Attachment E IMAR1.pdf

Effective Date: February 03, 2021 418-XO-IMAR-0026 Expiration Date: Five years from date of last signature Version 1.1 Responsible Organization: GeoXO Flight Project/Code 418

Check the GeoXO portal at https://goesportal.ndc.nasa.gov to verify correct version prior to use.

Geostationary and eXtended Observations (GeoXO) Instrument Mission Assurance Requirements

(IMAR)

Signature page

Prepared by:

Electronically approved 01/19/2021

Michelle P. Rizzo Date GeoXO Flight Project, Chief Safety & Mission Assurance NASA GSFC, Code 383

Reviewed by:

Electronically approved 02/03/2021

Alexander Krimchansky Date GeoXO Flight Project, Sys. Engineering Manager NASA GSFC, Code 599

Approved by:

Electronically approved 02/03/2021

Jason H. Hair Date GeoXO Flight Project, Project Manager NASA GSFC, Code 418

/GeoXO Flight Project Mission Assurance

IMAR

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

Version: 1.1 Printed by: rkhoover Printed on: Wednesday, February 3, 2021

No filter applied.

No sort applied.

Generated from DOORS 9.6.1.11

Contents

1 1General

1.1 1Systems Safety and Mission Assurance Program

1.2 1Management

1.3 1Requirements Flowdown

1.4 1Suspension of Work Activities

1.5 1Mission Assurance Surveillance

1.6 2Government Mandatory Inspection Points (GMIPs)

1.7 2Active Suppliers List (ASL)

1.8 2Use of Inherited Products/Items

1.9 3Applicable Documents

2 4Quality Management System

2.1 4General

2.2 4Supplemental Quality Management System Requirements

2.2.1 4Control of Nonconforming Product

2.2.2 4Preliminary Review

2.2.3 4Material Review Board (MRB)

2.2.4 5Failure Review Board (FRB)

2.2.5 6Reporting of Non-Conformances

2.3 6Lessons Learned

2.4 6Orbital Debris Assessment Report (ODAR) and End of Mission Plan (EOMP)

3 7System Safety

3.1 7General

3.2 7Mission Related Safety Requirements Documentation

3.3 7System Safety Deliverables

3.3.1 8System Safety Program Plan

3.3.2 8Safety Requirements Compliance Checklist

3.3.3 8Hazard Analyses

3.3.3.1 8Preliminary Hazard Analysis

3.3.3.2 8Instrument Safety Assessment Report (ISAR) and Verification Tracking Log (VTL)

3.3.3.3 9Operations Hazard Analysis (OHA) and Verification Tracking Log (VTL)

3.3.3.4 9Operating and Support Hazard Analysis (O&SHA)

3.3.4 9Procedures for Payload I&T and Pre-Launch Processing

3.3.5 10Safety Non-Compliances and Waivers

Project: GeoXO Flight Project Mission Assurance Module: IMAR Baseline Version: 1.1

Contents ii

3.3.6 10Mishap Reporting and Investigation

3.4 10Support for Safety Working Groups

3.5 10Test Safety Responsibilities

3.5.1 10Treatment of Hazards

3.5.2 11Facility Safety

3.5.3 11Lifting Device Safety Requirements

4 13Reliability

4.1 13General

4.2 13Reliability Program Plan (RPP)

4.3 13Failure Modes Effects and Criticality Analysis (FMEA / FMECA) and Critical Items

List (CIL)

4.4 15Fault Tree Analysis (FTA)

4.5 16Parts Stress Analysis

4.6 16Worst-Case Analysis

4.7 17Reliability Assessment and Predictions

4.8 17Trend Analysis

4.9 17Limited Life Items

5 19Software Assurance

5.1 19General

5.2 19Software Assurance Program

5.2.1 19Software Quality

5.2.2 20Software Safety

5.2.3 20Software Verification and Validation

5.2.4 21Independent Verification and Validation

5.3 22Peer Reviews

5.4 22Software Configuration Management

5.5 22Software Problem Reporting and Corrective Action

6 23Workmanship Standards

6.1 23General

6.2 24Electrostatic Discharge Control (ESD)

6.3 24Design and Process Qualification

6.4 24Printed Circuit Boards (PCB)

6.5 25Splices, Circuit Board Trace Cuts and Jumper Wires

6.6 25Lead-Free and Tin Whisker Control Measures

6.7 25Ground Systems that Interface with Space Flight Hardware

6.8 25Handling

6.9 26Preservation and Packaging

Contents iii

7 27EEE Parts

7.1 27General

7.2 27Parts Control Board Plan

7.3 28Radiation Requirements for Part Selection

7.3.1 28Total Ionizing Dose (TID)

7.3.2 28Displacement Damage

7.3.3 28Single-Event Effects (SEE)

7.3.4 29Custom or Advanced Technology Devices

7.3.5 29Parts Used in Off-the-Shelf Assemblies

7.4 29Value Added Testing for Enhanced Reliability

7.4.1 29Surge Current Screening for Tantalum Capacitors

7.4.2 30Dielectric Screening for Ceramic Capacitors

7.4.3 30Solid Tantalum Surface Mount Chip Capacitors Susceptible to Moisture Intrusion

7.4.4 30Screening for Magnetic Components

7.5 31Reuse of EEE Parts

7.6 31Master EEE Parts List

8 32Materials, Processes and Lubrication Requirements

8.1 32General

8.2 32Materials Identification and Usage List (MIUL)

8.3 32Materials Usage Agreement (MUA)

