Near-Earth phase risk comparison of human Mars campaign architectures

A risk analysis of the launch, orbital assembly, and Earth-departure phases of human Mars exploration campaign architectures was completed as an extension of a probabilistic risk assessment (PRA) originally carried out under the NASA Constellation Program Ares V Project [1]. The objective of the updated analysis was to study the sensitivity of loss-of-campaign risk to such architectural factors as composition of the propellant delivery portion of the launch vehicle fleet (Ares V heavy-lift launch vehicle vs. smaller/cheaper commercial launchers) and the degree of launcher or Mars-bound spacecraft element sparing. Both a static PRA analysis and a dynamic, event-based Monte Carlo simulation were developed and used to evaluate the probability of loss of campaign under different sparing options. Results showed that with no sparing, loss-of-campaign risk is strongly driven by launcher count and on-orbit loiter duration, favoring an all-Ares V launch approach. Further, the reliability of the all-Ares V architecture showed significant improvement with the addition of a single spare launcher/payload. Among architectures utilizing a mix of Ares V and commercial launchers, those that minimized the on-orbit loiter duration of Mars-bound elements were found to exceed the reliability of no spare all-Ares V campaign if unlimited commercial vehicle sparing was assumed.


INTRODUCTION
The NASA Mars Design Reference Architecture (DRA) Version 5.0 [2] for a human Mars campaign was introduced during NASA's now-cancelled Constellation Program. It envisioned using a series of Ares V launches to insert three Mars transfer vehicles (MTVs), their payloads, crew, and propellant into low-Earth orbit (LEO) for multi-year staging periods prior to sending the crew to Mars ( Figure 1) and back. Targeting 160 metric-ton payloads to LEO, the proposed Ares V heavylift launch vehicle was considered critical to NASA's deepspace exploration efforts. Ares V consisted of two space shuttle heritage solid rocket motors strapped to liquid-hydrogenfueled core and upper stages. The upper stage was dubbed the Earth Departure Stage (EDS) for its intended role in sending payloads from LEO to other destinations in the solar system. In 2010, the Ares V Project conducted an in-depth study of the implications of the Mars DRA 5 recommendations on Ares V utilization [1], examining only the launch, LEO, and Earthdeparting trans-Mars-injection (TMI) segments of the campaign. A broad range of DRA 5-derived architectures was considered, with MTVs driven variously by nuclear thermal propulsion (NTP), dedicated cryogenic rocket clusters, or Ares V EDS stages. These propulsion selections impacted the number of Ares Vs required to lift the MTV elements and propellant. Because studies indicate that extensive use of commercial launchers in a Mars campaign would help sustain a robust commercial vehicle market [2], the Ares V Mars study also considered a "Commercial Tanker" architecture in which large fleets of smaller capacity commercial launchers would carry propellant to assembled MTVs in LEO. Because achieving acceptable estimates of mission reliability will be a key challenge for initial human missions to Mars, the study [1] included a static probabilistic risk assessment (PRA) of the near-Earth phases of three of the campaign architectures. These included two EDS-powered MTV casesone Ares V-only ("Scavenger") and one Commercial Tanker. By far, the risk of loss of campaign was found to be the greatest for the Commercial Tanker architecture, because it utilized the most launches and forced the MTV elements to loiter in Crew LEO for years awaiting propellant deliveries. However, due to the limitations of the static PRA approach, the analysis assumed conservatively that no spare launch vehicles or MTV elements were available; any single launch or on-orbit failure was assumed to cause the total loss of a campaign. Also, alternative propellant delivery strategies that would reduce the LEO loiter exposure of MTV elements, such as the use of propellant depots [3], were not considered. Despite the discontinuation of the Constellation Program and Ares V, a further examination of the reliability of Ares Vbased Mars campaign architectures is warranted. Based on the Space Launch System, NASA's successor to the Ares V, human exploration campaigns to various destinations in the Solar System are currently being studied [4]. This paper revisits loss-of-campaign risk during the near-Earth phase for two of the EDS/MTV-based Ares V Mars campaign architectures from [1] and two additional variants. The objective of the present study is to understand how the dependence of loss-ofcampaign risk on launcher fleet composition and propellant delivery strategy varies with launcher and spacecraft element sparing level. The static PRA approach of [1] was reused to establish bounding cases of no spares across all architectures and, in Commercial Tanker architectures, unlimited commercial launch vehicle spares. A dynamic PRA based on a timemarching, event-driven Monte Carlo simulation was then developed to examine single-launcher sparing options for one of the Commercial Tanker architectures. The loiter risk failure rate used in both of these analyses was updated to better reflect anticipated subsystem redundancy and MMOD strike tolerance among the various spacecraft elements.
In the following sections, the campaign architectures are detailed and the basic campaign risk assumptions are outlined. The static and dynamic PRA methodologies are then introduced. Finally, no-spare, single-spare, and unlimited-spare results are compared and discussed for the four architectures. Ares [1]. †Prop. Depot loiter.

