Attachment A5_HLS-VV-002 HLS Integrated Lander Verification Guidebook - Sustained Phase_Rev A.pdf

The electronic version is the draft document.

Verify this is the correct version before use.

HLS Program Integrated Lander Verification Guidebook – Sustained Phase July 2022

National Aeronautics and Space Administration

HLS-VV-002

Revision A

RELEASE DATE: July 1, 2022 George C. Marshall Space Flight Center Marshall Space Flight Center, Alabama 35812

Human Landing System (HLS) Program Integrated Lander Verification Guidebook –

Sustained Phase

Revision: A Document No: HLS-VV-002 Release Date: July 1, 2022 Page: 2 of 119 Title: HLS Program Integrated Lander Verification Guidebook – Sustained Phase

The electronic version is the official approved document.

REVISION AND HISTORY PAGE

Revision

No.

Change

No.

Description Release

Date Draft Draft Release 06/25/21

Baseline HLS-C0209 Initial Baseline Release (Reference

HCB.02.02.2022)

02/04/22

Baseline HLS-MD-0007 Update Sustain Requirements in HLS-VV- 002 to "best available" based on requirement update recommendations to initial mission requirements.

03/10/22

Baseline HLS-MD-0010 Updating definitions for sustaining/App P/SLD. The intent is to be consistent between SOW, DRDs, SRDs, and IRDs.

04/28/22

A HLS-C0265 Updates based on Appendix P Industry feedback (Reference HCB.06.24.2022)

07/01/22

Release Date: July 1, 2022 Page: 3 of 119

TABLE OF CONTENTS

1 Introduction

1.1 Scope and Purpose

1.2 Measurement Units

2 Documents

2.1 Standards

3 General Verification Guidance on Probabilistic Success Criteria 4 Human Health and Performance Verifications

4.1 Human Capabilities and Characteristics

4.2 Natural and Induced Environments

4.2.1 Cabin Atmosphere

4.2.2 Cabin Contamination

4.2.3 Cabin Pressure

4.2.4 Acceleration and Vibration Limits

4.2.5 Acoustic Noise Limits

4.2.6 Ionizing Radiation

4.3 Habitability Functions

4.3.1 Potable Water

4.3.2 Food Accommodation

4.3.3 Design for Cleanliness

4.3.4 Personal Hygiene and Body Waste

4.4 Crew Medical and Behavioral Health

4.5 Cabin Architecture

4.5.1 Cabin Volume and Layout

4.5.2 Translation Pathways

4.5.3 Crew Restraint and Mobility Aids

4.5.4 Sleep Accommodation

4.5.5 Stowage and Inventory Management

4.5.6 Trash Management

4.5.7 Hatches

4.5.8 Windows

4.5.9 Lighting

4.6 Crew Safety

4.6.1 Mechanical Hazards

4.6.2 Touch Temperature Hazards

4.6.3 Electrical Hazards

4.6.4 Fluid Leak Hazards

4.6.5 Emergency and Protective Equipment

4.6.6 Fire Detection and Response

4.7 Design for Maintenance

4.8 Crew Interface Design

4.8.1 Design for Crew Performance

4.8.2 Design Standardization and Consistency

4.8.3 Human and System Interaction

4.8.4 Electronic Procedures

4.8.5 Design of Controls

4.8.6 Design of Displays

4.8.7 Design for Information Management

4.8.8 Design for Communication

Release Date: July 1, 2022 Page: 4 of 119

4.8.9 Design of Alerts

4.8.10 Crew Interface Labeling

4.9 Automated and Robotic Systems Design

5 Subsystem Verifications

5.1 Integrated Lander IVA Suit Subsystem

5.2 Integrated Lander Food Subsystem

5.3 Integrated Lander Medical Kit Subsystem

5.4 Integrated Lander Waste Management Subsystem

Appendix A Acronyms and Abbreviations Appendix B Glossary

TABLE OF FIGURES

Figure 4-1: Hot Touch Temperature Limits Figure 4-2: Cold Touch Temperature Limits

TABLE OF TABLES

Table 2-1: Health and Medical TA Documents Table 3-1: HLS Probabilistic Criteria Table 4-1: Trace Chemical Contaminant Design Load Table 4-2: Natural Sunlight Exposure Limits for Different Damage Mechanisms Table 4-3: Maximum Permissible Exposure (MPE) Limits for Radio-Frequency Electromagnetic Fields (modified from IEEE C95.1-2005 standard, lower tier) Table 4-4: Inverse Thermal Inertia for Commonly Used Materials Table 4-5: Hot Temperature Constants for Intentional (Planned) Contact Table 4-6: Cold Temperature Constants for Incidental Contact Table 4-7: Cold Temperature Constants for Intentional (Planned) Contact Table 4-8: Input-Output Compatibility

Release Date: July 1, 2022 Page: 5 of 119

1 Introduction

1.1 Scope and Purpose

Section 3 of this document offers general verification guidance on probabilistic success criteria that applies to verifications for all requirements in HLS-RQMT-006, Human Landing System (HLS) Program Integrated Lander Requirements Document – Sustained Phase.

Section 4 of this document provides baseline verifications for all Health and Medical Technical Authority (HMTA) requirements found in Appendix C of HLS-RQMT-006. They are verification methods intended for integrated system-level verification of performance or functionality. The Contractor may use these verifications directly in their verification, validation, and certification plan (VVCP) or offer tailoring of verification methods that, along with detailed verification objectives (DVOs), will provide sufficient evidence of compliance with the requirement as agreed upon with NASA.

