impact other Programs.

13
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

12 of 112

NESC Request No.: TI-14-00929, Volume II 

Approach to ESI IHA: ESI IHA Scope

14

NOTIONAL

Integrated HAs vs. Program HAs – Examples 

• IHA: Under-/Over-fill of prop leading 

to off-nominal engine performance

• Not IHA: RS-25 failure due to engine 

component failure 

• IHA: Inadvertent abort due improper 

notification.

• Not IHA: Inadvertent abort d/t 

premature LAS firing.

• IHA: Loss of comm due to system 

characteristics

• Not IHA: Loss of comm d/t 

hardware failure.

• IHA: Collision with tower d/t 

improper vehicle OML

• Not IHA: Collision w/ tower d/t 

GN&C failure

• IHA: Hazardous environment d/t 

combined sources of H2.

• Not IHA: Hazardous environment 

d/t H2 leak.

• IHA: Geysering in LOx line due to 

contamination.

• Not IHA: Geysering in LOx line d/t 

Ghe supply system failure.

ESI IHA METHODOLOGY

Approach to ESI IHA

15
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

13 of 112

NESC Request No.: TI-14-00929, Volume II 

Approach to ESI IHA: Methodology

• In order to provide a product within required timeframe and to provide more 

opportunity to influence design, the IHAWG adopted a streamlined approach. This 

approach focused on the following major aspects:

• Interfaces (Program-to-Program IRDs/ICDs):

• “Middle out” assessment based on the functions of the interface such as:

• Structural

• Electrical, data, or fluid pass-through

• Operations (specifically, the ESD Con Ops):

• Hazards imposed by planned ops.

• Environments (Thermal, winds, plume, etc.)

• Experience of Past Programs (SSP, CxP)

16

Approach to ESI IHA: Methodology

• Methodology adopted was “non-traditional” when compared to approaches used in 

past HSF programs.

• ESI IHA Cause Trees are not part of a single, comprehensive hazard model such as:

• Top-down fault tree

• Functional hazard analysis

• Hazard checklist

• With this methodology, classic hazard reports (a high-level hazard broken into causes) 

are not produced. 

• Cause trees are needed to relate individual causes to each other and to higher 

level Hazardous Conditions.

17
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

14 of 112

NESC Request No.: TI-14-00929, Volume II 

Approach to ESI IHA: Methodology

18

Cross Program architecture was assessed to identify hardware interfaces (i.e., mechanical, electrical, fluid, etc.), 

system interactions, and interdependencies to define a comprehensive list of

hazardous conditions/hazard topic areas. Approximately 270 hazardous conditions were identified.

Preliminary

Architecture 

Assessment

Closely coupled Engineering and S&MA teams identified ~270 hazardous conditions.

Approach to ESI IHA: Methodology

19

Hazardous 

Condition 

Development

Cross Program architecture was assessed to identify hardware interfaces (i.e., mechanical, electrical, fluid, etc.), 

system interactions, and interdependencies to define a comprehensive list of

hazardous conditions/hazard topic areas. Approximately 270 hazardous conditions were identified.

Hazardous 

Condition #XX

H

C

Hazardous Hazardous Hazardous 

Condition #XX

Hazardous Hazardous Hazardous 

Condition #XX

H

Co

Hazardous Hazardous Hazardous 

Condition #XX

Preliminary

Architecture 

Assessment

The hazardous conditions identified in the preliminary 

assessment were reviewed to eliminate duplication, 

identify Program-only content, identify single event 

causes and organized into natural groupings for cause 

tree development. Final review resulted in 70+ 

hazardous conditions.

270 conditions assessed by CSI, Program S&MA, and Program Engineering and placed 

into logical groupings.

Groupings would become the starting point for next step – Cause Tree development.
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

15 of 112

NESC Request No.: TI-14-00929, Volume II 

Approach to ESI IHA: Methodology

20

Hazardous 

Condition 

Development

Cross Program architecture was assessed to identify hardware interfaces (i.e., mechanical, electrical, fluid, etc.), 

system interactions, and interdependencies to define a comprehensive list of

hazardous conditions/hazard topic areas. Approximately 270 hazardous conditions were identified.

Step 1:

First/Preliminary Draft

Developed

Step 2:

Final Draft Reviewed

By Technical Community

For Development of 

Final Product

ESI MPCV GSDO SLS

Hazardous 

Condition #XX

H

C

Hazardous Hazardous 

Condition #XX C

Hazardous Hazardous Hazardous 

Condition #XX

H

Co

Hazardous Hazardous 

Condition #XX

ESI ESI

Cause Tree

Development

Preliminary

Architecture 

Assessment

The hazardous conditions identified in the preliminary 

assessment were reviewed to eliminate duplication, 

identify Program-only content, identify single event 

causes and organized into natural groupings for cause 

tree development. Final review resulted in 70+ 

hazardous conditions.

Each Top-Level Hazardous Condition was assigned to a Program to lead the 

development of Cause Trees.

ESI-owned Causes were “harvested” from Trees and assigned to Program Cause Teams 

for development.

Program-only causes were identified and provided to appropriate programs for 

consideration in their HA efforts.

Approach to ESI IHA: Methodology

21

Hazardous 

Condition 

Development

Cross Program architecture was assessed to identify hardware interfaces (i.e., mechanical, electrical, fluid, etc.), 

system interactions, and interdependencies to define a comprehensive list of

hazardous conditions/hazard topic areas. Approximately 270 hazardous conditions were identified.

Step 1:

First/Preliminary Draft

Developed

Step 2:

Final Draft Reviewed

By Technical Community

For Development of 

Final Product

ESI MPCV* GSDO* SLS*

Hazardous 

Condition #XX

H

C

Hazardous Hazardous Hazardous 

Condition #XX C

Hazardous Hazardous Hazardous 

Condition #XX

H

Co

Hazardous Hazardous Hazardous 

Condition #XX

ESI ESI

Cause Tree

Development

Preliminary

Architecture 

Assessment

ESI Cause

Development

The hazardous conditions identified in the preliminary 

assessment were reviewed to eliminate duplication, 

identify Program-only content, identify single event 

causes and organized into natural groupings for cause 

tree development. Final review resulted in 70+ 

hazardous conditions.

Cause # Title Accountability A Leads

Master Cause List

ESI Cause XXX ESI Cause XXX

ESI Cause XXX

ESI Cause XXX

ESI Cause Development

*Accountability Matrix (Transfers Program Only 

Causes to Programs for Assessment)

ESI Watch List

Program CEs accept 

ownership & CPIT tracks 

closure

Program CEs accept 

ownership & CPIT tracks 

closure

CPIT 

Presented to:
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

16 of 112

NESC Request No.: TI-14-00929, Volume II 

Approach to ESI IHA: Methodology

• Advantages of chosen approach:

• Allowed for a product with opportunity to influence design.

• Used available cross-program products in absence of more detailed design definition.

• Implementable with limited resources, the vast majority of which are provided by ESD 

Programs.

• Easily adaptable. Can add Cause Trees and Causes as design changes. (Example: Vehicle 

Stabilization System)

• Disadvantages:

• Potential to miss something due to lack of more structured model.

• Concerns and Lessons Learned:

• Common understanding of approach by all those involved in IHA development and review 

(including stakeholders).

• Difficult to see the “big picture” for causes and relationships between causes. Often results in 

scoping issues for these causes. 

• Example: Fire/Explosion causes are spread among multiple trees. 

• Sustainability and maintainability of the model structure over the long term.

22

ESI IHA DEVELOPMENT & REVIEW

Approach to ESI IHA

23
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

17 of 112

NESC Request No.: TI-14-00929, Volume II 

Approach to ESI IHA: IHA Product Development & Review

IHA Maturity for PDR

• These criteria for IHA content were approved by ESMAP and will be included 

in next rev of ESD S&MA Plan.

• IHA content consistent with level of PDR design definition.

• Hazard topics showing relationship between hazard topic and causes 

• Description and effect(s) for each hazardous topic

• Hazard causes identified

• Elimination/Mitigation strategies or preliminary controls for the hazard 

causes 

• Failure Tolerance/exception approach for applicable hazard causes

• Preliminary verification methods for each hazard control 

• Potential Crew Survival Methods (CSM) for catastrophic hazards and 

descriptions of their role in ensuring crew survival 

• All action items/RIDs required to be closed for phase I/PDR have been 

dispositioned

24

Approach to ESI IHA: IHA Product Development & Review

Products from ESI IHA 

• The ESI System Safety Analysis Report (ESI 10015) is the primary IHA product for 

any given milestone:

• Methodology Summary

• Cause Trees

• ESI Cause Sheets (aka Cause Records)

• Cause Title

• Description & Effects

• Mitigation Strategy and Acceptance Rationale

• Controls & Verifications

• Likelihood and Severity (LxS)

• ...

• Program-only causes

• ESI Watch Items 

• High Risk Causes

• The ESI SSAR is delivered as a draft for each Program’s major milestone.

• The SSAR will be baselined before or around the ESD Design-To Sync and formally 

revised for subsequent ESD milestones.

25

~95% of the SSAR content
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

18 of 112

NESC Request No.: TI-14-00929, Volume II 

Approach to ESI IHA: IHA Product Development & Review

26

TYPICAL CAUSE TREE

TYPICAL CAUSE RECORD

(partial)

ESI-owned Causes 

are “harvested” 

from Cause Trees

• 75 Cause Trees total.

• 70 Trees delivered with SSAR 

for GSDO PDR

• 190 Total Causes

• 149 with GSDO content 

(including 10 forward work 

Causes)

Approach to ESI IHA: IHA Development & Review for PDR

• Cause Tree Development & Review:

• All Cause Trees are assigned to a program S&MA engineer who facilitates the development of 

the Tree in collaboration with Engineering and S&MA from impacted or contributing programs.

• After initial drafting, a review is held with all appropriate stakeholders (including IHAWG 

members). Successful completion of that review results in a Cause Tree that is “Phase B 

complete”.

• Cause Development:

• ESI-owned Causes are harvested from Phase B Cause Trees and assigned to a Program for 

development.

• After basic Cause info is drafted (description, effects, mitigation strategy), IHAWG Lead and 

others meet with Cause Team to review and adjust the “scope” of the cause.

• IHAWG provided guidance on minimum content for PDR-mature causes. Also provided 

guidance on certain IHA cause categories to promote maturity and commonality.

• IHAWG Program Engineering and S&MA reps assign personnel to work together on Cause.

• Cause Review:

• Multiple reviews of IHA Causes to date:

• IHAWG/Grey-Beard Review of Causes and Trees prior to SLS PDR 

• ESD Change Request prior to SLS PDR

• Internal “Recovery” review by IHAWG post-SLS PDR

• IHAWG Table-Top Review prior to GSDO PDR (continued on next chart)

27
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

19 of 112

NESC Request No.: TI-14-00929, Volume II 

Approach to ESI IHA: IHA Development & Review for PDR

• Cause Review (continued):

• For GSDO PDR, the following review approach was employed:

• IHAWG table-top reviews were convened for the purpose of reviewing each cause needed 

for GSDO PDR (i.e., with GSDO content) prior to delivery to the milestone review.

• Chief Engineers and CSOs from ESI and each Program were invited to “augment” their 

participation in these reviews as desired.

• Cause Teams incorporate IHAWG agreed-to comments into causes.

• IHAWG Lead approves Cause for release to milestone review once comments (including 

comments from previous reviews) are verified as appropriately incorporated.

• Typical attendance for a Table-Top Review included:

28

• Mission Ops Rep

• Orion CE Rep

• GSDO CE Rep

• SLS CE Rep

• SLS CSO Rep

• IHAWG Admin

• Program Engineering

• Program S&MA

• Discipline Experts Reviewers

Presenters

* Program Engineering/SMA & IHAWG Lead

• Core IHAWG Members*

• CSI CSO Rep

• CSI CE Rep

• Crew Rep

• HMTA Rep

• IHAAT Members

Approach to ESI IHA: IHA Development & Review for PDR

• IHAWG Watch Items:

• Watch Items are opened as needed by any IHA team member to track any number 

of things, from issues to open work to process improvements.

