SSP_50146-RevB-SSCD_15566.pdf

SSP 50146, Revision B

National Aeronautics and Space

Administration

International Space Station

Program Johnson Space Center

Houston, Texas

Rosaviakosmos

Moscow, Russia

SSP 50146 Revision B

March, 2004

International Space Station Program

Incorporates SSCD 15566

NASA/RSA BILATERAL S&MA PROCESS REQUIREMENTS FOR

INTERNATIONAL SPACE STATION

SSP 50146, Revision B October 20, 2015 i

REVISION AND HISTORY PAGE

REV. DESCRIPTION PUB. DATE

A

B

Initial release per SSCD 000603, effective 06-12-97

Revision A per SSCD 000900 effective 05-28-99

Revision B per SSCD 008600 effective 03-14-05

DCN 001 (Reference per SSCD 013557, EFF. 12-06-12

DCN 002 (Reference per SSCN 15065, EFF 08-03-15

Update per SSCD 15566, EFF. 04-28-17

Program Release

02-20-98

08-16-99

04-07-05

03-01-13

10-27-15

05-01-17 ii

PREFACE

ISS Program requirements for hardware and software safety and mission assurance requirements are defined and controlled in this document. This document establishes the applicable requirements for Safety, Reliability, Maintainability, and Quality Assurance between NASA and

RSA.

In the implementation of safety and mission assurance requirements, consideration shall be given to criticality, complexity, state of hardware and software development, and unit and life cycle cost. The methods for implementing these requirements will be described in the respective

Safety and Mission Assurance Plan (S&MA) from RSA.

This document is under the control of the Space Station Control Board (SSCB), and any changes or revisions will be approved by the Deputy Director.

