Attachment E - IMAR.pdf

To verify the correct version of this document, please contact the GeoXO Series Configuration Management Office.

DRAFT

Effective Date: February 03, 2021 418-XO-IMAR-0026 Responsible Organization: GeoXO Flight Project/Code 418 Version 2.0 with PC‐X00091 changes

To verify the correct version of this document, please contact the GeoXO Series Configuration Management Office.

Geostationary eXtended Observations (GeoXO) Flight Project

Instrument Mission Assurance Requirements (IMAR) Signature page

Prepared by:

Kuiana E. Carson Date GeoXO Flight Project, Deputy Chief Safety & Mission Assurance NASA GSFC, Code 383

Reviewed by:

Joseph M. Spector Date GeoXO Flight Project, Chief Safety & Mission Assurance NASA GSFC, Code 383

Steven W. Bidwell Date GeoXO Flight Project, Sys. Engineering Manager NASA GSFC, Code 418

Approved by:

Monica Todirita Date GeoXO Flight Project, Deputy Project Manager NASA GSFC, Code 418

/GeoXO Flight Project Mission Assurance

IMAR

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

Version: 1.1 Printed by: hlhedger Printed on: Tuesday, June 28, 2022

No filter applied.

No sort applied.

Generated from DOORS 9.7.2.4

Contents

1 1GENERAL

1.1 1Terminology

1.2 1Systems Safety and Mission Assurance Program

1.3 1Management

1.4 2Requirements Flowdown

1.5 2Suspension of Work Activities

1.6 2Surveillance

1.7 3Government Mandatory Inspection Points (GMIPs)

1.8 3Suppliers List

1.9 4Use of Inherited Products/Items

1.10 5Risk Management

1.11 5Contract Data Requirements List (CDRL)

2 7QUALITY MANAGEMENT SYSTEM

2.1 7General

2.1.1 7Suppliers of Procured Critical Hardware

2.1.2 7Suppliers of Critical Piece Parts

2.2 7Supplemental Quality Management System Requirements

2.2.1 7Control of Nonconforming Product

2.2.1.1 7Preliminary Material Review

2.2.1.2 8Material Review Board (MRB)

2.2.1.3 9Failure Review Board (FRB)

2.2.2 10Reporting of Non-Conformances

2.2.3 10Safety and Mission Assurance Policy

2.2.4 10Lessons Learned

2.3 10Orbital Debris Assessment Report (ODAR) and End of Mission Plan (EOMP)

3 11SYSTEM SAFETY

3.1 11General

3.2 11Mission Related Safety Requirements Documentation

3.3 12System Safety Deliverables

3.3.1 12System Safety Program Plan

3.3.2 12Safety Requirements Compliance Checklist

3.3.3 12Hazard Analyses

3.3.3.1 12Preliminary Hazard Analysis

Project: GeoXO Flight Project Mission Assurance Module: IMAR Baseline Version: 1.1

Contents ii

3.3.3.2 12Operations Hazard Analysis (OHA) and Verification Tracking Log (VTL)

3.3.3.3 13Instrument Safety Assessment Report (ISAR) and Verification Tracking Log (VTL)

3.3.3.4 13Mechanical Ground Support Equipment Safety Requirements

3.3.3.5 15Operating and Support Hazard Analysis (O&SHA)

3.3.4 15Hazardous Procedures for Payload I&T and Pre-Launch Processing

3.3.5 15Safety Non-Compliances and Waivers

3.3.6 15Support for Safety Working Groups

3.3.7 16Mishap Reporting and Investigation

3.3.8 16NASA Expendable Launch Vehicle (ELV) Payload Safety Program Forms

4 18RELIABILITY

4.1 18General

4.2 18Reliability Program Plan (RPP)

4.3 18Failure Modes Effects and Criticality Analysis (FMECA) and Critical Items List (CIL)

4.4 21Reliability Assessment and Predictions

4.5 21Limited Life Items

4.6 22Parts Stress Analysis

4.7 22Worst-Case Analysis

4.8 23Trend Analysis

5 24SOFTWARE ASSURANCE

5.1 24General

5.2 24Software Assurance Program

5.3 24Surveillance of Software Development, Maintenance, and Assurance Activities

6 26WORKMANSHIP

6.1 26General

6.2 27Design and Process Qualification

6.3 27Electrostatic Discharge Control (ESD)

6.4 28Printed Circuit Boards (PCB) Procurement, Test Coupons, and Verification Tests

6.5 29Use of Water-Soluble Flux

6.6 29Lead-Free and Tin Whisker Control Measures

6.7 30Ground Systems that Interface with Space Flight Hardware

6.8 30Training and Certification

6.9 30Handling

6.10 31Preservation and Packaging

6.11 31Splices, Trace Cuts and Jumper Wires

7 32EEE PARTS

7.1 32General

Contents iii

7.1.1 33Single Point of Contact

7.2 33Parts Control Board Plan

7.2.1 33EPCB Responsibilities

7.2.2 33EPCB Meetings and Notification

7.2.3 34EPCB Membership

7.3 34Part Selection and Processing

7.3.1 34Radiation Requirements for Part Selection

7.3.1.1 34Total Ionizing Dose (TID)

7.3.1.2 34Displacement Damage

7.3.1.3 34Single-Event Effects (SEE)

7.3.2 35Custom or Advanced Technology Devices

7.3.3 35Parts Approved on Prior Programs

7.3.4 35Parts Used in Off-the-Shelf Assemblies

7.4 35Failure Analysis

7.5 36Re-use of EEE Parts and Materials

7.6 36Master EEE Parts List

7.7 36Retention of Data and Test Samples

8 37MATERIALS AND PROCESSES

8.1 37M&P Selection, Control, and Implementation Plan (MPSCIP)

8.2 37Materials Usage Agreement (MUA)

8.3 37Materials Identification and Usage List (MIUL)

8.4 37Life Test Plan and Final Report for Lubricated Mechanisms

8.5 37Additive Manufacturing Control Plan (AMCP)

8.6 37AM Part Production Plan (PPP)