• IHAWG periodically reviews Watch Items for status. IHAWG may elevate 

individual Watch Items to CPIT as needed to get help in resolving the WI. (IHAWG 

may also elevate certain WI’s for visibility.)

• While IHAWG tracks multiple WI’s, only those that have been elevated to CPIT and 

communicated to Program stakeholders are included in the ESI SSAR.

29
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

20 of 112

NESC Request No.: TI-14-00929, Volume II 

Approach to ESI IHA: IHA Development & Review 

Cross Program Hazard Analysis Database

• IHAWG makes extensive use of Ames-developed CP Hazard Database:

• Cause records

• Cause Tree metadata

• Watch Items

• Review and approval for release

• Reporting, including the bulk of the SSAR

• Database and developers are extremely flexible and responsive to changes 

needed by IHA Team.

30

Approach to ESI IHA: IHA Development & Review for PDR

SSAR Delivery for Program PDRs and ESD Sync

31

SLS PDR GSDO PDR Orion Δ-PDR ESD DT Sync

SSAR Draft 1 SSAR Draft 2 SSAR Dra SSAR Draft 3 SSAR Draft 4

RIDs/Comments

SSAR Dra

RIDs/Comments

SSAR Dra

RIDs/Comments

• 48 Cause Trees 

• 153 Causes with SLS 

Content • 70 Cause Trees (info only)

• ~149 Causes with GSDO Content 

(reviewable) *

• 33 Causes from Updated SLS PDR w/o 

GSDO content (info only) *

• ~75 (TBR) Cause Trees (info only)

• ~50 (TBR) Causes with Orion Content 

(reviewable) *

• ~140 (TBR) Updated Causes from previous 

PDRs w/o Orion content (Info only) * • All Cause Trees & Causes (reviewable) *

R Dra R Dra R Dra

* Minus any causes that are known forward work

CR SSAR B/L SS ESD Cross-Program Change Request
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

21 of 112

NESC Request No.: TI-14-00929, Volume II 

Top-Level View of the IHA

32

CAUSE TREES

Top-Level View of IHA

33

(ESI-018) Improper 

ICPS Fwd Umbilical 

Separation

ESI-018

Premature Separation 

of the ICPS Fwd 

Umbilical

G001

ICPS Fwd Umbilical 

Structural Failure

G004

Excessive Loading

G012

Improper Fluid 

Characteristics

G016

ESI 4985

Excessive Vehicle 

Excursion

G018

ESI 095

GSDO Design 

All owable Loads 

Exceeded

G019

GSDO

SLS Design 

All owable Loads 

Exceeded

G020

SLS

System/ Component Fai

lure

G021

GSDO 

System/ Component Fai

lure

G022

SLS

ICPS Fwd Umbilical 

Improper 

Configuration 

(Assembly/Buildup)

G005

ESI 5032

ICPS Fwd Umbilical 

System/Component 

Failure

G014

GSDO 

ICPS Fwd Umbilical 

System/Component 

Failure

G015

SLS

ICPS Fwd Umbilical 

Improper 

Configuration 

(Assembly/Buildup)

G005

ESI 5032

ICPS Fwd Umbilical 

Premature Release

G006

Premature release 

signal sent to LRS

G007

ESI 5000

ICPS Fwd Umbilical 

Improper 

Configuration 

(Assembly/Buildup)

G005

ESI 5032

ICPS Fwd Umbilical 

System/Component 

Failure

G061

GSDO

ICPS Fwd Umbilical 

System/Component 

Failure

G062

SLS

Failure to Properly 

Separate the ICPS Fwd 

Umbilical

G002

Late, Incorrect or No 

ICP S Fwd Um bi lical 

Release

G025

Late, Incorrect or No 

 Primary Release 

Mechanism

G029

ICPS Fwd Umbilical 

System/ Component Fai

lure

G033

SLS

ICPS Fwd Umbilical 

System/ Component Fai

lure

G064

GSDO

Primary mechanism is 

release cmd sent to 

LRS for Umbilical 

Plate Pin Retract

G067

ESI 5000

Late, Incorrect or No 

Secondary Release 

Mechanism

G063

ICPS Fwd Umbilical 

System/ Component Fai

lure

G065

SLS

ICPS Fwd Umbilical 

System/ Component Fai

lure

G066

GSDO

Secondary mechanism 

is activation of 

GSDO winch/wire rope

G068

GSDO

ICPS Fwd Umbilical 

Plate Hangup/ 

Mechanical Binding

G045

SLS

CSITU Fails Due to 

Inadequate Design 

Analysis, Reqts 

defintion, Ops 

Procedures

G013

ESI 4959

ICPS Fwd Umbilical 

Re-Contact with the 

Vehicle

G003

ESI 5008
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

22 of 112

NESC Request No.: TI-14-00929, Volume II 

Top-Level View of the ESI IHA: Major Hazardous Conditions 

• The IHAWG currently tracks 75 top-level Hazardous Conditions as Cause Trees.

• The following table shows the major categories in which these trees fall:

34

Cause Tree Area Number 

of Trees

Improper Cryo Load (LH2 and LOx – Core Stage and ICPS) 4

Improper Helium Load (Core Stage & ICPS) 2

LOx Geysering 1

Crew Access Arm Extendable Platform Impacts/Collides With 

Vehicle 1

Fire/Explosion In SLS/Orion Shared Compartment 1

Hazardous Environment External to Vehicle 2

Improper Crew Compartment Atmosphere During Launch 

Operations 1

Improper Operation Of FTS Leads To A Catastrophic Event 1

Improper Power Between GSDO and Flight Element 2

Structural Failure Of The MSA 1

Structural Failure Of The Vehicle Support Posts (VSPs) 1

Violation Of Thermal Environment Limits In The ISPE-SM 

Compartment 1

Excessive Vehicle/Tower Excursions 1

Improper Umbilical or T-0 Interface Operation Up to T-0 (1 

Tree per interface) 13

Improper Umbilical or T-0 Separation (1 Tree per interface) 13

Improper Ignition Overpressure Or Acoustics During Liftoff 1

Cause Tree Area Number 

of Trees

Recontact During Lift-Off or Staging 4

Improper start or shut-down of liquid engine or off-nominal 

performance 6

Plume Impingement & Interaction 1

Premature MPCV Separation 1

Debris Impact Results In Catastrophic Failure 1

Inadvertent Abort 1

Jettisoned Hardware Impact/Recontact With The Integrated 

Vehicle 1

Jettisoned Hardware/Debris Falls Outside Expected Footprint 1

Inability to Control Vehicle Trajectory (by Mission Phase) 5

Excessive Aero-Thermal Heating To The External Surface Of 

The Vehicle 1

Loss Of Communications During Operations 1

Adverse Radiation Effect 1

Inability To Open The LAS/CM Hatches When Required 1

Unable To Safely Recover The CM/Crew During Post Landing 

Operations 1

Natural Environments Mapping Tree 1

Improper Orion/SLS Umbilical Operation or Separation 2

35

Cryo Loading

• Improper Cryo/He Load

• Geysering

Hazardous Environments

• O2/H2 External to Vehicle

• SLS/MPCV Shared Compartment

• Crewed Compartment

Pre-Launch T-0 – Twr Clear Ascent

IOP & Acoustics

Improper Power b/n 

GSDO & Flight Veh

T-0 Interface Mal

T-0 Improper Sep

CAA/Vehicle Impact

Orbit & TLI

Inability to Control Vehicle Trajectory

Recontact (w/ tower, during seps, w/ jettisoned H/W)

Jettisoned H/W Debris Footprint

Loss of Comm

Adverse Radiation Effect (EMI, Conducted Emissions, RF, Laser, etc.)

Debris Impact

Fail to Start or S/D Liquid Engines

Abnormal Engine Thrust

Premature Engine Shutdown

Recovery

Failure to 

Recover Crew Plume Impingement & Interactions

Premature MPCV Separation, Inadvertent Abort

Structural Failure of Program Interface (VSPs, MSA)

Violation of Thermal Limits (Shared Compartment, Aero-thermal)

Inability to Open 

Hatches

Inability to Open 

Hatches

In-Space Ops

Top-Level View of the ESI IHA: Major Hazardous Conditions

Improper FTS Activation

Improper SLS/Orion Umbilical Operation or Separation

Recover Crew
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

23 of 112

NESC Request No.: TI-14-00929, Volume II 

(ESI-021) 

Malfunction of the ICPS AFT 

(JU1/JU2) Pull off Connectors 

up to Separation 

ESI-021

Excessive Vehicle 

Excursion

G023

ESI

Improper power 

characteristics

G004

ESI-035

Signal Path Failure

G028

ESI 5048

Improper signal 

characteristics 

G030

ESI 4994

System/Component 

Failure

G009

GSDO

System/Component 

Failure

G024

SLS

Arcing and/or Ignition 

Sources

G029

ESI 5078

Improper 

Configuration 

(Assembly/buildup)

G008

ESI 5036

Improper design analysis ,

requirements definition and 

operational procedures

G011

ESI 4961

Improper or Incorrect 

Modeling and/or 

Simulation analysis

G012

ESI

Improper, Incorrect 

or undocumented 

requirements (ICD, 

IRD, etc.)

G013

ESI

Top-Level View of the ESI IHA: Tree Example #1

36

Arcing/Ignition:

Excessive voltage, intermittent 

connections, voltage during sep.

Malfunction of the ICPS Aft Pull-off Connectors up to Sep

Improper Signal Characteristics: 

Degradation or corruption of 

signal across interface

Signal Path Failure: Loss of or 

misdirected signal across 

interface.

G004

ESI-035

S

E

Characteristics: 

orruption of 

rface

SI 5078

G

/

Inadequate Analysis, Definition, & Ops:

To be discussed as special topic.

Improper Umbilical Config: 

Improper build-up or installation 

of interface hardware.

8

ESI 5036

Excessive

connecti

6 ESI causes noted on tree (tanshaded events). 

Transfer to 

other cause tree

Top-Level View of the ESI IHA: Tree Example #2

37

(ESI-017) Malfunction 

of the ICPS Forward 

Umbilical up to 

separation

ESI-017

Excessive Vehicle 

Excursion

G023

ESI 095

Improper Fluid 

Characteristics

G005

ESI 4985

System/Component 

Failure

G009

GSDO

System/Component 

Failure

G024

SLS

Improper 

Configuration 

(Assembly/buildup)

G008

ESI 5032

Improper design 

analysis requirements 

definition and 

operational 

procedures

G011

ESI 4959

Improper or Incorrect 

Modeling and/or 

Simulation analysis

G012

ESI

Improper, Incorrect 

or undocumented 

requirements (ICD, 

IRD, etc.)

G013

ESI

ESI-017 - Malfunction of the ICPS Fwd Umbilical up to Sep

Improper Fluid Characteristics: Improper 

fluid pressure/temp/flow/purity; ice 

build-up; contamination

Excessive Vehicle Excursion: 

Relative movement between 

flight vehicle and tower in excess 

of design limits.