iii

NASA/Rosaviakosmos

INTERNATIONAL SPACE STATION PROGRAM

________________________ ____/s/A. Krasouv_______ NASA Program Manager Rosaviakosmos

________________________ ____A. Krasouv__________ Print Name Print Name

________________________ _____03/12/05___________ Date Date iv

INTERNATIONAL SPACE STATION PROGRAM

NASA/RSA BILATERAL S&MA PROCESS REQUIREMENTS FOR INTERNATIONAL SPACE

STATION

CONCURRENCE

OCTOBER 2004

Prepared by: Nancy L. Steisslinger NE

JOINT AMERICAN-RUSSIAN SAFETY WORKING

GROUP REPRESENTATIVE

ORG

/s/Nancy Steisslinger 10/12/04

SIGNATURE DATE

Controlled by: James W. Wade, PhD. OE

SAFETY & MISSION ASSURANCE PANEL ORG

/s/Warren Pattison for 10/12/04

Approved by: William H. Gerstenmaier OA

ISS, SPACE STATION CONTROL BOARD ORG

/s/William H. Gerstenmaier 10/13/04

DQA: Delegated Representative

CONFIGURATION MANAGEMENT REPRESENTATIVE ORG

N/A v

TABLE OF CONTENTS

1.0 INTRODUCTION

1.1 PURPOSE

1.2 SCOPE

1.3 GENERAL

1.3.1 NASA AND RSA ROLES AND RESPONSIBILITIES

1.3.2 NASA AND RSA MANAGEMENT APPROACH

1.3.3 SAFETY AND MISSION ASSURANCE PLAN

1.4 RELATION TO OTHER PROGRAM REQUIREMENTS

1.4.1 PROGRAM REQUIREMENTS

1.4.2 GSE

1.5 INDEPENDENT EVALUATIONS FOR NASA OR RSA

1.6 DATA ITEM DESCRIPTION (DID)

1.7 MILESTONE REVIEWS

1.8 REFERENCE DOCUMENTS

2.0 SAFETY PROGRAM

2.1 SAFETY MANAGEMENT

2.1.1 ROLES AND RESPONSIBILITIES

2.1.1.1 NASA ROLES AND RESPONSIBILITIES:

2.1.1.2 RSA ROLES AND RESPONSIBILITIES

2.1.2 ORGANIZATION

2.1.3 SAFETY PLAN

2.1.4 SAFETY REVIEW REQUIREMENTS

2.1.4.1 SPACE STATION REVIEW

2.1.4.2 SPACE STATION CARGO

2.1.4.2.1 TECHNICAL SAFETY REQUIREMENTS FOR ISS CARGO

2.1.4.2.2 SAFETY REVIEW PROCESS FOR RSA ISS CARGO

2.1.5 MISHAP REPORTING AND INVESTIGATION

2.1.6 WAIVERS AND DEVIATIONS

2.2 SAFETY

2.2.1 OBJECTIVES

2.2.2 SAFETY TECHNICAL REQUIREMENTS

2.2.3 SAFETY ANALYSES

2.2.3.1 NASA GOVERNMENT EQUIPMENT FOR RS INSTALLATION

2.2.3.2 INTEGRATED SAFETY DATA

2.2.4 HAZARD ELIMINATION AND CONTROL

vi

2.2.5 HAZARD REPORT/OFF-NOMINAL-SITUATION (ONS) CLOSURE CRITERIA

2.2.6 GROUND SUPPORT EQUIPMENT (GSE) SAFETY

2.2.7 REVIEW OF CHANGES

2.2.8 REVIEW OF FLIGHT AND GROUND HARDWARE FAILURES

2.2.9 EVALUATION OF TEST RESULTS

2.2.10 EVALUATION OF MISSION OPERATIONAL ACTIVITY

2.3 INDUSTRIAL SAFETY

2.3.1 GROUND OPERATIONS SAFETY

3.0 RELIABILITY AND MAINTAINABILITY (R&M)

3.1 MANAGEMENT

3.1.1 NASA ROLES AND RESPONSIBILITIES

3.1.2 RSA ROLES AND RESPONSIBILITIES

3.1.3 RECIPROCITY

3.1.4 ORGANIZATION

3.1.5 PLANS

3.1.5.1 RELIABILITY AND MAINTAINABILITY PLAN

3.1.6 SUPPLIER CONTROL

3.1.6.1 SUPPLIER RELIABILITY AND MAINTAINABILITY CONTROL

3.2 RELIABILITY AND MAINTAINABILITY ENGINEERING

3.2.1 RELIABILITY AND MAINTAINABILITY DESIGN CRITERIA

3.2.2. FAILURE MODE EFFECTS ANALYSIS/CRITICAL ITEMS LIST (FMEA/CIL)

3.2.2.2 RSA FAILURE ANALYSIS PROCEDURE

3.2.2.3 FAILURE MODE SUMMARY REPORT (FMSR)

3.2.2.4 CARGO FMEAs

3.2.3 CRITICALITY CATEGORIES

3.2.4 CRITICAL ITEMS LIST (CIL)

3.2.5 R&M PREDICTIONS REPORT

3.2.5.1 RELIABILITY

3.2.5.1.A LIMITED-LIFE DATA

3.2.5.1.B RELIABILITY PREDICTION DATA

3.2.5.2 MAINTAINABILITY

3.2.6 DESIGN REVIEWS

3.2.7 REVIEW OF CHANGES

3.2.8 FAILURE REPORTING SYSTEM

3.2.9 VERIFICATION ASSURANCE

4.0 QUALITY ASSURANCE

4.1 MANAGEMENT

vii

4.1.1 NASA ROLES AND RESPONSIBILITIES

4.1.2 RSA ROLES AND RESPONSIBILITIES

4.1.3 RECIPROCITY

4.2 QUALITY PROGRAM PLAN

4.3 ACCEPTANCE DATA PACKAGE (ADP)

4.4 FAILURE REPORTING AND CORRECTIVE ACTION

4.5 CONTROL OF NASA AND INTERNATIONAL PARTNER (IP) PROPERTY

4.5.1 RSA RESPONSIBILITY

4.5.2 UNSUITABLE NASA OR IP PROPERTY

5.0 SOFTWARE QUALITY ASSURANCE

5.1 MANAGEMENT

5.1.1 ORGANIZATION

5.1.2 SOFTWARE PRODUCT ASSURANCE PLANNING

5.1.3 FORMAL AND INTERNAL REVIEWS

5.1.4 SUBTIER REQUIREMENTS

5.1.5 NONDEVELOPMENTAL SOFTWARE

5.1.6 NASA OR INTERNATIONAL PARTNER FURNISHED EQUIPMENT (GFE/IGFE)

5.1.7 PROGRESS REPORTING

5.1.8 CONTROL BOARDS

5.1.9 OPERATIONS AND MAINTENANCE

5.1.10 TRAINING

5.1.11 SOFTWARE TOOLS

5.1.12 SOFTWARE PRODUCT ASSURANCE RECORDS

5.2 SOFTWARE QUALITY ASSURANCE

5.2.1 AUDITS

5.2.2 TOOLS, TECHNIQUES, AND METHODOLOGIES

5.2.3 SOFTWARE DOCUMENTATION

5.2.4 SOFTWARE CODE INSPECTION

5.2.5 SOFTWARE TESTING

5.3 CONFIGURATION MANAGEMENT

5.3.1 CONFIGURATION IDENTIFICATION, STATUS ACCOUNTING AND

VERIFICATION

5.3.2 CONFIGURATION CHANGE CONTROL

5.3.3 SOFTWARE LIBRARIES

5.3.4 DEVIATIONS AND WAIVERS

5.4 NONCONFORMANCE REPORTING AND CORRECTIVE ACTION

5.4.1 NONCONFORMANCE REPORTING

viii

5.4.2 PROBLEM REPORTING AND CORRECTIVE ACTION

5.5 RESERVED

5.6 SOFTWARE SAFETY

5.7 STANDARDS

5.8 TRADE STUDIES

5.9 INTEGRATION ASSURANCE

5.10 VERIFICATION AND VALIDATION

5.11 INDEPENDENT VERIFICATION AND VALIDATION (IV&V)

5.12 CERTIFICATION

5.13 SECURITY AND PRIVACY ASSURANCE

GLOSSARY AND ACRONYMS

ATTACHMENT A - GROUND SAFETY REQUIREMENTS FOR RUSSIAN ELEMENTS LAUNCHED

ON THE NASA SHUTTLE ................................................................................................................ ……………A-1

ATTACHMENT B - DATA ITEM DESCRIPTION (DIDS) ............................................................................. B-1

ATTACHMENT C - NASA/RSA SAFETY REVIEW PROCESS FOR ISS ................................................... C-1

ATTACHMENT D - NASA/RSA GENERAL PRINCIPLES AND REQUIREMENTS FOR ISS CARGO

SAFETY ................................................................................................................................................................... D-1

ATTACHMENT E - NASA/ROSAVIAKOSMOS/ESA TRI-LATERAL REQUIREMENTS FOR

IMPLEMENTATION OF THE SAFETY AND MISSION ASSURANCE PROCESSES FOR THE ATV AND

ISS RS…………………………………………………………………………………………………….………...E-1

1.0 INTRODUCTION

1.1 PURPOSE

This bilateral process agreement establishes specific roles and responsibilities that implement the interim agreement, establishes the ISS programmatic hardware and software safety and mission assurance requirements and defines the information and data exchanges which will allow NASA and RSA to conduct joint tasks successfully. This agreement is intended to be consistent with higher level agreements made in the Interim Agreement, the Joint Management Plan (JMP), and the Memorandum of Understanding (MOU).

1.2 SCOPE

Requirements defined in this agreement apply to all ISS elements developed by RSA and NASA, with respect to critical functions, as well as hardware and operations that may result in catastrophic hazards and/or crew injury in the event of an Off-Nominal Situation (ONS).

Where a reduced scope is applicable to Russian Transport Vehicles (Soyuz TM and Progress M, and Logistics Transfer Vehicle (LTV)) it is specifically delineated in the appropriate sections of this document. Automated Transfer Vehicle (ATV) safety is addressed in Attachment E to this document.

