For Reference_LAUNCH VEHICLE CERTIFICATION LSP PLN 324.01 Rev C.pdf

National Aeronautics and Space Administration LSP-PLN-324.01

John F. Kennedy Space Center, Florida Revision C

Launch Services Program

LAUNCH VEHICLE CERTIFICATION

Approved: Darren Bedell Date: 03/11/2020

Launch Services Development & Risk Mgr.

RELEASED - Printed documents may be obsolete; validate prior to use.

LSP-PLN-324.01, Rev. C

Section 2 – Implementation o Update to LSP required reviews

Section 3 – Definitions o CLVC Changes for Category 1 Certification

Section 4.1 – Category 1 Certification Requirements o Update to System Safety Requirements and deletion of Launch Vehicle Design Requirements

Section 6.1.e – Request for Certification o Added request for Category 1 Certification

1.0 PURPOSE AND APPLICABILITY

Any launch vehicle configuration utilized by Launch Service Contractors (LSC) to launch National Aeronautics and Space Administration (NASA) payloads must be certified in accordance with NASA Policy Directive (NPD) 8610.7, Launch Services

Risk Mitigation Policy for NASA-Owned or NASA-Sponsored Payloads/Missions.

This plan sets forth the criteria to be used by the NASA Launch Services Program

(LSP) to certify any launch vehicle configuration under contract to the LSP.

2.0 IMPLEMENTATION

(a) The LSC must be AS9100E compliant for any corporation, corporate divisions, subsidiaries, joint ventures, partner(s) and/or any (added) major supplier actually performing launch vehicle manufacturing, management, payload/launch vehicle integration, testing, and launch. Certification from a registrar accredited by either the International Registrar of Certified Auditors

(IRCA) or the Registrar Accreditation Board (RAB) is not required, but individual launch service contracts may require such certification. For

Category 1, compliance to ISO 9001:2015 can be used in place of AS 9100 compliance.

(b) For contract award of any launch services solicited under a NASA request for launch service proposal, the proposed Common Launch Vehicle

Configuration (CLVC) shall be certified to the required launch vehicle risk category, as defined by the NASA Enterprises or the LSC must provide a detailed, viable plan, subject to Government assessment and acceptance, to achieve all certification requirements prior to launch. (Note: The launch vehicle risk categories are defined in NPD 8610.7, Launch Services Risk

Mitigation Policy for NASA-Owned or NASA-Sponsored Payloads/Missions.)

(c) The LSP has established the Launch Vehicle Certification Process as outlined in Section 4. The LSC shall submit the required documentation for

NASA evaluation and determination of certification category.

(d) Prior to launch of the NASA payload, the proposed CLVC shall be certified to the required payload risk category.

i. For Category 2 and 3:

The certification evaluations, findings, residual risk determination shall be completed no later than L-6 months to avoid overlap with launch readiness activities. Any proposed corrective actions to lower the residual risk shall be identified at the same time. It is recognized that creating a schedule that includes enough time for corrective action implementation is extremely difficult due to the unknown nature of the findings that could be identified thru the certification evaluation. Therefore, emphasis shall be placed on the earliest practicable identification of corrective actions and associated residual risk if the actions are not taken.

At or before L-12 months, LSP shall review the certification progress at the Program Requirements Control Board (PRCB). This presentation shall include findings for any completed technical assessments, any corrective actions taken or already in work, potential corrective actions (if any) for technical items still in work.

At or before L-6 months LSP shall review the completed certification assessments at the PRCB. This presentation shall include findings, corrective actions taken, corrective actions not yet complete with a schedule for completion prior to the appropriate launch campaign milestone, and any residual risks (schedule, cost and technical) that have been identified.

The outcome of the PRCB will be presented to the NASA Flight

Planning Board no later than L-4 months. The launch readiness review process, which starts with the Pre-Vehicle on Stand Review or equivalent, will subsequently serve to determine the flight readiness of a particular mission.

ii. For Category 1:

The certification evaluations (other than for Flight Hardware/Software

Qualification and Test and Verification as noted below), associated findings, and an initial residual risk determination shall be completed no later than L-6 months. This assessment shall include findings, corrective actions taken, corrective actions not yet complete with a schedule for completion prior to appropriate launch campaign milestones, and any residual risks (schedule, cost and technical) that have been identified.