9 38CONTAMINATION CONTROL

9.1 38Contamination Control Plan

9.2 38Material Outgassing

9.3 38Foreign Object Debris Program

10 39METROLOGY AND CALIBRATION

10.1 39Metrology and Calibration Program

10.2 39Use of Calibrated and Non-Calibrated Instruments

11 41GIDEP ALERTS AND PROBLEM ADVISORIES

11.1 41Government-Industry Data Exchange Program (GIDEP)

11.2 41Alert Disposition

11.3 41GIDEP Reporting

11.4 41Review Reporting

Contents iv

12 43Appendix A. Acronym List

13 45Appendix B. CDRL Item Descriptions

14 47Appendix C. Mission Assurance Compliance Matrix

15 57Appendix D. Applicable Documents

16 60Appendix E. Reference Documents

Contents v

Page 1 of 60 Printed Tuesday, June 28, 2022

ID

IMAR1

IMAR761

IMAR762

IMAR2

IMAR3

IMAR933

IMAR4

IMAR6

IMAR7

IMAR8

IMAR9

IMAR5

IMAR10

Object Number

1.1

1.1.0-1

1.2

1.2.0-1

1.2.0-2

1.2.0-3

1.2.0-4

1.2.0-5

1.3

1.3.0-1

1.3.0-2

1.3.0-3

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

1 GENERAL

1.1 Terminology

The following requirements terminology is used throughout this document:

The use of “shall” designates a requirement that must be met.

The use of “will” designates a statement of fact or intention of the government.

The use of “may” designates that permission has been granted by the government.

The term “(TBD)” means, “to be determined” and is used when no value is available with subsequent study needed to obtain it.

The term “days” refers to calendar days, unless specified as business days.

1.2 Systems Safety and Mission Assurance Program

The Contractor shall implement a Safety and Mission Assurance (SMA) program that is consistent with contractual requirements.

The SMA program shall be documented in a Mission Assurance Implementation Plan (CDRL # MA 1-1). Note: The safety aspects of this program will be documented in the Systems Safety Program Plan (SSPP) in Section 3

The SMA program shall at a minimum cover:

⦁ Flight hardware that is designed, built, or provided by the Contractor, and its subcontractors or furnished by the government, from project initiation through launch and mission operations

⦁ The Ground Support Equipment (GSE) and test scripts that interface with flight items to the extent necessary to assure the integrity and safety of flight items, including but not limited to any electrical, optical, laser, and mechanical GSE that interfaces with flight articles.

⦁ How Electrical Ground Support Equipment (EGSE), and Mechanical Ground Support Equipment (MGSE) are certified to cause no harm to flight articles (including design for safety and current limiting).

⦁ All software critical for mission success

The Contractor's procedures, documentation and drawings shall specifically reference which GSE interfaces with flight hardware.

The Contractor shall submit a compliance matrix that identifies variance and acceptance rationale for processes, procedures, and standards that are proposed as alternatives to those specified by the contract (CDRL # MA 1-1).

1.3 Management

The Contractor shall designate a manager for assurance activities.

The Assurance Manager shall not be responsible for project costs and schedules other than those pertaining to assurance activities.

The Contractor shall ensure that the Assurance Manager has direct access to upper management that is independent of Contractor project management.

Page 2 of 60 Printed Tuesday, June 28, 2022

ID

IMAR763

IMAR11

IMAR12

IMAR13

IMAR26

IMAR14

IMAR15

IMAR16

IMAR17

IMAR18

IMAR27

IMAR764

IMAR19

Object Number

1.3.0-4

1.4

1.4.0-1

1.4.0-2

1.4.0-3

1.5

1.5.0-1

1.6

1.6.0-1

1.6.0-2

1.6.0-3

1.6.0-4

1.6.0-5

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

The Assurance Manager shall have the functional freedom and authority to interact with all elements of the project.

1.4 Requirements Flowdown

The Contractor shall ensure flow down of Safety and Mission Assurance (SMA) requirements as well as the processes, products, services, and technical data (e.g., specifications, drawings, process requirements, work instructions) to Subcontractors based on the work to be performed and establish a process to verify compliance, except for items identified through the Inherited Item Risk Assessment process (see Section 1.9 "Use of Inherited Products/Items").

The Contractor’s contract review and purchasing processes shall indicate the method for documenting, communicating, and reviewing requirements with sub-tier suppliers to ensure requirements are met.

The Contractor shall ensure that quality plans, processes, procedures, hardware, and software submitted by the Contractor’s Subcontractor suppliers are compliant with the requirements in this IMAR, as applicable.

1.5 Suspension of Work Activities

The Contractor shall direct the suspension of any work activity that presents a hazard, imminent danger, or future hazard to personnel, property, or mission operations resulting from unsafe acts or conditions that are identified by inspection, test, or analysis.

1.6 Surveillance

The work activities, operations, and documentation performed by the Contractor and Subcontractors or suppliers shall be subject to evaluation, review, audit, inspection and survey by government-designated representatives as noted in the 418-XO- PLN-0109 Flight Project Quality Assurance Surveillance Plan (QASP). These audits, assessments, inspections, or surveys may be performed by NASA Project representatives and/or by NASA Supply Chain Quality representatives at various points over the program/project development lifecycle. Surveillance plans will focus on suppliers of project-defined critical items. (per NPR 8735.2).

In accordance with Federal Acquisition Regulations (FAR) 46.103, 46.104, 46.202-2, 46.4, and 46.5, the Contractor shall grant physical or remote access to NASA representatives to conduct an on-site and/or remote audit, assessment, inspection, or survey upon notice. A 30-day notice will be provided to the supplier prior to the start of an assessment.

The Contractor shall supply personnel, documents, records, equipment, and an acceptable work area within the Contractor's facilities to assist with the audit/assessments/inspections/surveys.

The Contractor shall report the status of facility operations and quality metrics to NASA monthly.

The status of facility operations and quality metrics reports shall include:

⦁ Quality escapes - Any product released by an internal or external supplier that is subsequently determined to be nonconforming to contract and/or

Page 3 of 60 Printed Tuesday, June 28, 2022

ID

IMAR19

IMAR20

IMAR765

IMAR21

IMAR766

IMAR767

IMAR768

IMAR22

IMAR32

IMAR33

Object Number

1.6.0-5

1.6.0-6

1.6.0-7

1.7

1.7.0-1

1.7.0-2

1.7.0-3

1.7.0-4

1.7.0-5

1.8

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements product specification requirements.