1.3 GENERAL

1.3.1 NASA AND RSA ROLES AND RESPONSIBILITIES

Overall roles and responsibilities in the S&MA area are established in Article 4 of the Interim

Agreement between NASA and RSA which states the following:

4.1 In order to assure safety, NASA has the responsibility, working with the RSA and the

Cooperating Agencies of the Space Station Partners, to establish overall Space Station safety and mission assurance requirements and plans.

4.2 RSA will develop detailed safety and mission assurance requirements and plans, using its own requirements for its Space Station hardware and software. Such requirements and plans must meet of exceed the overall Space Station safety requirements and plans. Requirements for which meet of exceed criteria are not appropriate will be determined by agreement of the

Parties. RSA will have the responsibility to implement Space Station safety and mission assurance requirements and plans with respect to the elements and payloads it provides throughout the lifetime of the program, and to certify that such requirements and plans have been met. NASA will have the overall responsibility to certify that all Space Station elements and payloads are safe.

4.3 The Parties will support and exchange information necessary in order to conduct system safety reviews. The Parties will also conduct safety reviews of the elements and payloads they provide.

1.3.2 NASA AND RSA MANAGEMENT APPROACH

NASA and RSA management of S&MA shall include the following:

1.3.2.A Defining the major hardware and software safety and mission assurance tasks and assuring that they are performed as integral parts of all phases of the program

1.3.2.B Evaluating the safety, reliability, maintainability, and quality of hardware, software, and operations through analyses, tests, reviews, and assessments

1.3.2.C Providing timely status reporting through periodic project reviews and as a part of overall project status reports

1.3.2.D Ensuring compatible safety and mission assurance requirements among manufacturing, test, launch, and ground operations sites

1.3.2.E NASA shall assure that the results of the S&MA analysis on Russian Segment (RS) design conducted by RSA are integrated into ISS assessments activities.

1.3.3 SAFETY AND MISSION ASSURANCE PLAN

A Safety and Mission Assurance (S&MA) plan shall be prepared by RSA and NASA. This plan shall define the tasks and products of the Safety, Reliability, Maintainability, and Quality

Assurance activities of the Russian and U. S. Segments and the organizational responsibilities for task implementation. The S&MA Plans shall be prepared in accordance with DID R-10-S01 and

DID U-10-S08 for RSA and NASA, respectively.

1.4 RELATION TO OTHER PROGRAM REQUIREMENTS

1.4.1 PROGRAM REQUIREMENTS

The S&MA analytical and verification requirements set forth in this document shall take precedence in cases of conflict with requirements contained in sub tier documents. The RS

S&MA design requirements are contained in SSP 41163, RS Specification International Space

Station Program and the US S&MA design requirements are contained in SSP 41162, USOS

Specification International Space Station Program. ISS components provided by RSA to NASA under the contract NAS 15-10110 may be covered by additional S&MA requirements stipulated by the contract.

1.4.2 GSE

1.4.2.A RS GSE hardware and software used at other than Russian ground sites shall be subject to the S&MA requirements of those facilities.

1.4.2.B USOS GSE hardware and software used at other than US ground sites shall be subject to the S&MA requirements of those facilities.

1.5 INDEPENDENT EVALUATIONS FOR NASA OR RSA

NASA and the RSA reserve the right to appoint independent representatives to assist in safety and mission assurance evaluation activities. These representatives will provide technical support to the applicable parent organization and determine effectiveness of and recommend improvements for S&MA activities.

1.6 DATA ITEM DESCRIPTION (DID)

DIDs which define the applicable S&MA documentation requirements for Russian and U. S.

Segments elements shall be contained in SSP 50137, NASA/RSA Bilateral Data Exchange

Agreement and in Attachment B of this document. The DIDs included in SSP 50137 shall take precedence in the event of a discrepancy.

1.7 MILESTONE REVIEWS

NASA and RSA S&MA activities shall include supporting internal and supplier design reviews, and ISS Program design and readiness reviews. Participation in milestone reviews shall assure that S&MA requirements are adequately considered.

1.8 REFERENCE DOCUMENTS

The following documents are reference documents that are invoked to the extent specified in the text of this document.

NSTS 13830B Implementation Procedure for NSTS Payloads System Safety Requirements

NSTS 1700.7B Safety Policy and Requirements for Payloads using the Space Transportation

System

SSP 30223 Problem Reporting and Corrective Action System Requirements for the Space

Station Program

SSP 30233 Space Station Requirements for Materials and Processes

SSP 30234 Instructions for Preparation of FMEA and CIL for Space Station

SSP 30309 Safety Analysis and Risk Assessment Requirements Document

SSP 30459 International Space Station Interface Control Plan

SSP 30599 Safety Review Process

SSP 41000 System Specification for the International Space Station

SSP 41162 United States On-orbit Segment Specification

SSP 41163 Russian Segment Specification

SSP 41170 Configuration Management Requirements

SSP 50021 Safety Requirements Document

SSP 50094 NASA/RSA Joint Specification/Standards Document for the ISS Russian Segment

SSP 50108 Certification of Flight Readiness Process

2.0 SAFETY PROGRAM

2.1 SAFETY MANAGEMENT

2.1.1 ROLES AND RESPONSIBILITIES

2.1.1.1 NASA ROLES AND RESPONSIBILITIES:

NASA Safety has the following roles and responsibilities for the ISS:

a) To establish the overall safety requirements covering ISS detailed design, development activities, and mature operations and utilization.

b) To certify that the overall integrated Space Station elements and cargo are safe.

c) To conduct overall integrated system safety reviews for Space Station elements, launch packages and stages.

d) To conduct safety reviews for the elements and cargo provided by NASA.

e) To participate in and support as appropriate the reviews of other partners. To support these reviews, NASA will provide the necessary safety related information to enable the partners to conduct their reviews.

f) To conduct interface hazards analysis between elements of the RS and elements of other

International Partners (IP).