I

5

System/Component 

Failure

G009

GSDO

System/Component

Failure

G024

SLS

Program-only causes: captured in 

Program accountability matrix 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

24 of 112

NESC Request No.: TI-14-00929, Volume II 

Top-Level View of the ESI IHA: Tree Example #3

38

(ESI-018) Improper 

ICPS Fwd Umbilical 

Separation

ESI-018

Premature Separation 

of the ICPS Fwd 

Umbilical

G001

ICPS Fwd Umbilical 

Structural Failure

G004

Excessive Loading

G012

Improper Fluid 

Characteristics

G016

ESI 4985

Excessive Vehicle 

Excursion

G018

ESI 095

GSDO Design 

All owable Loads 

Exceeded

G019

GSDO

SLS Design 

All owable Loads 

Exceeded

G020

SLS

System/ Component Fai

lure

G021

GSDO 

System/ Component Fai

lure

G022

SLS

ICPS Fwd Umbilical 

Improper 

Configuration 

(Assembly/Buildup)

G005

ESI 5032

ICPS Fwd Umbilical 

System/Component 

Failure

G014

GSDO 

ICPS Fwd Umbilical 

System/Component 

Failure

G015

SLS

ICPS Fwd Umbilical 

Improper 

Configuration 

(Assembly/Buildup)

G005

ESI 5032

ICPS Fwd Umbilical 

Premature Release

G006

Premature release 

signal sent to LRS

G007

ESI 5000

ICPS Fwd Umbilical 

Improper 

Configuration 

(Assembly/Buildup)

G005

ESI 5032

ICPS Fwd Umbilical 

System/Component 

Failure

G061

GSDO

ICPS Fwd Umbilical 

System/Component 

Failure

G062

SLS

Failure to Properly 

Separate the ICPS Fwd 

Umbilical

G002

Late, Incorrect or No 

ICP S Fwd Um bi lical 

Release

G025

Late, Incorrect or No 

 Primary Release 

Mechanism

G029

ICPS Fwd Umbilical 

System/ Component Fai

lure

G033

SLS

ICPS Fwd Umbilical 

System/ Component Fai

lure

G064

GSDO

Primary mechanism is 

release cmd sent to 

LRS for Umbilical 

Plate Pin Retract

G067

ESI 5000

Late, Incorrect or No 

Secondary Release 

Mechanism

G063

ICPS Fwd Umbilical 

System/ Component Fai

lure

G065

SLS

ICPS Fwd Umbilical 

System/ Component Fai

lure

G066

GSDO

Secondary mechanism 

is activation of 

GSDO winch/wire rope

G068

GSDO

ICPS Fwd Umbilical 

Plate Hangup/ 

Mechanical Binding

G045

SLS

CSITU Fails Due to 

Inadequate Design 

Analysis, Reqts 

defintion, Ops 

Procedures

G013

ESI 4959

ICPS Fwd Umbilical 

Re-Contact with the 

Vehicle

G003

ESI 5008

ESI-018 Improper ICPS Fwd Umbilical Sep

(Broken out of following charts)

8 ESI causes noted on tree (tan-shaded events). 

However, there are actually 5 unique causes on this tree.

It also shares 3 causes with previous tree.

Top-Level View of the ESI IHA: Tree Example #3

39

Next page

Inadequate Analysis, Definition, & Ops:

To be discussed as special topic.

Umbilical recontact: inadequate 

retraction, capture

Release signal; Early, late, or 

no signal sent to umbilical.

(ESI-018) Improper 

ICPS Fwd Umbilical 

Separation

ESI-018

Premature Separation 

of the ICPS Fwd 

Umbilical

G001

ICPS Fwd Umbilical 

Structural Failure

G004

Excessive Loading

G012

Improper Fluid 

Characteristics

G016

ESI 4985

Excessive Vehicle 

Excursion

G018

ESI 095

GSDO Design 

All owable Loads 

Exceeded

G019

GSDO

SLS Design 

All owable Loads 

Exceeded

G020

SLS

System/ Component Fai

lure

G021

GSDO 

System/ Component Fai

lure

G022

SLS

ICPS Fwd Umbilical 

Improper 

Configuration 

(Assembly/Buildup)

G005

ESI 5032

ICPS Fwd Umbilical 

System/Component 

Failure

G014

GSDO 

ICPS Fwd Umbilical 

System/Component 

Failure

G015

SLS

ICPS Fwd Umbilical 

Improper 

Configuration 

(Assembly/Buildup)

G005

ESI 5032

ICPS Fwd Umbilical 

Premature Release

G006

Premature release 

signal sent to LRS

G007

ESI 5000

ICPS Fwd Umbilical 

Improper 

Configuration 

(Assembly/Buildup)

G005

ESI 5032

ICPS Fwd Umbilical 

System/Component 

Failure

G061

GSDO

ICPS Fwd Umbilical 

System/Component 

Failure

G062

SLS

Failure to Properly 

Separate the ICPS Fwd 

Umbilical

G002

Late, Incorrect or No 

ICP S Fwd Um bi lical 

Release

G025

Late, Incorrect or No 

 Primary Release 

Mechanism

G029

ICPS Fwd Umbilical 

System/ Component Fai

lure

G033

SLS

ICPS Fwd Umbilical 

System/ Component Fai

lure

G064

GSDO

Primary mechanism is 

release cmd sent to 

LRS for Umbilical 

Plate Pin Retract

G067

ESI 5000

Late, Incorrect or No 

Secondary Release 

Mechanism

G063

ICPS Fwd Umbilical 

System/ Component Fai

lure

G065

SLS

ICPS Fwd Umbilical 

System/ Component Fai

lure

G066

GSDO

Secondary mechanism 

is activation of 

GSDO winch/wire rope

G068

GSDO

ICPS Fwd Umbilical 

Plate Hangup/ 

Mechanical Binding

G045

SLS

CSITU Fails Due to 

Inadequate Design 

Analysis, Reqts 

defintion, Ops 

Procedures

G013

ESI 4959

ICPS Fwd Umbilical 

Re-Contact with the 

Vehicle

G003

ESI 5008
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

25 of 112

NESC Request No.: TI-14-00929, Volume II 

Top-Level View of the ESI IHA: Tree Example #3

40

Improper Umbilical Config: Improper 

build-up or installation of interface 

hardware.

Improper Fluid Characteristics: 

Excessive Pressure, ice build-up

Release signal; Early signal 

sent to umbilical.

cs: 

-up

(ESI-018) Improper 

ICPS Fwd Umbilical 

Separation

ESI-018

Premature Separation 

of the ICPS Fwd 

Umbilical

G001

ICPS Fwd Umbilical 

Structural Failure

G004

Excessive Loading

G012

Improper Fluid 

Characteristics

G016

ESI 4985

Excessive Vehicle 

Excursion

G018

ESI 095

GSDO Design 

All owable Loads 

Exceeded

G019

GSDO

SLS Design 

All owable Loads 

Exceeded

G020

SLS

System/ Component Fai

lure

G021

GSDO 

System/ Component Fai

lure

G022

SLS

ICPS Fwd Umbilical 

Improper 

Configuration 

(Assembly/Buildup)

G005

ESI 5032

ICPS Fwd Umbilical 

System/Component 

Failure

G014

GSDO 

ICPS Fwd Umbilical 

System/Component 

Failure

G015

SLS

ICPS Fwd Umbilical 

Improper 

Configuration 

(Assembly/Buildup)

G005

ESI 5032

ICPS Fwd Umbilical 

Premature Release

G006

Premature release 

signal sent to LRS

G007

ESI 5000

ICPS Fwd Umbilical 

Improper 

Configuration 

(Assembly/Buildup)

G005

ESI 5032

ICPS Fwd Umbilical 

System/Component 

Failure

G061

GSDO

ICPS Fwd Umbilical 

System/Component 

Failure

G062

SLS

Failure to Properly 

Separate the ICPS Fwd 

Umbilical

G002

Late, Incorrect or No 

ICP S Fwd Um bi lical 

Release

G025

Late, Incorrect or No 

 Primary Release 

Mechanism

G029

ICPS Fwd Umbilical 

System/ Component Fai

lure

G033

SLS

ICPS Fwd Umbilical 

System/ Component Fai

lure

G064

GSDO

Primary mechanism is 

release cmd sent to 

LRS for Umbilical 

Plate Pin Retract

G067

ESI 5000

Late, Incorrect or No 

Secondary Release 

Mechanism

G063

ICPS Fwd Umbilical 

System/ Component Fai

lure

G065

SLS

ICPS Fwd Umbilical 

System/ Component Fai

lure

G066

GSDO

Secondary mechanism 

is activation of 

GSDO winch/wire rope

G068

GSDO

ICPS Fwd Umbilical 

Plate Hangup/ 

Mechanical Binding

G045

SLS

CSITU Fails Due to 

Inadequate Design 

Analysis, Reqts 

defintion, Ops 

Procedures

G013

ESI 4959

ICPS Fwd Umbilical 

Re-Contact with the 

Vehicle

G003

ESI 5008

ESI-OWNED CAUSES

Top-Level View of IHA

41
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

26 of 112

NESC Request No.: TI-14-00929, Volume II 

Top-Level View of the ESI IHA: IHA Causes

• The ESI IHA currently contains 190 ESI-owned causes.

• Number fluctuates due to:

• New Cause Trees being developed

• Combining of like causes where possible

• Deletion of causes due to non-applicability, non-credibility, transfer to program-only

• Many causes share much in common with other similar causes in the 

general hazard scenario and mitigation approach. 

• IHAWG categorizes each hazard cause to facilitate review and commonality 

of approach.

• Aids in cause scoping and table-top reviews where IHAWG can review similar 

causes one or two sessions.

• 20+ cause categories are used as shown on following chart.

42

Top-Level View of the ESI IHA: IHA Cause Categories

Cause Categories Used by IHAWG

43

Cause 

Category Description Number of 

Causes

Analysis Inadequate analysis, design, or ops 50

Recontact Recontact during lift-off, sep, or jettison 19

Fluid Char Improper fluid characteristics across interface 

(temp, pressure, flow, etc.) 17

Config Improper build-up/config of interface 16

Cryo Load Over-/under-press, geysering, over-/under-load 15

EMI Improperly characterized or controlled EMI 9

Arcing Arcing within T-0 electrical connection 8

Comm Loss of or improper communication 8

Channelization Improper signal path between elements 7

Data Char Improper/corrupted data signal across interface 7

Flam Flammable environment 5

Structural Structural failure 5

Abort Inadvertent abort 5

Ops Ops outside certified limits 4

IOP Excessive ignition over-pressure or acoustics 3

DOLILU Improper or corrupted DOLILU 2

FTS Inadvertent FTS or FTS failure when needed 2

Recovery Unable to recover crew 2

Traj Trajectory anomalies 2

Excursion Excessive excursion of flight or ground elements 1

Materials Material incompatibility 1

Power Improper power between programs 1

Release Sig Early, late, or no release signal to T-0’s 1

Total 190
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

27 of 112

NESC Request No.: TI-14-00929, Volume II 

Top-Level View of the ESI IHA: IHA Causes

44

Example of Typical Cause Sheet

Top-Level View of the ESI IHA: IHA Causes

45

Example of Typical Cause Sheet
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

28 of 112

NESC Request No.: TI-14-00929, Volume II 

Top-Level View of the ESI IHA: IHA Causes

46

Example of Typical Cause Sheet

Top-Level View of the ESI IHA: IHA Causes

47

Example of Typical Cause Sheet
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

29 of 112

NESC Request No.: TI-14-00929, Volume II 

Top-Level View of the ESI IHA: IHA Causes

48

Example of Typical Cause Sheet

Slices of the IHA

49
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

30 of 112

NESC Request No.: TI-14-00929, Volume II 

CAUSE SPECIAL TOPICS – ANALYSIS 

CAUSES

Slices of the IHA

50

Top-Level View of the ESI IHA: IHA Cause Categories

Analysis Causes

• IHAWG applied Shuttle IHA experience gained during Columbia return to flight 

regarding integrated design analyses.

• Primary objectives for developing these causes:

• Determine if integrated (cross-program) analysis is needed to characterize a potential hazard, 

validate the effectiveness of controls, or identify controls. Assure such an analysis exists, is inwork, or planned.

• Identify the actual analyses needed along with supporting models.

• Capture the controls & verifications needed to provide confidence in the results of the analyses.

• Management/Engineering processes that govern development, maintenance, approval of 

analyses/models and results.

• Plans for validation of results – testing, peer review, etc.

• Identify the critical assumptions and inputs, including those from other programs. 

• Identify the key design requirements resulting from analyses and assure requirements are 

implemented appropriately in IRDs/ICDs or other cross-program specs as appropriate.

• Identify needed operational requirements or constraints needed to assure system is operated 

within design limits derived from key analytical inputs or assumptions.

51
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

31 of 112

NESC Request No.: TI-14-00929, Volume II 

Top-Level View of the ESI IHA: IHA Cause Categories

Analysis Causes (continued)

52

Analysis

Key Assumptions

Key Inputs

Critical Models

Results

Design Docs Des Docs Ops Req’mnts Ops Req’m

Accounted For

Approved &

Controlled & Validated

Included

Accounted For

Key Parameters

Performed & 

Documented

sign D

Accounted For

Accounted For

Top-Level View of the ESI IHA: IHA Cause Categories

Analysis Causes

• Implementation was difficult.

