Final Report of the International Space Station Independent Safety Task Force – Executive Summary

Full Report

As required by the National Aeronautics and Space Administration (NASA) Authorization Act of 2005 (Public law 109-155), this report of the International Space Station Independent Safety Task Force (IISTF) to NASA and the United States Congress assesses vulnerabilities of the International Space Station (ISS) that could lead to its destruction, compromise the health of its crew, or necessitate its premature abandonment. The Task Force offers recommenda- tions that, if followed, should strengthen the ISS Program by increasing the likelihood of mission success and mitigating risks to crew safety or health.

The Task Force’s approach to the assigned tasks was two dimensional. First, the Task Force identified threats and vulnerabilities (hazards) that could cause ISS destruction, compromise crew health, or necessitate the premature abandonment of the ISS. The Task Force reviewed the controls against these vulnerabilities, which included design requirements, safety controls, and procedural/operational controls. Second, the Task Force reviewed the ISS Program’s cross- cutting management functions consisting of plans, procedures, governing processes, and man- agement processes that should provide advanced indications and warnings that will avoid events that might lead to destruction of the ISS, loss of its crew, or abandonment of the Station as well as avoid crew health problems.

The ISS Program is an international partnership comprised of the United States, Russia, Canada, the members of the European Space Agency, and Japan. Some 16 countries are in the partnership or involved via bilateral agreements with a Partner in building, operating, and using the ISS. This partnership will continue throughout the operational (post-assembly) phase of the Program, where NASA will continue to be responsible for the sustaining engineering, operation of NASA’s elements, and integration of the Station.

The vehicle is extremely large and complex with a current living volume of 15,000 cubic feet and a weight of 455,000 pounds. Planned assembly will expand it to 33,125 cubic feet and 855,000 pounds. Hardware and software are developed and tested all over the world and are assembled and operated on orbit at an altitude of approximately 215 nautical miles. Major systems including electrical power, cooling, data handling, and navigational control are distribu- ted throughout the Station and are expanded as assembly progresses. Station assembly to date has gone exceptionally well and is a tribute to the ISS and Shuttle teams. Anomalies occur but are dealt with quickly and with outstanding results as demonstrated recently by the solar wing retraction problem on ISS flight 12A.1/STS-116, where the spacewalking astronauts assisted in the retraction of the jammed solar array wing.

These factors result in a complex and distributed program with a highly technical and distributed management system that must be staffed by highly skilled engineers and skilled, experienced managers. Maintaining critical technical and management skills in the ISS Program as the ISS matures and NASA’s exploration program staffs up will be a challenge requiring proactive and continuing attention by NASA management.

NASA depends heavily on U.S. contractors for technical support of Station integration and for vehicle operations. These contractors are the source of data and expertise that are critical in ensuring mission safety and success, and their timely participation is essential to meeting mission schedules. Due to the international nature of the ISS Program, this support requires mandatory interfaces with NASA’s International Partners (IPs).

Currently the International Traffic in Arms Regulation (ITAR) restrictions and IP objections to signing what the IPs believe are redundant Technical Assistance Agreements are a threat to the safe and successful integration and operation of the Station. For example, a contractor work- force comprises a majority of the operations workforce and must be able to have a direct inter- face with the IP operations team to assure safe and successful operations. Their interactions, ability to exchange and discuss technical data relevant to vehicle operation, etc. are severely hampered by the current ITAR restrictions. This is an issue across the ISS Program, but must be resolved soon to allow operations training for the first flight of the European Space Agency’s Automated Transfer Vehicle (ATV) in late summer 2007.

The ISS on-orbit vehicle is robust and, to the extent practicable, meets a two failure-tolerance requirement to minimize the likelihood of catastrophic events. The Russian and U.S. systems provide robust redundancy from dissimilar hardware and designs in critical systems such as guidance, navigation, and control; environmental control and life support; and crew/cargo transportation. For most safety-related issues, time is available to mitigate vulnerabilities by switching to redundant systems, performing maintenance/repairs by the crew, or relying on consumables reserves until a future logistics flight can be launched to the Station.

Time-critical exceptions to the failure tolerance requirements are uncontrolled fire, collision with micrometeoroid and orbital debris (MMOD) leading to a major loss of cabin pressure, toxic spills, or a collision with a visiting vehicle. However, the Task Force found that systems design, testing, and adherence to operational procedures either provide adequate controls or that adequate mitigations are being developed for these conditions. For example, the risk of MMOD penetrating the ISS in its Assembly Complete configuration is 55% with a 9% risk of a catastrophic result over a 10-year period. This risk can be reduced to 29% and 5% respectively by implementation of changes that are available or being considered for development. It must be recognized that regardless of the efforts put forth, operating in space is, and will be for the foreseeable future, inherently risky and requires continuing discipline and diligence to maintain safe operations.