Prior to the Launch Vehicle or Payload shipment to the launch site, the core stage engines and tanks, flight computer and Inertia

Navigation Unit (INU), engine actuators, main batteries and payload fairing shall have completed qualification. The assessment required in section 4.1.1 (k) shall also be completed to close the Hardware

Qualification Element. An LSP PRCB shall be held if the noted hardware items were not completed at the L-6 month assessment.

All open certification related items (i.e. yet to be completed component qualification and/or acceptance tests and End-to-End

Ground Tests) shall be scheduled for completion prior to the appropriate launch campaign milestone.

Prior to the Flight Readiness Review (FRR), the remaining qualification and/or acceptance testing (e.g. an item not listed in the paragraph above) and End-to-End Ground Test (i.e. flight simulation) shall be completed to close the two elements. NASA shall review the results prior to the FRR and acknowledge the completion of these elements at the FRR without requiring another PRCB. Note that, acceptance tests and End-to-End Ground tests on a previously successful launch of the same CLVC will meet the requirement and therefore, these elements shall have been reviewed at the PRCB at an earlier date.

e. NASA reserves the right to require a specific launch vehicle certification category and alternative for selected payloads, regardless of the payload risk classification. This determination will be made prior to the launch service contract award.

f. If no certified CLVC exists to meet specific mission requirements solicited under a NASA request for contract proposal, the LSP may elect to award or issue Acceptance Test Plan (ATP) of a mission, contingent on the launch vehicle configuration achieving tailored certification requirements.

2.1 A launch vehicle certified to launch a higher class of payload (e.g. A) is inherently certified to launch a lower class of payload (i.e. CLVCs certified to Category 3 are also certified to Category 2).

2.2 Upgrades or modifications to a certified CLVC do not require re-certification. For upgraded or modified vehicle configurations, NASA may require additional technical insight into the design, manufacturing, testing, integration, and launch of the affected systems and launch vehicle.

2.3 Changes, as defined in this document, to a certified CLVC would be considered a new CLVC and therefore require a new certification.

2.4 In the event of a launch failure of a certified CLVC, the NASA LSP will either participate in or perform a failure investigation/return-to-flight board. Participation in the LSC investigation is required to maintain Category 2 or 3 certification, even if

NASA performs its own investigation. NASA must concur with the out brief of the

LSC failure investigation board and return-to-flight plan for the LSC to retain their certification. For Category 1 certification, NASA LSP may be briefed by the LSC in place of conducting or participating in a failure investigation.

2.5 The LSP, in conjunction with the KSC Engineering Directorate and the KSC Safety and Mission Assurance Launch Services Division (SMA LS Division), will make assessments as described in section 4. In some cases the assessment will be via an Engineering Review Board that is defined in LSP-P-321.01. In all cases, the

LSP PRCB makes the determination of successful assessment completion with input from the two technical authorities. The two technical authorities have the right to appeal the PRCB determination as defined by the NASA Governance Model.

2.6 Once a Category 2 or 3 certification has been initiated, NASA shall maintain insight into the launch vehicle, including CLVC upgrades and modifications, as outlined in

NPD 8610.23.

2.7 Category 1 Certification, per NPD 8610.7, is for high risk tolerant payloads as defined in NPR 8705.4. Requirements for Category 1 Certification defined in this plan apply to FAA licensed launches only. Therefore, FAA will conduct all post flight failure investigations and NPR 8621.1, NASA Mishap and Close Call

Reporting, will not be employed because a single mission failure will not cause a failure of a NASA Program’s mission. In addition, launches carried out by LSP with a vehicle certified to Category 1, will not be considered a government launch, and tailoring of NPD 8610.23 has been approved by the Flight Planning Board and included in the NPD.

3.0 DEFINITIONS

Certified CLVC: A CLVC which has met the requirements defined in this document for a specific payload risk category.

CLVC: A distinct combination of core propulsive stages and hardware used to deliver payloads to earth orbit or escape trajectories.

Core Propulsive Stages: All propulsive stages except strap-on motors, final stages (exclusively used for orbit circularization or escape), and trim stages.

CLVC Upgrades or Modifications: Items that do not substantially affect operating time, specific impulse, the thrust, and/or the mass of one or more propulsive stages are considered upgrades or modifications to the certified

CLVC. Examples of upgrades and modifications include changes in avionics, software, payload fairing, payload electrical/mechanical interfaces, incorporation of mission-unique requirements, and the addition or deletion of a final stage

(exclusively used for orbit circularization or escape), strap-on solid rocket motors, and/or trim stage. Upgrades or modifications are not to be interpreted as CLVC changes.