• Completely different than a system HA

• What value does this add?

• What needs to be captured?

• What analyses does this apply to?

• IHAWG developed guidelines for analysis-related causes for use by Cause Teams

• Cause Scoping:

• Identify System/Critical Functions

• ID potential hazards associated with loss of and performance of functions.

• ID critical attributes associated with functions: Loads/margins; pressure/temp/flow rate; data 

transfer; tolerances; etc.

• ID any integrated analyses needed to characterize critical attributes: loads; CFD; tolerance 

stack-up; electrical; etc.

• Controls:

• Provide confidence in adequacy/accuracy of models: V&V; testing; conservatism; etc.

• ID how/where resulting design parameters are documented;

• ID any needed operational constraints required to assure system operated within limits as 

analyzed

53
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

32 of 112

NESC Request No.: TI-14-00929, Volume II 

Top-Level View of the ESI IHA: IHA Cause Categories

Analysis Causes (continued)

• Implementation was still difficult.

• Some “integrated” analyses not really cross-program.

• Some analyses delegated to lower levels.

• Identifying the real critical parameters is not straight-forward.

• Guidance doesn’t fit all situations.

• Team made very good progress, but still lots of work ahead.

• Several iterations of causes through IHAWG table-top reviews. 23 of 31 causes approved for 

release for GSDO PDR.

• Have some good examples for others in team to use.

54

Top-Level View of the ESI IHA: IHA Cause Categories

Example of Analysis Cause Sheet

55
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

33 of 112

NESC Request No.: TI-14-00929, Volume II 

56

Example of Analysis Cause Sheet

57

Example of Analysis Cause Sheet
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

34 of 112

NESC Request No.: TI-14-00929, Volume II 

58

Example of Analysis Cause Sheet

59

Example of Analysis Cause Sheet
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

35 of 112

NESC Request No.: TI-14-00929, Volume II 

60

Example of Analysis Cause Sheet

61

Example of Analysis Cause Sheet
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

36 of 112

NESC Request No.: TI-14-00929, Volume II 

62

Example of Analysis Cause Sheet

CAUSE SPECIAL TOPICS – DEBRIS 

HAZARDS

Slices of the IHA

63
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

37 of 112

NESC Request No.: TI-14-00929, Volume II 

Top-Level View of the ESI IHA: IHA Cause Categories

Debris Hazards

• Generally, debris impacts do not constitute integrated hazards from the strictest sense 

of the IHA definition.

• ESD Programs are not required to tolerate strikes from debris liberated by other programs.

• However, assessment of cross-program risks from debris is a highly integrated 

activity.

• Debris Transport Analysis needed to estimate likelihood of debris strikes to critical areas of 

flight and ground systems.

• Approach to debris hazards:

• Programs identify their debris sources.

• Cross-Program Debris Team (sub-team under Loads ITT) performs DTA using inputs from 

Programs. Results (debris environment) will be documented for Program assessment.

• Programs assess potential damage from debris environment.

• Results documented in program-owned hazard reports.

• IHAWG will own cause(s) associated with integrated analysis (DTA).

• IHAWG will capture/track program-owned debris hazards as events in Cause Tree ESI-049 

(Debris Impacts that Result in Catastrophic Failure).

64

Top-Level View of the ESI IHA: IHA Cause Categories

65

ESI-049 – Ascent and Liftoff Debris Impact that Results in Catastrophic Failure

ESI-owned DTA Cause Area where IHAWG Tracks Program 

Debris Strike Hazards

Debris Environment 

Exceeds Expected Env.

Incorrect Debris Source 

Definition

Debris Hazards
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

38 of 112

NESC Request No.: TI-14-00929, Volume II 

CAUSE SPECIAL TOPICS – T-0/UMBILICAL 

CAUSES

Slices of the IHA

66

Top-Level View of the ESI IHA: IHA Cause Categories

67

NOTIONAL

Eric Bissonnette LX-S1

T-0 Interfaces (GSDO-Flight)

Courtesy of GSDO

• 2 cause trees developed for each T-0 interface:

• Malfunction of interface up to separation

• Improper separation

• Premature separation

• Failure to properly separate 

• Recontact with flight vehicle

Malfunction Up To Sep Improper Sep

Improper Signal 

Characteristics

Improper Signal Path

Improper Fluid Characteristics

Inadequate Analysis, Design Def, or Operational Procedures

Improper Configuration

Arcing and Ignition Sources

Recontact

Early/Late/No Release Signal (1 cause record for all T-0 I/Fs)

177.4’

212.2’

322.4’

0.0’

Ø

27.

6’

iCPSU

(2 Plates)

ML Deck

LAS ECS 

TSMs are both on 

South side of ML

Swing Arm

CSITU

(Core Stage 

Avionics and 

GH2 Vent)

Swing Arm

OSMU 1

(ECS, Avionics)

Tilt Up

Pull Off

T-0 

Vehicle 

Stabilizer

Drop Down

TSM 1

Tilt Up

TSM 2

Tilt Up

ASEU/ASPU 1 Rise OffASEU/ASPU 2 Rise Off

CSFSU

Swing Arm

Causes
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

39 of 112

NESC Request No.: TI-14-00929, Volume II 

Top-Level View of the ESI IHA: IHA Cause Categories

• There are 66 IHA Causes related to T-0 Interfaces (Umbilicals and Vehicle 

Stabilization System)

• 35% of all Causes (190)

• 44% of Causes applicable to GSDO PDR (149)

• Cause categorization helped promote commonality and consistency in these 

causes.

• Special TIMs were convened to address certain T-0 related Cause 

categories.

68

DISCUSSION OF HIGH-RISK CAUSES

Slices of the IHA

69
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

40 of 112

NESC Request No.: TI-14-00929, Volume II 

Slices of the IHA: High-Risk Causes

• Per ESD S&MA Plan, any hazards with 3x5 LxS or higher are elevated to ESD (ECB) 

for final acceptance. This would occur later in the life cycle once hazards are finalized 

(prior to FRR or equivalent).

• At each major program and integrated milestone, the SSAR will contain a brief 

discussion of each hazard cause that meet the elevation criteria.

• Discussion is for visibility. Idea is to provide risk acceptor with current risk picture 

before affordable options for mitigation are lost.

• SSAR for any given Program milestone will only include high-risk causes 

applicable to that Program.

• Likelihoods will fluctuate over time with changes in uncertainty, design and design 

definition, operational definition, etc. 

• Initial likelihoods of IHA causes reflect best understanding of identified controls 

informed by experience. 

• With exception of single watch item associated with one of these causes that was 

elevated to CPIT, IHAWG does believe any additional management attention is 

required at this time.

70

Slices of the IHA: High-Risk Causes

• Following charts summarize High-Risk Causes that are depicted in the GSDO PDR 

version of the SSAR. 

• All high-risk causes will be included in the SSAR at ESD Design Sync

71

Record Title LxS

4302 Bird Strikes During Ascent (to be discussed as Watch Item) 5x5

4424 External H2 due to failure to dilute/inert Lag RS-25 H2 3x5

4426 H2 external to the vehicle due to unburned H2 from core stage 

APU exhaust

3x5

4428 External H2 due to failure to dilute/inert Lead RS-25 H2 3x5

4610 Loss of SLS to GSDO hardline communication due to improper 

system characteristics

3x5

4983 Improper load of the ICPS LO2 tank due to Propellant Under fill / 

Overfill

3x5

4981 Improper load of the ICPS LH2 tank due to Propellant Under fill / 

Overfill

3x5
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

41 of 112

NESC Request No.: TI-14-00929, Volume II 

72

Record Title LxS

4302 Bird Strikes During Ascent (to be discussed as Watch tem) 5x5

4424 External H2 due to failure to dilute/inert Lag RS-25 H2 3x5

• Fuel-rich mixture during on-pad shutdown. Potential for hazard environment external 

to vehicle if H2 not burned off or diluted.

• Hydrogen Burn-Off Igniters (HBOIs) placement and analysis in-work so 

effectiveness is uncertain.

• Preliminary Rain Bird flow rates and timing for acoustics potentially negate HBOI 

effectiveness.

• FireEx activation also affects HBOI operation.

• Cause Likelihood is Moderate: “May occur. Controls exist with some uncertainty.

• SLS PDR RID SLSP-0059:

• HBOI output will be modeled and HBOIs will be aligned to provide max coverage.

• Diverter plate on ML to protect HBOIs being modeled.

• FireEx analysis in work.

• Risk will be reassessed as part of RID closure.

• Cause record likelihood is expected to be categorized as low upon completion of the 

analysis.

73

Record Title LxS

4426 H2 external to the vehicle due to unburned H2 from core stage 

APU exhaust

3x5

• Core Stage CAPU vents GH2 below the Engine Section. Failure to burn-off the 

CAPU GH2 as it emerges from the Core Stage exhaust vents could result in 

hazardous concentrations of hydrogen external to the vehicle. 

• Hydrogen Burn-Off Igniters (HBOIs) placement and analysis in-work so effectiveness 

is uncertain.

• Cause Likelihood is Moderate: “May occur. Controls exist with some uncertainty.

• SLS PDR RID SLSP-0059, HBOI Effectiveness:

• HBOI output will be modeled and HBOIs will be aligned to provide max coverage 

for CAPU H2.

• Risk will be reassessed as part of RID closure.

• Cause record likelihood is expected to be categorized as low upon completion of the 

analysis.
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

42 of 112

NESC Request No.: TI-14-00929, Volume II 

74

Record Title LxS

4428 External H2 due to failure to dilute/inert Lead RS-25 H2 3x5

• Fuel-rich mixture during RS-25 start. Potential for hazard environment external to 

vehicle if H2 not burned off or diluted.

• Hydrogen Burn-Off Igniters (HBOIs) placement and analysis in-work so 

effectiveness is uncertain.

• Cause Likelihood is Moderate: “May occur. Controls exist with some uncertainty.

• SLS PDR RID SLSP-0059:

• HBOI output will be modeled and HBOIs will be aligned to provide max coverage.

• Risk will be reassessed as part of RID closure.

• Cause record likelihood is expected to be categorized as low upon completion of the 

analysis.

75

Record Title LxS

4610 Loss of SLS to GSDO hardline communication due to improper 

system characteristics

3x5

• Loss of hardline communication could occur if the redundant Ethernet cables, 

which run in close proximity to each other, were compromised/destroyed, possibly 

due to a common cause issue. 

• Loss of hardline communication could result in:

• Inability to execute critical functions/commands.

• Inability to monitor the state of a system, for example the pressure and 

temperature of a tank or the voltage of a battery. 

• Loss could result in catastrophic events such as over stressing structures (over 

filling, wrong sequence, etc.) 

• IHAWG will work with cross-program safing team to capture operational responses 

to loss of comm events.
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

43 of 112

NESC Request No.: TI-14-00929, Volume II 

76

Record Title LxS

4981 Improper load of the ICPS LH2 tank due to Propellant Under fill / Overfill 3x5

4983 Improper load of the ICPS LO2 tank due to Propellant Under fill / Overfill 3x5

• Prop under fill of propellants leads to premature engine shutdown/abort. 

• Overfill could cause:

• Wetting of pressurization diffuser to with potential pressurization control issues. 

• Propellant mass exceeds the mission needs (loss of payload delivery performance). 

• Prop flowing through vent/relief valve possibly causing a fire/explosion. 

• Icing and blockage at the vent relief valve, possibly resulting in an over pressurization and 

structural failure of the tank. 

• Currently many unknowns, TBDs, and TBRs. 

• The number and extent of what analyses to be done. 

• Wet dress rehearsal is the only procedural testing that will be done for verifying the 

loading requirements of the ICPS. 

• Differential pressure transducer for monitoring the propellant fill level is zero fault 

tolerant. (SPIO reports that the pressure transducer is only critical during loading, 

and could be replaced on the pad assuming adequate access . There is currently a 

trade study underway in regards to the removal of the ICPS access arm.)

