New Horizons: A Risk-Informed Launch Decision
The New Horizons mission to Pluto (and then on to the Kuiper Belt and the farthest reaches of the solar system) would be historic. Pluto was the last planet not “visited” by US spacecraft—New Horizons, the first mission in NASA’s New Frontier’s program, would complete the reconnaissance of the entire solar system by US spacecraft. Development and launch of the spacecraft faced two challenges. The only power source that could meet the mission’s requirements posed a slight but possible risk to human health in the event that the satellite crashed on Earth. In addition, a first-stage tank on the launch vehicle had failed during testing. The case examines the risk assessment undertaken by launch decision-makers with the Launch Readiness Review imminent.
Figure 1. Artist’s concept of the New Horizon spacecraft.
The New Horizons mission was time-critical because of Pluto’s 248-year orbit around the sun. To conduct the science of the mission—primarily, mapping Pluto’s surface—it was imperative that the reconnaissance with the planet be done as near in time to Pluto’s perihelion, or closest point to the sun (1989), as possible. The farther Pluto retreated in its orbit, the more its polar regions would be lost in shadows and the more rapidly its atmosphere and surface would change, or even collapse, as it cooled. The launch window was narrow, and time was critical.
One technological challenge for the New Horizons team was to find a power source that could meet the mission’s performance and operational requirements. The General Purpose Heat Source (GPHS) Radioisotope Thermoelectric Generator (RTG), using plutonium dioxide (PuO2) as the heat source, was identified as the only feasible power system with the physical and operational characteristics capable of providing the necessary power to complete the mission.
The New Horizons Environmental Impact Statement (EIS) focused on launch accidents involving radiological consequences. It determined that, depending on the sequence of events, some launch accidents could result in release of some of the PuO2, which could have adverse impacts on human health and the environment.
In the extremely unlikely event of a ground impact of the entire launch vehicle, the EIS estimated, nearly 300 square kilometers (about 115 square miles) of land area could be contaminated above the screening level. Considering both the unlikely and the extremely unlikely launch accidents assessed in the EIS, both the maximally exposed member of the exposed population and the average individual within the exposed population faced a less than 1 in 1 million chance of incurring a latent cancer due to a catastrophic failure of the New Horizons mission.
At the engineering-technology level, of greater concern was a rupture of the Atlas first-stage RP1 tank during testing in January 2005. The tank rupture, the prime contractor reported, was just under the “ultimate pressure” threshold. On that basis (among other considerations) the project proceeded toward launch.
In September 2005, however, NASA learned that the contractor had used an incorrect material in modifications made to the tank. The Agency decided to re-inspect the tank before approving the launch, and the inspection revealed no apparent structural anomalies.
As the Launch Readiness Review approached for a launch date in January 2006, the chief of safety and mission assurance (SMA) and the NASA chief engineer conferred with their respective communities at the project level and sized up the situation. The SMA organization had earlier asked for an assist from the NASA Engineering and Safety Center (NESC)1, and together they analyzed the residual risk posture posed by the non-compliant tank. Program engineers worked hard with the contractor to understand the nature of the deficiency and to develop risk mitigation strategies, for example a modified (delayed) pressurization profile that would effectively delay the highest loads until the vehicle was beyond the No-Longer-Endanger line, thus minimizing the residual risk to the public.
As the time drew near, the launch authority, associate administrator, Space Operations Mission Directorate (SOMD), decided to bring the issue to his Headquarters Flight Planning Board rather than delegate the decision to his launch services program manager as is usually done. And, knowing that at least two members of his board were in a no-go status, he invited the Administrator to the review in case the Flight Planning Board could not reach consensus.
At the end of the discussion, the SMA chief voted no-go, citing unacceptable risk to mission success. He recommended that the program modify the tank to provide standard structural safety margin and that the mission be delayed until the following year when the next Pluto window opened. This option would necessarily extend the transit time, thus introducing its own risks to mission success, but that risk had not been analyzed to the same level as the tank rupture risk and would not be easy to compare in an apples to apples manner. The chief engineer also voted no-go.
How can a complete risk profile for the mission be assessed, given the RTG risk and the tank test anomaly?
The PI and the program manager are recommending proceeding with launch. How can they ensure that all opinions and points of view are adequately heard so that an informed final decision can be made?
Is the process of knowledge-based, risk-informed decision-making working properly—and how do you know? What can be done to improve the integrity and openness of communication and subsequent decision-making in your organization?
This case was developed by the Goddard Knowledge Management Office with support from the NASA Academy of Program/Project & Engineering Leadership (APPEL. http://www.appel.nasa.gov) for the purpose of discussion and training. The material here is extracted from publicly available sources. It is not a comprehensive account of the mission and should not be quoted as primary source. Feedback on this document may be sent to Dr. Ed Rogers, Chief Knowledge Officer, Edward.W.Rogers@nasa.gov or (301) 286-4467.