CLVC Changes: Items that substantially affect the airframe integrity, operating time, specific impulse, the thrust and/or the mass of one or more core propulsive stages are considered changes to the CLVC. Examples of vehicle configuration changes include the replacement of engine(s), core propulsive stages, and/or major airframe structures (e.g. significant stage length increase and/or major changes in primary load path). For Category 1 Certification, a change in thrust of any core stage engine greater than 10% constitutes a change to the CLVC.

Additionally, for Category 1, a change in propellant mass of a core stage greater than 10% is a change to the CLVC.

Payload: A spacecraft and any integral propulsive system.

Successful Flight: A launch that met primary mission requirements.

4.0 CERTIFICATION PROCESS

4.1 Category 1 Certification Requirements:

To achieve a Category 1 CLVC certification, the LSC must achieve one of two alternatives:

4.1.1 If there has not been a successful launch of the CLVC, the LSC participate with

NASA in a review of LSC processes and plans as follows

(a) Flight Hardware Assembly/Operations. The LSP in conjunction with the LSP

Engineering and SMA technical representatives will conduct an assessment of flight vehicle hardware assembly-level, and integrated assembly test plans including post flight operations/anomaly resolution process. This assessment will be a review of the plans at a Critical Design Review (CDR) level of detail during the Qualification Data Review (item k)

(b) Manufacturing Processes. The LSP in conjunction with the LSP Engineering and SMA technical representatives will conduct audits/2nd party audits with focus on the LSC’s manufacturing processes.

(c) Quality Systems. The SMA LS Division will conduct an audit of the LSC’s management processes, quality systems, and problem reporting and corrective action systems. NASA will utilize industry-accepted practices to perform the audits using AS9101E Quality Management Systems Audit

Requirements for Aviation, Space, and Defense Organizations as a set of reference guidelines. The audits will be structured to minimize impacts to operations where possible. LSC’s will support these audits with a quality department associate and by permitting free interchange with personnel including production floor interviews with technicians, when required. NASA may choose to attend a limited number of key/critical supplier audits conducted by the LSC. LSP Agreement on corrective actions from the audit are required for Category 1 Certification unless the LSC obtains AS9100 certification.

(d) Risk Mitigation. The LSP and SMA LS Division will review documented risk management policies with respect to the identification, tracking, analysis, and mitigation techniques used to manage potential impacts to delivery of the launch service. Specific mitigated and accepted technical and safety risks for the CLVC will be reviewed by the LSP in conjunction with the LSP

Engineering and SMA Technical Authorities.

(e) Systems Engineering: This item will be evaluated as early as possible in the certification process. The LSP in conjunction with the LSP Engineering and

SMA technical representatives will assess the LSC’s Systems Engineering

Practices. Included elements are the LSC’s engineering decision making process (e.g. informal and/or formal reviews, boards, documentation and communication of decisions), documented test philosophy (i.e. use of test like you fly principles), knowledge of suppliers design and evaluation of supplier changes, requirements definition, requirements tracking, requirements verification, configuration management system, existing documentation system discipline, design process control, problem reporting and corrective action practices. LSP participation in launch system development reviews may be used to satisfy this element.

(f) Documented ICD: The LSP will assess the LSC documented Launch

Vehicle to Spacecraft Interface Control Document process including its development, configuration control, changes, and requirement verification.

(g) Reserved

(h) Flight Data Assessment Process: The LSP in conjunction with LSP

Engineering and SMA technical representatives will assess the LSC documented flight data assessment process including locations of instrumentation to enable subsequent evaluation of items required by

Category 2 and/or 3 certification (e.g. Flight Margin Verification, Hardware

Qualification). The LSC shall submit a detailed plan defining how the vehicle instrumentation will be used to prove design verification and evaluate flight performance data. In addition, the plan shall detail how post flight data will be reviewed, anomalies identified and resolved. If the LSC has previously flown a launch vehicle, then examples of the post flight process, as applicable to the new CLVC, shall be provided and can be used in place of detailed plans described herein.

(i) System Safety: LSP requires the LSC to obtain an FAA license when launching NASA Missions with a requirement for Category 1 certification.

Any license from any mission using the same CLVC is acceptable to demonstrate that the LSC has complied with applicable range safety requirements.

(j) Launch Vehicle Analysis: The LSP in conjunction with the LSP Mission

Analysis and SMA technical representatives will review the LSC’s analysis plan which will include detailed definitions and methodologies of the analyses to be performed by the LSC.