8.4 32Life Test Plan and Final Report for Lubricated Mechanisms

8.5 32Materials and Processes (M&P) Control Board

8.6 33Fasteners

8.7 33Process Selection Requirements

8.8 33Prohibited Metals

9 34Design Verification Requirements

9.1 34General

9.2 34System Performance Verification Plan and Matrix

9.3 34Criteria for Unsatisfactory Performance

9.3.1 34Failure

9.3.2 34Failure with Retroactive Effect

9.3.3 34Wear Out

9.4 34Performance Verification Procedures

9.5 34Verification Reports

9.6 35Electrical Functional and Performance Test Requirements

9.6.1 35General

9.6.2 35Electrical Interface Tests

Contents iv

9.6.3 35Comprehensive Performance Tests

9.6.4 35Limited Performance Tests

9.6.5 35Limited-Life Electrical Parts

9.7 36Radiation Environment

9.7.1 36Single Event Effects

9.7.2 36In-Orbit Electro-Static Discharge Control Plan

9.8 36Contamination Control

9.9 36Unrealistic Failure Modes

9.10 36Thermal Analytical Model Correlation

9.11 36Testing of Spare Hardware

9.11.1 36General

9.11.2 36Extent of Testing

9.11.3 37Caution on the Use of Spares

9.11.4 37“One-Shot” Items

9.12 37Test Facilities

9.12.1 37General

9.12.2 37Test Facilities Calibration

10 38Metrology and Calibration

10.1 38Metrology and Calibration Program

10.2 38Use of Calibrated and Non-Calibrated Instruments

11 39Government-Industry Data Exchange Program (GIDEP) Alerts and Problem Advisories

11.1 39GIDEP Participation

11.2 39Alert Disposition

11.3 39GIDEP Reporting

11.4 39Review Reporting

12 40Applicable Documents

13 43APPENDIX A: Acronyms

14 45APPENDIX B: Data Items Descriptions

15 90APPENDIX C. Mission Assurance Compliance Matrix

16 97APPENDIX D. Data Item Description Delivery Requirements

Contents v

Page 1 of 102 Printed Wednesday, February 3, 2021

ID

IMAR1

IMAR2

IMAR3

IMAR4

IMAR6

IMAR7

IMAR8

IMAR9

IMAR5

IMAR10

IMAR11

IMAR12

IMAR13

IMAR26

IMAR14

IMAR15

IMAR16

Object Number

1.1

1.1.0-1

1.1.0-2

1.1.0-3

1.1.0-4

1.2

1.2.0-1

1.2.0-2

1.2.0-3

1.3

1.3.0-1

1.3.0-2

1.3.0-3

1.4

1.4.0-1

1.5

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

1 General

1.1 Systems Safety and Mission Assurance Program

The contractor shall implement a safety and mission assurance program that is consistent with contractual requirements.

The mission assurance program shall cover:

⦁ Flight hardware and software that is designed, built, or provided by the contractor and its subcontractors or furnished by the government, from project initiation through launch and mission operations

⦁ The ground support equipment that interfaces with flight items to the extent necessary to assure the integrity and safety of flight items

The contractor shall submit a compliance matrix that identifies variance and acceptance rationale for processes, procedures, and standards that are proposed as alternatives to those specified by the contract (DID 1-1).

Any deviations/waivers from this MAR shall be documented and submitted to the GeoXO Flight Project Office for approval. These deviations/waivers will be controlled and maintained by the GeoXO Configuration Management Group at GSFC.

1.2 Management

The contractor shall designate a manager for assurance activities.

The assurance manager shall not be responsible for project costs and schedules other than those pertaining to assurance activities.

The contractor shall ensure that the assurance manager has direct access to upper management that is independent of project management and shall have the functional freedom and authority to interact with all elements of the project.

1.3 Requirements Flowdown

The contractor shall apply the system safety and mission assurance requirements in this document to subcontractors and suppliers to the extent necessary to ensure that the delivered product meets performance requirements.

The Contractor's mission assurance program shall document and implement a process to verify subcontractor and supplier compliance.

Specifically, the Contractor's Contract Review and Purchasing processes shall establish the process for documenting, communicating, and reviewing requirements with sub-tier suppliers to ensure requirements are met.

1.4 Suspension of Work Activities

The contractor shall direct the suspension of any work activity that presents a hazard, imminent danger, or future hazard to personnel, property, or mission operations resulting from unsafe acts or conditions that are identified by inspection, test, or analysis.

1.5 Mission Assurance Surveillance

Page 2 of 102 Printed Wednesday, February 3, 2021

ID

IMAR17

IMAR18

IMAR27

IMAR28

IMAR19

IMAR20

IMAR21

IMAR22

IMAR32

IMAR33

IMAR34

IMAR35

Object Number

1.5.0-1

1.5.0-2

1.5.0-3

1.5.0-4

1.5.0-5

1.5.0-6

1.6

1.6.0-1

1.6.0-2

1.7

1.7.0-1

1.8

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

The work activities, operations, and documentation performed by the Contractor and sub-tier contractors or suppliers shall be subject to evaluation, review, audit, and inspection by government-designated representatives from GSFC, the Government Inspection Agency (GIA), or an Independent Assurance Contractor (IAC). GSFC will delegate in-plant responsibilities and authority to those agencies via a letter of delegation and task assignment.

The contractor shall grant access for National Aeronautics and Space Administration (NASA) and NASA mission assurance representatives to conduct an audit, assessment, or survey upon notice.

The contractor shall supply documents, records, equipment, and a work area within the contractor’s facilities in support of NASA audits, assessments, inspections, or surveys.

Resources shall be provided to assist with the assessments/surveys with minimal disruption to work activities.

These assessments, audits, assessments, inspections, or surveys may be performed by NASA Project representatives and/or by NASA Supply Chain Quality representatives at various points over the program/project development lifecycle and will focus on prime and critical/complex sub-tier suppliers across the NASA Goddard Space Flight Center supply chain. Any assessment may require a follow-up visit.

Note: see Federal Acquisition Regulations (FAR) Parts 46.103, 46.104, 46.202-2, 46.4, and 46.5 for government quality assurance requirements at contractor facilities. See FAR Part 52.246 for inspection clauses by contract type.

1.6 Government Mandatory Inspection Points (GMIPs)

The contractor shall plan for GMIPs and provide work instructions, procedures, drawings, etc. that are appropriate for the activities. The following are examples of activities that may be subject to GMIPs:

⦁ Circuit card assemblies ⦁ Final solder inspection before conformal coating and staking ⦁ Post conformal coating ⦁ Pre-closure of boxes ⦁ Harness – pre-integration (pre-staking or potting) ⦁ Unit and component level assembly – witness final assembly ⦁ Mechanical – final assembly ⦁ Software acceptance test ⦁ Rework and repairs to flight hardware

Note: This list is for planning purposes. Items may be added or deleted based on the specifics of the development effort.