⦁ First Pass Yield - A measure of quality in a process that reflects the percentage of product made correctly without any rework or corrective activity.

⦁ Supplier Defect Rate - The supplier defeat rate measures the percentage of materials or product received from suppliers that do not meet required or compliance specifications.

⦁ Internal Audit results

The status of facility operations and quality metrics reports shall include Subcontractors of project-defined critical items.

The Contractor shall consider supplier quality and develop an industrial base and Supply Chain Risk Management (SCRM) Strategy per NPR 8735.2 during design and product selection.

1.7 Government Mandatory Inspection Points (GMIPs)

The Contractor shall provide a plan for proposed GMIPs, consistent with the requirements of NPR 8735.2 “Hardware Quality Assurance Program Requirements for Programs and Projects”, and subject to government approval.

The Contractor shall develop a criticality identification method, determine critical items and develop a plan to address them using hardware quality data management analytics per NPR 8735.2.

Prior to the start of manufacturing, the Contractor shall provide work instructions, procedures, drawings, etc. that are required for performing the planned inspections.

The following activities shall be subject to GMIPs:

⦁ Pre-ship inspection ⦁ Circuit card assemblies ⦁ Final solder inspection before conformal coating and staking ⦁ Post conformal coating ⦁ Pre-closure of boxes ⦁ Harness – pre-integration (pre-staking or potting) ⦁ Unit and component level assembly – witness final assembly ⦁ Mechanical – final assembly and acceptance test (unit/component, subsystem, and top-level assembly) ⦁ Software acceptance test ⦁ Rework and repairs to flight hardware

The Contractor can exclude non-critical items (as defined in NPR 8735.2 and determined by the project) or where GMIP requirements have been relieved as a result of the Inherited Item Risk Assessment (see Section 1.9 "Use of Inherited Products/Items"), or by the GSFC project office through terms of the procurement for commercial-off-the-shelf (COTS) items.

Note: This list is for planning purposes. Items may be added or deleted based on the specifics of the development effort.

1.8 Suppliers List

Page 4 of 60 Printed Tuesday, June 28, 2022

ID

IMAR34

IMAR35

IMAR36

IMAR37

IMAR38

IMAR905

IMAR906

IMAR907

IMAR908

Object Number

1.8.0-1

1.9

1.9.0-1

1.9.0-2

1.9.0-3

1.9.0-4

1.9.0-5

1.9.0-6

1.9.0-7

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

The Contractor shall provide a list of suppliers used for product(s) and services produced under this contract (CDRL # MA 1-2).

1.9 Use of Inherited Products/Items

For Inherited Products/Items, defined as those that will be build-to-print (BTP), rebuilt with modification, are available as COTS, or were previously developed and exist (e.g., spares), the Contractor may propose to follow the GSFC Inherited Item Risk Assessment process. Reference: (GPR 8730.5 Safety and Mission Assurance Acceptance of Inherited and Build-to-Print Products)

The Contractor shall comply with all requirements of the MAR and SOW for the Inherited Product unless specifically relieved by the GSFC Project office as a result of the Inherited Item Risk Assessment.

Use of this process does not relieve the Contractor from meeting contractual performance and functional requirements for the Inherited Product.

Inherited Item Data Package submissions for each Inherited Item shall be accompanied by Contractor’s Major MRB Form or Waiver for Inherited Item(s) not meeting MAR requirements.

The Contractor shall participate in Technical Interchange Meetings (TIM) regarding the baseline risk and risk mitigation strategies for Inherited Products. For candidate EEE Parts inherited items, the EPCB may act as the TIM.

Note: For Projects, this Inherited Item Risk Assessment is used to support Project planned reviews and meetings

For the Proposed Inherited Items List, the Contractor shall provide the following data in table format:

a. Name and Model of Inherited Products/Items proposed for Inherited Item Risk Assessment process

b. Manufacturer

c. Part Number

d. Origin (e.g., build to print / COTS, modified design of a previous build, existing product / flight spare)

e. Requirement tailoring need date (e.g. Subcontractor/supplier award date)

For the Inherited Item Data Package, the Contractor shall provide the following data:

a. Name and Model of Inherited Product/Item, Manufacturer, Manufacturer’s Part number, statement regarding their origin (e.g. build to print, COTS, modified design of a previous build, existing product, flight spare, or combination thereof)

b. Summary results of qualification, acceptance, or prototype/protoflight testing, or comparison of current qualification or proto-qualification requirements to that of the inherited product, including environments, required design margins, and life

c. Flight history and specific attributes for each flight, including comparison of environment to the current environmental requirements, including duty cycle and general concept of operations

Page 5 of 60 Printed Tuesday, June 28, 2022

ID

IMAR908

IMAR909

IMAR769

IMAR770

IMAR771

Object Number

1.9.0-7

1.9.0-8

1.10

1.10.0-1

1.11

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

d. MRB disposition for inherited products that do not meet this MAR or mission requirements

e. Ground and on-orbit anomaly and failure history including the determination of root causes or information that root cause was not determined (ground anomalies may be restricted to major anomalies, where component performance requirements were violated)

f. Reliability analyses performed for the most recent version of the product

g. Identification of significant changes in manufacturing from the qualified product to current product (e.g., facility, process, sub-tier supplier, testing, company change of ownership), and changes in design or materials, including electronic parts, printed circuit boards, or standards used

The Contractor may provide information from the following to mitigate risk:

a. Deviations of the product from the original design and reasons for each deviation (e.g., white wires, cut traces, and splices). Note; if the design was qualified on a previous GSFC Project in the same environment and same risk posture, then the deviations may be discussed relative to the previously qualified design

b. Specifications and standards used to develop/build the inherited product (e.g., IPC, J-STD, NASA, or GSFC requirements, including fastener integrity approach, or company standards). For products with minimal prior flight history, company standards or detailed synopses of such should be provided, if such are used to develop the product

c. Previous as-built parts list, including lot date codes, and the differences for new inherited item. This should include evidence that Government Industry Data Exchange Program (GIDEP) alerts and advisories have been properly dispositioned if the parts have already been procured.