Section 5 of this document provides baseline verifications for all Subsystem requirements found in Appendix E of HLS-RQMT-006. They are verification methods intended for integrated system-level verification of performance or functionality. The Contractor may use these verifications directly in their VVCP or offer tailoring of verification methods that, along with DVOs, will provide sufficient evidence of compliance with the requirement as agreed upon with NASA.

1.2 Measurement Units

Numerical data entered in shall be in International System of Units (SI) (metric) units with applicable tolerances. When appropriate the equivalent value in English Units should be added in parenthesis. Conversions between English and SI units shall be in accordance with NIST SP811, Guide for the Use of the International System of Units (SI).

2 Documents For the purpose of this document, the term “document” can also refer to “digital artifacts,” “models,” or “viewpoints” as needed to convey and exchange configuration managed data or information.

2.1 Standards

The following documents may include specifications, models, standards, guidelines, handbooks, and other special publications that are called out in this document. These standards should be used as a basis for potential providers to build a proposal that will result in a human certifiable system.

Release Date: July 1, 2022 Page: 6 of 119

Table 2-1: Health and Medical TA Documents Document Number Document Name ACGIH TLVs® and BEIs®, 2014 (or later)

American Conference of Governmental Industrial Hygienists (ACGIH) standard for “Threshold Limit Values (TLVs®) and Biological Exposure Indices (BEIs®),” sections Infrasound and Low-Frequency Sound, Light and Near-Infrared Radiation, and Ultraviolet Radiation

ANSI/ASA S3.2-2009 Method For Measuring The Intelligibility Of Speech Over Communication Systems

ANSI Z136.1, 2014 “American National Standard for Safe Use of Lasers”, Table 5 (ocular) and Table 7 (dermal) without personal protective equipment.

HLS-PAP-001 HLS Physical Characteristics and Capabilities Dataset

HLS-STD-002 HLS Program GUI Standard IEEE C95.1-2005 IEEE Standard for Safety Levels with Respect to

Human Exposure to Radio Frequency Electromagnetic Fields, 3 kHz to 300 GHz

ISO 2631-1:1997(E) Mechanical Vibration and Shock – Evaluation of Human Exposure to Whole-Body Vibration—Part 1: General Requirements

ISO 7731:2003(E) Ergonomics -- Danger Signals for Public and Work Areas -- Auditory Danger Signals

JSC 20584 Spacecraft Maximum Allowable Concentrations (SMAC) for Airborne Contaminants

NASA/TM-2013-217380 REV1 Application of the Brinkley Dynamic Response Criterion to Spacecraft Transient Dynamic Events

SSP 30573 Space Station Program Fluid Procurement and Use Control Specification

TOX-VER-2016-03 Volatile Combustion Product Monitoring in Spacecraft

Release Date: July 1, 2022 Page: 7 of 119

3 General Verification Guidance on Probabilistic Success Criteria

All requirements that specify a specific quantitative value or target generally require that a statistical basis be used in determining the subsequent verification success criteria. This is typically required for verifying the performance of electrical or mechanical systems that need to provide a particular function for the system. HLS recommends that a consistent set of probabilistic success criteria be utilized across the program wherever applicable.

The recommended HLS probabilistic criteria (Table 3-1 below) are based on experience from past programs such as Space Shuttle, ISS, CCP and Constellation.

TABLE 3-1: HLS PROBABILISTIC CRITERIA

Requirement Type: Probabilistic Success Criteria:

For nominal (i.e. no-fail) requirements 99.73% probability of success with 90% confidence

For contingency, off-nominal, requirements

95% probability success with 90%

For lower priority requirements 90% probability of success with 90%

Note that the second case for contingency or off-nominal requirements are associated with scenarios that are less likely than the nominal mission scenarios and therefore can have a reduced success criteria compared to the nominal mission cases. But contingency or off-nominal scenarios may still be strong drivers on design.

The third case for lower priority requirements applies to scenarios that do not directly support the primary mission objectives and therefore should not drive the design. Using the nominal/contingency success criteria may place too much emphasis for these cases.

Typically these are scenarios that do not require added functionality or the allocation of additional consumables to mission. Additionally as a rule of thumb, a value of 90% will also generally provide good confidence for Monte Carlo or acceptance sampling analyses.

For situations where probabilistic success criteria are appropriate but the above guidelines are overly constraining or not directly applicable, the following should be considered in determining probability and confidence levels:

1. Whether the requirement is for nominal or contingency scenarios;

2. Safety consequences of not meeting the requirement;

3. Priority of the requirement e.g. whether the requirement is associated with primary or secondary mission objective(s);

4. Achievability of the required probability of success.

Release Date: July 1, 2022 Page: 8 of 119

The rationale for use of different probabilities of success and confidence levels needs to be fully documented.

4 Human Health and Performance Verifications

Verification requirements include the method(s) for verification (e.g., test and analysis), the purpose of the verification method(s), and the criteria for assessing the success of the verification method(s). Verification requirements take into account the specific design, relevant development and flight experience, and overall Integrated Lander plan for certification. Successfully implementing the methods defined in the verification requirements will enable the Integrated Lander Provider to achieve certification by reducing the risk to a residual level acceptable by NASA.

Integrated Lander Providers are responsible for verification planning and the performance of verification activities as specified in section 4.1, below. The Integrated Lander Providers will produce verification evidence for compliance with all applicable requirements.