MARS CAMPAIGN ARCHITECTURES
The four EDS/MTV-based architectures considered in the present study are listed in Table 1. They share the utilization of three MTVs and one crew launch vehicle (CLV), but differ in terms of terms of the launch vehicle fleet composition, launch/delivery schedule, and the set of on-orbit operations. The Scavenger architecture (Figure 1), carried over from [1], relies exclusively on the Ares V to launch uncrewed hardware and propellant to LEO. The three Commercial Tanker architectures, of which the "Post-MTV" variant also originates from [1], use Ares V to deliver MTV spacecraft elements and then rely on fleets of 20-metric-ton-payload-class commercial launch vehicles to deliver MTV propellant. MTV1 and MTV2 each use a single EDS to depart LEO through an initial TMI window on a nine-month, minimum-energy trajectory to Mars. The crewed MTV3 departs using two EDS units through a second TMI window approximately 26 months later, on a 6month trajectory.
Details of all the architectures are provided in the following sections, with a summary of launch count, campaign duration, and LEO loiter characteristics given in Table 1 and campaign schedules given in Figure 2.

Scavenger
The Scavenger architecture ( Figure 1) utilizes nine Ares V launches and one CLV crew launch. MTV1 and MTV2 each receive their hardware and EDS propulsion element from the first two Ares Vs, followed by two-thirds of their propellant from the third and fourth Ares Vs. The fifth Ares V then supplies the remaining propellant to both MTVs in succession. MTV3 receives its payload and EDS propulsion elements from the sixth and seventh Ares Vs, with propellant following in the eighth and ninth launches. The CLV launch supplies the Earth reentry vehicle and crew.

Commercial Tanker Variants
The Commercial Tanker concept replaces the five propellant-delivery Ares Vs with a fleet of much smaller but cheaper commercial heavy-lift launchers. Four Ares Vs are retained to lift the non-propellant and EDS propulsion elements. If the commercial tanker is the Delta IV Heavy, 36 are needed: 11 each for MTV1 and MTV2, and 14 for MTV3. The use of commercial tankers will offset Ares V propellant launch and delivery risk, but the overall campaign risk will also depend on the details of tanker use and the tolerance for tanker loss.
Three variants on the Commercial Tanker concept are considered. These differ in terms of the strategy by which the propellant is stored in orbit and transferred to the MTVs and, as a consequence, where LEO loiter exposure risk is carried ( Table 1)  is delivered to orbit by an Ares V before the commercial tankers are launched ( Figure 2). In this scenario, MTV elements can each loiter for up to 375 days in orbit without tankers accumulating any loiter time. The "Pre-MTV" variant assumes the commercial tankers are launched first and then wait in orbit for the MTV propellant deliveries to arrive-exchanging MTV loiter time for tanker loiter time. (The details of tanker conjunction or formation flying in LEO are not considered here.) The "Propellant Depot" variant assumes an additional Ares V that initially delivers a permanent propellant storage vehicle to LEO, which can store propellant over an indefinite period. The advantage of the propellant depot is its reusability across campaigns and its increased robustness against LEO loiter hazards of propellant loss, component failure, and micro-meteorite and orbital debris (MMOD) strike, compared with mass-constrained, Mars-bound elements [3].