Note that GIDEP should always be used as an aid in procuring new parts or pulling parts from inventory. Reference to prior Project deliveries to GSFC is acceptable, in which case, an amendment may be delivered to indicate any changes

d. Known obsolete parts that are to be supplied from existing inventory, including the quantity required and the quantity available. If available, include the sparing plan (quantity required, quantity available, and sparing philosophy)

e. Materials list and approved Material Usage Agreements (MUAs).

Materials list should include lot date codes and evidence that GIDEP alerts and advisories have been properly dispositioned, if the materials have already been procured. Such evidence should be encompassed in GIDEP closure records for each of the items that have impacts. Reference to prior Project deliveries to GSFC is acceptable, in which case, an amendment may be delivered to indicate any changes

f. List of major electrical and mechanical analyses completed and summary of results

1.10 Risk Management

SMA activities shall be coordinated with the Contractor's Risk Management processes. For example, see the Section 4 Reliability discussion regarding risks managed in the project’s risk database that evolve from reliability analyses.

1.11 Contract Data Requirements List (CDRL)

Page 6 of 60 Printed Tuesday, June 28, 2022

ID

IMAR772

IMAR774

Object Number

1.11.0-1

1.11.0-2

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

This document references CDRLs for deliverables, however the DIDs reside in the GeoXO Flight Project Contract Data Requirements Lists (CDRLs).

The Contractor may combine deliverables if the requirements for the individual deliverables are addressed.

Page 7 of 60 Printed Tuesday, June 28, 2022

ID

IMAR42

IMAR43

IMAR44

IMAR775

IMAR776

IMAR777

IMAR778

IMAR45

IMAR46

IMAR47

IMAR48

IMAR29

IMAR49

IMAR50

IMAR51

IMAR52

IMAR53

Object Number

2.1

2.1.0-1

2.1.1

2.1.1.0-1

2.1.2

2.1.2.0-1

2.2

2.2.0-1

2.2.1

2.2.1.0-1

2.2.1.0-2

2.2.1.0-3

2.2.1.0-4

2.2.1.1

2.2.1.1.0-1

2.2.1.1.0-2

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

2 QUALITY MANAGEMENT SYSTEM

2.1 General

The Contractor shall have a quality management system (QMS) that is compliant with the requirements of SAE AS9100 Quality Systems - Aerospace - Model for Quality Assurance in Design, Development, Production, Installation and Servicing.

2.1.1 Suppliers of Procured Critical Hardware

Suppliers of procured critical hardware systems (e.g., subassemblies, functional systems) as defined in the Critical Items List (CIL) shall be compliant to AS9100D.

Third-party certification to AS9100D is preferred over compliance to AS9100D.

2.1.2 Suppliers of Critical Piece Parts

Suppliers of piece parts determined to be critical items, or special process execution (e.g., plating, polishing, soldering, brazing) determined to be critical or services (e.g., machining, laboratory testing, transportation, and storage) determined to be critical, shall maintain a current QMS that complies with one of the following:

AS9100 (preferred), ISO9001, AS9003A, ISO17025 or other applicable technical accreditation (Nadcap, IPC, DoD).

2.2 Supplemental Quality Management System Requirements

The following requirements supplement identified portions of the AS9100 requirements.

2.2.1 Control of Nonconforming Product

The Contractor shall have a documented closed loop system for identifying, reporting, and correcting product nonconformances.

The system shall ensure that the adequacy of corrective action is determined by audit or test, that objective evidence is collected, and that preventive action is implemented to preclude recurrence.

The Contractor shall provide electronic access to the nonconformance system to designated local and remote government representatives.

Non-conformances shall be reported in accordance with (CDRL # MA 2-1).

2.2.1.1 Preliminary Material Review

The material review process shall be initiated with the identification and documentation of a non-conformance.

A preliminary review shall be the initial step performed by Contractor-appointed personnel to determine if the non-conformance is minor and therefore can readily be processed using the following disposition actions:

⦁ Scrap — the product is not usable ⦁ Re-work — the product will be re-worked to conform to requirements ⦁ Return to supplier — the product will be returned to the supplier

Page 8 of 60 Printed Tuesday, June 28, 2022

ID

IMAR57

IMAR787

IMAR58

IMAR59

IMAR30

IMAR54

IMAR60

IMAR64

IMAR65

IMAR61

IMAR68

IMAR779

IMAR780

IMAR781

Object Number

2.2.1.1.0-3

2.2.1.1.0-4

2.2.1.2

2.2.1.2.0-1

2.2.1.2.0-2

2.2.1.2.0-3

2.2.1.2.0-4

2.2.1.2.0-5

2.2.1.2.0-6

2.2.1.2.0-7

2.2.1.2.0-8

2.2.1.2.0-9

2.2.1.2.0-10

2.2.1.2.0-11

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

The Contractor shall refer the non-conformance to the Material Review Board when the above actions do not apply to the non-conformance.

Note: Preliminary Review does not negate the requirement to identify, segregate, document, report, and disposition non-conformances.

2.2.1.2 Material Review Board (MRB)

Non-conformances not dispositioned by Preliminary Review shall be referred to the MRB for disposition.

The Contractor shall have a documented process for the establishment and operation of an MRB to process major non-conformances, which are those that affect form, fit, function of the product, requires a software change, involves domestic or foreign object debris, or involves elevated risk per assessment by the Contractor.

The MRB process shall investigate and perform engineering analysis sufficient to determine cause, corrective action, and proper disposition in a timely manner.

The Contractor shall appoint an MRB chairperson who is responsible for implementing the MRB process and ensuring that the MRB actions are performed in compliance with this process as implemented by Contractor procedures.

The MRB shall consist of a core team of functional and project representatives with other disciplines brought in as necessary.

The MRB process shall include the Government Chief Safety and Mission Assurance Officer (CSO) or designee as a voting member. The CSO or designee reserves the right to include and poll the government project representatives (e.g. Systems Engineers, Discipline Leads, etc.) in the MRB before giving approval.