Verifications are performed to evaluate the system relative to an attribute established by the requirement. The evaluations must ensure capabilities are evaluated within all the constraints established by HLS-RQMT-006, applicable laws and regulations. Thus, test, analyses, and demonstrations must consider the full required operating envelope, environments, other interfacing elements, and range of states of the system when formulating the evaluation conditions.

4.1 Human Capabilities and Characteristics

V-HLS-S-HMTA-0002 Accommodate Physical Characteristics of Crew Statement: Inspection, Analysis, Demonstration.

Anthropometry Dimensions and Range of Motion. Crew task analysis shall identify the postures, body motions, and anthropometric dimensions, including spinal lengthening associated with weightlessness and fractional gravity, applicable to crew task performance. Integrated task and worksite analysis, using drawings or CAD modeling, shall be performed on all crew functional areas to confirm that the design of crew interfaces for task performance accommodates the crew postures, range of motions, and range of applicable anthropometric dimensions. HITL demonstration shall utilize a flight representative mockup in the flight configuration with subjects in flight configurations (which will include emulation of suits and restraints as indicated) performing select tasks, as agreed to through JTP, to evaluate anthropometric and range of motion accommodation. Where the full anthropometric range (min through max) cannot be evaluated in worksite analysis or HITL demonstration, population analysis shall be performed to evaluate any limitations to crew accommodation or task performance.

Release Date: July 1, 2022 Page: 9 of 119

Verification Success Criteria: The verification of anthropometry dimensions and range of motion shall be considered successful when analysis and demonstration show that crew physical characteristics as defined in HLS-PAP-001 Physical Characteristics and Capabilities Dataset are applied to the design of crew accommodations and interfaces for task performance.

Body Mass. Analysis shall be performed to confirm that body mass data as defined in HLS-PAP-001 Physical Characteristics and Capabilities Dataset are accommodated in the design of structures and equipment that will support crew mass under expected gravity and acceleration conditions through all mission phases.

Verification Success Criteria: The verification of body mass shall be considered successful when analysis shows that crew body mass as defined in HLS-PAP-001 Physical Characteristics and Capabilities Dataset are applied to the design of crew accommodations and interfaces for expected gravity and acceleration conditions through all mission phases.

Strength. Analysis and/or Test. Crew task analysis shall identify the crew postures, task motions, and Types of Strength applicable to crew task performance. Integrated task and worksite analysis shall be performed on all crew actuated interfaces to confirm that the design of crew-actuated mechanisms accommodates the Minimum Crew Operational Load for the appropriate operation criticality and withstands the Maximum Crew Operational Load as defined in HLS-PAP-001 Physical Characteristics and Capabilities Dataset. Test shall utilize a flight representative mockup in the flight configuration to measure the forces required to operate mechanical crew interfaces such as cranks, fasteners, switches, and buttons.

Verification Success Criteria: The verification of design for operational strength shall be considered successful when test shows the mechanical crew interfaces can be operated with the minimum crew operational load for the appropriate operation criticality and can withstand the Maximum Crew Operational Load as defined in HLS-PAP-001 Physical Characteristics and Capabilities Dataset.

V-HLS-S-HMTA-0012 Nominal Cognitive Workload Statement: Test. The cognitive workload for nominal crew tasks shall be verified by test.

The test for nominal cognitive workload shall consist of tasks from the crew task analysis that are jointly agreed upon by the provider and the JTP. The test shall consist of an evaluation by at least ten (10) trained personnel who are crew or designated crew representatives performing each of the listed crew tasks in a flight-like simulator or mockup (i.e., a facility that is determined to be as close to flight like as is possible) and providing workload ratings on the Bedford Workload Scale. Tasks shall be performed as operationally planned in ‘test-like-you-fly’ manner. When tasks are designed to be performed by multiple crewmembers, multiple personnel shall participate in the test and provide individual workload ratings. The evaluation period for each operational task sequence shall span the duration of the expected in-flight operation with personnel

Release Date: July 1, 2022 Page: 10 of 119 providing their ratings at the end so as not to interrupt task flow. During workload evaluation tests, personnel will maintain performance error rates and completion times commensurate with the performance requirements of the particular task.

Workload must be assessed repeatedly by highly trained individuals using a consistent methodology immediately following dynamic human-in-the-loop simulations of tasks. A key element of testing in a flight-like simulator or mockup is that the simulated capabilities provide ‘test like you fly’ interfaces and functionality for accurate assessments of the capabilities under test. Workload should also be assessed in the design phase, prior to verification (including multi-dimensional tools such as the NASA- TLX), to ensure that the design or task does not induce unnecessary workload. The Bedford scale is appropriate for verification because it provides anchors for every rating, is familiar to the crew population, and provides a decision gate in which ratings above this gate are indicative of workload that is not satisfactory without a reduction in spare capacity. When using the Bedford scale, each subject must be briefed as to what each of the ratings on the scale mean, the task they are rating, the time period over which to make the rating, and the other tasks for which they need to judge their spare capacity.

These items need to be consistent across subjects for each task. The Bedford scale is not linear, and the underlying distribution is not predicted to be normal, thus calculation of a mean and median or the uses of parametric statistics are not appropriate. An acceptable verification level of workload is a rating of 3 or less for critical or frequent tasks, and 6 or less for infrequent, non-critical tasks.