RISK ASSESSMENT ASSUMPTIONS AND APPROACH
Both the static and dynamic PRAs utilized in this study are based on a common set of assumptions and the same demand-based and duration-based failure probability building blocks. The static PRA approach relies solely on a logic-based framework to consolidate the campaign risk. The dynamic approach extends the static PRA risk units with simulation to capture interactive effects among events, permitting sparing to be modeled. In this section, the ground rules assumed in the Ares V Mars campaign risk assessment are delineated, the methods by which risk blocks are obtained are described, and details of the static and dynamic PRA models are provided.

Ground Rules and Assumptions
The assessment of loss-of-campaign risk is built around the loss of functionality of individual spacecraft elements-the launch vehicles, MTV payloads, and propellant delivery or storage vessels. Every launch vehicle is tracked, in terms of its launch and subsequent payload-element operations, to include launch risks, delivery risks (on-orbit maneuvers, deployments, dockings/assemblies, etc.), loiter risks, and the TMI burn. The following assumptions were adopted: 1) Ares V and commercial tanker loss-of-vehicle risks per launch are fixed over the campaign. 2) On-orbit loiter carries duration-based risk per in-space element, based on days of LEO exposure.
3) The launch spacings are 30 days for Ares Vs, 15 days for commercial tankers, and 1 day for the CLV. 4) There is a 14-day checkout period after MTV assembly and before TMI. 5) All launches supplying a given MTV are scheduled ahead of its TMI window ( Figure 2). 6) Propellant capacities are 18.5 metric tons for the commercial tanker (Delta IV Heavy), 201 tons each for MTV1 and MTV2, and 250 tons for MTV3.

Demand-based Risks
Failures probabilities during launch, delivery, and TMI propulsion system burn segments were modeled as demand risks and remained unchanged from [1]. Crew launch vehicle (CLV) risks were based on Constellation risk assessments for Ares I, which utilized physics-based, simulation-assisted risk assessment techniques [3]. Ares V ascent failure probability was adapted from Ares I risk assessments. Commercial launcher failure risk was based on heritage data [6]. Delivery risks stemmed from complex, temporally sensitive mission operations such as rendezvous and docking, on-orbit fuel transfer, and solar array deployments, and are also heritagebased. For MTV engine TMI burn utilizing the EDS J-2X engine, failure risk was based on the restart burn failure rates assumed in an Ares V lunar sortie [1].

Element LEO Loiter Risk Assessment
Duration-based LEO loiter risk was comprehensively updated in the present study to better model the differences in exposure tolerance among in-space elements, according to their function and utilization. A preliminary top-down risk assessment based upon a previous study [7] and the historical record [8] of known risks to orbital vehicles in LEO identified two broad classes of risk contributors: subsystem reliability and MMOD. In order to ensure accurate relative risk results between the existing and proposed architectures considered in this study, an independent bottom-up probabilistic risk assessment (PRA) was performed to obtain quantitative risk estimates for LEO loiter risk originating from subsystem unreliability. The risk of MMOD was based upon particle flux models, element size, and vulnerability.
For each of the architectures, the mission elements were decomposed into the subsystems required to fulfill the functional mission requirements. Surrogate estimates for each class of subsystem were produced and used as "building blocks" to be applied to all elements requiring that subsystem. These subsystem "building-blocks" were produced by examining an existing detailed PRA of a similar vehicle [9] and proposed future vehicle designs [11] to create a generic subsystem master equipment list (MEL). The risk of failure stemming from the unreliability of subsystem components was estimated by assuming an exponential failure model for each MEL component, utilizing surrogate failure rates from the Space Shuttle (SS) PRA 3.0 [7], the International Space Station (ISS) Modeling and Analysis Data Set, and the Valador Failure Data Handbook [8]. The subsystem reliability model [10] took into account component redundancy and assumed a different "baseline" level of redundancy for each element.
The risk of MMOD was calculated for each element based upon the flux of particles at the particular altitude and inclination in LEO, the total surface area of the element, the assumed MMOD damage tolerance of the element, and the time each element spent in LEO. The flux of OD was determined by using ORDEM2000 [12] for a 400-km circular orbit at 28.5 degrees of inclination [1], and the flux of MM was determined by the predictions of the NASA MMOD handbook [13] for the same orbit. Estimates for the total surface area of each element were produced from literature or by assuming the worst-case size of the Ares V shroud [1]. Assumptions were made about the damage tolerance of each element that corresponded to previously designed space vehicles such as Apollo, Soyuz, Shuttle, and ISS [14].