• Engineering working the TBD/TBRs and should be matured in the coming months. 

• Once analyses completed and relevant documents are released, the risk should be lowered.

ELEVATED IHAWG WATCH ITEMS

Slices of The IHA

77
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

44 of 112

NESC Request No.: TI-14-00929, Volume II 

Slices of the IHA: Elevated Watch Items

• IHA Cause Record #4302, “Bird strikes during ascent”

• LxS: 5x5

• Lead Program: GSDO

• Summary:

• No controls for catastrophic hazard resulting from a bird strike have been identified.

• Likelihood based on lack of controls and Shuttle experience of 1 strike in

• Cross-Program Design Specification for Natural Environments (DSNE) defines bird 

environment (2.2 kg commonly found up to an altitude of 0.5 km above MLP).

• SLS Program Vehicle Design Environments does not allocate launch/ascent flora/fauna 

environments to SLS elements as a design requirement. 

• The risk of exposure to this environment to be assessed as part of the hazard analysis

• Orion System Requirements Document requires Orion to meet its requirements during and 

after exposure to the environments defined in the Cross-Program DSNE.

• Actual design capability is uncertain but not expected to meet DSNE based on CxP

history*.

• GSDO has no requirement to provide operational controls for bird strike.

• WI elevated to CPIT on 12/9/13

• Action to IHAWG to reassess likelihood using other applicable launch history from KSC & 

CCAFS.

78

* In waning days of CxP, Program was moving away from augmenting designs to withstand bird strikes towards 

using operational controls similar to Shuttle (avian radar, bird abatement, etc.). (reference Orion Change 

Directive #CEV-00254 and CxP directive C000432)

DEEP DIVE WHERE DAN WANTS TO GO

Slices of the IHA

79
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

45 of 112

NESC Request No.: TI-14-00929, Volume II 

AREAS WHERE IHA IMPACTED DESIGN

Success Stories

80

Success Stories: Where IHA Impacted Design

 The development and review of the IHA adds another level of crossprogram integration:

 Cause Tree development and review

 Cause Development

 Cause Review 

 The IHA team has been identifying issues as the analysis has matured, 

then passing them on to the design teams through the engineering 

representatives who then work them as part of their design cycles.

 With this “as they pop up” approach, the team has not tried to document them 

unless they remain an issue and end up on the Watch Item List.

 The next chart contains some examples that have been recalled by members.

 IHAWG has CSI action to track instances where IHA has impacted design 

or operations.

81
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

46 of 112

NESC Request No.: TI-14-00929, Volume II 

Success Stories: Where IHA Impacted Design

82

IHA Process Finding Results

Identified a potential failure tolerance deficiency during 

umbilical cause tree development that needed further 

interface work between JSC and KSC.

Design issue was identified and 

solution being worked in 

engineering

Requirements for limiting vehicle charging were deemed 

insufficient for controlling static build-up.

Cross-Program E3 requirements 

were updated (MPCV 70080).

Identified integrated analyses needed to characterize 

potential hazards or hazard controls: e.g., MSA 

hazardous gas analysis; SLS/Orion separation analysis; 

combined external leakage flammability analysis; core 

stage pressurization analysis given H2 bleed for APUs.

New analyses are in work.

Identification of LVSA diaphragm as a potential for 

several hazards which may reduce its intended 

advantage

Part of trade study to 

keep/remove diaphragm.

Identified Hydraulic lock up on the engine throttle valve. Identified integrated cause that 

needs analysis to determine 

consequence before working 

failure tolerance. 

Success Stories: IHA Status for GSDO PDR

• IHA Team delivered SSAR for GSDO PDR.

• 70 of 75 Cause Trees

• 139 of 149 Causes

• 10 Causes not approved for release (forward work):

• 7 Inadequate Analysis Causes on umbilicals and CAA

• 2 causes regarding inadvertent abort while on pad

• 1 Aft Skirt Purge umbilical configuration

• SSAR also includes 27 of 33 Causes updated since SLS PDR in response to predeclared RID:

• 6 Causes not approved for release:

• 1 on-hold pending SM/ICPS diaphragm trade study

• 3 Orion H/W jettison d/t SLS notification

• 1 RS-25/Booster plume analysis

• 1 Orion S-Band comm

• Other forward work includes updated program cause accountability matrix.

83
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

47 of 112

NESC Request No.: TI-14-00929, Volume II 

Forward Work for IHA

84

Forward Work: IHA Model Completeness & Sustainability

• As acknowledged prior to adoption of the ESI IHA methodology, the lack of a 

comprehensive model could result in gaps in the analysis.

• In addition, the current IHA model (Cause Trees) may not be easily maintainable or 

sustainable in the long run.

• The Cause Trees are not logically linked together and therefore have no easily 

recognizable relationship to each other.

• Related causes are spread across multiple trees (e.g., fire/explosion).

• Future owners and reviewers of the IHA will need specific understanding of the 

unique methodology employed in order to maintain the model.

• The IHAWG will evaluate options for evolving the current cause tree structure with the 

goal to have a comprehensive and sustainable model by the ESI Design-To Sync 

point.

• Planned completion: ESI Design Sync

85
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

48 of 112

NESC Request No.: TI-14-00929, Volume II 

Forward Work: Vehicle Safing in Response to Failures

• The IHA addresses conditions that may lead to realization of a critical or catastrophic 

outcome. However, not all of these conditions are imminently critical or catastrophic 

depending on time of occurrence and/or responses to initiating conditions.

• Loss of comm and loss of power between GSDO and flight systems (as examples) 

are assessed with a catastrophic severity. However, mitigations may be implemented 

such as safing responses (automated on flight systems) and operational workarounds. 

• The IHAWG is participating in the ad hoc cross-program team looking at potential 

responses to such initiating events.

• IHAWG will provide hazardous scenarios from the IHA. 

• Proposed safing operations will be assessed as part of the IHA.

• Planned completion: Orion Δ-PDR

86

Forward Work: MM/OD

• MM/OD is not currently included in the IHA.

• IHAWG will assess need for inclusion of MMOD in new or existing cause 

tree(s). 

• Planned completion: Orion Δ-PDR

87
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

49 of 112

NESC Request No.: TI-14-00929, Volume II 

Forward Work: Road to Orion Delta-PDR and ESI Sync Point

• Beyond forward work already discussed, IHAWG at a minimum will:

• Update causes and cause trees as needed

• Improve commonality and consistency across IHA content

• Improve cohesiveness between causes and cause trees (or future 

model)

88

Backup 

89
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

50 of 112

NESC Request No.: TI-14-00929, Volume II 

Approach to ESI IHA: IHA Development & Review for PDR

Distribution of Work Load

90

190 Causes

75 Cause Trees

Approach to ESI IHA: IHA Development & Review

SSAR Delivery Over Life Cycle - DRAFT

91

PDR

Jan ‘15

Nov ‘14 Aug ‘15 Apr ‘17

Oct ‘16

CDR EM-1 DCR

EM-1 SIR EM-1 FRR

Dec ‘17

Feb ‘17

EM-1 SAR

PDR

May ‘13

June ‘14 June ‘15

CDR

Dec ‘16

EM-1 SAR

CDR

Feb ‘15

PDR

Jan ‘14 Nov ‘16 Oct ‘17

SAR/ORRs

DT Sync BT Sync

Baseline/Rev

SLS

Orion

GSDO

CY’14 CY’15 CY’16 CY’17

Draft

g

CDR

Feb ‘15

CDR

CDR

Jan ‘15

Nov ‘14

DT Sync

b ‘17

-1 SAR

6

AR
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

51 of 112

NESC Request No.: TI-14-00929, Volume II 

• Cause record number 4408 – Structural Failure of the MPCVP to SLSP Interface due to Improper Loads Analysis or 

Definition during Ascent up to SM Separation

• Engineering Lead: Rumaasha Maasha S&MA Lead: Cody Hawes

• Potential Consequences – Improper loads definition leads to load exceedances during ascent due to 

unknowns/uncertainties within the analysis leads to structural failure of the interface and/or vehicle. 

• Current Control Strategy – To ensure analysis has adequate margin and conservatism or low uncertainty. 

Engineering will acquire modal data from a planned series of tests that include element static structural tests, 

element modal tests, a modal survey of the integrated vehicle in the VAB, and an instrumented roll-out. Engineering 

expects these test to provide sufficient data to confirm/validate the integrated vehicle model.

• Current Verification Strategy – Review and approval of the analysis and methodology by the Joint Loads Task 

Team (JLTT). Validation of models via the rollout and modal test. Engineering will review data from the modal survey 

and compare it to the model; any significant outliers could potentially delay the launch until the correlation between 

the model and the test is better understood.

• Likelihood Justification – The likelihood of structural failure due to an improper loads analysis/definition is currently 

ranked as moderate due to the uncertainty within the design; however, the uncertainty factors applied during the 

analysis/model and the FoS used during hardware design help mitigate the risk of loads exceeding the structural 

capability. The modal survey test should drive out potential discrepancies within the model. 

• Recommendations – Based on the better understanding of the application of uncertainty factors and FoS, 

recommend lowering likelihood to 2x5 (Low). Although it is possible to have errors within the loads definition process 

the uncertainty factors applied to the analysis and FoS applied to hardware design make the possibility of structural 

failure due to an improper loads definition low. Likelihood may be lowered more as the design matures and as the 

uncertainty within the analysis decreases.

3x5 Cause Records

92

National Aeronautics and Space Administration

3x5 Cause Records

• Cause record number 4424 - External H2 due to failure to dilute/inert Lag RS-25 H2

• Engineering Lead: Louise Strutzenberg S&MA Lead: Janette May

• Potential Consequences - Following an on-the-pad engine shutdown, the engine is designed to shutdown with a hydrogen lag 

which provides a fuel-rich environment to prevent LOX-rich combustion and hardware burn-through. Failure to burn-off the Lag 

GH2 as it emerges from the Core Stage Engine (CSE) nozzle could result in hazardous concentrations of hydrogen external to the 

vehicle, which could lead to a fire/explosion.

• Current Controls:

• Design: HBOI System function for lag H2 is identified in ICD-052-01

• Design: The HBOIs shall be configured with sufficient directional redundancy to prevent accumulation of H2 for all 

applicable environmental conditions and redundancy in the event of HBOI failure to operate. Configuration of the HBOI 

system will be documented in SLS-ICD-052-03

• Operational: A complete ground checkout of the HBOI will be performed prior to launch.

• Placeholder Control: Firex water system may improve or worsen dilution of Lag H2 depending timing, location, etc. Will 

consider all aspects of the pad configuration including Firex timing and location in the analysis.

• Current Control Strategy – Hydrogen Burn-Off Igniters (HBOIs) or “sparklers” are used to burn-off the vented GH2 by ejecting 

hot particulates. The HBOI system is mounted on the mobile launcher near the SLS core stage engine nozzles and is comprised 

of 6 pairs of HBOIs to provide redundant coverage for the 4 SLS CSEs and the 2 CAPU exhaust vents.

• Current Verification Strategy – TBD analysis will be performed to verify HBOIs will be adequate to ignite Lag GH2 based on 

engine-provided allowable leak rates. . Analysis will be documented in SLS-HDBK-033, SLSP Vehicle Acoustic Data Book. HBOI 

alignment will be performed to ensure adequate coverage of all four engines.

• Likelihood Justification – HBOI placement and analysis are currently in-work and therefore the effectiveness of the HBOIs are 

uncertain. Also, preliminary Rain Bird water flow rates and timing requirements for mitigating the acoustic environments hazard,

compromises, or completely removes the HBOIs to effectively mitigate unburned Lag GH2 by potentially deflecting or quenching 

the HBOI output (hot particulates). Firex water (used to cool the surrounding surfaces to prevent re-ignition/explosion events 

during on-the-pad engine shutdown) may also worsen (or improve) HBOI effectiveness. Per SLS-RQMT-015, Moderate definition: 

May occur. Controls exist with some uncertainties.