Verification Success Criteria: The verification shall be considered successful when the analysis in conjunction with the test results show that for representative nominal tasks identified in the analysis, at least 7 of the 10 ratings are no greater than a rating of 3 on the Bedford workload scale, while up to 3 of the 10 ratings may exceed the rating of 3 (allowing workload ratings of 4, 5, or 6 on the Bedford workload scale). For any ratings of 4, 5, or 6, a consensus must be reached by all of the participants indicating that the workload is acceptable in order for verification to be considered successful.

V-HLS-S-HMTA-0013 Off-Nominal Cognitive Workload Statement: Test. The cognitive workload for off-nominal crew tasks shall be verified by test. The test for off-nominal cognitive workload shall consist of tasks from the crew task analysis that are jointly agreed upon by the provider and the JTP. The test shall consist of an evaluation by at least ten (10) trained personnel who are crew or designated crew representatives, and are representative of the crew population performing each of the listed crew tasks in a flight-like simulator or mockup (i.e., a facility that is determined to be as close to flight like as is possible) and providing workload ratings on the Bedford Workload Scale. Tasks shall be performed as operationally planned in ‘test-like-you-fly’ manner. When tasks are designed to be performed by multiple crewmembers, multiple personnel shall participate in the test and provide individual workload ratings. The evaluation period for each operational task sequence shall span the duration of the of expected in-flight operation with personnel providing their ratings at the end so as not to interrupt task flow. During workload evaluation tests, personnel will maintain

Release Date: July 1, 2022 Page: 11 of 119 performance error rates and completion times commensurate with the performance requirements of the particular task.

Workload must be assessed repeatedly by highly trained individuals using a consistent methodology immediately following dynamic human-in-the-loop simulations of tasks. A key element of testing in a flight-like simulator or mockup is that the simulated capabilities provide ‘test like you fly’ interfaces and functionality for accurate assessments. Workload should also be assessed in the design phase, prior to verification (including multi-dimensional tools such as the NASA-TLX), to ensure that the design or task does not induce unnecessary workload. The Bedford scale is appropriate for verification because it provides anchors for every rating, is familiar to the crew population, and provides a decision gate in which ratings above this gate are indicative of workload that is not satisfactory without a reduction in spare capacity and a gate in which ratings above this gate are indicative of workload that is not tolerable for the task. When using the Bedford scale, each subject must be briefed as to what each of the ratings on the scale mean, the task they are rating, the time period over which to make the rating, and the other tasks for which they need to judge their spare capacity. These items need to be consistent across subjects for each task. The Bedford scale is not linear, and the underlying distribution is not predicted to be normal, thus calculation of a mean and median or the uses of parametric statistics are not appropriate. This verification requires that every subject’s raw score is a 6 or less on the Bedford scale. The Bedford scale allows for half ratings (e.g., 1.5), which is also allowed here, as long as the rating is a 6 or less. A rating of 6.5 or higher is not acceptable for verification of this requirement. A rating of 6 or less is acceptable for this verification because workload is expected to be higher under off-nominal than nominal conditions, but workload is still rated as tolerable for the task.

Verification Success Criteria: The verification shall be considered successful when the analysis in conjunction with the test results show that for representative off-nominal tasks identified in the analysis, all of the subjects provide a rating of 6 or less on the Bedford scale.

4.2 Natural and Induced Environments

4.2.1 Cabin Atmosphere

V-HLS-S-HMTA-0015 Trend Analysis of Environmental Data Statement: Analysis and Test. The ability of the Integrated Lander to provide environmental monitoring data at the specified rates shall be verified by test and analysis. The analysis shall include a review of the Integrated Lander software and be supported by component certification data to assess the rate at which the Integrated Lander samples and transmits the environmental data specified in HLS-RQMT-006, Table C-1: Sampling Rates for Trending Environmental Data.

Release Date: July 1, 2022 Page: 12 of 119

Verification Success Criteria: The verification shall be considered successful when the analysis and test data show the Integrated Lander samples and transmits the appropriate environmental data at the rates specified in HLS-RQMT-006, Table C-1:

Sampling Rates for Trending Environmental Data.

V-HLS-S-HMTA-0016 Inert Diluent Nitrogen Gas for Cabin Atmosphere Statement: Analysis. The maintenance of a cabin atmosphere with nitrogen as the diluent gas shall be verified by analysis. The analysis shall include a review of the vehicle design including atmospheric constituent control setpoints and availability of consumables.

Verification Success Criteria: The verification shall be considered successful when the analysis shows that the vehicle uses nitrogen as the diluent gas while maintaining all other key atmospheric constituents correctly.

V-HLS-S-HMTA-0017 O2 Partial Pressure Range for Crew Exposure Statement: Analysis and Test. The maintenance of oxygen partial pressure shall be verified through analysis of integrated, hardware/software, ECLSS subsystem functionality and performance, supported by test. Test generated data used by the analysis shall include oxygen system component certification data. Analysis shall also include generated data from ECLSS control software functional, performance, and interface testing.

Verification Success Criteria: The verification shall be considered successful when the analysis, supported by test, shows that the vehicle can maintain the partial pressure of the internal atmosphere within the ranges described in the requirement.

V-HLS-S-HMTA-0018 Nominal Vehicle/Habitat Carbon Dioxide Levels Statement: Analysis and Test. The maintenance of carbon dioxide partial pressure shall be verified through analysis of integrated, hardware/software, ECLSS subsystem functionality and performance, supported by test. Test generated data used by the analysis shall include certification data from CO2 removal system components. Analysis shall also include generated data from ECLSS control software functional, performance, and interface testing.