2.1.1.2 RSA ROLES AND RESPONSIBILITIES

RSA has the following roles and responsibilities:

a) To develop detailed safety requirements which implement the overall safety requirements for the elements and cargo developed by RSA. These detailed requirements must meet or exceed the safety requirements in SSP 41163, including those specified in the SSP 50094, NASA/RSA Joint

Specifications / Standards Document for the RS.

b) To certify that the overall and detailed safety requirements have been met with respect to the elements and cargo RSA provides.

c) To support the overall integrated system safety reviews conducted by NASA. This support includes participation as a developer and provider of safety data for elements being reviewed by the ISS Safety Review Panel (SRP). As a provider of data RSA participation in the meeting shall include the presentation of the safety data to the SRP and technical support to respond to questions related to the identification and control of hazards related to the detailed design and operation of the RS elements.

d) To conduct safety reviews for the elements and cargo provided by RSA.

e) To participate in and support as appropriate the reviews of other partners. To support these reviews RSA will provide the necessary safety related information to enable other IPs to conduct their reviews.

f) To participate, as appropriate, in any Space Station safety review boards established by

NASA. This includes membership in the ISS SRP which will conduct the overall integrated safety review of ISS elements. Elements being launched on the Space Shuttle shall be subject to the GSRP process documented in Attachment A. Cargo for the ISS shall be subject to the cargo safety process documented in Attachment D.

g) To provide the support and information necessary for integrated analyses and assessments which lead to NASA's safety certification responsibilities.

2.1.2 ORGANIZATION

Organization of the NASA and RSA safety effort shall assure effective planning, management, implementation and performance of safety activities. While the accomplishment of all safety tasks may not be the responsibility of the same organizational element, management of the safety effort shall assure that all tasks are effectively accomplished.

2.1.3 SAFETY PLAN

The RSA and NASA safety organizations shall prepare, implement, and maintain a Safety Plan as a part of the S&MA Plan (Reference paragraph 1.3.3) which describes the compliance with requirements set forth herein.

2.1.4 SAFETY REVIEW REQUIREMENTS

2.1.4.1 SPACE STATION REVIEW

2.1.4.1.A SSP 30599, Safety Review Process, defines the safety review process that is used by

NASA to implement its responsibilities for ISS elements.

2.1.4.1.B RSA shall utilize standard Russian S&MA processes to implement its internal responsibilities for the RS.

2.1.4.1.C To assure the joint review of RS Safety, RSA and NASA shall implement the safety review process defined in the "NASA/RSA Safety Review Process" provided in Attachment C.

2.1.4.1.D For RS Russian Transport Vehicles (e.g. Soyuz TM, Progress M, and LTV) NASA and RSA shall implement the Safety Review Process defined in the "NASA/RSA Safety Review

Process" with the following reduced scope:

- Hazards to the ISS caused by any ISS vehicle that is temporarily in the proximity of or docked to the ISS must be identified and controlled. This excludes Hazards associated with autonomous flight of these vehicles (i.e. launch operations, orbit insertion, deorbit, and landing)

- Hazards resulting from the inability of the vehicles to perform critical ISS functions

(Reference Attachment A)

2.1.4.2 SPACE STATION CARGO

The process for certification of the safety of Russian cargo on Shuttle and ISS, and NASA cargo on the Russian Segment and Russian transport vehicles, is defined in Attachment D

“NASA/RSA General Principles and Requirements For ISS Cargo Safety”.

2.1.5 MISHAP REPORTING AND INVESTIGATION

Mishaps occurring during manufacturing, testing, and operations shall be investigated and reported as specified in the internal native specifications and reported in accordance to DID R-

10-S03 and U-10-S09 for RS and USOS mishaps, respectively.

2.1.6 WAIVERS AND DEVIATIONS

The NASA and RSA will evaluate proposed hardware, software, and operational waivers and deviations for safety impact, and recommend disposition for management concurrence. Where the acceptance of a deviation or waiver impacts an existing hazard report, the hazard report will be updated to show the accepted risk status and resubmitted with the waiver or deviation.

2.2 SAFETY

2.2.1 OBJECTIVES

The NASA and RSA safety objectives are to identify and evaluate their respective design and operational activities to assure that measures are taken to minimize risks. Safety objectives include the following:

2.2.1.A Performing safety analyses to identify the hazards associated with hardware, software, and operations during all program phases

2.2.1.B Assuring that proper design and performance requirements are developed, documented, and implemented which will eliminate whenever possible or control the identified hazards.

2.2.1.C Providing appropriate documentation to enable NASA and RSA to perform an overall risk assessment including: the identification of residual hazards/risks and providing recommendations with supporting data and rationale for management awareness and decision on acceptance of the residual hazards/risks.

2.2.2 SAFETY TECHNICAL REQUIREMENTS

Safety technical requirements have been established for the RS and the USOS and are defined in

SSP 41163, "ISS RS Specification" and SSP 41162 "ISS USOS Specification", respectively.

These requirements should be identified and implemented in system design, operations, and procurement documentation including flight hardware and safety critical software.

2.2.3 SAFETY ANALYSES

NASA and RSA shall perform hazards analyses, including hardware hazards analyses, operational hazards analyses, and software hazards analyses.

2.2.3.A NASA shall document the results of the USOS hazard analyses on hazard report forms as defined in SSP 30599. This documentation will be provided to RSA in accordance with the established distribution to the ISS Safety Review Panel.

2.2.3.B RSA shall document the results of RS hazard analyses, as defined in the "NASA/RSA

Safety Review Process" provided in Attachment C, on hazard report forms in accordance with

DID R-10-S02.

2.2.3.1 NASA GOVERNMENT EQUIPMENT FOR RS INSTALLATION

NASA equipment installed in the Russian Segment shall be subject to the process for safety reviews described in “NASA/RSA Safety Review Process.” RSA representatives shall take part in the work of the Safety Review Panel for this hardware.

2.2.3.2 INTEGRATED SAFETY DATA

To provide information required for the RS and ISS integrated hazard analysis, NASA and RSA will exchange Safety Data in addition to hazard analysis. NASA shall provide this data to RSA in accordance with DID U-10-S05 and U-10-S07. RSA shall provide this data in accordance with DID R-10-S04 and R-10-S06.