93
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

52 of 112

NESC Request No.: TI-14-00929, Volume II 

National Aeronautics and Space Administration

3x5 Cause Records

• Cause record number 4424 - External H2 due to failure to dilute/inert Lag RS-25 H2 (continued)

• Recommendation – The HBOI output will be modeled and then aligned to provide maximum coverage with both 

systems operating across the modeled Main Engine Nozzle exit plane. A diverter plate on the ML to cascade rain bird 

water around HBOIs is currently being modeled. Firex water analysis on Lag GH2 during pad abort is in-work. Analysis 

supports PDR RID SLSP-0059, HBOI Effectiveness. Re-assessment of the risk level will be a part of its closure. This 

cause record is expected to be categorized as low upon completion of the analysis. 

94

• Cause record number 4426 – H2 external to the vehicle due to unburned H2 from Core Auxiliary Power Units (CAPU) 

exhaust 

• Engineering Lead: Louise Strutzenberg S&MA Lead: Janette May

• Potential Consequences – Core Stage CAPU system has been designed to vent GH2 below the Engine Section. 

Failure to burn-off the CAPU GH2 as it emerges from the Core Stage exhaust vents at engine start could result in 

hazardous concentrations of hydrogen external to the vehicle, which could lead to a fire/explosion.

• Current Controls:

• Design: The HBOIs shall be configured with sufficient directional redundancy to prevent accumulation of H2 for all 

applicable environmental conditions and redundancy in the event of HBOI failure to operate. Configuration of the HBOI 

system will be documented in SLS-ICD-052-03

• Operational: A complete ground checkout of the HBOI will be performed prior to launch.

• Current Control Strategy – Hydrogen Burn-Off Igniters (HBOIs) or “sparklers” are used to burn-off the vented GH2 

by ejecting hot particulates. The HBOI system is mounted on the mobile launcher near the SLS core stage engine 

nozzles and is comprised of 6 pairs of HBOIs to provide redundant coverage for the 4 SLS CSEs and the 2 CAPU 

exhaust vents.

• Current Verification Strategy – TBD analysis will be performed to verify HBOIs will be adequate to ignite CAPU H2 

based on Core-provided allowable leak rates. . Analysis will be documented in SLS-HDBK-033, SLSP Vehicle 

Acoustic Data Book. HBOI alignment will be performed to ensure adequate coverage of both CAPU exhaust vents.

• Likelihood Justification – HBOI placement and analysis are currently in-work and therefore the effectiveness of the 

HBOIs are uncertain. Per SLS-RQMT-015, Moderate definition: May occur. Controls exist with some uncertainties.

• Recommendations – The HBOI output will be modeled and then aligned to provide maximum coverage with both 

systems operating across the modeled CAPU exhaust vents. Analysis supports PDR RID SLSP-0059, HBOI 

Effectiveness. Re-assessment of the risk level will be a part of its closure. This cause record is expected to be 

categorized as low upon completion of the analysis. 

3x5 Cause Records

95
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

53 of 112

NESC Request No.: TI-14-00929, Volume II 

• Cause record number 4428 – External H2 due to failure to dilute/inert Lead RS-25 H2 

• Engineering Lead: Louise Strutzenberg S&MA Lead: Janette May

• Potential Consequences – The engine is designed to start with a hydrogen lead which provides a fuel-rich 

environment to prevent LOX-rich combustion and hardware burn-through. Failure to burn-off the Lead GH2 as it 

emerges from the Core Stage Engine (CSE) nozzle prior to engine start could result in hazardous concentrations of 

hydrogen external to the vehicle, which could lead to a fire/explosion.

• Current Controls:

• Design: HBOI System function for Lead H2 is identified in ICD-052-01

• Design: The HBOIs shall be configured with sufficient directional redundancy to prevent accumulation of H2 for all 

applicable environmental conditions and redundancy in the event of HBOI failure to operate. Configuration of the HBOI 

system will be documented in SLS-ICD-052-03

• Operational: A complete ground checkout of the HBOI will be performed prior to launch.

• Current Control Strategy – Hydrogen Burn-Off Igniters (HBOIs) or “sparklers” are used to burn-off the vented GH2 

by ejecting hot particulates. The HBOI system is mounted on the mobile launcher near the SLS core stage engine 

nozzles and is comprised of 6 pairs of HBOIs to provide redundant coverage for the 4 SLS CSEs and the 2 Core 

Auxiliary Power Units (CAPU) exhaust vents.

• Current Verification Strategy – TBD analysis will be performed to verify HBOIs will be adequate to ignite Lead H2 

based on engine-provided allowable leak rates. Analysis will be documented in SLS-HDBK-033, SLSP Vehicle 

Acoustic Data Book. HBOI alignment will be performed to ensure adequate coverage of all four engines.

• Likelihood Justification – HBOI placement and analysis are currently in-work and therefore the effectiveness of the 

HBOIs are uncertain. Per SLS-RQMT-015, Moderate definition: May occur. Controls exist with some uncertainties.

• Recommendations – The HBOI output will be modeled and then aligned to provide maximum coverage with both 

systems operating across the modeled Main Engine Nozzle exit plane. Analysis supports PDR RID SLSP-0059, HBOI 

Effectiveness. Re-assessment of the risk level will be a part of its closure. This cause record is expected to be 

categorized as low upon completion of the analysis. 

3x5 Cause Records

96

National Aeronautics and Space Administration

• Background

3x5 Cause Records

Rain Bird

Firex

HBOI

97
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

54 of 112

NESC Request No.: TI-14-00929, Volume II 

National Aeronautics and Space Administration

• Background

4.1.7 Hydrogen Burn off Igniter (CL-8000)

The purple shaded cones shown in Figures 4-52, 4-53, and 4-54 notionally depict the coverage of the Hydrogen Burn Off 

Igniters (HBOI) for the Core Stage Engines exhaust and TVC CAPU exhaust. The HBOI system will be comprised of 2 sets of 6 

each HBOIs (12 total per launch attempt) to provide redundant coverage for the 4 SLS Core Stage Engines and the 2 pairs of 

Core Auxiliary Power Unit exhaust vents. They will be directed at the SLS Core Stage Main Engines and CAPU exhaust vent 

pairs. The HBOI output is specified for a 15’ minimum throw with a 20㼻 cone pattern. The cone angle pattern will be modeled 

and then aligned to provide maximum coverage with both systems operating across the modeled Main Engine Nozzle exit 

plane. CAPU Exhaust Vent HBOIs will be directed at the each of the modeled exhaust vent locations. HBOIs will provide a 

minimum of 22 seconds burn duration and ignited prior to Core Stage Main Engine start (~ T-10 seconds).

3x5 Cause Records

Figure 4-52. HBOI Coverage Bottom View 98

National Aeronautics and Space Administration

• Cause record number 4582 – Ascent Trajectory Anomaly due to Unexpected Dynamic Response

• Engineering Lead: Rumaasha Maasha S&MA Lead: Cody Hawes

• Potential Consequence – Inability to correctly define or characterize the vehicle dynamic modes and responses 

causes load exceedances and leads to structural failure of the vehicle. 

• Current Control Strategy – To ensure analysis has adequate margin and conservatism or low uncertainty. 

Engineering will acquire modal data from a planned series of tests that include element static structural tests, 

element modal tests, a modal survey of the integrated vehicle in the VAB, and an instrumented roll-out. Engineering 

expects these test to provide sufficient data to confirm/validate the integrated vehicle model. Control algorithms are 

validated through rigorous testing in multiple dynamic situations. 

• Current Verification Strategy – Review and inspection of MAVERIC and Monte Carlo models to ensure compliance 

with the model and simulation plan. Models shall also be validated via the rollout and modal test. 

• Likelihood Justification – The likelihood of structural failure due to load exceedances caused by an unexpected 

dynamic response is currently ranked as moderate due to the uncertainty within the design; however, uncertainty 

factors applied to the G&NC algorithms used in the analysis and the FoS used during hardware design help mitigate 

the risk of loads exceeding the structural capability. The margin/uncertainty factors used in the analysis account for 

uncertainty and errors. The modal survey test should drive out potential discrepancies within the model and it is 

very unlikely to launch without proper correlation of the model to the test. 

• Recommendations – Based on the better understanding of the application of uncertainty factors to the G&NC 

algorithms and FoS used during hardware design, recommend lowering likelihood to 2x5 (Low). Likelihood may be 

lowered more as the design matures and as the uncertainty within the analysis decreases. 

3x5 Cause Records

99
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

55 of 112

NESC Request No.: TI-14-00929, Volume II 

• Cause Record number 4610 – Loss of SLS to GSDO hardline communication due to improper system characteristics

• Engineering Leads: Jon Patterson, John Ormsby, and Bob Trapnell S&MA Lead: Early McKnight

• Hazard Cause – Loss of command/data path communication between Ground Support Design Organization (GSDO) 

and Space Launch System (SLS) interface during critical operations in the preflight phase of launch resulting in 

inability to execute functions like opening or closing valves or switches; and inability to monitor the state of a system, 

for example temperature and pressure of a tank or voltage of a battery.

• Potential Consequences – Potential consequences include over/under filling tanks resulting in structural failure or 

inability to reach target, inability to safely remove cryogens if required, loss of vehicle power due to under 

charged/damaged batteries, and failure to process commands. All of which potentially resulting in Loss of Mission 

(LOM), or Loss of Crew (LOC).

• Current Control Strategy – Currently, controls to ensure a viable communication path with fault tolerance are not 

ensured. The existence of redundant paths and separation of those redundant paths has been demonstrated to 

some extent, but common cause potential still exist.

• Likelihood Justification – The likelihood applied to this cause is moderate because of the uncertainty resulting from 

immaturity of analysis

• Recommendations –

• GSDO to provide capability to detect loss of communication sufficient to prevent catastrophic failure of vehicle or GSDO

• SLS to provide capability to detect loss of communication sufficient to prevent catastrophic failure of vehicle system

• Upon detection of loss of communication, switch to backup communication 

• Upon detection of loss of Safety-critical communication link, SLS and GSDO to provide capability to safe vehicle and/or 

ground systems as expeditiously as possible in order to minimize risk to crew, vehicle and facilities

3x5 Cause Records

100

• Cause record number 4981 – Improper load of the ICPS LH2 tank due to Propellant Under fill / Overfill

• Engineering Lead: Jay Russell S&MA Lead: Dustin Drake

• Potential Consequences – Under fill of propellants will lead to premature engine shutdown causing loss of vehicle 

thrust resulting in a mission abort. Overfill could cause the pressurization diffuser to become wetted which could 

result in potential pressurization control issues. Excessive overfill could result in LH2 flowing through vent/relief valve 

possibly causing a fire/explosion. Excessive overfill could also cause icing and blockage at the vent relief valve, 

possibly resulting in an over pressurization and structural failure of the tank. These effects or combination of effects 

may potentially result in loss of mission, loss of vehicle, or loss of crew. 

• Current Control Strategy – The propellant fill level sensor system in conjunction with GSDO control software will allow proper control of propellant flow rates to reach the nominal propellant load per the requirements defined in the 

ICDs. Operational procedures based on heritage loading information TBD.

• Current Verification Strategy – Testing at the wet dress rehearsal to ensure operational procedures lead to a proper 

propellant fill level as well as inspection of the ICDs to ensure proper propellant requirements are documented.

• Likelihood Justification – Currently there are many TBDs and TBRs which cause uncertainties in the controls and 

overall mitigation strategy. The number and extent of what analyses are going to be done is unknown at this time. The 

wet dress rehearsal is the only procedural testing that will be done for verifying the loading requirements of the ICPS. 

The differential pressure transducer for monitoring the propellant fill level is zero fault tolerant. Failure of the 

differential pressure transducer would likely require a de-tanking and roll back to the VAB. SPIO reports claim that the 

pressure transducer is only critical during loading, and could be replaced on the pad. This assumes there will be 

adequate access to the ICPS. There is currently a trade study underway in regards to the removal of the ICPS access arm.

• Recommendations – Engineering is working the TBD/TBRs and should be matured in the coming months. Once 

relevant documents are baseline and the analyses are released, the risk should be lowered. Additionally, perform 

sensor and software testing to ensure that overfill can be properly detected and that the software will provide the 

correct response to the situation. Add redundancy to fill level sensor system or accept risk of a de-tanking and roll 

back assuming access to the ICPS is not available.