(k) Flight Hardware Qualification: The LSC shall demonstrate the functional performance of launch vehicle components and systems/subsystems, with margin above maximum predicted environments encompassing the entire component life-cycle to include all shipping, handling, acceptance testing, integrated LV checkout/testing, and flight. A Qualification Data Review (~2 days duration) shall be presented by the LSC to provide NASA confidence in the LSC’s ability to successfully deliver the launch service. The LSC will present rational to LSP showing that components and subsystems are

“qualified” to contractor’s satisfaction (i.e. meet contractor’s internal standards deviation/waiver process and risk management practices).

Qualification rationale shall include the qualification and acceptance test and/or analysis levels, the environments derivation methodology and examples. The rationale shall be clear on the use of analysis, test and/or similarity. All anomalies and deviations from the LSC test plans, with associated resolutions and rationale shall be identified. The QDR presentation will address the entire vehicle, with the most detailed information addressing the major items listed above, separation systems, and flight software processes/testing.

The QDR shall include the as-built and qualified implementation/fabrication, component qualification, and system level qualification/compatibility for the listed major items. The presentation material of the QDR will cover all elements of the hardware’s entire life cycle.

While not held as an Engineering Review Board (ERB), the LSP Chief

Engineer, or designee, will chair the Qualification Data Review (QDR) with a small, multifunctional technical team that includes a mission assurance representative from SMA. Qualification is required to be accomplished against the Contractor’s internal standards and is subject to LSP review;

however, this review does not require or constitute NASA verification or agreement that the qualification meets NASA’s definition.

It is recognized that LSCs choose or maintain their own technical standards for design and test; therefore, the chosen standard(s) will be provided to

LSP 1 month prior to the QDR to aid in our understanding of the qualification status.

LSP reserves the right to withhold Category 1 Certification if the Contractor defined success criteria has not been met or if there is other reasonable evidence to suggest the Qualification Test of a defined major/key item (see section 2.0 d ii) is unsuccessful.

(l) Test and Verification: During the QDR, LSP will also assess if ATPs, including end-to-end system level tests plan are in place and are consistent with the qualification rationale presented. If NASA is to be the first flight of the CLVC, these assessments shall occur before the flight hardware acceptance tests occur.

Prior to completion of this element, all component level acceptance tests and system end-to-end testing (thru Flight Simulation) must be completed for at least a single flight unit. Major anomalies and deviations from the LSC test plans presented at QDR, with associated resolutions and rationale, must be identified by the LSC to NASA.

4.1.2 A minimum of 1 successful flight of a CLVC and the LSC shall participate with

NASA in a post flight data review:

(a) Post Flight Data Review: The LSP Chief Engineer, or designee, will chair a

Technical Interchange Meeting (TIM) with the LSC and an LSP small, multifunctional technical team that includes a mission assurance representative from SMA. The team will review the LSC’s post fight data report before scheduling the TIM. During the TIM, the team will complete the assessment to verify a successful flight of the CLVC met predicted vehicle and performance parameters within three sigma criteria. Actual vehicle and performance parameters which exceed three sigma predictions shall be specifically presented by the LSC in the TIM, regardless of mission success determination as defined in this document. The LSC’s resolution of the anomalies shall also be presented to NASA.

(b) NASA assessments of LSC compliance with applicable Range Safety

Requirements, and Risk Management shall be conducted as defined above in section 4.1.1.

4.2 Category 2 Certification Requirements:

To achieve a Category 2 CLVC certification, the LSC must achieve one of three alternatives:

4.2.1 A minimum of 6 consecutive, successful flights of a CLVC and the LSC shall participate with NASA in post flight data reviews:

(a) Flight Margin Verification. The LSP in conjunction with the LSP Engineering and SMA Technical Authorities will make a comprehensive assessment, via applicable Engineering Review Board and SMA evaluation/Watch Item processes that will verify all six flights of the CLVC met predicted vehicle and performance parameters within three sigma criteria. Actual vehicle and performance parameters which exceed three sigma predictions will be investigated by NASA as anomalies regardless of mission success determination as defined in this document.

(b) NASA assessments of LSC design reliability, compliance with applicable

Range Safety Requirements, and Risk Management shall be conducted as defined below.

4.2.2 A minimum of one successful flight of the CLVC and the LSC must participate with

NASA in a review of vehicle characteristics and LSC processes as follows:

LAUNCH VEHICLE ASSESSMENT

(a) Launch Vehicle Design: The SMA LS Division will conduct a review to assess the launch vehicle predicted design reliability.