2.2.4 HAZARD ELIMINATION AND CONTROL

The foremost consideration for resolving hazards shall be to eliminate them by design through removal of hazard sources and hazardous operations. Corrective action priorities shall be established to achieve maximum benefit in reducing potential personnel and material losses.

Actions for satisfying safety engineering requirements shall be in the following order of precedence:

2.2.4.A Hazard Elimination. The hazard source or the hazardous operation shall be eliminated.

2.2.4.B Design for Minimum Hazard. The major goal throughout the design phase shall be to ensure inherent safety through provisions of appropriate design features, materials and parts selection, and safety factors. Control and isolation of potential hazards and failure tolerance considerations are to be included in design considerations.

2.2.4.C Safety Devices. Known hazards which cannot be eliminated by design shall be reduced to an acceptable level by incorporating safety devices as part of the system, subsystem, or equipment.

2.2.4.D Warning Devices. Where it is not possible to preclude the existence or occurrence of a known hazard, warning devices shall be employed for the timely detection of hazardous conditions and the generation of adequate warning signals.

2.2.4.E Special Procedures. Where it is not possible to reduce the magnitude of an existing or potential hazard by design or by use of safety and warning devices, special procedures (including the requirement for Personal Protective Clothing/Equipment) shall be developed to counter hazardous conditions for enhancement of ground and flight crew safety.

2.2.5 HAZARD REPORT/OFF-NOMINAL-SITUATION (ONS) CLOSURE CRITERIA

A hazard report/ONS shall be considered closed only after at least one of the following conditions have been satisfied:

(1) The hazard/ONS has been eliminated by a design or operational change, and the change has been implemented and verified or;

(2) The hazard/ONS has been controlled in accordance with at least one of the corrective actions identified in paragraph 2.2.4.B through 2.2.4.E, and the controls have been verified by successful completion of the required design change, test programs, analytical studies, or training programs or;

(3) The hazard has been accepted by program management. Signature of the phase 3 safety hazard report at the conclusion of the NASA/RSA Safety Review Panel meetings shall indicate

ISS program approval of the identified hazard.

2.2.6 GROUND SUPPORT EQUIPMENT (GSE) SAFETY

2.2.6.A RS GSE safety requirements have been established for the RS and are defined in SSP

41163.

2.2.6.B USOS GSE safety requirements have been established for the USOS and are defined in

SSP 41162.

2.2.7 REVIEW OF CHANGES

When changes are proposed for equipment design (hardware and software) or procedures, NASA and RSA safety organization shall assure the identification and resolution of hazards that may be introduced into the system. These hazards shall be documented in hazard reports in accordance with the DID R-10-S02 for the RS, and in accordance with SSP 30309 and SSP 30599 for the

USOS, respectively.

2.2.8 REVIEW OF FLIGHT AND GROUND HARDWARE FAILURES

NASA and RSA safety organization shall review, provide recommendations and concur in failure resolutions associated with catastrophic and critical hazards.

2.2.9 EVALUATION OF TEST RESULTS

NASA and RSA safety organizations shall evaluate results of tests that verify design safety compliance.

2.2.10 EVALUATION OF MISSION OPERATIONAL ACTIVITY

NASA and RSA safety organizations shall participate in mission operational activities and make safety evaluations of anomalous conditions. These safety evaluations will provide guidance to plan future activities and to establish necessary corrective actions.

2.3 INDUSTRIAL SAFETY

2.3.A Russian Industrial and personnel safety standards apply for all ISS hardware while in

Russian facilities.

2.3.B US industrial and personnel safety standards apply for all ISS hardware while in US.

facilities.

2.3.1 GROUND OPERATIONS SAFETY

2.3.1.A Russian ground operations safety standards apply for all ISS hardware while in Russian

2.3.1.B US ground operations safety standards apply for all ISS hardware while in U.S.

3.0 RELIABILITY AND MAINTAINABILITY (R&M)

3.1 MANAGEMENT

3.1.1 NASA ROLES AND RESPONSIBILITIES

a) NASA is responsible for establishing overall R&M technical and process requirements which will be necessary to assure vehicle life and system availability for scientific utilization. In doing this, NASA defines the system level R&M design requirements and is responsible for allocating and coordinating the appropriate requirements with RSA for the RS.

b) NASA defines and documents the analytical processes which are to be used to perform integrated R&M assessments for the ISS. NASA is responsible to identify and agree with RSA on the processes applicable to the RS and the data required to fulfill NASA's integration needs.

c) NASA will be responsible to assure that R&M requirements allocated to the RS have been verified by the RS providers or that the requirements are specifically verified by NASA. NASA is also responsible to assist RS providers in identifying verification methods for each R&M requirement.

d) NASA is responsible to provide the program manager and program teams with status of

R&M requirements implementation and an assessment of the risk involved for further evaluation at the program level.

3.1.2 RSA ROLES AND RESPONSIBILITIES

a) RSA is responsible for developing the R&M requirements allocated to the RS in SSP 41163, "ISS RS Specification" for the elements and cargo provided by RSA. These detailed requirements must meet or exceed the requirements of SSP 41163.

b) For each R&M requirement allocated to the RS, RSA is responsible for defining and conducting verification activities necessary to assure that the requirement is met.

c) RSA is responsible to provide status of implementation and verification results for R&M requirements to NASA.

d) RSA is responsible to provide NASA with R&M data , in order to support NASA's responsibilities to perform integrated analyses of the ISS.

e) RSA will be responsible for the certification of the R&M characteristics of the RS with respect to the overall program R&M requirements.

3.1.3 RECIPROCITY

NASA and RSA shall establish and maintain a Reliability and Maintainability function which possesses attributes, performs the functions, or supplies the data described herein.

3.1.4 ORGANIZATION

Organization of the NASA and RSA reliability and maintainability efforts shall assure effective planning, management, implementation, and performance of reliability and maintainability activities. While the accomplishment of all reliability or maintainability tasks may not be the responsibility of the same organizational element, management of the reliability and maintainability efforts shall assure that all tasks are effectively accomplished.