The MRB shall use the following disposition actions:

⦁ Scrap — the product is not usable ⦁ Re-work — the product will be re-worked to conform to requirements ⦁ Return to supplier — the product will be returned to the supplier ⦁ Repair — the product will be repaired using a repair process approved by the MRB ⦁ Use as is — the product will be used as is ⦁ Request for Waiver

All MRB meetings shall be documented in the Contractor's system and include a list of the attendees (virtual and in person), key discussions, action items, and decision of the voting members.

The Contractor shall ensure that the MRB conclusions are approved by a NASA/Government representative.

The NASA/Government written authorization shall be documented per the Contractor’s process to disposition the nonconforming product.

The Government shall be notified and provided applicable documentation, including Problem Reports, a minimum of 24 hours in advance of scheduled MRB meetings.

Page 9 of 60 Printed Tuesday, June 28, 2022

ID

IMAR62

IMAR69

IMAR70

IMAR104

IMAR154

IMAR758

IMAR71

IMAR66

IMAR67

IMAR72

IMAR79

IMAR73

IMAR74

IMAR80

IMAR783

Object Number

2.2.1.2.0-12

2.2.1.3

2.2.1.3.0-1

2.2.1.3.0-2

2.2.1.3.0-3

2.2.1.3.0-4

2.2.1.3.0-5

2.2.1.3.0-6

2.2.1.3.0-7

2.2.1.3.0-8

2.2.1.3.0-9

2.2.1.3.0-10

2.2.1.3.0-11

2.2.1.3.0-12

2.2.1.3.0-13

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

The Contractor shall document and inform the government of MRB actions no later than five (5) working days after MRB action for approval (CDRL # MA 2-1).

2.2.1.3 Failure Review Board (FRB)

Non-conformances not dispositioned by Preliminary Review or Material Review Board shall be referred to the Failure Review Board for disposition.

Non-conformances to be dispositioned by FRBs shall include those that have resulted in hardware or software test failures and damage or potential damage to hardware.

The Contractor shall have a documented process for the establishment and operation of an FRB to process non-conformances.

The FRB process shall investigate and perform engineering analysis sufficient to determine corrective action and proper disposition, in a timely manner.

The Contractor shall appoint an FRB chairperson who is responsible for implementing the FRB process and ensuring that the FRB actions are performed in compliance with this standard as implemented by Contractor procedures.

The FRB shall consist of a core team of functional and project representatives with other disciplines brought in as necessary.

The FRB process shall include the Government's Chief Safety and Mission Assurance Officer (CSO) or designee as a voting member. The CSO or designee reserves the right to include and poll the government project representatives (e.g., Systems Engineers, Discipline Leads, etc.) in the FRB before giving approval.

The FRB shall use the following disposition actions:

⦁ Scrap — the product is not usable ⦁ Re-work — the product will be re-worked to conform to requirements ⦁ Return to supplier — the product will be returned to the supplier ⦁ Repair — the product will be repaired using a repair process approved by the MRB ⦁ Use as is — the product will be used as is ⦁ Request for Waiver

All FRB meetings shall be documented in the Contractor's system and include a list of the attendees (virtual and in person), key discussions, action items, and decision of the voting members.

Written Government authorization shall be documented to disposition the non-conforming product.

The Contractor shall ensure that FRB conclusions are approved by a NASA/Government representative.

The Contractor shall document and inform the government of FRB actions no later than five (5) working days after each FRB action for approval (CDRL # MA 2-1).

The Government shall be notified and provided applicable documentation, including Problem Reports, a minimum of 24 hours in advance of scheduled FRB meetings.

Page 10 of 60 Printed Tuesday, June 28, 2022

ID

IMAR785

IMAR81

IMAR82

IMAR86

IMAR786

IMAR788

IMAR789

IMAR87

IMAR88

IMAR89

IMAR90

IMAR791

Object Number

2.2.1.3.0-14

2.2.2

2.2.2.0-1

2.2.2.0-2

2.2.2.0-3

2.2.3

2.2.3.0-1

2.2.4

2.2.4.0-1

2.3

2.3.0-1

2.3.0-2

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

Failures that cannot be duplicated, have unknown root cause, or cannot be verified shall be assessed for residual risk, and brought to the project risk board for disposition.

2.2.2 Reporting of Non-Conformances

The Contractor shall report:

⦁ Major hardware non-conformances beginning with the first application of power at the component level

⦁ Major software non-conformances beginning with flight software acceptance testing and when interfacing with flight hardware

⦁ Major mechanical system non-conformances beginning with the first operation

⦁ All non-conformances for review on a periodic basis as deemed appropriate by the government and Contractor SMA team

Non-conformance reporting shall continue through formal Government acceptance of the end item on orbit.

Note: a component is defined as a functional subdivision of a subsystem and generally as a self-contained combination of items performing a function necessary for the subsystem's operation and synonymous with Unit. Examples are electronics unit and sensor unit.

2.2.3 Safety and Mission Assurance Policy

Contactors shall ensure that appropriate review processes are in place at their level to certify the safety and operational readiness of flight hardware/software, mission critical support equipment, hazardous facilities/operations, and high-energy ground based systems.

2.2.4 Lessons Learned

The Contractor shall collect lessons learned in accordance with major review packages (SRR, PDR, CDR, PER and PSR) and provide them to the GeoXO Project.

2.3 Orbital Debris Assessment Report (ODAR) and End of

Mission Plan (EOMP)

The Contractor shall provide the information necessary for conducting the analyses to develop the ODAR and the EOMP deliveries per the content defined in NASA-STD

8719.14 Process for Limiting Orbital Debris Appendix A (ODAR) and Appendix B

(EOMP).

NOTE: Orbital Debris Assessment Software is available for download from Johnson Space Center at URL: http://sn-callisto.jsc.nasa.gov/mitigate/das/das.html

The Contractor shall provide inputs/data to ensure the implementation of orbital debris mitigation measures for all mission hardware in Earth orbit.