• Cause record number 4983 – Improper load of the ICPS LO2 tank due to Propellant Under fill / Overfill

• 4983 is identical to 4981

3x5 Cause Records

101
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

56 of 112

NESC Request No.: TI-14-00929, Volume II 

Appendix C. ESD Cross Program Safety and Mission Assurance 

Plan (ESD 10010) 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

57 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

58 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

59 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

60 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

61 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

62 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

63 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

64 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

65 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

66 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

67 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

68 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

69 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

70 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

71 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

72 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

73 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

74 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

75 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

76 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

77 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

78 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

79 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

80 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

81 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

82 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

83 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

84 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

85 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

86 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

87 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

88 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

89 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

90 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

91 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

92 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

93 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

94 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

95 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

96 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

97 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

98 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

99 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

100 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

101 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

102 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

103 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

104 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

105 of 112

NESC Request No.: TI-14-00929, Volume II 
NASA Engineering and Safety Center 

Technical Assessment Report

Document #: 

NESC-RP14-00929 

Version: 

1.0

Title:

Review of ESD Integrated Hazard Development Process 

Page #: 

106 of 112

NESC Request No.: TI-14-00929, Volume I I 

Appendix D. Hazard Analysis Comparison 

Hazard Analysis Process

Exploration (ESD, SLS, MPCV, 

GSDO) Apollo - Pre-Apollo 1 Apollo - Post-Apollo 1 Shuttle - Original Shuttle Post- Challenger Shuttle Post-Columbia Constellation ISS Accidents/Close Calls Findings

Who:Owns the overall HA requirement

Enterprise System Development (ESD) Level I - As defined in ESD 10010 Enterprise System DevelopmentSafety and Mission Assurance Plan.

SSEB & PCSSP SSEB & PCSSP

Shuttle Program, documented in NSTS07700 Requirement Documents

SSP Program Level II SSP Program Level II S&MA Office MX

Constellation Program owned the HA requirements. Maintained by program SR&QA. 

Program Management

STS-1 two close calls: SRB Ignition Overpressure- noncatastrophic failure of Orbiter hardware. Aerodynamic anomaly - non catastrphic negative margins during ascent. Both owned by Level II System Integration. NEITHER WAS IDENTIFIED AS A HAZARD.

Generates the IHA

NASA - The IHAWG (as a CSI ITT) oversees the development of the Cross-Program Integrated Hazard Analysis and is responsible for tracking the schedule and status of the CPIH causes and compiling/delivering the System Safety Analysis Report. The IHAWG assigns Program S&MA and Engineering representatives to be responsible for the collaborative effort to generate and develop each CPIH cause and cause tree. 

SSEB & PCSSP SSEB & PCSSP System Contractor (Rockwell International)

Since all waivers and CILs were cancelled, Rockwell and NASA regenerated and expanded all IHA

SE&I Prime Contractor - USA & Subcontractor Boeing - the HR was a contract Deliverable

CxP SE&I led the development with Program and Project S&MA personnel - MOA from SE&I SMA identified responsibilities for specific IHAs.In-flight IHAs between Orion and Ares only were developed by Ares Project under delegation from CxP SE&I.

ISS/Payload Contractor/Element developer

Hazards were not identified

Reviews it

 Integrated Hazard Analysis Working Group (IHAWG).Drafts are delivered for review during major program milestones.Also undergoes cross-program review via change request prior to delivery for major cross-program milestones.

SSEB & PCSSP SSEB & PCSSP Rockwell Engineering and JSC S&MA Space Shuttle Safety Review Panel (SSRP) Integration Safety Review Panel (ISERP) Level II Safety Panel Constellation Safety and Engineering Review Panel (CSERP) 

Reveiwed and approved by the Flight SRP and/or GSRP (dependent on the nature of the hazard) per SSP 30599. Accepted by Program Management via CoFR process.

N/A

Approves/accepts it

Program Managers (s) (Joint 

PCB) and Level 1 (DAA for ESD AA) depending on the residual risk 

level

SSEB & PCSSP SSEB & PCSSP

JSC S&MA Director, NASA Integration Manager and finally NASA Shuttle Program Manager 

Same as Shuttle - Original. In adition all Criticality 1 items were required to be reviewed and accepted by NASA HQ. Involvement by crew and JSC engineering mandated. Additionally, NRC formed a post Challenger review of Controlled Hazards and Accepted Risk Hazards with Retention Rationale.

SSP Program Manager 

Approval of 1x5 , 2x4, 1x4, and all marginal, minor, and negligible hazards were approved by the CSERP. All other critical and catastrophic hazards, except those ranked 5x5, were approved by the CxCB. 5x5 hazards approved at the agency level - revisions after base lining reviewed and approved by CSERP (program cancelled prior to this)

Program Management N/A

Baselines it Enterprise System Development Control Board (ECB) SSEB & PCSSP SSEB & PCSSP SSP Program Control Board SSP Program Control Board SSP Program Control Board See above ? N/A
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

107 of 112

Hazard Analysis Process

NESC Request No.: TI-14-00929, Volume II 

Exploration (ESD, SLS, MPCV, 

GSDO) Apollo - Pre-Apollo 1 Apollo - Post-Apollo 1 Shuttle - Original Shuttle Post- Challenger Shuttle Post-Columbia Constellation ISS Accidents/Close Calls Findings

Implements controls and verifications (i.e., who makes it happen)

Programs SSEB & PCSSP SSEB & PCSSP

Projects, as directed by the Shuttle Program Manager

Projects, as directed by the Shuttle Program Manager

Projects, as directed by the Shuttle Program Manager

Projects ? N/A

Monitors/reviews systems changes for their effect on accepted risk level

S&MA personnel SSEB & PCSSP SSEB & PCSSP

System Contractor and NASA S&MA, report chages at FRR

Monitoring elevated to newly appointed Associate Administrator for Safety & Reliability

SSP Level II SE&I MS and S&MA

Integration S&MA personnel - Change approved by CSERP

? N/A

Generates the element-level HA

Prime Contractor - CFE NASA - GFENASA - SLS Integrated Hazards

SSEB & PCSSP SSEB & PCSSP Element Contractor S&MA

SSP Element Prime Contractors with oversight from NASA/ crew office

SSP Element Prime Contractors with oversight from NASA/ crew office

Prime Contractor Element Provider N/A

Reviews them

Varies between programs:NASA Safety & Engineering Reviews at minimum

SSEB & PCSSP SSEB & PCSSP

Element Contractor Engineering and NASA S&MA

SSRP

Center Safety Engineering Review Panels (KSERP, MSERP, JSERP) and SE&I (to check for integrated effects)

CSERP SRP/GSRP N/A

Approves them

Program Manager(s) and Level 1 (DAA for ESD AA) depending on 

the residual risk level

SSEB & PCSSP SSEB & PCSSP NASA Program Manager SSP Program Manager SSP Program Manager 

Approval of 1x5 , 2x4, 1x4, hazards were approved by the CSERP. All other critical and catastrophic hazards, except those ranked 5x5, were approved by the CxCB. 5x5 hazards approved at the agency level. All marginal, minor and negligible hazards approved at project level. - revisions after base lining reviewed and approved by CSERP (program cancelled prior to this )

SRP/GSRP N/A

Baselines them Program control Board (PCB) SSEB & PCSSP SSEB & PCSSP NASA Element Project Control Board NASA Element Project Control Board NASA Element Project Control Board See above ? N/A

Implements controls and verifications (i.e., who makes it happen)

Programs SSEB & PCSSP SSEB & PCSSP

NASA & Contractor S&MA and Engineering as directed by NASA Element Project Mgr

NASA & Contractor S&MA and Engineering as directed by NASA Element Project Mgr

NASA & Contractor S&MA and Engineering as directed by NASA Element Project Mgr

Element ? N/A

Monitors/reviews systems changes for their effect on accepted risk level

S&MA personnel SSEB & PCSSP SSEB & PCSSP

NASA and Contractor S&MA, report changes at FRR

NASA and Contractor S&MA, report changes at FRR, Additioal oversite from AA for Safety and Reliability at FRRs 

NASA and Contractor S&MA, report changes at FRR, Additioal oversite from AA for Safety and Reliability at FRRs 

Prime Contractor and Element S&MA Personnel - changes approved by CSERP

? N/A
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

108 of 112

Hazard Analysis Process

NESC Request No.: TI-14-00929, Volume II 

Exploration (ESD, SLS, MPCV, 

GSDO) Apollo - Pre-Apollo 1 Apollo - Post-Apollo 1 Shuttle - Original Shuttle Post- Challenger Shuttle Post-Columbia Constellation ISS Accidents/Close Calls Findings

What:Is the IHA starting point

Interfaces, operations concepts, and Shuttle and CxP hazards were used to derive potentially hazardous conditions. IHA is defined as any hazard in which more than one program is a contributing cause, control, or verification for the hazard. CPIHs require more than one program to contribute to the analysis of the system effect, the interactions/interfaces, and interdependencies of the hazard. 

Varies by element and 

subsystem

Varies by element and 

subsystem

Elements' FMEA/CILs, Element Hazard Analysis, and EEFA (Element Interface Functional Analysis), and definition of top level generic hazards

Elements' FMEA/CILs, Element Hazard Analysis, and EEFA (Element Interface Functional Analysis), and definition of top level generic hazards

Level II Fault Tree created by SSP SE&I

Program level Fault Tree Analysis. Development begun at the Concept Development Phase

Element-toElement

Is the process/flow

As defined in ESD 10010 Enterprise System DevelopmentSafety and Mission Assurance Plan.With 3 Programs - The cause trees are used to identify the IHA causes and the program-only causes for each hazard topic. IHA causes are assigned to the accountable program to be developed with engineering and safety representatives from the affected programs to define controls and verifications. Any causes determined to be program-only will be passed to the identified program for further evaluation. Individual programs are responsible for verification that program-only hazard causes have been properly mitigated.

MIL-S-38130 (then 882) MIL-S-38130 (then 882)

Contractor S&MA develops IHA, table top review with contractor engineering, engineering performs analysis, results of analysis assists in clsification of hazard - controlled hazard or accepted risk, or recommendation of design change 

Hazard Reports were not emphasized by the program, the focus was on FMEA/CIL Aditional crew involement and JSC Engineering sign off on FMEA/CIL and HA

Fault Tree Items --> Hazardous Events --> causes --> Hazard Reports Hazard Reports were submitted via SSP Change Request

Fault Tree developed. Causes identified and Hazard Reports developed. Product matures throughout life cycle review process

Safety review process, keyed to design maturity
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

109 of 112

Hazard Analysis Process

NESC Request No.: TI-14-00929, Volume II 

Exploration (ESD, SLS, MPCV, 

GSDO) Apollo - Pre-Apollo 1 Apollo - Post-Apollo 1 Shuttle - Original Shuttle Post- Challenger Shuttle Post-Columbia Constellation ISS Accidents/Close Calls Findings

Is included in the IHA (Condition, Cause, Effect, Mitigation, Control, Verification, Risk Classification, etc.)

 Mission Effectively, Mission Phase, Cause Description, Mitigation Strategy, Acceptance Rationale, Failure Tolerance, Likelihood Justification, Risk Matrix, Cause Tree Reference, Effects, Transfers Out, Controls, Control Verifications, Verification Status, Severity, Likelihood, FEMA/CIL number, Program/Element Control References, Crew Survival Notes, Background

Mostly included but not 

clear

Mostly included but not 

clear

Description of hazard, causes, controls, verification of controls, and clasification - controlled or accepted risk

Description of hazard, causes, controls, verification of controls, and clasification - controlled or accepted risk

Yes to all, along with Acceptance Rationale 

Mission Effectively, Mission Phase, Hazardous Condition Description, Cause Summary, Acceptance Rationale, Likelihood Justification, Hazard Risk Matrix, Cause, Fault Tree Reference, Effects, Transfers Out, Controls, Transfers In, Verifications, Verification Status, Severity, Likelihood, Safety Requirements, Interfaces, FEMA/CIL number, operations Related Documentation, Detection and Warning Method, CSM, Operational Implementation of CSM, Verification of CSM, Background

All

Is not included in the IHA

Hazards caused and controlled by a single program.Hazards during crew surivial ops (e.g., aborts).

no RAC no RAC

Hazards created by a single element and controlled by that element

Hazards created by a single element and controlled by that element

Hazards created by a single element and controlled by that element

Hazards created by a single project/element 

and controlled by that project/element

n/a

Is the format

 Narrative SSAR submitted at milestone reviews - ESI System Safety Analysis Report (ESD 10015).Hazard Tables in SSAR include top-level hazardous condition description and integrated (crossprogram) causes contributing to that condition.