3.1.5 PLANS

3.1.5.1 RELIABILITY AND MAINTAINABILITY PLANS

The NASA and RSA reliability organizations shall prepare, implement and maintain an integrated reliability and maintainability (R&M) plan, or separate plans, as a part of the S&MA

Plan, which describes how the reliability and maintainability requirements will be implemented, controlled and verified and shall be prepared and maintained in accordance with DID R-10-S01 and U-10-S08 for RSA and NASA, respectively.

3.1.6 SUPPLIER CONTROL

3.1.6.1 SUPPLIER RELIABILITY AND MAINTAINABILITY CONTROL

The RSA and NASA reliability and maintainability efforts shall assure that ISS (USOS and RS) hardware obtained from any source meets the reliability and maintainability requirements of the overall system.

3.2 RELIABILITY AND MAINTAINABILITY ENGINEERING

3.2.1 RELIABILITY AND MAINTAINABILITY DESIGN CRITERIA

The reliability and maintainability efforts shall include a systematic approach for reviewing and concurring in design and procurement specifications and in design changes to assure that all design items reflect proper and complete reliability and maintainability design criteria and that the specifications contain applicable reliability and maintainability requirements.

Reliability and maintainability engineering tasks shall be accomplished, to the extent specified, for all flight equipment. Maintainability engineering efforts shall support maintenance planning efforts as appropriate.

3.2.2. FAILURE MODE EFFECTS ANALYSIS/CRITICAL ITEMS LIST (FMEA/CIL)

3.2.2.1 USOS FAILURE ANALYSIS PROCEDURE

The USOS segment shall perform Failure Mode Effects Analysis/Critical Items List

(FMEA/CIL) in accordance with SSP 30234 Revision D.

3.2.2.2 RSA FAILURE ANALYSIS PROCEDURE

The RS segment shall perform failure analysis in accordance with it’s own standards and methodology in order to identify critical items and evaluate failure effects on critical capabilities and interfaces with other segments of ISS.

3.2.2.3 FAILURE MODE SUMMARY REPORT (FMSR)

Each respective segment shall exchange the results of failure analysis required by paragraphs

3.2.2.1 and 3.2.2.2 in the FMSR. At a minimum the FMSR shall be prepared for equipment whose single failure manifests critical effects at the physical and functional interfaces to the associated segment. The analysis shall be used to summarize the cases of non-compliance with segment specification reliability requirements and to identify critical items. These analyses shall be documented in accordance with DID R-10-R01 and U-10-R05 for RSA and NASA, respectively.

3.2.2.4 CARGO FMEAs

RESERVED

3.2.3 CRITICALITY CATEGORIES

Criticality Categories are defined in DID R-10-R03, and SSP 30234.

3.2.4 CRITICAL ITEMS LIST (CIL)

The CIL determines the equipment for which the established requirements for reliability and safety are not fully met. Preparation of the CIL will utilize a structured process which will assure that all failure modes of each component of critical functions of the ISS are considered in the critical items analysis. Based on results of system analysis, the CIL includes justification for use of the Critical Element as part of the ISS. CIL preparation, maintenance, and control are aimed at assuring an efficient monitoring of critical elements of the ISS, and initiation of corrective action to reduce the criticality of these elements. The CIL shall be prepared for the RS in accordance with DID R-10-R03. USOS CIL will be provided to RSA in accordance with DID U-

10-R05.

3.2.5 R&M PREDICTIONS REPORT

3.2.5.A R&M Predictions data will be used to document the results of the ISS R&M analyses.

NASA and RSA shall exchange R&M Prediction data. The reliability data shall be collected for functions critical to ISS as a whole. The R&M Predictions Report will be used to status analysis results concerning segment reliability, segment maintainability allocations, provide data which will be used to develop an integrated preventive maintenance plan, and to provide data which can be used to perform integrated system level predictions of R&M characteristics. For RS, this report shall be developed in accordance with DID R-10-R02. For the USOS, this data will be reported in accordance with DID U-10-R06.

3.2.5.B

RESERVED

3.2.5.1 RELIABILITY

3.2.5.1.A LIMITED-LIFE DATA

RESERVED

3.2.5.1.B RELIABILITY PREDICTION DATA

Reliability prediction data for hardware shall be compiled to assess the reliability of the ISS.

3.2.5.2 MAINTAINABILITY

Maintainability data for RS and USOS flight elements shall be compiled in order to estimate the time and equipment required to maintain RS and USOS systems, both during assembly and at assembly complete.

3.2.6 DESIGN REVIEWS

RSA and NASA Reliability and maintainability activities shall include supporting RS and USOS internal design reviews and Space Station Program design and readiness reviews. Participation in reviews shall assure that reliability and maintainability requirements are adequately considered in such reviews.

3.2.7 REVIEW OF CHANGES

When changes are proposed for equipment design (hardware and software) or procedures, the changes shall include a review of the reliability and maintainability impact of the proposed changes.

3.2.8 FAILURE REPORTING SYSTEM

Reliability and maintainability activities shall support the failure reporting system (defined in paragraph 4.4).

3.2.9 VERIFICATION ASSURANCE

RSA and NASA Reliability and maintainability shall assure that an effective verification program is established and implemented for RS and USOS hardware and software. Reliability and maintainability activities shall include participation in such verification processes as development, certification, acceptance, checkout and maintainability verification.

4.0 QUALITY ASSURANCE

4.1 MANAGEMENT

4.1.1 NASA ROLES AND RESPONSIBILITIES

a) NASA is responsible for establishing overall QA program requirements for ISS and to allocate and coordinate them with RSA for the RS.

b) NASA is responsible to establish and coordinate with RSA the QA data on RS equipment necessary to support integrated assessments of equipment certification status and problem resolution of critical ISS capabilities and segment interfaces.

c) NASA is responsible to provide RSA with problem resolution status for USOS/RS interfaces, and critical functions for the ISS in accordance with DID U-10-QA03.

d) NASA is responsible to conduct QA activities for RSA property while it is under the control of NASA in accordance with the requirements agreed upon with RSA.