1.7 Active Suppliers List (ASL)

The contractor shall provide a list of active suppliers used for product produced under this contract (DID 1-2).

1.8 Use of Inherited Products/Items

Page 3 of 102 Printed Wednesday, February 3, 2021

ID

IMAR36

IMAR37

IMAR38

IMAR39

IMAR40

IMAR41

Object Number

1.8.0-1

1.8.0-2

1.8.0-3

1.9

1.9.0-1

1.9.0-2

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

For Inherited Products/Items, defined as those that will be build-to-print (BTP), or rebuilt with modification, or are available as commercial-off-the-shelf (COTS), or were previously developed and exist (e.g., spares), the contractor may propose to follow the GSFC Inherited Item Risk Assessment process (DID 1-3).

The contractor shall comply with all requirements of the MAR and SOW for the Inherited Product unless specifically relieved by the GeoXO Flight Project office as a result of the Inherited Item Risk Assessment.

Use of this process does not relieve the contractor from meeting contractual performance and functional requirements for the Inherited Product.

1.9 Applicable Documents

The applicable documents are referenced in Section 12 – they form a part of this specification to the extent specified in Section 12. In the event of conflict between documents specified in Section 12 and other detailed content of the MAR, the MAR shall be the superseding requirement.

Deliverables referenced in this document shall be delivered in accordance with the DID in Appendix B.

Page 4 of 102 Printed Wednesday, February 3, 2021

ID

IMAR42

IMAR43

IMAR44

IMAR45

IMAR46

IMAR47

IMAR48

IMAR29

IMAR49

IMAR50

IMAR51

IMAR52

IMAR53

IMAR57

IMAR58

IMAR59

IMAR30

IMAR31

Object Number

2.1

2.1.0-1

2.2

2.2.0-1

2.2.1

2.2.1.0-1

2.2.1.0-2

2.2.1.0-3

2.2.1.0-4

2.2.2

2.2.2.0-1

2.2.2.0-2

2.2.2.0-3

2.2.3

2.2.3.0-1

2.2.3.0-2

2.2.3.0-3

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

2 Quality Management System

2.1 General

The contractor shall have a quality management system that is compliant with the requirements of SAE AS9100 Quality Systems - Aerospace - Model for Quality Assurance in Design, Development, Production, Installation and Servicing.

2.2 Supplemental Quality Management System Requirements

The following requirements augment identified portions of the ISO requirements.

2.2.1 Control of Nonconforming Product

The contractor shall have a documented closed loop system for identifying, reporting, and correcting product nonconformances.

The system shall ensure that the adequacy of corrective action is determined by audit or test, that objective evidence is collected, and that preventive action is implemented to preclude recurrence.

The contractor shall provide electronic access to the nonconformance system to designated local and remote government representatives.

Nonconformances shall be reported in accordance with the DID 2-1 and DID 2-2.

2.2.2 Preliminary Review

The material review process shall be initiated with the identification and documentation of a nonconformance.

A preliminary review shall be the initial step performed by Contractor-appointed personnel to determine if the nonconformance is minor and can readily be processed using the following disposition actions:

⦁ Scrap — the product is not usable ⦁ Re-work — the product will be re-worked to conform to requirements ⦁ Return to supplier — the product will be returned to the supplier ⦁ Refer to Material Review Board when the above actions do not apply to the nonconformance.

Note: Preliminary Review does not negate the requirement to identify, segregate, document, report, and disposition nonconformances.

2.2.3 Material Review Board (MRB)

Nonconformances not dispositioned by Preliminary Review shall be referred to the MRB for disposition.

The contractor shall have a documented process for the establishment and operation of an MRB to process nonconformances.

The contractor process shall include definitions of major and minor nonconformances.

Page 5 of 102 Printed Wednesday, February 3, 2021

ID

IMAR54

IMAR55

IMAR60

IMAR64

IMAR65

IMAR61

IMAR68

IMAR62

IMAR63

IMAR69

IMAR70

IMAR104

IMAR154

IMAR758

IMAR759

Object Number

2.2.3.0-4

2.2.3.0-5

2.2.3.0-6

2.2.3.0-7

2.2.3.0-8

2.2.3.0-9

2.2.3.0-10

2.2.3.0-11

2.2.3.0-12

2.2.4

2.2.4.0-1

2.2.4.0-2

2.2.4.0-3

2.2.4.0-4

2.2.4.0-5

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

The MRB process shall investigate, in a timely manner, each nonconforming item in sufficient depth to determine proper disposition.

For each reported nonconformance, there shall be an investigation and engineering analysis sufficient to determine cause and corrective actions for the nonconformance.

The contractor shall appoint an MRB chairperson who is responsible for implementing the MRB process and ensuring that the MRB actions are performed in compliance with this standard as implemented by Contractor procedures.

The MRB shall consist of a core team of functional and project representatives with other disciplines brought in as necessary.

The MRB process shall include a government representative who will be a voting member on MRB actions involving major nonconformances.

The MRB shall use the following disposition actions:

⦁ Scrap — the product is not usable ⦁ Re-work — the product will be re-worked to conform to requirements ⦁ Return to supplier — the product will be returned to the supplier ⦁ Repair — the product will be repaired using a repair process approved by the MRB ⦁ Use as is — the product will be used as is ⦁ Request for Waiver

All MRB meetings shall be documented in the contractor’s system and include a list of the attendees (virtual and in person), key discussions, action items, and decision of the voting members.

Written authorization shall be documented to disposition the nonconforming product.

The contractor shall inform the government of MRB actions (DID 2-1).

2.2.4 Failure Review Board (FRB)

Nonconformances not dispositioned by Preliminary Review or Material Review Board shall be referred to the Failure Review Board for disposition.

Nonconformances to be dispositioned by FRBs shall include: those items that fail;

show performance at limits of tolerance; and out of family type operation.