Page 11 of 60 Printed Tuesday, June 28, 2022

ID

IMAR91

IMAR92

IMAR93

IMAR910

IMAR94

IMAR95

IMAR99

IMAR100

IMAR101

Object Number

3.1

3.1.0-1

3.1.0-2

3.1.0-3

3.1.0-4

3.2

3.2.0-1

3.2.0-2

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

3 SYSTEM SAFETY

3.1 General

The Contractor shall document and implement a System Safety program to include their facility, and the launch facilities; support the ELV Safety Review Process as defined in Chapter 3 of NPR 8715.7, Payload Safety Program; comply with launch service provider requirements; and comply with launch range safety requirements.

The Contractor shall prepare a System Safety Program Plan (SSPP) that describes the development and implementation of a system safety program that complies with the requirements of NPR 8715.7, the launch service provider, and launch range safety.

The SSPP shall provide for early identification and control of hazards during design, fabrication, test, transportation, and ground activities.

The Contractor shall include the following specific safety requirements in the SSPP:

⦁ Three independent inhibits in the design (dual failure tolerant) if a system failure may lead to a catastrophic hazard. A prelaunch catastrophic hazard is a payload-related hazard, condition, or event occurring prior to launch that could result in a fatal injury to personnel or loss of a ground facility. A post-launch catastrophic hazard is a payload-related hazard, condition, or event occurring after launch and up to payload separation that could result in a fatal injury or loss of flight termination system. The system is defined as all flight hardware, all supporting equipment, interfacing EGSE and MGSE, and facilities.

⦁ Two independent inhibits in the design (single failure tolerant) if a system failure may lead to a critical hazard. A critical hazard is defined as a hazard, condition or event that may cause severe injury or occupational illness or major property damage to facilities. The system is defined as all flight hardware, supporting equipment, interfacing EGSE and MGSE, and facilities as applicable.

⦁ Compliance verification that must be met for design elements with hazards that cannot be controlled by failure tolerance. The process by which safety is incorporated into these design elements (e.g., structures and pressure vessels) is called "Design for Minimum Risk".

3.2 Mission Related Safety Requirements Documentation

The Contractor shall implement the launch range safety requirements that are applicable to the launch site.

The Contractor shall implement the most stringent safety requirement in the event there are conflicting requirements.

ELV Eastern Test Range (ETR)

⦁ NASA-STD 8719.24 (with Annex) NASA Expendable Launch Vehicle Payload Safety Requirements

⦁ KNPR 8715.3 KSC Safety Practices Procedural Requirements (applicable at KSC property, KSC-controlled property, and offsite facility areas where KSC has operational responsibility)

Page 12 of 60 Printed Tuesday, June 28, 2022

ID

IMAR101

IMAR105

IMAR106

IMAR107

IMAR108

IMAR109

IMAR110

IMAR111

IMAR112

IMAR113

IMAR114

IMAR75

IMAR792

IMAR76

IMAR120

IMAR121

Object Number

3.2.0-2

3.3

3.3.1

3.3.1.0-1

3.3.2

3.3.2.0-1

3.3.2.0-2

3.3.3

3.3.3.1

3.3.3.1.0-1

3.3.3.1.0-2

3.3.3.1.0-3

3.3.3.1.0-4

3.3.3.1.0-5

3.3.3.2

3.3.3.2.0-1

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

⦁ NPR 8715.7 Expendable Launch Vehicle Payload Safety Program ⦁ Launch Site Facility-specific Safety Requirements, as applicable

(e.g., Astrotech)

3.3 System Safety Deliverables

3.3.1 System Safety Program Plan

The Contractor shall prepare a System Safety Program Plan (SSPP) that describes the tasks and activities of system safety management and engineering required to identify, evaluate, and eliminate or control hazards to the hardware, software, and system design by reducing the associated risk to an acceptable level throughout the system life cycle, including launch range safety requirements complies with the requirements of NPR 8715.7, the launch service provider, and launch range safety.

(CDRL# MA 3-1).

3.3.2 Safety Requirements Compliance Checklist

The Contractor shall document and implement a Safety Requirements Compliance Checklist to demonstrate that the payload complies with NASA and range safety requirements (CDRL# MA 3-2).

The Contractor shall document design element non-compliances to safety requirements in safety waivers per section 3.3.5 of this document.

3.3.3 Hazard Analyses

3.3.3.1 Preliminary Hazard Analysis

The Contractor shall perform a Preliminary Hazard Analysis (PHA) in accordance with NASA-STD 8719.24 to obtain an initial risk assessment and to identify safety critical areas of a concept or system.

The Contractor shall base the PHA on the best available data, including mishap data from similar systems and other lessons learned.

The Contractor shall evaluate hazards associated with the proposed design or function for severity, control approach (fault tolerance or design for minimum risk), hazard probability and operational constraints.

The Contractor shall identify safety provisions and alternatives that are needed to eliminate hazards or reduce their associated risk to an acceptable level.

The Contractor shall deliver the PHA with Preliminary ISAR (CDRL # MA 3-3).

3.3.3.2 Operations Hazard Analysis (OHA) and Verification

Tracking Log (VTL)

The Contractor shall document, implement, and maintain an Operations Hazard Analysis (OHA) and a Hazard Verification Tracking Log (HVTL) to demonstrate that hardware operations, test equipment operations, and integration and test (I&T) activities comply with the safety requirements of the facilities where the activities will be performed and that hazards associated with those activities are mitigated to an acceptable level of risk (CDRL # MA 3-4).

Page 13 of 60 Printed Tuesday, June 28, 2022

ID

IMAR23

IMAR115

IMAR116

IMAR117

IMAR118

IMAR77

IMAR78

IMAR119

IMAR56

IMAR84

IMAR85

IMAR102

IMAR103

IMAR793

IMAR794

IMAR795

Object Number

3.3.3.2.0-2

3.3.3.3

3.3.3.3.0-1

3.3.3.3.0-2

3.3.3.3.0-3

3.3.3.3.0-4

3.3.3.3.0-5

3.3.3.3.0-6

3.3.3.3.0-7

3.3.3.3.0-8

3.3.3.3.0-9

3.3.3.3.0-10

3.3.3.3.0-11

3.3.3.4

3.3.3.4.0-1

3.3.3.4.0-2

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

The Contractor shall update and maintain the Hazard Verification Tracking Log during I&T activities to track open issues.