Verification Success Criteria: The verification shall be considered successful when the test and analysis data shows that the vehicle can maintain the partial pressure in the internal atmosphere within the limits specified.

V-HLS-S-HMTA-0019 Ventilation Rate Statement: Analysis and Test. The capability to maintain a ventilation rate within the Integrated Lander shall be verified by analysis and test. The analysis shall include a review of the vehicle design, component certification data, and software control performance data. The analysis shall include a fluid dynamics model of the interior habitable volume and shall be of sufficient fidelity to identify potential areas within the

Release Date: July 1, 2022 Page: 13 of 119 habitable volume with degraded air movement. The analysis shall include a plan to validate the model using data collected during the vehicle acceptance/qualification testing. The analysis shall consider the ventilation rate only at a single, nominal setting for all fan speeds and diffusers. The test shall be of the flight hardware’s response to commands in the flight vehicle.

Verification Success Criteria: The verification shall be considered successful when the analysis and test establish that two-thirds (66.7%) of the atmosphere velocities are between 4.57m/min (15ft/min) and 36.58 m/min (120 ft/min) at a distance measured more than 0.15 m [6 inches]) from the vehicle walls during all mission phases except during toxic cabin events, or when the crew is not inhabiting the vehicle.

V-HLS-S-HMTA-0023 Comfort Zone

Statement: Analysis and Test. Maintaining the atmospheric temperature and relative humidity within the specified range shall be verified by analysis and test. The analysis shall include assessment of the Integrated Lander design via a thermal model of the habitable volume based on the final flight configuration as well as the pertinent aspects of the subsystems involved in controlling the habitable environment (such as ECLSS, TCS) as well as critical aspects of the external and internal environments that will impact the volume conditions (e.g. external heat loads, metabolic loads, etc.). The model shall be validated using relevant performance data (e.g. integrated testing, flight data, etc.).

The test shall exercise and verify the correct response of the flight hardware and software commands.

Verification Success Criteria: The verification shall be considered successful when the analysis and test shows that the temperature can be maintained between 18 ºC (64.4 ºF) to 27 ºC (80.6 ºF) and the relative humidity between 25% and 75% during all nominal flight operations, excluding suited operations.

V-HLS-S-HMTA-0495 Thermal Comfort Capability Statement: Analysis and Test. The capability of the occupied habitable volume to reach a temperature of 22.5°C during all mission phases shall be verified by analysis. Analysis shall be validated by relevant performance data (e.g. integrated testing, flight data, etc.).

The test shall exercise and verify the correct response of the flight hardware and software commands.

analysis and test, using a moderate fidelity simulation of Integrated Lander environment and subsystems, shows that the temperature of occupied habitable volume can be adjusted to 22.5°C during worst-case mission thermal environments.

V-HLS-S-HMTA-0496 Temperature Selectability

Statement: Analysis and Test. The capability to provide and maintain selectable set points for habitable atmosphere temperature shall be verified by analysis, supported by test, of the crew interface and software and vehicle level thermal selectability.

Release Date: July 1, 2022 Page: 14 of 119

Verification Success Criteria: The verification shall be considered successful when analysis, supported by test, shows that crew is provided the means to control the temperature in occupied habitable volume within steps no greater than 1°C and maintain that temperature at +/- 1°C.

V-HLS-S-HMTA-0497 Temperature Adjustability

Statement: Analysis and Test. The capability to adjust the temperature in the habitable volume by at least 1°C/hr shall be verified by analysis, supported by test, of the crew interface and software and vehicle level thermal adjustability.

analysis, supported by test shows that it takes no more than 1hr to adjust the temperature by 1°C after receiving the command.

V-HLS-S-HMTA-0025 Atmospheric Control

Statement: Analysis and Test. Capability for crew and remote operators to control atmospheric parameters and set-points for atmospheric pressure, O2 partial pressure, temperature, humidity, and ventilation shall be verified through analysis of integrated ECLSS subsystem (hardware and software) functionality and performance, supported by test. Test generated data used by the analysis shall include certification data from participating ECLSS subsystem components. Analysis shall also include generated data from ECLSS control software functional, performance, and interface testing.

Verification Success Criteria: The verification shall be considered successful when the analysis, supported by test, shows that each atmospheric parameter can be controlled by the crew and remote operators.

V-HLS-S-HMTA-0026 Atmospheric Data Recording Statement: Analysis and Demonstration. Capability for each isolatable, habitable compartment to record pressure, humidity, temperature, ppO2, and ppCO2 data at the rates specified in Table C-1, Sampling Rates for Trending Environmental data shall be verified by analysis and demonstration. The analysis shall include a review of vehicle design supported by component certification data to show that the required sensors are located in the appropriate areas. A demonstration of the software with simulated sensor inputs shall show that the required values are properly recorded.

Verification Success Criteria: The verification shall be considered successful when the analysis and tests demonstrates that the Integrated Lander can automatically record pressure, humidity, temperature, ppO2, and ppCO2 data.

V-HLS-S-HMTA-0027 Atmospheric Data Displaying Statement: Demonstration. Capability for the Integrated Lander to display real time values pressure, humidity, temperature, ppO2, and ppCO2 data from each isolatable, habitable compartment shall be verified by demonstration.

Release Date: July 1, 2022 Page: 15 of 119

Verification Success Criteria: The demonstration shall be considered successful when the Integrated Lander displays to crew and remote operators the real time values for pressure, humidity, temperature, ppO2 and ppCO2 each isolatable, habitable compartment that are consistent with known or simulated values.