The contractor shall have a documented process for the establishment and operation of an FRB to process nonconformances.

The FRB process shall investigate, in a timely manner, each nonconforming item in sufficient depth to determine proper disposition.

For each reported nonconformance, there shall be an investigation and engineering analysis sufficient to determine cause and corrective actions for the nonconformance.

Page 6 of 102 Printed Wednesday, February 3, 2021

ID

IMAR71

IMAR66

IMAR67

IMAR72

IMAR79

IMAR73

IMAR74

IMAR80

IMAR81

IMAR82

IMAR86

IMAR87

IMAR88

IMAR89

IMAR90

Object Number

2.2.4.0-6

2.2.4.0-7

2.2.4.0-8

2.2.4.0-9

2.2.4.0-10

2.2.4.0-11

2.2.4.0-12

2.2.4.0-13

2.2.5

2.2.5.0-1

2.2.5.0-2

2.3

2.3.0-1

2.4

2.4.0-1

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

The contractor shall appoint an FRB chairperson who is responsible for implementing the FRB process and ensuring that the FRB actions are performed in compliance with this standard as implemented by Contractor procedures.

The FRB shall consist of a core team of functional and project representatives with other disciplines brought in as necessary.

The FRB process shall include a government representative who will be a voting member on FRB actions.

The FRB shall use the following disposition actions:

⦁ Scrap — the product is not usable ⦁ Re-work — the product will be re-worked to conform to requirements ⦁ Return to supplier — the product will be returned to the supplier ⦁ Repair — the product will be repaired using a repair process approved by the MRB ⦁ Use as is — the product will be used as is ⦁ Request for Waiver

All FRB meetings shall be documented in the contractor’s system and include a list of the attendees (virtual and in person), key discussions, action items, and decision of the voting members.

Written authorization shall be documented to disposition the nonconforming product.

Completed FRB’s will be approved by NASA/Government representative.

The contractor shall inform the government of FRB actions (DID 2-2).

2.2.5 Reporting of Non-Conformances

The contractor shall report:

⦁ Major hardware non-conformances beginning with the first application of power at the component level ⦁ Major hardware non-conformances beginning with the first application of power at the component level ⦁ Major mechanical system non-conformances beginning with the first operation.

Non-conformance reporting shall continue through formal Government acceptance of the end item on orbit.

2.3 Lessons Learned

The Contractor shall collect lessons learned and submit them to the GeoXO Flight Project Office for input into a Government Lessons Learned Database. (DID 2-3)

2.4 Orbital Debris Assessment Report (ODAR) and End of

Mission Plan (EOMP)

The contractor shall provide the input necessary for the development of the mission level ODAR and the EOMP deliveries per the content defined in NASA-STD 8719.14 Process for Limiting Orbital Debris (DID 2-4).

Page 7 of 102 Printed Wednesday, February 3, 2021

ID

IMAR91

IMAR92

IMAR93

IMAR94

IMAR95

IMAR96

IMAR97

IMAR98

IMAR99

IMAR100

IMAR101

IMAR105

Object Number

3.1

3.1.0-1

3.1.0-2

3.1.0-3

3.1.0-4

3.1.0-5

3.1.0-6

3.2

3.2.0-1

3.2.0-2

3.3

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

3 System Safety

3.1 General

The contractor shall document and implement a system safety program, support the ELV Safety Review Process as defined in paragraph 2.4 of NPR 8715.7 Expendable Launch Vehicle Payload Safety Program, comply with launch service provider requirements, and comply with launch range safety requirements.

The system safety program shall provide for early identification and control of hazards during design, fabrication, test, transportation, and ground activities.

The contractor shall include the following specific safety requirements in the system safety program:

⦁ The contractor shall incorporate three independent inhibits in the design (dual failure tolerant) if a system failure may lead to a catastrophic hazard.

A prelaunch catastrophic hazard is a payload-related hazard, condition, or event occurring prior to launch that could result in a fatal injury to personnel or loss of a ground facility. A post-launch catastrophic hazard is a payload-related hazard, condition, or event occurring after launch and up to payload separation that could result in a fatal injury or loss of flight termination system.

⦁ The contractor shall incorporate two independent inhibits in the design (single failure tolerant) if a system failure may lead to a critical hazard. A critical hazard is defined as a hazard, condition or event that may cause severe injury or occupational illness or major property damage to facilities.

⦁ The contractor shall adhere to specific detailed safety requirements, including compliance verification that must be met for design elements with hazards that cannot be controlled by failure tolerance. The process by which safety is incorporated into these design elements (e.g., structures and pressure vessels) is called "Design for Minimum Risk".

3.2 Mission Related Safety Requirements Documentation

The contractor shall implement the launch range safety requirements that are applicable to the launch site.

The contractor shall implement the most stringent safety requirement in the event there are conflicting requirements.

⦁ NASA-STD 8719.24 (with Annex) NASA Expendable Launch Vehicle Payload Safety Requirements

⦁ KNPR 8715.3 KSC Safety Practices Procedural Requirements (applicable at KSC property, KSC-controlled property, and offsite facility areas where KSC has operational responsibility)

⦁ NPR 8715.7 Expendable Launch Vehicle Payload Safety Program ⦁ Launch Site Facility-specific Safety Requirements, as applicable (e.g., Astrotech)

3.3 System Safety Deliverables

Page 8 of 102 Printed Wednesday, February 3, 2021

ID

IMAR106

IMAR107

IMAR108

IMAR109

IMAR110

IMAR111

IMAR112

IMAR113

IMAR114

IMAR75

IMAR76

IMAR115

IMAR116

IMAR117

IMAR118

IMAR77

IMAR78

Object Number

3.3.1

3.3.1.0-1

3.3.2

3.3.2.0-1

3.3.2.0-2

3.3.3

3.3.3.1

3.3.3.1.0-1

3.3.3.1.0-2

3.3.3.1.0-3

3.3.3.1.0-4

3.3.3.2

3.3.3.2.0-1

3.3.3.2.0-2

3.3.3.2.0-3

3.3.3.2.0-4

3.3.3.2.0-5

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

3.3.1 System Safety Program Plan

The contractor shall prepare a System Safety Program Plan (SSPP) that describes the tasks and activities of system safety management and engineering required to identify, evaluate, and eliminate or control hazards to the hardware, software, and system design by reducing the associated risk to an acceptable level throughout the system life cycle, including launch range safety requirements (DID 3-1).