3.3.3.3 Instrument Safety Assessment Report (ISAR) and

Verification Tracking Log (VTL)

The Contractor shall generate an ISAR to document the comprehensive evaluation of the risk being assumed prior to the testing or operation of an instrument. The spacecraft Contractor will use the ISAR as an input to the Safety Data Package

(SDP) (CDRL # MA 3-3).

The Contractor shall develop analyses for identifying the hazards associated with the hardware, support equipment, software, instrument ground operations and ground support equipment, and their interfaces.

The Contractor shall take measures to minimize each identified hazard.

Hazard reports shall be generated for all identified system hazards.

The hazard reports shall document the causes, controls, verification methods and status of verification for each hazard.

The Contractor shall implement a Verification Tracking Log (VTL) that documents the results of the Hazard Control and Verification Tracking process as a closed-loop system that ensures safety compliance has been satisfied per NASA-STD 8719.24 (with Annex) launch range safety requirements.

The Contractor shall document in the VTL the process of verifying the control of hazards by test, analysis, inspection, similarity to previously qualified hardware, or any combination of these activities.

The Contractor shall ensure that verifications listed on the hazard reports refer to specific test, analysis, or inspection reports with a summary of the pertinent results.

The Contractor shall make the results of these tests, analyses, and inspections available for government review.

The VTL shall identify hazard controls that are not verified as closed and be delivered with the final ISAR (CDRL # MA 3-3).

The Contractor shall provide regular electronic updates of the VTL until all hazard controls are verified as closed.

3.3.3.4 Mechanical Ground Support Equipment Safety

Requirements

The MGSE, including but not limited to, lifting slings/spreader bars, handling and support fixtures, and shipping containers, shall provide the required mechanical support from lower-level assembly operations through final satellite I&T at all instrument and spacecraft vendor facilities and the Launch Site Payload Processing Facility.

MGSE is divided into the following three categories: Lifting devices and equipment (LDE); Support and Handling MGSE; and Work Platforms, Stands, and other Personnel Access MGSE.

Page 14 of 60 Printed Tuesday, June 28, 2022

ID

IMAR796

IMAR797

IMAR798

IMAR799

IMAR800

IMAR801

Object Number

3.3.3.4.0-3

3.3.3.4.0-4

3.3.3.4.0-5

3.3.3.4.0-6

3.3.3.4.0-7

3.3.3.4.0-8

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

The Contractor shall comply with the following safety requirements for LDE when performing NASA work at non-NASA facilities:

⦁ Ensure overhead cranes, winches, and wire rope hoists have a dual hoist braking system and hoist dual upper limit switches installed per the NASA STD 8719.9 (Lifting Standard), Sections 5.4 and 7.4. If not commercially available dual upper limit switches and dual brakes do not apply to chain hoists. A single hoist motor holding brake in combination with a Variable Frequency Drive (VFD) dynamic braking system is an acceptable dual braking system.

⦁ Label and tag LDE the NASA STD 8719.9B, Section 4.9 requirements with no more than it’s Working Load Limit (WLL) as determined by the original equipment manufacturer (OEM) or it’s current certified WLL if that value is lower than the OEM rated WLL.

⦁ Perform an initial one-time proof load test per the following NASA STD 8719.9B, Section 4.5 requirements:

⦁ 1.25X WLL for overhead cranes.

⦁ 1.25X WLL for mobile aerial platforms that will be used near critical hardware.

⦁ 1X WLL for mobile cranes and derricks (.95X to 1X is acceptable).

⦁ 1.25X WLL for below-the-hook (BTH) lifting devices.

⦁ Ensure slings (i.e., wire rope, synthetics, chain, etc.) are only proof load tested beyond its WLL with OEM approval.

⦁ 2X WLL for rigging hardware items used for critical lifts (i.e., shackles. hoist rings. turnbuckles, etc.).

⦁ Perform a 1X WLL load test every four years after the initial proof test on all LDE.

In addition to visual inspection, perform a post load test Non-Destructive Testing (NDT) inspection (e.g., radiographic, ultra-sonic, magnetic particle, dye penetrant, etc.) on crane hooks and critical welds. A critical weld is one in which a failure would result in a failure of the hardware. Ensure that the inspections are performed by an American Society of Non-destructive Testing (ASNT) or equivalently trained inspector

A critical lift is defined as a lift during which failure/loss of control presents an elevated risk of serious injury, loss of life, or loss of one-of-a-kind articles, or high dollar items, whose loss would have serious programmatic or institutional impact.

Any lift hardware which attaches to the instrument or instrument component below the respective center of gravity shall be verified by an analysis to show that the lift is stable.

Support and Handling MGSE that is not being delivered to the Launch Site shall meet factors of safety requirements as defined in NASA-STD-5005D, Section 5.1.2 Factor of Safety.

Support and Handling MGSE that is not being delivered to the Launch Site shall be proof load tested to 150% of rated load.

LDE MGSE that interfaces to flight hardware and is not being delivered to the Launch Site shall meet requirements as defined in Chapter 14 of NASA-STD-8719.9.

Page 15 of 60 Printed Tuesday, June 28, 2022

ID

IMAR802

IMAR934

IMAR803

IMAR935

IMAR123

IMAR124

IMAR24

IMAR125

IMAR126

IMAR911

IMAR127

IMAR25

IMAR128

IMAR129

IMAR130

IMAR137

IMAR138

Object Number

3.3.3.4.0-9

3.3.3.4.0-10

3.3.3.4.0-11

3.3.3.4.0-12

3.3.3.5

3.3.3.5.0-1

3.3.3.5.0-2

3.3.4

3.3.4.0-1

3.3.4.0-2

3.3.4.0-3

3.3.4.0-4

3.3.5

3.3.5.0-1

3.3.5.0-2

3.3.6

3.3.6.0-1

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

Support and Handling MGSE shall be recertified at minimum to the working load once every four years.

Work Platforms, Stands, and other Personnel Access MGSE shall meet requirements as defined in CFR 29 OSHA 1910.28.

Work Platforms, Stands, and other Personnel Access MGSE and dollies shall be subjected to stability analysis.