(b) Vehicle Flight Hardware/Software Qualification: The LSP in conjunction with the LSP Engineering and SMA Technical Authorities will make a comprehensive assessment, via applicable (ERBs) and SMA evaluation/Watch Item processes, of the LSC’s qualification rationale including but not limited to environments derivation, design information, associated analyses, Basis of Similarity claims and qualification and ATPs.

The LSC must submit documented and comprehensive vehicle qualification and acceptance test results, including resolution of test anomalies, from its environmental, propulsive, avionics, and payload electrical/mechanical interface testing programs. The ERB will include an assessment of the

LSC’s approach (e.g. standards, items tested, margins, measurements etc.)

to hardware acceptance testing for the launch vehicle.

(c) Flight Margin Verification: The LSP in conjunction with the LSP Engineering and SMA Technical Authorities will make a comprehensive assessment, via applicable ERB and SMA evaluation/Watch Item processes, that the demonstrated vehicle configuration flight met the predicted vehicle and performance parameters within three sigma criteria. Actual vehicle and performance parameters which exceed three sigma predictions will be investigated by NASA as anomalies regardless of mission success determination as defined in this document.

(d) Demonstrated System Safety: The LSP will require the LSC to submit documentation for the SMA LS Division to verify compliance to EWR 127.1 or AFSPCMAN 91-710 as prescribed by the Eastern or Western Range (or equivalent for launch sites other than Eastern and Western ranges) with regard to its launch vehicle systems.

(e) Launch Complex: The LSP in conjunction with the LSP Engineering and

SMA Technical Authorities will make an assessment, via applicable

Engineering Review Board and SMA evaluation/Watch Item processes, of the Launch Service Complex and the associated support equipment. This will be a system level engineering review of launch complex structural, mechanical, fluid and electrical ground to vehicle interfaces with respect to their affect upon the completion of the mission objectives.

(f) Launch Vehicle Analyses: The LSP will conduct an IV&V of the LSC’s

Coupled Loads Analysis. The LSP in conjunction with the LSP Engineering and SMA Technical Authorities will make an assessment of the LSC’s analysis plan which will include detailed definitions and methodologies of the analyses performed by the LSC.

MANAGEMENT AND PROCESS AUDITS

(a) Flight Hardware/Software Operational/Integrated Test Process. The LSP in conjunction with the LSP Engineering and SMA Technical Authorities will conduct an assessment of all flight vehicle hardware environmental, assembly-level, and integrated assembly test process including post flight operations/anomaly resolution process.

(b) Manufacturing Processes. The LSP in conjunction with the LSP Engineering and SMA Technical Authorities will conduct audits/2nd party audits with focus on the LSC’s manufacturing processes.

(c) Quality Systems. The SMA LS Division will conduct an audit of the LSC’s management processes, quality systems, and problem reporting and corrective action systems. NASA will utilize industry-accepted practices to perform the audits using AS9101E Quality Management Systems Audit

Requirements for Aviation, Space, and Defense Organizations as a set of reference guidelines. The audits will be structured to minimize impacts to operations where possible. LSC’s will support these audits with a quality department associate and by permitting free interchange with personnel including production floor interviews with technicians, when required. A limited number of key/critical supplier audits will be required.

(d) Risk Mitigation. The LSP and SMA LS Division will review documented risk management policies with respect to the identification, tracking, analysis, and mitigation techniques used to manage potential impacts to delivery of the launch service. Specific mitigated and accepted technical and safety risks for the CLVC will be assessed by the LSP in conjunction with the LSP

Engineering and SMA Technical Authorities to determine if any additional risk mitigation is warranted.

(e) Systems Engineering: This item will be evaluated as early as possible in the certification process. The LSP in conjunction with the LSP Engineering and

SMA Technical Authorities will conduct an audit to assess the LSC’s

Systems Engineering Practices. Included elements are the LSC’s engineering decision making process (e.g. informal and/or formal reviews, boards, documentation and communication of decisions), documented test philosophy (i.e. use of test like you fly principals), knowledge of suppliers design and evaluation of supplier changes, requirements definition, requirements tracking, requirements verification , configuration management system, existing documentation system discipline, design process control, problem reporting and corrective action practices.