Static Probabilistic Risk Assessment
The static PRA is a logic-based fault-tree analysis in which the risk elements described in the previous section were consolidated at the subsystem and spacecraft-element levels, accounting for operational demand counts and element exposure durations in LEO. Subsystem redundancy levels were adjusted to balance risk tolerance and mass limitations, leading to low subsystem redundancy in commercial tanker vehicles, high redundancy in the propellant depot, and intermediate levels for most other elements.

Dynamic Probabilistic Risk Assessment
To allow the dynamic effects of vehicle sparing on campaign risk to be examined, a continuous-time Monte Carlo risk simulation model consisting of transportation and orbital elements was developed for this study. This model was based on a model originally generated for the NASA Lunar Surface Systems study [15], which also incorporated an Ares V delivery system. While the demand-based failure probabilities and exposure-based failure rates are identical to those used in the static PRA model, the interaction among events and the time delays modeled in the simulation result in a more complex set of outcomes. The simulation model accounts for payload reflights if there is a failure during launch or delivery and tracks the risk consequences that propagate to other elements. The simulation algorithm is depicted in Figure 3.
Each Monte Carlo realization of a campaign starts with the launch event of the first mission. If the launch is successful, the payload of the mission is activated and exposure time starts accruing. If the launch fails, a refly of the mission with a specified delay can be simulated, based on the availability of redundancy for flight and payload elements. After the delivery of all the MTV elements, given no orbital failure, there is a TMI Earth-departure activity. A simulation run is considered successful if all of the necessary elements are delivered successfully to orbit and there is no on-orbit element failure. Missed TMI windows were not recorded as failures.
In these simulations, a spare was assumed to be flown only in response to launch or delivery failures. Loiter and TMI failures were not considered triggers for reflight, due to the modeling complexity introduced by the docking and undocking procedures that would be required to replace failed elements during these phases. Failure probability was taken as the ratio of failed realization count to total realization count.