3.3.2 Safety Requirements Compliance Checklist

The contractor shall document and implement a Safety Requirements Compliance Checklist, tailored for the instrument, to demonstrate that the instrument complies with NASA and range safety requirements (DID 3-2).

The contractor shall document non-compliances to safety requirements in waivers per section 3.3.5 of this document.

3.3.3 Hazard Analyses

3.3.3.1 Preliminary Hazard Analysis

The contractor shall perform a Preliminary Hazard Analysis (PHA) to obtain an initial risk assessment and to identify safety critical areas of a concept or system. The contractor will base the PHA on the best available data, including mishap data from similar systems and other lessons learned.

The contractor shall evaluate hazards associated with the proposed design or function for severity, control approach (fault tolerance or design for minimum risk), and operational constraints.

The contractor shall identify safety provisions and alternatives that are needed to eliminate hazards or reduce their associated risk to an acceptable level.

The contractor shall deliver the PHA with Preliminary ISAR (DID 3-3).

3.3.3.2 Instrument Safety Assessment Report (ISAR) and

Verification Tracking Log (VTL)

The contractor shall generate an ISAR to document the comprehensive evaluation of the risk being assumed prior to the testing or operation of an instrument. The spacecraft contractor will use the ISAR as an input to the Safety Data Package

(SDP) (DID 3-3).

The contractor shall develop analyses for identifying the hazards associated with the hardware, support equipment, software, instrument ground operations and ground support equipment, and their interfaces.

The contractor shall take measures to minimize each identified hazard.

Hazard reports shall be generated for all identified system hazards.

The hazard reports shall document the causes, controls, verification methods and status of verification for each hazard.

Page 9 of 102 Printed Wednesday, February 3, 2021

ID

IMAR119

IMAR56

IMAR84

IMAR85

IMAR102

IMAR103

IMAR120

IMAR121

IMAR122

IMAR23

IMAR123

IMAR124

IMAR24

IMAR125

Object Number

3.3.3.2.0-6

3.3.3.2.0-7

3.3.3.2.0-8

3.3.3.2.0-9

3.3.3.2.0-10

3.3.3.2.0-11

3.3.3.3

3.3.3.3.0-1

3.3.3.3.0-2

3.3.3.3.0-3

3.3.3.4

3.3.3.4.0-1

3.3.3.4.0-2

3.3.4

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

The contractor shall document and implement a Verification Tracking Log (VTL) that documents a Hazard Control and Verification Tracking process as a closed-loop system that ensures safety compliance has been satisfied per applicable launch range safety requirements.

The contractor shall document in the VTL the process of verifying the control of hazards by test, analysis, inspection, similarity to previously qualified hardware, or any combination of these activities.

The contractor shall ensure that verifications listed on the hazard reports refer to specific test, analysis, or inspection reports with a summary of the pertinent results.

The contractor shall make the results of these tests, analyses, and inspections available for government review.

The VTL shall identify hazard controls that are not verified as closed and shall be delivered with the final ISAR (DID 3-3).

The contractor shall provide regular electronic updates of the VTL until all hazard controls are verified as closed.

3.3.3.3 Operations Hazard Analysis (OHA) and Verification Tracking Log (VTL)

The contractor shall document, implement, and maintain an Operations Hazard Analysis (OHA) and a hazard Verification Tracking Log (VTL) to demonstrate that hardware operations, test equipment operations, and integration and test (I&T) activities comply with the safety requirements of the facilities where the activities will be performed and that hazards associated with those activities are mitigated to an acceptable level of risk (DID 3-4).

The OHA shall document all controls and methods of verifications for each hazards listed. The OHA process considers the timing and sequence of tasks with respect to the equipment/hardware/software design, human engineering provisions, assembly, test, and operating procedures, and the facility environments for each specific operation being performed.

The contractor shall update and maintain the Hazard Verification Tracking Log during I&T activities to track open issues.

3.3.3.4 Operating and Support Hazard Analysis (O&SHA)

The contractor shall perform an Operating and Support Hazard Analysis (O&SHA) to evaluate activities for hazards introduced during testing, transportation, storage, integration, and prelaunch operations at the launch site. The primary purpose is to evaluate the adequacy of procedures used to eliminate, control, or mitigate identified hazards so as to ensure implementation of safety requirements for personnel, procedures, and equipment during activities at the launch site.

The contractor shall submit the results of the O&SHA as a part of the Intermediate & Final ISARs (DID 3-3).

3.3.4 Procedures for Payload I&T and Pre-Launch Processing

Page 10 of 102 Printed Wednesday, February 3, 2021

ID

IMAR126

IMAR127

IMAR25

IMAR128

IMAR129

IMAR130

IMAR131

IMAR132

IMAR133

IMAR134

IMAR135

IMAR136

IMAR137

IMAR138

IMAR139

IMAR140

IMAR141

IMAR142

Object Number

3.3.4.0-1

3.3.4.0-2

3.3.4.0-3

3.3.5

3.3.5.0-1

3.3.5.0-2

3.3.5.0-3

3.3.6

3.3.6.0-1

3.3.6.0-2

3.3.6.0-3

3.3.6.0-4

3.4

3.4.0-1

3.4.0-2

3.5

3.5.1

3.5.1.0-1

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

The contractor shall document all procedures that will be implemented when integration and test activities and pre-launch activities are performed at processing facilities and the launch site (DID 3-5).

The contractor shall ensure that the procedures comply with applicable facility safety requirements.

The contractor shall provide safety support for the implementation of hazardous procedures.

3.3.5 Safety Non-Compliances and Waivers

The contractor shall request waivers for variations from the applicable safety requirements per paragraph 1.4 of NPR 8715.7 Expendable Launch Vehicle (ELV) Payload Safety Program. The waiver form is available at URL.

https://kscsma.ksc.nasa.gov/PayloadSafety/forms

Safety Noncompliance/Waiver Requests shall be delivered in accordance with the

DID 3-6.