MGSE that is being delivered to the Launch Site shall meet requirements as defined in NASA-STD-8719.24.

3.3.3.5 Operating and Support Hazard Analysis (O&SHA)

The Contractor shall perform an Operating and Support Hazard Analysis (O&SHA) to evaluate activities for hazards introduced during testing, transportation, storage, integration, and prelaunch operations at the launch site. The primary purpose is to evaluate the adequacy of procedures used to eliminate, control, or mitigate identified hazards to ensure implementation of safety requirements for personnel, procedures, and equipment during activities at the launch site.

The Contractor shall submit the results of the O&SHA as a part of the intermediate & final ISARs (CDRL # MA 3-3).

3.3.4 Hazardous Procedures for Payload I&T and Pre-Launch

Processing

The Contractor shall document the procedures that will be implemented when hazardous integration and test activities and pre-launch activities are performed at processing facilities and the launch site (CDRL # MA 3-5).

The Contractor-provided safeguards shall comply with the applicable safety requirements for the installation where the activities will be performed.

The Contractor shall ensure that the procedures comply with applicable facility safety requirements.

The Contractor shall provide safety support for the implementation of hazardous procedures.

3.3.5 Safety Non-Compliances and Waivers

The Contractor shall request waivers for variations from the applicable safety requirements per paragraph 1.4 of NPR 8715.7 Expendable Launch Vehicle (ELV) Payload Safety Program. The waiver form is available at URL.

https://kscsma.ksc.nasa.gov/PayloadSafety/forms

3.3.6 Support for Safety Working Groups

Contractor safety personnel shall support Safety Working Group (SWG) meetings, Payload Safety Working Group (PSWG) meetings, Technical Interface Meetings (TIMs), and technical reviews, as required.

Page 16 of 60 Printed Tuesday, June 28, 2022

ID

IMAR139

IMAR132

IMAR804

IMAR133

IMAR912

IMAR913

IMAR136

IMAR914

IMAR805

Object Number

3.3.6.0-2

3.3.7

3.3.7.0-1

3.3.7.0-2

3.3.7.0-3

3.3.7.0-4

3.3.7.0-5

3.3.7.0-6

3.3.8

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

The PSWG will meet as necessary to review procedures and analyses that contain or examine safety critical functions, or as convened by the GeoXO project to discuss any situations that may arise with respect to overall project safety. The timeline for all safety reviews, beginning with the Payload Safety Introduction Briefing, is contained in NPR 8715.7, Section 3.4.

3.3.7 Mishap Reporting and Investigation

The Contractor shall prepare a Pre-Mishap Plan, prior to initiating any project operations with potential for personnel injury or hardware damage, that describes appropriate mishap and close call notification, reporting, recording, and investigation procedures in accordance with NPR 8621.1 NASA Procedural Requirements for Mishap and Close Call Reporting, Investigating, and Recordkeeping (CDRL # MA 3-6).

Note: The following are not reportable as mishaps but may be reportable as failures or anomalies:

Property Damage:

- Items normally covered under Failure Reporting

- Malfunction or failure of component parts or equipment due to normal wear and tear where the malfunction is the only damage and the only action is to replace or repair the equipment.

- Anticipated damage to equipment or property was incurred during testing or manufacturing.

- Property damage from vandalism, arson, sabotage or acts of God.

Injury:

- Injuries and illnesses from non-occupational diseases.

- Injuries that occur during work arrival or departure.

- Injuries or illness sustained before working at the developer unless specifically aggravated by a work assignment.

- Injuries from non-work-related, pre-existing disorders or by minimum stress and strain.

- Injuries from activities unrelated to work (e.g., recreational activities, workouts, etc.).

The Contractor shall report accidents, test failures, or other mishaps and close calls promptly to NASA. (CDRL # MA 3-6)

The Contractor shall report all Type A Mishaps, Type B Mishaps, High Visibility Mishaps and High Visibility Close Calls as defined in the NPR 8621.1, within in one hour of occurrence

The Contractor shall report all Type C Mishaps, Type D Mishaps, and Close Calls as defined in the NPR 8621.1, within 24 hours of occurrence.

The Contractor shall promptly investigate to determine the root cause.

Upon investigation and resolution of the Mishap / Close-Call, the Contractor shall submit an Incident Report.

3.3.8 NASA Expendable Launch Vehicle (ELV) Payload Safety

Program Forms

Page 17 of 60 Printed Tuesday, June 28, 2022

ID

IMAR806

IMAR807

Object Number

3.3.8.0-1

3.3.8.0-2

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

The Contractor shall prepare NASA Expendable Launch Vehicle Payload Safety Forms. The forms are available at URL.

http://kscsma.ksc.nasa.gov/PayloadSafety/Forms

Page 18 of 60 Printed Tuesday, June 28, 2022

ID

IMAR163

IMAR164

IMAR808

IMAR809

IMAR810

IMAR811

IMAR812

IMAR173

IMAR174

IMAR175

IMAR176

Object Number

4.1

4.1.0-1

4.1.0-2

4.1.0-3

4.1.0-4

4.1.0-5

4.2

4.2.0-1

4.2.0-2

4.3

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

4 RELIABILITY

4.1 General

Reliability activities shall be coordinated with the Contractor's Risk Management processes. For example, risks that evolve from reliability analyses that affect overall mission objectives shall be managed in the project’s risk database when not eliminated or mitigated to noncredible likelihood levels, likewise, for safety risks (threats to personnel, the public, the environment, hosts, and facilities).

All credible Single Point Failures (SPFs) for Class B instruments shall be analyzed and considered for management within the project’s Risk Management process.

In addition, as designs evolve and change, the analyses described in this section shall be updated. Credible denotes that the likelihood is at least as high as the lowest likelihood on the pertinent risk scale given in GPR 7120.4D.

The Contractor shall perform reliability analyses concurrent with design so that identified problem areas are addressed, and corrective action taken in a timely manner.

The Contractor shall provide technical support to the GeoXO Project for the NASA-chaired Reliability Working Group (RWG) meetings and technical reviews, as required. The RWG will meet as necessary, and as convened by NASA, to review reliability requirements and analyses, assist in resolving reliability issues and concerns, and discuss any situations that may…