V-HLS-S-HMTA-0028 Atmospheric Monitoring and Alerting

Statement: Demonstration. Onboard monitoring of and alerts for atmospheric parameters shall be verified by demonstration. The demonstration shall use actual or simulated sensor data. Each atmospheric parameter shall be set at contingency levels to produce alerts.

Verification Success Criteria: The demonstration shall be considered successful when atmospheric parameters are monitored and alerts are provided to crew and remote operators when defined limits are reached for atmospheric parameters, including atmospheric pressure, humidity, temperature, ppO2, and ppCO2.

V-HLS-S-HMTA-0414 Volatile Organic Compound Monitoring and Alerting Statement: Test. Volatile Organic Compound Monitoring and Alerting shall be verified by test.

Verification Success Criteria: Verification shall be considered successful when the test demonstrates that the Integrated Lander system provides the capability to monitor trace volatile organic compounds and demonstrates that the Integrated Lander system provides the capability to notify the crew and other mission systems whenever a monitored chemical parameter in the atmosphere approaches applicable limits in the pressurized habitable volume.

V-HLS-S-HMTA-0029 Smoke Particulate Monitoring and Alerting Statement: Analysis and Demonstration. The ability of the Integrated Lander to detect combustion events and alert crew and other mission systems shall be verified by analysis and demonstration. An analysis shall be performed to identify the types and locations of potential ignition sources in areas with either forced air flow or credible oxygen enrichment/leakage and shall show that all such areas are covered by detection devices. This analysis shall consider the impacts of vehicle atmospheric pressure, oxygen concentration, and partial gravity on the detection and spread of fires. The demonstration shall show that the Integrated Lander notifies the crew and other mission systems when the smoke detectors are exposed to particle concentrations of the chosen threshold.

Verification Success Criteria: The verification shall be considered successful when the analysis shows all required areas have a combustion event detection capability and the demonstration shows that the Integrated Lander notifies the crew and other mission systems when particle concentrations exceed the chosen threshold.

Release Date: July 1, 2022 Page: 16 of 119

V-HLS-S-HMTA-0029a Combustion Product Monitoring Statement: Demonstration. The ability of the Integrated Lander to monitor toxic atmospheric components listed in TOX-VER-2016-03 shall be verified by demonstration. The demonstration shall show that the atmospheric monitoring instruments correctly and accurately measure the atmospheric concentration of toxic combustion products in the required ranges.

Verification Success Criteria: The verification shall be considered successful when the demonstration shows a real time capability for the measurement and display of atmospheric concentrations of the specified toxic combustion products over the specified ranges with the required accuracy and resolution in TOX-VER-2016-03.

V-HLS-S-HMTA-0030 Toxic Release Monitoring and Alerting Statement: Analysis and Demonstration. The requirement shall be verified by demonstration and analysis. An analysis shall be performed to identify fluids that may create a critical or catastrophic hazard if released into the habitable volume. The demonstration shall show that the detection system(s) automatically detect fluid leaks prior to the leaks creating a critical or catastrophic hazard and the Integrated Lander automatically detects the identified toxic releases and automatically notifies the crew and other mission systems when the monitoring system detects a release.

Verification Success Criteria: The verification is successful when the analysis and demonstration show the crew and other mission systems are automatically notified when a toxic release is automatically detected prior to the leak creating a critical or catastrophic hazard.

V-HLS-S-HMTA-0030a Contamination Monitoring Statement: Analysis. The analysis shall include a review of Integrated Lander systems and operations to identify substances that could credibly be introduced into the habitable environment and result in a critical or catastrophic hazard. The analysis shall use data from qualification testing of the atmosphere monitoring systems and a review of the vehicle layout to show that concentration information is available to the crew and other mission systems during a contamination event. An analysis shall also be performed to determine the measurement response time required to support operational decisions. An analysis shall be performed to confirm that concentrations of gases and volatile liquids that could present a critical or catastrophic hazard is accurately computed and communicated to crew.

Verification Success Criteria: The verification shall be considered successful when the analysis shows that the Integrated Lander can provide real-time monitoring across a relevant range of concentrations to crew and other mission systems to support appropriate operational response.

Release Date: July 1, 2022 Page: 17 of 119

V-HLS-S-HMTA-0460 Protect Crew in Contaminated Atmosphere Statement: Analysis and Test. The ability of the Integrated Lander to protect crew in a contaminated atmosphere shall be verified by analysis and test. The analysis shall identify credible toxic events and elapsed time for returning the habitable volume to levels below the 7-day SMAC. Further analysis shall show that the protective equipment will supply uncontaminated breathing gas to each crewmember for the longest duration of the credible toxic events. The HITL test shall measure time for test subjects to access and don flight-representative protective equipment and start flowing breathing gas. The test shall also show that the test subjects eyes and respiratory tract are protected after completion of donning. The number of test subjects shall be jointly agreed upon through the JTP.

Verification Success Criteria: Verification shall be considered successful when the analysis and test show the Integrated Lander provides protective equipment that is donnable in ≤15 seconds to protect the crews’ eyes and respiratory tract while supplying uncontaminated breathing gas for the longest duration of credible toxic events.