Unknown Unknown Narrative report Narrative report Narrative report

 Narrative SSAR submitted at milestone reviews includea.The relevant information on the Project/element/subsystem being analyzed b. Descriptions and background data c. Reference(s) to milestone review data necessary to understand the analyzed system d. The ground rules for the analysis, hazards evaluated and excluded from further detail in hazard reports e. The hazard reports 

Safety Data Package/Hazard Reports
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

110 of 112

Hazard Analysis Process

NESC Request No.: TI-14-00929, Volume II 

Exploration (ESD, SLS, MPCV, 

GSDO) Apollo - Pre-Apollo 1 Apollo - Post-Apollo 1 Shuttle - Original Shuttle Post- Challenger Shuttle Post-Columbia Constellation ISS Accidents/Close Calls Findings

When:Are the products delivered Milestone Reviews Milestone Reviews Milestone Reviews

Initial delivery conurent with Design Reviews. All IHAs closed fefore each flight

HRs must be Submitted via CR Prior to FRR - 30 Days 

HRs must be Submitted via CR Prior to FRR - 30 Days

Final approval at SAR

Consistent with design and I&T maturity

Does the Crew Office get involved Yes. Member of IHAWG, Yes Yes

Individual interested crew members were involved in selected areas of interest

Yes, at SSRP and PRCB Yes, at ISERP and PRCB

Member of CSERP that reviews the SSAR (hazard reports, fault trees) throughout the process

Yes

Where:Are controls focused (Ops, Design, etc.)

Yes, as applicable. Fault tolerance for catastrophic hazards/DFMR per Human-Rating Requirements for Space Systems NPR 8705.2B.Controls for engineering processes driving integrated analysis and design definition.Ops controls such as constraints and OMRS.

Controls are spread out 

across the system by what 

was deemed important to 

cover

Controls are spread out 

across the system by what 

was deemed important to 

cover

First focus was on design(strongest controls), followed by Safety Systems, followed by notifications (alarms), followed by operational controls (weakest controls)

Design - preventing the hazardous event 

Design - preventing the hazardous event Design

Yes, as applicable. Twofault tolerance for Catastrophic Hazards/DFMR. SPP 50021, Safety Policy and Requirements

Are the safety design requirements defined

Human-Rating Requirements for Space Systems NPR 8705.2B and NPR 8715.3C NASA General 

Safety Program Requirements

Yes, but loosely by today's 

standards

Yes, but loosely by today's 

standards

Vol X of NSTS - 07700 doccumented all design requirements, including safety related requrements such as safety factors and safety margins, redundancy requirements and requirements for analysis and test. NHB-5300.4 was an SR&QA Process Requirement Documment for Shuttle Program. 

After Challanger accident, System Integrity Assurance Program Plan (SIAPP) was developed and imposed on the Shuttle Program,to elevate level of discipline of all activities from design, test, manufacturing, and operations. NSTS 22254 and NSTS 5300.5

NSTS 22254 and NSTS 5300.5

Constellation Architectural Requirements

SSP 50021, 5002, 5004, KHB 1700.7B

Are the verification requirements defined Program Verification Plans Yes - but loosely by today's standards Yes - but loosely by today's standards Yes, in the same documments as design requirements NSTS 22254 NSTS 22254

Program Verification Plan - clarifications for verifications in hazards listed in Appendix of CxP 70038 

SSP 50021, and applicable referenced documents.
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

111 of 112

Hazard Analysis Process

NESC Request No.: TI-14-00929, Volume II 

Exploration (ESD, SLS, MPCV, 

GSDO) Apollo - Pre-Apollo 1 Apollo - Post-Apollo 1 Shuttle - Original Shuttle Post- Challenger Shuttle Post-Columbia Constellation ISS Accidents/Close Calls Findings

Why:Was this approach taken

To influence design earlier than possible with a top-down fault tree approach.To take maximum advantage of program resources given lighttouch intgration approach.

Safety Program; "learn as 

you go" philosophy Safety Program

Shuttle development was challenging, with new technologies required and perception of no room for safety shortcuts. Therefore conventional top-down hazard analysis, with hierarchical controlls were used to provide safety net under untried design

Challenger accident resulted in increased focus on SSP Critical Items, FMEA, and CILs - Full review of all Program CILs

Columbia accident resulted in increased focus on SSP hazard reports and Program Integration - IHRs were rebaselined

Consistency from each project/element at each design phase - Consistency in formatting from project to project and element to element - Looked at Shuttle, Payload Safety, Space Station for guidance on use of fault tree methodology and hazard reports

Consensus standard, utilized by other NASA programs, DOD, industry.

How:Are hazards identified

Mixture of sources - Interface requirements; con ops; engineering interview/brainstoarming; experiences of past programs (Shuttle, CxP), cause trees. 

HA & FMECA HA & FMECA

Mixture of sources - top level generic hazards, Element FMEA, Element Hazard Analysis, and EEFAs

Mixture of sources - top level generic hazards, Element FMEA, Element Hazard Analysis, and EEFAs

Fault Tree Fault tree analysis approach 

Based on unmittigated credible worst case results.

Are the IHA controls implemented

Primarily through cross-program documentation (environments def, IRD/ICDs, etc.).Through program-owned documentation for engineering process controls.

Yes but no clearly Yes but no clearly

Following was preferred priority- design features/margins, safety features, warning systems, operational controls

Following was preferred priority- design features/margins, safety features, warning systems, operational controls

Following was preferred priority- design features/margins, safety features, warning systems, operational controls

A closed loop tracking system utilized for closing verifications - Hazard Precedence - a. Eliminate the Hazard b. Design to Minimize Hazards c. Incorporate Safety Devices d. Provide Caution and Warning Devices e. Develop and Implement Special Procedures

Consistant with fault tolerance and other design requirements.
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP14-00929

Version: 

1.0

Title:

Review of ESD Integrated Hazard 

Development Process 

Page #: 

112 of 112

Hazard Analysis Process

NESC Request No.: TI-14-00929, Volume II 

Exploration (ESD, SLS, MPCV, 

GSDO) Apollo - Pre-Apollo 1 Apollo - Post-Apollo 1 Shuttle - Original Shuttle Post- Challenger Shuttle Post-Columbia Constellation ISS Accidents/Close Calls Findings

Are the element HA controls implemented

Through program- and elementowned documentation, drawings, etc.

Yes but not clearly Yes but not clearly Same priority as in IHAs Same as in IHAs Same as in IHAs Same as above Same

Are the controls verified Test, Analysis, Inspection Not sure but likely in CM Not sure but likely in CM

Analysis and test during design, OMRS during operations

Analysis and test during design, OMRS during operations

Analysis and test during design, OMRS during operations

Test, Analysis, Inspection, Demonstration

As required by reference requirements.

Is configuration control implemented Yes Yes Yes

Math models under configuration control, configuration control of OMRSD, PCASS System - closed loop verification of satisfaction of the OMRS requirements

Submitted via CR and Under SSP Program CM

Submitted via CR and Under SSP Program CM

CxP hazard database was required to be under configuration control - SSAR delivered at each milestone review placed under program configuration control

?

Are likelihood and consequence assessed (numerically, subjectively)

Both qualitatively and quantitatively but matrix for likelihood only shows qualitative assessment. 

No RAC or probability 

calculations

No RAC or probability 

calculations

Only by engineering judgment

Subjectively - done to preclude people "gaming the numbers" in lieu of focusing on HR controls

Subjectively - done to preclude people "gaming the numbers" in lieu of focusing on HR controls

Methodology states both qualitatively and quantitatively but matrix for likelihood only shows qualitative assessment. 

Subjectively.

Are other risk identification/control processes integrated with the HAs (FMEA/CIL, PRA, etc.)

Linked to the CILs and programowned hazards/controls. Does not appear that way Does not appear that way

System Integration S&MA integrated IHA with FMEA/CIL, Element Hazards, EEFA (but not PRA) to create a safety net for the Space Shuttle System

NoFMEA/CILs had priority over HRs No not for IHRs

yes - linked to the fault trees and hazard reports -maintained in separate systems

Not specified.

Are LOC and LOV risks marked: separately or combined on (5x5) risk matrix

No No data No data No No No 

separately (JAW: I don't think CxP logged these seperately in the risk matrix. Considered worst case.)

Not specified.
REPORT DOCUMENTATION PAGE Form Approved

OMB No. 0704-0188

2. REPORT TYPE 

Technical Memorandum

 4. TITLE AND SUBTITLE

Review of Exploration Systems Development (ESD) Integrated Hazard 

Development Process

Appendices

5a. CONTRACT NUMBER

 6. AUTHOR(S)

Smiles, Michael D.; Blythe, Michael P.; Bejmuk, Bo; Currie, Nancy J.; 

Doremus, Robert C.; Franzo, Jennifer C.; Gordon, Mark W.; 

Johnson, Tracy D.; Kowaleski, Mark M.; Laube, Jeffrey R.

 7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES)

NASA Langley Research Center

Hampton, VA 23681-2199

 9. SPONSORING/MONITORING AGENCY NAME(S) AND ADDRESS(ES)

National Aeronautics and Space Administration

Washington, DC 20546-0001

 8. PERFORMING ORGANIZATION

 REPORT NUMBER

L-20523 NESC-RP-14-00929

10. SPONSOR/MONITOR'S ACRONYM(S)

NASA

13. SUPPLEMENTARY NOTES

12. DISTRIBUTION/AVAILABILITY STATEMENT

Unclassified - Unlimited

Subject Category 16 Space Transportation and Safety

Availability: NASA CASI (443) 757-5802

19a. NAME OF RESPONSIBLE PERSON

STI Help Desk (email: help@sti.nasa.gov)

14. ABSTRACT

The Chief Engineer of the Exploration Systems Development (ESD) Office requested that the NASA Engineering and Safety 

Center (NESC) perform an independent assessment of the ESD's integrated hazard development process. The focus of the 

assessment was to review the integrated hazard analysis (IHA) process and identify any gaps/improvements in the process 

(e.g., missed causes, cause tree completeness, missed hazards). This document contains the outcome of the NESC assessment. 

15. SUBJECT TERMS

Exploration Systems Development; Cross-Program Integrated Hazard Process; NASA Engineering and Safety Center; 

Integrated Hazard Analysis Process

18. NUMBER

 OF 

 PAGES

117

19b. TELEPHONE NUMBER (Include area code)

(443) 757-5802

a. REPORT

U

c. THIS PAGE

U

b. ABSTRACT

U

17. LIMITATION OF 

 ABSTRACT

UU

Prescribed by ANSI Std. Z39.18

Standard Form 298 (Rev. 8-98)

3. DATES COVERED (From - To)

February 2014 - November 2014

5b. GRANT NUMBER

5c. PROGRAM ELEMENT NUMBER

5d. PROJECT NUMBER

5e. TASK NUMBER

5f. WORK UNIT NUMBER

869021.05.07.09.49

11. SPONSOR/MONITOR'S REPORT

 NUMBER(S)

NASA/TM-2015-218676/Volume II

16. SECURITY CLASSIFICATION OF:

The public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, 

gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this 

collection of information, including suggestions for reducing this burden, to Department of Defense, Washington Headquarters Services, Directorate for Information Operations and 

Reports (0704-0188), 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302. Respondents should be aware that notwithstanding any other provision of law, no person 

shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

PLEASE DO NOT RETURN YOUR FORM TO THE ABOVE ADDRESS.

1. REPORT DATE (DD-MM-YYYY)

01- 01 - 2015