4.2.3 A minimum of three successful flights (with two of the 3 successful flights being consecutive) of a CLVC and the LSC must participate with NASA in a review of vehicle characteristics and LSC processes as follows:

All of the elements of the above Category 2 assessments and audits will be conducted with the following changes. A minimum of 3 Flight Margin Verifications will be performed. Vehicle Flight Hardware/Software Qualification and the Launch

Service Complex will be assessed thru the successful completion of a NASA ERB concurrent with an LSC DCR. LSP will conduct a comprehensive launch vehicle

IV&V, based on the specifics of the CLVC, to meet the analysis requirement. This may include all or a subset of the following: Flight design, flight software, control dynamics, guidance, coupled loads, environments, thermal, stress and structures, and Electromagnetic Comparability (EMC) Radio Frequency (RF).

The objective of the DCR is to hold a NASA ERB, with participation of the SMA LS

Division (who will conduct an SMA Watch Item Meeting in parallel), during an LSC presented review of the final/actual design implementation/fabrication, component qualification, and system level qualification/compatibility. A DCR for purposes of certification is essentially an updated CDR after the new CLVC has completed its design, fabrication, qualification testing, analysis and initial set of flights.

Realistically some amount of design is likely to be in progress at the time a CDR is convened and qualification is obviously not expected to be complete at CDR.

Typically, analyses at CDR are preliminary in nature and must often be finalized later. Further, there are always design changes between CDR and final implementation as a result of initial flights of a new LV.

The expectation for the DCR is as follows:

1) NASA will review the LSC provided CDR documentation (e.g. requirements, design, analyses, reports), and LSC updates to CDR documentation if any, existing qualification test reports, and existing LV analyses

2) DCR specific agenda items are established by the LSC with NASA approval after the review noted in item 1

3) The DCR will be conducted after a minimum of 2 FMV ERB’s and completion of the NASA Risk Management Assessments, may be held before IV&V is completed.

4) The DCR presentation package will be available at least 1 month prior to the review

5) The DCR will review the design changes that occurred subsequent to CDR or as a result of the CLVC initial flights

6) The DCR will review the component qualification rationale (similarity, test, analysis) for all affected components (either new, changed or subject to new environments or functional requirements) by presenting a summary of applicable tests (set up, test cases, results, significant anomalies), analyses, margins or similarity assessments.

7) The DCR will review the qualification rationale for the system as a whole.

8) The DCR will review methodology and results of current analyses

9) The DCR will review the LSC’s approach (e.g. standards, items tested, margins, measurements etc.) to hardware acceptance testing for the launch vehicle.

4.3 Category 3 Certification Requirements:

To achieve a Category 3 CLVC, the LSC must achieve one of three alternatives:

4.3.1 A minimum of 14 consecutive, successful flights of a CLVC and the LSC shall participate with NASA in post flight data reviews:

(a) Flight Margin Verification. The LSP in conjunction with the LSP

Engineering and SMA Technical Authorities will make a comprehensive assessment, via applicable Engineering Review

Board and SMA evaluation/Watch Item processes that will verify all fourteen flights of the CLVC met predicted vehicle and performance parameters within three sigma criteria. Actual vehicle and performance parameters which exceed three sigma predictions will be investigated by NASA as anomalies regardless of mission success determination as defined in this document.

(b) NASA assessments of LSC design reliability, compliance with applicable Range Safety Requirements, and Risk Management shall be conducted as defined below.

4.3.2 A minimum of three successful flights (with two of the 3 successful flights being consecutive) of a CLVC and the LSC will participate with NASA in a review of

LAUNCH VEHICLE ASSESSMENT

(a) Launch Vehicle Design: The SMA LS Division will conduct a review to assess of the launch vehicle predicted design reliability.

(b) Vehicle Flight Hardware/Software Qualification: The LSP in conjunction with the LSP Engineering and SMA Technical Authorities will make a comprehensive assessment, via applicable Engineering Review Boards

(ERB) and SMA evaluation/Watch Item processes, of the LSC’s qualification rationale including but not limited to environments derivation, design information, associated analyses, Basis of Similarity claims and qualification and ATPs. The LSC must submit documented and comprehensive vehicle qualification and acceptance test results, including resolution of test anomalies, from its environmental, propulsive, avionics, and payload electrical/mechanical interface testing programs. The ERB will include an assessment of the LSC’s approach (e.g. standards, items tested, margins, measurements etc.) to hardware acceptance testing for the launch vehicle.