V-HLS-S-HMTA-0460a Breathing Apparatus- Reduced Atmosphere

Statement: Analysis and Test. The ability of the Integrated Lander to provide breathing apparatus to support crew in a reduced atmosphere event shall be verified by analysis and test. The analysis shall identify credible events resulting in reduced cabin atmosphere, time to effect within which crew must have breathing apparatus support, and elapsed time for returning the crew to a safe environment. Further analysis shall show that the breathing apparatus will supply 100% O2 to each crewmember for the longest duration of the credible reduced atmosphere events. The HITL test shall measure time for test subjects to access and don flight-representative breathing apparatus and start flowing oxygen. The number of test subjects shall be jointly agreed upon through the JTP.

Verification Success Criteria: Verification shall be considered successful when the analysis and test show the Integrated Lander provides breathing apparatus that is donnable within time to effect and provides 100% O2 for the longest duration of credible reduced atmosphere events.

V-HLS-S-HMTA-0502 Contingency Cabin Leak Response Statement: Analysis. The ability of the Integrated Lander to maintain required atmospheric conditions for a sufficient time shall be verified by analysis. A task analysis shall be performed to determine the amount of time required to establish the safe haven (e.g. by donning and leak-checking suits, gathering required equipment and supplies, isolating an airlock, etc.). The task analysis shall incorporate the results of HITL simulation testing where possible. A performance and consumables analysis shall show that the Integrated Lander is able to maintain required atmospheric conditions for the necessary amount of time in the presence of a 6.35 mm (¼ in) cabin hole. A mission timeline analysis shall be performed to determine the maximum length of time between the occurrence of a cabin leak and the opportunity for the Integrated Lander to dock

Release Date: July 1, 2022 Page: 18 of 119 with a CSV in NRHO. A consumables and task analysis shall show that sufficient consumables exist to sustain the crew in the safe haven for the required amount of time, that required vehicle systems can operate with the Integrated Lander in safe haven configuration, and that the crew is able to perform the required functions (commanding, data monitoring, DCS treatment, etc.) from the safe haven.

Verification Success Criteria: Verification shall be considered successful when the analyses show the Integrated Lander has the ability to maintain the cabin atmosphere until the crew can establish a safe haven and that the safe haven can sustain the crew until they can dock and transfer to the CSV.

4.2.2 Cabin Contamination

V-HLS-S-HMTA-0041 Toxic Hazard Level Three

Statement: Analysis. Use of chemicals that are Toxic Hazard Level Three or below in the habitable volume of the Integrated Lander shall be verified by analysis. The analysis shall include a review of the materials and chemicals selected for spacecraft construction and their use in the operation of the vehicle.

Verification Success Criteria: The verification shall be considered successful when the analysis shows that only Toxic Hazard Level Three or lower chemicals are used in the habitable volume of the vehicle and that no chemical decomposition products are a Toxicological Hazard Level Four.

V-HLS-S-HMTA-0042 Toxic Hazard Level Four Statement: Analysis. Preventing Toxic Hazard Level Four chemicals from entering the habitable volume of the spacecraft shall be verified by analysis. The analysis shall include a review of the vehicle design and operational procedures to ensure that no credible failures (such as leaks or crew errors) could result in the release of Toxic Hazard Level Four compounds into the cabin.

Verification Success Criteria: The verification shall be considered successful when the analysis shows adequate controls are in place to prevent Toxic Hazard Level Four chemicals from entering the habitable volume of the spacecraft.

V-HLS-S-HMTA-0043 Chemical Decomposition Statement: Inspection and Analysis. The prevention of chemical decomposition into hazardous compounds in the habitable volume shall be verified by analysis and inspection. The analysis shall identify chemicals that will be exposed to or have the potential to be introduced into the habitable volume and the likely chemical interactions with the environment. The inspection shall include a review of Program Safety Review Panel approval documentation.

analysis and inspection show that no chemicals have been used in the Integrated

Release Date: July 1, 2022 Page: 19 of 119

Lander design that can be broken down or converted into compounds that threaten crew health and have the potential to be introduced into the habitable volume.

V-HLS-S-HMTA-0044 Atmosphere Contamination Limit – Inhabited Operations Statement: Test and Analysis. The spacecraft’s ability to control the concentration of gaseous pollutants in the habitable atmosphere shall be verified by analysis and test.

The initial analysis shall evaluate the vehicle’s active control of the concentration of individual trace chemical contaminants introduced into the cabin according to the load defined by Table 4-1: Trace Chemical Contaminant Design Load. The chemical contaminant load provided by Table 4-1 is a subset of the chemicals included in JSC 20584 and serves as the active trace contaminant control design basis until vehicle off-gassing test and vehicle system chemical release data become available. The vehicle off-gassing test shall be conducted according to SSP 41172, Section 5.2.4 and the resulting data shall be used to determine the integrated vehicle equipment off-gassing load for the contaminants observed by the test. The off-gassing load derived from the test supersedes the equipment off-gassing load component of Table 4-1: Trace Chemical Contaminant Design Load. Rates for chemicals released from system operations shall be quantified to supplement the equipment off-gassing and crew metabolic load components and shall be included in the final analysis.