3.3.6 Mishap Reporting and Investigation

The contractor shall report accidents, test failures, or other mishaps and close calls promptly to NASA. (DID 3-7)

The contractor shall report all Type A Mishaps, Type B Mishaps, High Visibility Mishaps and High Visibility Close Calls as defined in the NPR 8621.1, within in one hour of occurrence.

The contractor shall report all Type C Mishaps, Type D Mishaps, and Close Calls as defined in the NPR 8621.1, within 24 hours of occurrence.

All mishaps and close calls shall be investigated to determine root cause.

3.4 Support for Safety Working Groups

Technical support shall be provided to the GeoXO Flight Project for Safety Working Group (SWG) meetings, Technical Interface Meetings (TIM), and technical reviews, as required.

The SWG will meet as necessary to review procedures and analyses that contain or examine safety critical functions or as convened by the GeoXO Project Safety Manager to discuss any situations that may arise with respect to overall project safety. Meetings are normally held as a sidebar to other reviews and meetings to minimize extra travel. There is no required number of meetings.

3.5 Test Safety Responsibilities

3.5.1 Treatment of Hazards

As hazards are discovered, every attempt shall be made to eliminate them. This may be accomplished by redesign, controlling energy sources, revising the test, or by some other method.

Page 11 of 102 Printed Wednesday, February 3, 2021

ID

IMAR143

IMAR144

IMAR145

IMAR146

IMAR147

IMAR148

IMAR149

IMAR150

IMAR151

IMAR152

IMAR153

Object Number

3.5.1.0-2

3.5.1.0-3

3.5.1.0-4

3.5.1.0-5

3.5.2

3.5.2.0-1

3.5.2.0-2

3.5.2.0-3

3.5.2.0-4

3.5.3

3.5.3.0-1

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

If the hazard cannot be eliminated, automatic safety controls shall be applied, for example: pressure relief devices, electrical circuit protection devices, or mechanical interlocks.

If that is not possible or is too costly, warning devices shall be considered.

If none of the foregoing methods are practicable, control procedures must be developed and applied. In practice, a combination of all four methods may be the best solution to the hazards posed by a complex system.

Before any test begins, the Contractor project manager and test facility management shall agree on the hazard control method(s) that are to be used.

3.5.2 Facility Safety

The contractor shall verify that the test facility and normal operations present no unacceptable hazard to the test item, test and support equipment, or personnel.

The contractor shall ensure that facility personnel abide by all applicable regulations, (i.e., OSHA and NASA) observe all appropriate industrial safety measures, and follow all requirements for personal protective equipment.

The contractor shall ensure that all facility personnel are trained and qualified for their positions. Training should include the handling of emergencies by the simulation of emergency conditions.

Analysis, tests and inspections shall be performed to verify that the safety requirements are satisfied.

3.5.3 Lifting Device Safety Requirements

The contractor shall implement the following safety requirements for lifting devices and equipment (LDE) when performing NASA work at non-NASA facilities:

⦁ Ensure that, for critical lifts, overhead cranes, winches, and hoists have dual holding brakes and dual upper limit switches installed per paragraph 5.4 of NASA Standard 8719.9A Standard for Lifting Devices and Equipment (note:

dual upper limit switches do not apply to chain hoists). A single holding brake in combination with a motor drive that automatically tests the holding ability of the brake prior to every release of the brake is equivalent to a second brake if the crane has a audible or visual alarm to alert the operator of a failure in the braking system.

⦁ Label and tag lifting devices and equipment per paragraph 4.9 of NASA-

STD-8719.9A.

⦁ Label LDE as having a Safe Working Load (SWL) as determined by the manufacturer or of no more than the applied load if the SWL test is performed at a value lower than that allowed by the manufacturer.

⦁ Perform, per paragraph 4.5 of NASA-STD-8719.9A, a proof test at 100% of the SWL for overhead cranes, mobile cranes, derricks, hooks, hydra-sets, load measuring devices, slings, and rigging, with the following exceptions;

⦁ A proof test at 125% of the SWL for overhead and mobile cranes and for aerial platforms such as scissor or boom lifts that will be used near critical hardware.

⦁ A proof test at 200% of the SWL for shackles, turnbuckles, and

Page 12 of 102 Printed Wednesday, February 3, 2021

ID

IMAR153

Object Number

3.5.3.0-1

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements similar items.

⦁ Perform SWL proof test every four years after the initial test.

⦁ Perform NDT inspections of critical welds on LDE after initial proof test and load testing (a critical weld is one in which a failure would result in a failure of the hardware). The inspections will be performed by an American Society of Nondestructive Testing (ASNT) or equivalently trained inspector.

Page 13 of 102 Printed Wednesday, February 3, 2021

ID

IMAR163

IMAR164

IMAR165

IMAR166

IMAR172

IMAR173

IMAR174

IMAR175

IMAR176

IMAR177

IMAR155

IMAR178

IMAR156

Object Number

4.1

4.1.0-1

4.1.0-2

4.1.0-3

4.2

4.2.0-1

4.2.0-2

4.3

4.3.0-1

4.3.0-2

4.3.0-3

4.3.0-4

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

4 Reliability

4.1 General

The contractor shall plan and implement a reliability program that interacts effectively with other project disciplines, including systems engineering, hardware design, and product assurance.

The program shall be tailored to:

1. Assure the specified reliability probability of success is achieved.

2. Demonstrate that redundant functions, including alternative paths and work-arounds, are independent to the extent practicable.

3. Demonstrate that the stress applied to parts meet applicable derating criteria.

4. Identify single failure items/points, their effect on the attainment of mission objectives, and possible safety degradation.

5. Identify limited-life items and ensure that special precautions are taken to conserve their useful life for on-orbit operations.

The Contractor for a primary instrument only shall support the mission level Probabilistic Risk Assessment (PRA). (CCR X00007)

4.2 Reliability Program Plan (RPP)

The contractor shall document and implement an RPP using both qualitative and quantitative techniques to support decisions regarding mission success and safety throughout system development (DID 4-1).