4.1.2 RSA ROLES AND RESPONSIBILITIES

a) RSA is responsible to conduct QA activities for the RS in accordance with the requirements agreed upon with NASA.

b) RSA is responsible to notify NASA of unresolved problems identified while conducting QA activities which may impact RS quality, on-orbit performance, and safety.

c) RSA is responsible to provide NASA with problem resolution status for equipment which supports critical functions and at RS/USOS interfaces in accordance with DID R-10-QA01.

d) RSA is responsible to conduct QA activities for NASA property while it is under the control of RSA in accordance with the requirements agreed upon with NASA.

4.1.3 RECIPROCITY

NASA and RSA shall establish and maintain a Quality Assurance function which possesses attributes, performs the functions, or supplies the data described herein.

4.2 QUALITY PROGRAM PLAN

RSA and NASA shall prepare, implement and maintain a Quality Program Plan, as a part of the

S&MA Plan, which describes the compliance with requirements established by RSA and NASA.

The QA plan shall describe how the quality requirements will be implemented, controlled and verified and shall be prepared and maintained in accordance with DID R-10-S01 and DID U-10-

S08.

4.3 ACCEPTANCE DATA PACKAGE (ADP).

NASA and RSA shall compile/maintain an Acceptance Data Package for their respective flight equipment in accordance with native requirements. This data shall be retained for the operational life of the equipment.

4.4 FAILURE REPORTING AND CORRECTIVE ACTION

A closed-loop system shall be provided for reporting and correcting failures. All problems involving flight articles shall be included in this system. NASA and RSA shall conduct activities aimed at failure detection, analysis of causes, and development of corrective actions, including supporting information in accordance with the respective existing requirements. NASA and RSA shall exchange information about failures per the detailed requirements for failure reporting, analysis, and resolution in accordance with DID R-10-QA01 and U-10-QA03, Failure Reporting and Corrective Action (FRACA) System Requirements.

4.5 CONTROL OF NASA AND INTERNATIONAL PARTNER (IP) PROPERTY

When NASA property is under the control of RSA, the following requirements apply. The designated NASA representative, acting as NASA Quality Assurance Representative (QAR), may travel with the hardware to support the planned activities and may perform quality assurance functions defined herein. (NOTE: these requirements will apply to NASA, when RSA property is under the control of NASA.)

4.5.1 RSA RESPONSIBILITY

RSA Quality Assurance shall ensure that a documented system for controlling NASA property and associated documentation has been established and is maintained as follows:

4.5.1.1 Upon receipt, RSA Quality Assurance shall inspect NASA property to detect damage in transit and to verify that the article and its hardware data package are complete and as specified in the shipping documents. Photo and/or imagery documentation of the hardware shall be taken whenever necessary by the NASA QAR. Articles found to be serviceable shall be re-preserved and repackaged unless the articles are to be used immediately. Should there be evidence of damage in transit, the article shall be inspected to determine the extent of damage in transit and a report of the damage provided to the NASA QARfor disposition/concurrence. Receiving inspection results shall be recorded in the historical log sheet for the article. The article is transferred following positive conclusion of the inspection, documented by joint signatures of both sides on the incoming inspection protocol.

RSA shall coordinate with the NASA QAR in the event of any unscheduled removal of an article or material from its container.

4.5.1.2 When testing or operating NASA property the NASA QAR shall be notified and shall participate in the activity unless otherwise agreed. RSA shall make necessary arrangements to allow the participation by the NASA QAR in the testing facility. RSA shall perform tests in accordance with jointly approved procedures and record and approve any deviations to the test procedures. Any such deviation must be coordinated and approved jointly with the NASA QAR.

Each test operation shall be traceable to the individual responsible for its accomplishment.

Flight articles undergoing test shall not be adjusted, modified, repaired, reworked, or replaced except as authorized by the NASA QAR. Test conduct and verification shall include the following:

a) Prior to testing, RSA shall ensure that approved test procedures are available, that test equipment is calibrated and properly configured, that the facility is properly configured, that lower level test operations are complete, and that the configuration of the flight article is correct and ready for test.

b) During test, RSA shall ensure that testing is performed in accordance with approved test procedures, that approved procedure deviations are properly recorded, that test data are accurately recorded, and that all non-conformances are documented. When a nonconformance is detected, RSA shall halt the test, secure the hardware and the test setup, and immediately notify the NASA QAR. The test shall be resumed only after a joint decision is made to proceed following analysis.

c) Subsequent to testing, RSA shall ensure that:

- The history log is updated;

- Test results, data, and test summary (AKT) are complete and traceable to the flight article and are inserted into the data package;

- Non-conformances are document;

- Proper dispositions of articles have been made; and

- Integrity control of flight articles is properly established and implemented.

4.5.1.3 RSA shall provide for the proper storage and control of NASA property. Controls shall include the following:

- Limited personnel access

- Controlled receipt and withdrawal

- Identification of article status

- Inventory list of articles in the area

- Periodic inspection of the area and verification of the inventory list

- Control for items that must be environmentally protected such as temperature, humidity, electrostatic, etc. (as required)

4.5.1.4 RSA shall provide for the protection, maintenance, calibration, periodic inspection, and controls necessary to ensure that quality of NASA property is maintained and deterioration does not occur during handling, storage, installation, shipment, testing, or operations.

4.5.1.5 RSA shall assure that contamination sensitive items are controlled in accordance with documented procedures to the levels specified in the applicable technical documents and are maintained to these cleanliness levels. These procedures shall cover hardware, equipment, personnel, and control of such inspection, test, and storage. Specific cleanliness levels to be maintained for systems, subsystems, and major components shall be indicated on drawings, specification, or documents controlling the test of those items. RSA shall assure that clean room disciplines and procedures are properly implemented and monitored to assure continuing compliance with requirements.

4.5.1.6 NASA property shall not be diverted or loaned from its assigned purpose without the prior approval of the NASA QAR.

4.5.1.7 RSA shall provide the NASA QAR test data and records of inspection and tests performed for NASA provided hardware.