(c) Flight Margin Verification: For 3 successful flights, the LSP in conjunction with the LSP Engineering and SMA Technical Authorities will make a comprehensive assessment, via applicable Engineering Review Board and

SMA evaluation/Watch Item processes, that the demonstrated vehicle configuration flight met the predicted vehicle and performance parameters within three sigma criteria. Actual vehicle and performance parameters which exceed three sigma predictions will be investigated by NASA as anomalies regardless of mission success determination as defined in this document. The assessment will include an understanding of any launch vehicle failures and associated corrective actions for flights which do not undergo an FMV.

(d) Demonstrated System Safety: The LSP will require the LSC to submit documentation for SMA LS Division to verify compliance to EWR 127.1 or

AFSPMAN 91-710 as prescribed by the Eastern or Western Range (or equivalent for launch sites other than Eastern and Western ranges) with regard to its launch vehicle systems.

(e) Launch Complex: The LSP in conjunction with the LSP Engineering and

SMA Technical Authorities will make an assessment, via applicable

Engineering Review Boards and SMA evaluation/Watch Item processes, of the Launch Service Complex and the associated support equipment. This will be a system level engineering review of launch complex structural, mechanical, fluid and electrical ground to vehicle interfaces with respect to their affect upon the completion of the mission objectives.

(f) Launch Vehicle Analyses: LSP will conduct a comprehensive launch vehicle

IV&V, based on the specifics of the CLVC. This may include all or a subset of the following: Flight design, flight software, control dynamics, guidance, coupled loads, environments, thermal, stress and structures, and EMC/RF.

(g) Full Vehicle Fishbone: LSP will require the LSC to perform a formal cause and effect analysis of the launch service, including the CLVC, beginning with the top-level effect of mission loss. An Ishikawa-style cause-and-effect (aka

“fishbone”) diagram will be used to guide the analysis. The cause and effect analysis will examine and document the evidence supporting a mission loss outcome due to defects in human error (i.e. Man), hardware/software failure

(i.e. Machine), design and manufacturing (Method), material defect

(Material), or measurement/instrumentation error (Measurement). The depth of this analysis will extend to the failure of every discreetly qualified flight-critical component on the vehicle (i.e. avionics box, pneumatics pressure vessel, propellant valve, primary structure, etc). Outcomes will be determined based on a documented set of credibility codes (e.g. confirmed, likely, credible, unlikely, not credible) delineating specific rules of evidence required for disposition. All dispositions will be documented by the LSC and reviewed for acceptance by LSP in conjunction with the LSP Engineering and S&MA Technical Authorities.

MANAGEMENT AND PROCESS AUDITS

(a) Flight Hardware/Software Operational/Integrated Test Process. The LSP in conjunction with the LSP Engineering and SMA Technical Authorities will conduct an assessment of all flight vehicle hardware environmental, assembly-level, and integrated assembly test process including post flight operations/anomaly resolution process.

(b) Manufacturing Processes. The LSP in conjunction with the LSP Engineering and SMA Technical Authorities will conduct audits/2nd party audits with focus on the LSC’s manufacturing processes.

(c) Quality Systems. The SMA LS Division will conduct an audit of the LSC’s management processes, quality systems, and problem reporting and corrective action systems. NASA will utilize industry-accepted practices to perform the audits using AS9101E Quality Management Systems Audit

Requirements for Aviation, Space, and Defense Organizations as a set of reference guidelines. The audits will be structured to minimize impacts to operations where possible. LSC’s will support these audits with a quality department associate and by permitting free interchange with personnel including production floor interviews with technicians, when required. A limited number of key/critical supplier audits will be required

(d) Risk Mitigation. The LSP and SMA LS Division will review documented risk management policies with respect to the identification, tracking, analysis, and mitigation techniques used to manage potential impacts to delivery of the launch service. Specific mitigated and accepted technical and safety risks for the CLVC will be assessed by the LSP in conjunction with the LSP

Engineering and SMA Technical Authorities to determine if any additional mitigation is warranted.

(e) Systems Engineering: This item will be evaluated as early as possible in the certification process. The LSP in conjunction with the LSP and Engineering and SMA Technical Authorities will conduct and audit to assess the LSC’s

Systems Engineering Practices. Included elements are the LSC’s engineering decision making process (e.g. informal and/or formal reviews, boards, documentation and communication of decisions), documented test philosophy (i.e. use of test like you fly principals), knowledge of suppliers design and evaluation of supplier changes, requirements definition, requirements tracking, requirements verification, configuration management system, existing documentation system discipline, design process control, problem reporting and corrective action practices.