The contractor shall include a detailed approach to the analysis of hardware and software for their contributions to system reliability and mission success.

4.3 Failure Modes Effects and Criticality Analysis (FMEA /

FMECA) and Critical Items List (CIL)

The contractor shall perform and maintain FMECAs that address flight hardware and software and ground support equipment that interfaces with flight systems that is being designed, built, or provided from project initiation through launch and mission operations.

The contractor shall include likelihood, cause, detection and mitigation, and the effects of each failure mode at the local, subsystem, and system or mission levels to the interface level for existing systems and to the box or functional level for modified or new systems (DID 4-2).

Results of the FMECA shall be used to evaluate the design relative to requirements (e.g., no single instrument failure will prevent removal of power from the instrument).

Identified discrepancies shall be evaluated by management and design groups for assessment of the need for corrective action.

Page 14 of 102 Printed Wednesday, February 3, 2021

ID

IMAR179

IMAR180

IMAR181

IMAR158

IMAR182

IMAR183

IMAR184

Object Number

4.3.0-5

4.3.0-6

4.3.0-7

4.3.0-8

4.3.0-9

4.3.0-10

4.3.0-11

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

The FMECA shall analyze redundancies to ensure that redundant paths are isolated or protected such that any single failure that causes the loss of a functional path will not affect the other functional path(s) or the capability to switch operation to that redundant path.

Failure modes shall be assessed at a level sufficient to identify all single point failure modes at the unit piece part (e.g. transistor, Integrated Circuit) level.

The failure mode shall be assigned a severity category based on the most severe effect caused by a failure.

Failure modes resulting in Severity Categories 1, 1R, 1S or 2 shall be analyzed at a greater depth, to the single parts if necessary, to identify the cause of failure.

The contractor shall prepare and maintain a Critical Items List for severity categories 1, 1R, 1S, and 2 per table 4.1.

The contractor shall prepare and maintain a single point failure list for modes resulting in categories 1, and 1S per table 4.1 and document applicable failure causes, corresponding mitigations, and retention rationale.

In performing the likelihood part of this analysis, the contractor shall predict the likelihood score from 1-5 for each failure mode, using the Technical Likelihood criteria shown in Table 4-2, to facilitate risk assessment using the FMEA results.

Each likelihood prediction can be based on qualitative assessment and/or failure rate data from other analyses (i.e., system predictions) in order to score each failure mode for the mission duration.

Table 4.1 Severity Categories

Page 16 of 102 Printed Wednesday, February 3, 2021

ID

IMAR191

IMAR159

IMAR192

IMAR160

IMAR193

IMAR194

IMAR195

IMAR196

IMAR197

IMAR161

IMAR162

IMAR198

IMAR199

IMAR200

IMAR167

IMAR201

Object Number

4.4.0-1

4.4.0-2

4.4.0-3

4.4.0-4

4.4.0-5

4.5

4.5.0-1

4.5.0-2

4.5.0-3

4.5.0-4

4.5.0-5

4.6

4.6.0-1

4.6.0-2

4.6.0-3

4.6.0-4

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

A qualitative fault tree analyses (FTA) shall be performed and delivered in accordance with DID 4-3 that addresses instrument failures and degraded modes of operation.

Beginning with each undesired state (instrument failure or degraded mode of operation), the fault tree shall be expanded to include all credible combinations of events/faults and environments that could lead to the undesired state.

Fault tree analyses shall address both hardware and software contributions to analyzed scenarios and identify cut sets of interest and risks.

Subassembly hardware/software failures, external hardware/software failures and human factors shall be considered in the analysis.

The contractor shall quantify FTAs to support specific end-states of interest risk assessments.

4.5 Parts Stress Analysis

The contractor shall perform parts stress and derating analyses for electrical, electronic, and electromechanical (EEE) parts in accordance with GSFC EEE- INST-002 Instruction for EEE Parts Selection, Screening, Qualification, and Derating

(DID 4-4).

The Parts Stress analyses shall be performed at the most stressful values that result from specified performance and environmental requirements (e.g., temperature and voltage) on the assembly or part.

The results of the Parts Stress analyses shall be presented at all design reviews starting with the PDR.

The results of the Parts Stress analyses with summary sheets and updates shall be submitted as part of the Reliability Predictions.

Design presentations shall include comments on how the analysis was used to perform design trade-offs and how the results were taken into consideration when making design or risk management decisions.

4.6 Worst-Case Analysis

Worst Case Analyses shall be performed on all circuits where failure results in a severity category of 1, 1R, 1S, or 2 or where de-rating guidelines are violated. (DID 4-5)

The most sensitive design parameters, including those that are subject to variations that could degrade performance, shall be subjected to Worst case analysis.

The Worst case analyses shall consider all parameters set at worst case limits and worst case environmental stresses for the parameter or operation being evaluated.

Depending on mission parameters and parts selection methods, part parameter values for the analysis will typically include: manufacturing variability, variability due to temperature, aging effects of environment, and variability due to cumulative radiation.

The Worst case analyses shall be updated in keeping with design changes.

Page 17 of 102 Printed Wednesday, February 3, 2021

ID

IMAR202

IMAR203

IMAR204

IMAR210

IMAR211

IMAR760

IMAR212

IMAR213

IMAR214

IMAR215

IMAR216

IMAR217

IMAR218

IMAR83

Object Number

4.6.0-5

4.7

4.7.0-1

4.7.0-2

4.7.0-3

4.7.0-4

4.8

4.8.0-1

4.8.0-2

4.8.0-3

4.8.0-4

4.9

4.9.0-1

4.9.0-2

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

The results of any analyses will be presented at all design reviews starting with peer reviews.

4.7 Reliability Assessment and Predictions

The contractor shall perform numerical reliability prediction to validate that the design meets the requirements of the specification, as needed and to assist:

a) Evaluation of alternative design concepts, redundancy and cross-strapping approaches.

b) Identification of the elements of the design, which are the greatest detractors of system reliability.

c) Identification of those potential mission limiting elements and components that will require special attention in part selection, testing, environmental isolation, and/or special operations.

d) Evaluation of the impact of proposed engineering change and waiver requests on reliability.

e) With life, stress, fault, and failure risk evaluation.