Table 4-1: Trace Chemical Contaminant Design Load

Contaminant

GENERATION RATE

Off-Gassing (mg/d-kg)

Metabolic (mg/d-person)

Methanol 1.3 × 10-3 4.9 Ethanol 3.7 × 10-2 C 10.7 n-butanol 1.0 × 10-3 1.0 2-propanol 2.8 × 10-3 4.5 Methanal (formaldehyde) 4.8 × 10-4 0.7 Ethanal (acetaldehyde) 1.9 × 10-3 2.8 Benzene 2.6 × 10-5 1.3 Methylbenzene (toluene) 1.7 × 10-3 1.2 Dimethylbenzenes (xylenes) 9.5 × 10-4 3.9 Furan 1.9 × 10-6 0.5 Dichloromethane 8.2 × 10-4 0.2 2-propanone (acetone) 3.0 × 10-3 22 Trimethylsilanol 3.1 × 10-3 0 Hexamethylcyclotrisiloxane 7.1 × 10-3 0 Ammonia 8.7 × 10-5 51 Carbon monoxide 3.5 × 10-3 18.4

Notes:

A) Off-gassing rate is for the mass of internal, non-structural equipment.

B) Off-gassing rates are superseded by rates derived from a vehicle off-gassing test when available.

C) For vehicles where ethanol-based housecleaning wipes will be used, an additional contribution of 1000 mg/day shall be added.

D) Internal system generation, vent, or leakage sources supplement this load as appropriate, e.g.

systems with amine-containing components shall include a representative ammonia generation rate in addition to the equipment off-gassing and crew metabolic rates.

Release Date: July 1, 2022 Page: 20 of 119 final analysis with test data incorporated shows the spacecraft can control the concentration of gaseous pollutants in the habitable atmosphere during all inhabited mission phases so that the toxic hazard index (T-value) is maintained below 1.0 unit based on 180-day (SMACs).

V-HLS-S-HMTA-0482 Flammable Constituents Limit Statement: Analysis and Test. The limit of flammable constituents shall be verified by test and analysis. Component testing of the gas control system(s) shall be performed to establish removal rates for hydrogen and methane. An analysis using these removal rates and the generation rates from RQMT-006, Table C-4: Flammable Contaminant Design Load shall show that the concentrations of hydrogen and methane stay below the limits in RQMT-006, Table C-3: Flammable Chemical Contaminant Limits for the extent of the mission.

Verification Success Criteria: The verification shall be considered successful when component testing of the vehicle’s gas removal system(s) and vehicle-level analysis using generation rates from RQMT-006, Table C-4: Flammable Contaminant Design Load shows that flammable gases are controlled as specified over the duration of the mission in both ventilated and non-ventilated areas.

V-HLS-S-HMTA-0503 Post Contamination Atmosphere Levels Statement: Analysis. The Integrated Lander ability to return the habitable atmosphere to levels below the 7-day SMAC shall be verified by analysis. Hazard analysis shall identify credible contamination events and the resulting chemical contaminants and their concentrations. Further analysis shall evaluate the vehicle’s active control of the concentration of contaminants released into the habitable atmosphere after defined contamination events.

Verification Success Criteria: The verification shall be considered successful when the analysis shows the Integrated Lander can return the habitable atmosphere to levels below the 7-day SMACs, contained in JSC 20584, within 24 hours.

V-HLS-S-HMTA-0046 Particulate Matter Statement: Analysis. The ability of the Integrated Lander to limit the amount of particulate matter in the habitable volume shall be verified by analysis. The analysis shall include a review of the vehicle design to ensure that there is adequate airflow and filtration to control particulate matter in the habitable volume. The analysis shall use the provided generation rates to account for the particulate generation from the onboard crew.

Verification Success Criteria: The verification shall be considered successful when the analysis shows that the Integrated Lander controls total dust to <3 mg/m3, and the respirable fraction of the total dust <2.5 μm in aerodynamic diameter to <1 mg/m3.

Release Date: July 1, 2022 Page: 21 of 119

V-HLS-S-HMTA-0047 Lunar Dust Contamination

Statement: Analysis and Test. The control of lunar dust in the internal atmosphere shall be verified by integrated system analysis supported by test. The analysis shall include a review of the vehicle design and results from testing components of the Atmosphere Revitalization System (ARS).

Verification Success Criteria: The verification shall be considered successful when the analysis supported by test shows that the system limits lunar dust in the habitable volume for particles 0.02 to 10 μm in size below a time-weighted average of 0.4 mg/m3 during daily exposure periods that may persist over a 30-day mission.

V-HLS-S-HMTA-0480 Lunar Dust Monitoring Statement: Test. The ability of the system to monitor, record, and transmit the atmospheric concentration of lunar dust in the habitable volume shall be verified by test.

The test shall show that the atmospheric monitoring instruments correctly and accurately measure the atmospheric concentration of lunar dust in the required ranges.

Verification Success Criteria: Verification shall be considered successful when the test shows that the Integrated Lander provides the capability to monitor, record, and transmit, to the crew and other mission systems, the atmospheric concentration of lunar dust in the habitable volume.

V-HLS-S-HMTA-0050 Condensation Limitation Statement: Analysis. The condensation persistence on surfaces shall be verified by thermal analysis to predict internal surface temperatures that may result in condensation plus assessment of expected water on internal surfaces.

Verification Success Criteria: The verification shall be considered successful when the analysis shows that condensation persistence is limited to 1 hour a day on surfaces within the internal volume during the mission.

V-HLS-S-HMTA-0051 Microbial Air Contamination Statement: Analysis. The limitation of microbial contaminants in the internal atmosphere shall be verified by analysis. The analysis shall include a review of the vehicle design to ensure adequate airflow and filtration is in place.

Verification Success Criteria: The verification shall be considered successful when the analysis shows continuous air flow within the vehicle that has been cleaned to have at least 99.97% of…