4.3.3 A minimum of six successful flights (with three of the six successful flights being consecutive) of a CLVC and the LSC must participate with NASA in a review of

All of the elements of the above Category 3 assessments (section 4.3.2) and audits will be conducted with the following changes. A minimum of 6 Flight Margin

Verifications will be performed. Vehicle Flight Hardware/Software Qualification and the Launch Service Complex will be assessed thru the successful completion of a

NASA Engineering Review Board concurrent with an LSC Design Certification

Review.

The objective of the DCR is to hold a NASA ERB, with participation from the SMA

LS Division (who will conduct an SMA Watch Item Meeting in parallel), during an

LSC presented review of the final/actual design implementation/fabrication, component qualification, and system level qualification/compatibility. A DCR for purposes of certification is essentially an updated CDR after the new CLVC has completed its design, fabrication, qualification testing, analysis and initial set of flights. Realistically some amount of design is likely to be in progress at the time a

CDR is convened and qualification is obviously not expected to be complete at

CDR. Typically, analyses at CDR are preliminary in nature and must often be finalized later. Further, there are always design changes between CDR and final implementation and as a result of initial flights of a new LV.

The expectation for the DCR is as follows:

1) NASA will review the LSC provided CDR documentation (e.g. requirements, design, analyses, reports), and LSC updates to CDR documentation if any, existing qualification test reports, and existing LV analyses

2) DCR specific agenda items are established by the LSC with NASA approval after the review noted in item 1

3) The DCR will be conducted after a minimum of 2 FMV ERB’s and completion of the NASA Risk Management Assessments, may be held before IV&V is completed.

4) The DCR presentation package will be available at least 1 month prior to the review

5) The DCR will review the design changes that occurred subsequent to CDR or as a result of the CLVC initial flights

6) The DCR will review the component qualification rationale (similarity, test, analysis) for all affected components (either new, changed or subject to new environments or functional requirements) by presenting a summary of applicable tests (set up, test cases, results, significant anomalies), analyses, margins, or similarity assessments.

7) The DCR will review the qualification rationale for the system as a whole.

8) The DCR will review methodology and results of current analyses

9) The DCR will review the LSC’s approach (e.g. standards, items tested, margins, measurements etc.) to hardware acceptance testing for the launch vehicle.

5.0 CONSECUTIVE SUCCESS REQUIREMENT RELIEF

Via ERB assessment, a CLVC failure caused by a part or subsystem that has had at least 14 consecutive successful flights in a similar application on another CLVC from the same LSC may be used to recommend to the PRCB that the consecutive success string has not been broken. At a minimum, the new operational environment for the part or subsystem must not be the cause of the failure as determined via the LSP Flight Margin Verification. In addition, LSP must agree with the proximate and/or root cause as “most probable”.

6.0 LAUNCH VEHICLE CERTIFICATION REQUEST

6.1 Request for Certification:

Any LSC on contract to the LSP may request certification of a contracted CLVC by sending a written request to the LSP. This written request may be in the form of a

Launch Service Task Order (LSTO) proposal for a specific mission. The request shall identify the type of certification being requested (e.g. NPD 8610.7 Category 3

Alternative 2) and be accompanied by the following:

(a) A description of any significant upgrades or modifications to the contracted

CLVC that the LSC proposes for certification

(b) A list of mission names, launch dates, any significant launch vehicle upgrades or modifications, and associated customers for all planned and/or performed launches of the CLVC requesting certification.

(c) An LSC certification plan and integrated schedule of activities, or an updated one if one already exists on contract, which address and meets the requirements of section 4.0 above, as appropriate for the certification level and alternative method being requested. LSP will evaluate the LSC certification plan and the available resources for the requested certification to determine a strategy for implementation.

(d) A point-of-contact for coordination of NASA’s certification process.

(e) For Category 1 Certification, a briefing on the basic design and approach of the launch vehicle, schedule for first launch, and list of contracted customers is sufficient. LSP has a generic certification plan available as a starting point in developing the LSP vehicle specific Category 1 Certification plan.

6.2 LSP will create the final Certification Plan with specific implementation details and a target schedule based upon the LSC’s submitted plan and the certification strategy approved by the NASA Flight Planning Board.

6.3 Throughout the certification process, open dialog is required between the LSC and

NASA to ensure timely delivery of appropriate documentation and to avoid unnecessary efforts.

6.4 Upon completion of the certification process, the LSP will issue a letter to the LSC informing them of the launch vehicle configuration’s certification category.