4.5.1.8 RSA shall ensure the NASA QAR access to facilities in the various functions defined herein.

4.5.1.9 RSA shall maintain the hardware data package (defined in 4.5.2) and return the package to NASA at the completion of hardware use. Hardware life, time, and cycle data shall be maintained by RSA for articles identified by the hardware data package as having characteristics of quality degradation or drift with age and/or use.

4.5.1.10 RSA shall assure that requirements for flight article inspection and testing in a temperature, humidity, electrostatic discharge (ESD), or contamination controlled environment are properly implemented and recorded. The NASA QAR shall verify proper entrance in the history records.

4.5.2 NASA RESPONSIBILITY

NASA shall provide selected hardware documentation to RSA. The hardware data package shall be used to update the hardware acceptance data package (ADP). The hardware data package shall include requirements pertaining to handling, storage, operations, preservation, packaging, and shipping operations. Specifically, the list shall include the following items, as required:

- Checklist of data in package (with references)

- List of hardware including fidelity

- Applicable pre-shipment test results

- Post-delivery checkout procedures

- Storage and handling requirements

- Special storage and handling instructions including calibration instructions

- Hazardous material and special requirements

- Pyrotechnic lot certification

- Pressure vessel data

- Ground equipment calibration and operation instructions

- Hardware history log sheet (to allow for RSA input of activities)

- Hardware life, time, and cycle recording requirements

- Additional information as jointly agreed in a separate document by both sides, such as:

- Technical description including interface information with host modules

- On-orbit configuration (including physical installation with dimensions, electrical schematics, and mechanical connections, if required. For reference only)

- Jointly approved test configuration

- Jointly approved test procedures (stand alone and integrated)

4.5.3 UNSUITABLE NASA PROPERTY

NASA property found to be damaged, fails to meet its specifications, or otherwise unsuitable for its intended use shall be identified as nonconforming, segregated to the extent practicable, held for review, and analyzed to ascertain the probable cause of damage. The report shall be generated by the organization that discovered the nonconformance. The report shall include the nonconforming article name, part number/serial number, date, location, activity when nonconformance occurred, nature of nonconformance with description and data, current status of nonconforming article, conclusions, and recommendation for resolution. NASA shall perform an analysis and shall provide a disposition report that includes the nonconforming article name, part number/serial number, date and event where nonconformance was reported, nonconformance description, the probable cause, resolution information including method and status, and instructions for further activity. When the cause is determined to be in the RSA’s operations or activities, action shall be taken to prevent recurrence and to resolve compensation if required.

Disposition shall not be assigned to discrepant NASA property nor shall this property be reworked, repaired, modified, or replaced without the specific written authorization of NASA.

4.5.4 TEST PROCEDURES

Test procedures shall be jointly developed and approved by the hardware provider and test conductor prior to the hardware shipment. Approved test procedures shall be readily available to inspection and test personnel at the time of inspection and test.

Steps identified as Mandatory Inspection Point (MIP) shall be verified/witnessed by the NASA

QAR. The NASA QAR shall be notified of any tests requiring MIPs prior to hardware shipment.

4.5.5 INSPECTION AND TEST RECORDS AND DATA

4.5.5.1 Records and data of all inspections and test performed shall be prepared and maintained by RSA on the hardware history log in sufficient detail to verify and evaluate the status of the articles and materials.

4.5.5.2 RSA shall ensure that hardware data packages are updated and maintained with the following:

a) A summary of test and checkout operations and results with anomalies encountered.

b) The completed test procedure and test data including strip charts, deviations, and other data applicable to evaluate test records.

c) Documents have been properly identified as to inspection status by appropriate inspection stamps and the data package is complete.

4.5.6 PACKAGING, PACKING, MARKING, AND LABELING

RSA shall ensure that packaging and packing material, procedures, and instructions are used and that marking and labeling for packaging, storage, and shipping of articles and materials are performed in accordance with applicable specification. Special attention shall be given to critical, sensitive, dangerous, and high value articles. Reusable containers shall be inspected prior to each use. The NASA QAR shall be notified and shall participate in the activity, unless otherwise agreed.

RSA shall package the updated hardware data package with the flight article.

The article is authorized to be returned following joint signatures of both sides on the return inspection protocol.

5.0 SOFTWARE QUALITY ASSURANCE

SPA is a technical discipline which establishes requirements and criteria for the evaluation, assessment, assurance and enhancement of software safety, reliability, maintainability, and quality. It is to be accomplished to the extent specified for International Space Station software, including flight software, flight support software, software used for their design, development, verification, storage and maintenance, and software that controls or could affect flight hardware or software. SPA requirements apply to the software portions of a system. Assurance of a system shall include software affecting the system safety, reliability, maintainability or quality, and shall emphasize the use of preventative, as well as, corrective methods.

ISS Product Assurance requirements for hardware and operational procedures are addressed only as they relate to software. SSP 41000, System Specification for the International Space Station, and other paragraphs of this document "NASA/RSA Bilateral Safety and Mission Assurance

Process Requirements," provide requirements for aspects of safety, reliability, maintainability and Quality Assurance that relate to the other system components, and are not repeated here.

This chapter establishes common SPA requirements for the ISS organizations including the

International Partners, and contractors. The SPA requirements for the International Partners shall be equivalent to the requirements of this paragraph. Software, which is loaded in a class of memory that cannot be dynamically modified (i.e., firmware), is subject to these software assurance requirements to the extent practical.

5.1 MANAGEMENT

Software product assurance activities shall be planned, managed, and integrated in conjunction with other management, and technical functions to assure a complete, concise, and consistent approach to the development of program plans, and compliance with ISS program requirements.

5.1.1 ORGANIZATION

SPA shall be accomplished in accordance with the overall QA systems, accepted by NASA and

RSA respectively. Personnel responsible for ensuring compliance with SPA requirements shall have the resources, responsibility, authority and organizational freedom to permit objective evaluations. SPA shall have the authority to initiate the corrective action process, and to verify corrective actions.

SPA management shall be structured to provide planning, management, and implementation of all SPA activities.