The assessments and updates will be submitted to GSFC in accordance with the DID. The results of reliability assessments shall be reported at PDR and CDR. (DID 4-6)

As part of the reliability prediction the contractor shall provide and update a Reliability Block Diagram.

The requirements of Section 4.7 shall NOT be applicable to contractors developing non-primary instruments. (CCR X00007)

4.8 Trend Analysis

The contractor shall prepare and maintain a list of subsystems and components for which trend analysis will be performed, including the parameters to be monitored.

A list of subassemblies and units to be assessed and the parameters to be monitored and the trend analysis reports shall be maintained and submitted in accordance with the DID 4-7.

The contractor shall begin trend analysis at subsystem and component acceptance testing and continue through system integration and test phase. The monitoring will be accomplished within the normal test framework; i.e., during functional tests, environmental tests, etc.

The contractor shall establish a system for recording and analyzing the parameters as well as any changes from the nominal (out of family) even if the levels are within specified limits.

4.9 Limited Life Items

The contractor shall document and implement a plan to manage limited life items

(DID 4-8).

This plan shall be part of the Reliability Program Plan.

Page 18 of 102 Printed Wednesday, February 3, 2021

ID

IMAR219

IMAR220

IMAR221

IMAR222

IMAR223

IMAR224

Object Number

4.9.0-3

4.9.0-4

4.9.0-5

4.9.0-6

4.9.0-7

4.9.0-8

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

The contractor shall prepare and maintain a list of potential limited life items that includes expected life, required life, duty cycles, an assessment of life margin that includes servicing and maintenance, and the retention rationale for items with an expected life of less than 2x the requirement, less than 4x the requirement for structural items and 4x the requirement for items involving life safety.

Note: Limited Life items are generally defined as items that have a limited shelf life, operational life, or a cycle life and whose life expectancy is less than 2x the requirement.

The risk assessment and mitigations plans shall factor in wear caused by atomic oxygen, solar and trapped radiation, shelf-life, extreme temperatures, thermal cycling, and mechanical wear or fatigue, and include refurbishment and maintenance plans.

The list of limited-life items shall include, but not necessarily be limited to: selected consumables; structures; mechanisms; batteries; seals; thermal control surfaces;

solar arrays; and, electromechanical mechanisms.

Mechanisms such as compressors, seals, bearings, valves, actuators, and scan devices shall be included when aging, wear, fatigue and lubricant degradation limit their life.

The use of an item whose expected life is less than its mission design life must be approved by GSFC.

Page 19 of 102 Printed Wednesday, February 3, 2021

ID

IMAR225

IMAR226

IMAR227

IMAR228

IMAR232

IMAR233

IMAR235

IMAR236

IMAR237

IMAR238

IMAR239

Object Number

5.1

5.1.0-1

5.1.0-2

5.2

5.2.0-1

5.2.0-2

5.2.0-3

5.2.1

5.2.1.0-1

5.2.1.0-2

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

5 Software Assurance

5.1 General

The contractor shall plan and implement a software assurance program that interacts effectively with other project disciplines, including systems engineering, hardware design and product assurance.

When identifying, developing, verifying, and maintaining software, the contractor shall apply the following definitions:

⦁ Software is defined as computer programs, procedures, scripts, rules, and associated documentation and data pertaining to the development and operation of a computer system. Software includes commercial–off-the-shelf (COTS) software, government-off-the-shelf (GOTS) software, modified-off-the-shelf (MOTS) software, custom software, reused software, heritage software, auto-generated code, and code executed on microprocessors.

⦁ Mission-Critical Software - Software that can cause, contribute to, or mitigate the loss of capabilities that are essential to the primary mission objectives. The software reliability assessment and analysis is focused on failure modes specific to post-separation mission phases.

⦁ Safety-Critical Software - Software that can cause, contribute to, or mitigate human safety hazards or damage to facilities. The software safety assessment and analysis is focused on hazards specific to Integration and Test, launch, and up through spacecraft separation from the launch vehicle.

5.2 Software Assurance Program

The contractor shall plan and implement a Software Assurance Program that complies with the definitions in 5.1 and:

⦁ NASA-STD-8739.8 NASA Standard for Software Assurance and Software Safety

The contractor shall identify the person responsible for directing and managing the software assurance program and interfacing with government assurance personnel.

The contractor shall document the software assurance program in a Software Assurance Plan (DID 5-1). The plan will address the disciplines of Software Quality, Software Safety, Software Reliability, Software Verification and Validation (V&V), and Independent Verification and Validation (IV&V) and detail the role of assurance and their activities in ensuring quality products and processes for each discipline.

The plan will include the software assurance processes, procedures, tools, and techniques to be used commensurate with the Software Classification Assessment.

The plan will address the necessary collaboration between software assurance, system safety, system reliability, and software engineering.

5.2.1 Software Quality

The contractor shall implement a Software Quality program to assure the quality of all software products.

The Software Quality program shall assure that the standards, processes and procedures are appropriate for the project, correctly implemented, and that all efforts adhere to the requirements, plans, procedures and standards.

Page 20 of 102 Printed Wednesday, February 3, 2021

ID

IMAR240

IMAR241

IMAR242

IMAR243

IMAR244

IMAR245

IMAR246

IMAR247

IMAR248

IMAR249

IMAR250

IMAR251

IMAR252

IMAR258

Object Number

5.2.2

5.2.2.0-1

5.2.2.0-2

5.2.2.0-3

5.2.2.0-4

5.2.2.0-5

5.2.2.0-6

5.2.2.0-7

5.2.2.0-8

5.2.2.0-9

5.2.2.0-10

5.2.2.0-11

5.2.2.0-12

5.2.3

418-XO-IMAR-0026, RM Version, GeoXO Instrument Mission Assurance Requirements

5.2.2 Software Safety

Software safety is a systematic approach to identifying, analyzing, tracking, mitigating and controlling software hazards and hazardous…