The transition from the space Shuttle to post-Shuttle system(s) for logistical support to the ISS will require careful planning and phasing of new capabilities to ensure adequate logistics and spares are provided to maintain a viable Station. Approximately 160,000 pounds of logistics and spares must be transported to the Station between 2010 and 2015 by the Russian Progress or emerging transportation systems. The Program’s IPs have committed to launch 40,000 pounds of this required 160,000-pound requirement. Premature commitment to emerging logistics delivery capability – if it does not materialize – could result in the loss of logistics support to the ISS for some time. Inadequate logistics will result in a serious decrease in the utility of the Station and could result in its abandonment.

The ISS Program has excellent processes and mechanisms in place on multiple fronts to ensure proper Program execution. A major component of avoiding catastrophic problems is continued diligence in monitoring the ISS system including hardware design, software devel- opment, flight preparation, and flight operations to detect and avoid unknown problems or in- adequately defined operational environments. The ISS Program must maintain its current level of diligence throughout the life of the Station, never letting previous successes lead to a compromise in the required level of support or attention to detail.

NASA manages the health of ISS flight crews with intensive pre-flight medical screening, certification as “fit to fly,” regular in-flight health monitoring, and a limited capability to diagnose and treat illness and injuries on board. In a worst-case scenario, a spontaneous health event may necessitate returning the crew to Earth for specialized medical attention, which would result in temporary abandonment of the ISS. Analogue environment data (i.e., Antarctica and submarine populations) and astronaut health events on the ground indicate that, with an ISS crew of six, the Program might expect a spontaneous medical event requiring medical evacuation once every four to six years.

Principal Observations

• The International Space Station Program is currently a robust and sound program with respect to safety and crew health. Safety and crew health issues are well documented and acceptable, and are either currently adequately controlled or mitigations are being developed to maintain acceptable risk levels.
• The International Space Station Program has strong and proactive crosscutting functions that – if continued – should provide advance indications and warnings that will avoid events that might lead to destruction of the Station, loss of the Station crew, abandonment of the Station, or development of untoward crew health issues. The International Space Station Program’s operating procedures and processes are thorough and sound.
• The International Space Station currently has an experienced, knowledgeable, and proac- tive team, both internally and in its institutional technical checks and balances, that provides the defense for process and management failures that might lead to an ISS safety or major crew health issue. This posture must be maintained to continue the Station’s successful operation.
• Micrometeoroid and orbital debris penetrating the living quarters or damaging critical equipment is a high safety risk to the crew and the Station.
• Spontaneous crew illness is a significant crew risk and may necessitate returning the crew to Earth for specialized medical attention, which would result in temporary abandonment of the Station. International Space Station medical and Program management officials are taking all reasonable precautions to minimize this risk.
• There are significant programmatic risks associated with completing the ISS Shuttle manifest and providing robust post-Shuttle logistics capabilities that threaten the ability to support a viable Station.
• Workforce composition is a growing concern throughout NASA because of the tech- nical and specialized nature of most of the agency’s work and the large-scale program transition now under way. The International Space Station Program is vulnerable to crit- ical management losses, making strategic workforce planning as important as ever.
• Design, development, and certification of the new Commercial Orbital Transportation System capability for ISS resupply are just beginning. If similar to other new program development activities, it most likely will take much longer than expected and will cost more than anticipated.
• The current International Traffic in Arms Regulation restrictions on NASA are a threat to the safe and successful integration and operations of the International Space Station.

Principal Recommendations

• The International Space Station Program should place the highest priority on options to decrease the risk of micrometeoroid and orbital debris.
• NASA should develop and implement plans to maintain Station critical skills and experienced managers.
• The Administration, Congress, and NASA should support the completion of the current Shuttle manifest to the International Space Station, including flights ULF-4 and ULF-5, to assemble a viable Station and provide spares for its long term operation.
• The Administration, Congress, and NASA should support a proactive and phased post-Shuttle logistical transportation program, including adequate funding of approx- imately one billion dollars per year above current allocations to ensure that adequate logistics and spares are available to maintain a viable Station.
• NASA senior management should conduct a comprehensive review of the Automated Transfer Vehicle to ensure agreement on the policies, approach, and technical imple- mentation of the safety strategy for the Automated Transfer Vehicle’s demonstration flight. [Note: This review was conducted on January 8, 2007, and met the intent of this recommendation.]
• The Department of State should grant immediate relief from the International Traffic in Arms Regulation restrictions in the form of an exemption to allow NASA contractors direct interaction with the International Space Station’s International Partners and their contractors. This must be affected no later than summer 2007 to support Automated Transfer Vehicle operations.
• The ISS Program should carefully consider implementing all IISTF recommendations to improve the overall safeguards and controls against vulnerabilities.

Further details on the recommendations as well as additional recommendations can be found in Section 5. A summary listing of all the recommendations is provided in Section 6. It is important to stress that for these recommendations to be effective and for the International Space Station to remain a robust and healthy program, sufficient support from the Admini- stration and Congress is required to ensure that resources are provided and the safety-critical aspects of International Space Station assembly and operations can be executed.

Full Report