Figure 4: Loss-of-campaign probability by mission phase, based on Static PRA (no sparing) 4 RISK ASSESSMENT RESULTS
The results presented in this section cover baseline, nospare risk assessment results for all four architectures; singlelaunch vehicle sparing results for the Scavenger architecture; and unlimited sparing risk estimates for the three Commercial Tanker architectures.
The no-spare loss-of-campaign risk results of all four architectures are shown in Figure 4. These results were obtained using the static PRA. Contributions to campaign risk are categorized by mission phase and launch vehicle type. For both Scavenger and Commercial Tanker architectures, launch and delivery risks were driving factors in determining overall risk. It follows, then, as was observed in [1], that overall Commercial Tanker risk far exceeds overall Scavenger risk due primarily to the large commercial launcher count. Among the Commercial Tanker architectures, loiter risk is the discriminating factor. The Pre-MTV variant carries the most campaign risk due to its reliance on prepositioning the tanker fleet in LEO. The tankers launched early must wait in orbit through the numerous remaining launches before delivering propellant to MTVs. However, in exchange, Pre-MTV also minimizes MTV element loiter. Conversely, the Post-MTV variant imposes the most loiter time of any of the architectures on the MTV elements and the least on the tankers. Due to its use of a dedicated storage platform in LEO, the Propellant Depot variant minimizes both MTV element and tanker loiter. A set of launch vehicle sparing cases within a single campaign architecture was studied, requiring the use of the dynamic PRA Monte Carlo simulation. The architecture selected was the all-Ares V Scavenger campaign, with the sparing level limited to one reflown Ares V or CLV. To address the possibility that some payloads would be one-of-akind, and not sparable, a partial sparing case was also added. The three simulation cases were: 1) No Spare: No launcher/payload redundancy.
2) Partial Spare: One spare Ares V to refly only one spare EDS for TMI and/or propellant payload. 3) All Spare: One spare Ares V or CLV, to refly any payload once.  Each simulation was run for 100,000 Monte Carlo realizations. The probabilities of loss-of-campaign for the three simulations are shown in Figure 5, and are compared to the static PRA No Spare case. The simulation-based result for the No Spare option agrees with the static PRA result, validating the simulation approach. Having one spare Ares V with an EDS/propellant payload reduces the probability of overall loss of campaign by a third, and reduces the chance of campaign loss during launch and delivery by half, since five of ten flights can be reflown. Allowing the spare Ares V or CLV to refly any payload (the "All Spare" option) reduces overall risk by two-thirds and nearly eliminates loss-of-campaign risk during launch and delivery. While spare campaign spacecraft elements come at a significant program cost, the advantage in terms of campaign reliability is clear. An increase in LEO loiter risk was observed with increasing sparing in the Scavenger architecture ( Figure 6). These Scavenger sparing simulations registered different failure probabilities during the LEO loiter phase as a result of the dynamic interaction among simulation elements. The variations that arise are due to two effects: 1) Reduction in launch and delivery failures increases the number of realizations in which the loiter phase is exercised, resulting in increased observed loiter risk. 2) Reflights (no more than one per realization) extend the overall loiter exposure of other in-space elements by the delay caused by the reflight. Without spares, any launch failure ends the campaign and all in-orbit elements are discarded. With spares, in-orbit elements continue to be tracked until either a second failure ends the campaign or the realization ends successfully. These effects are small due to the relatively short exposure to LEO loiter experienced in the Scavenger architecture. A comprehensive sparing study was not carried out on the Commercial Tanker architectures in the present work. In a robust market of commercial launch vehicles, an essentially unlimited supply of tanker spares may be possible to help assure the success of a human Mars campaign. To estimate where deep tanker sparing might lead, the no-spare Commercial Tanker risk results ( Figure 4) were adjusted by zeroing the direct tanker launch, delivery, and loiter contributions to campaign risk. These results are shown in Figure 7. In this limit, the Pre-MTV and Propellant Depot variants are shown to exceed even the reliability of the No Spare and Partial Spare (single spare) results for the Scavenger architecture. The Pre-MTV variant, which shows the most risk among all the architectures in the no-spare scenario, shows the least risk in the unlimited spare limit due to its lack of MTV element loiter. In reality, launcher reflights will not be unlimited, and they will cause delays in the schedule that might increase both loiter risk for waiting elements and the risk of a missed TMI window.

CONCLUSIONS AND FUTURE WORK
This study presents a risk assessment of the near-Earth launch and orbital operations activity of a conceptual human campaign to Mars involving heavy-lift and commercial launch vehicles. The goals of the study were: 1) to determine the risk trade-offs of utilizing commercial launch vehicles as propellant tankers instead of the much larger Ares V, 2) to understand the risk benefits of launch vehicle and spacecraft element sparing, and 3) to determine the risk sensitivity to commercial tanker propellant delivery strategy. One Ares Vonly architecture and three combined Ares V/commercial launcher architectures were assessed using both logic-based When no sparing was assumed, the loss-of-campaign risk borne by Commercial Tanker architectures was found to far exceed the Ares V-only Scavenger architecture due to the large number of commercial launches and the resulting loiter time imposed on elements waiting in orbit. The Monte Carlo simulation findings, which allow for partial or complete launcher and payload single-fault redundancy, clearly indicate that even a modest reflight capability of the Ares V will greatly increase the likelihood of success of a Mars campaign. In the special case of unlimited commercial tanker sparing, the potential hypothetical reliability of architectures that launch propellant prior to Mars-bound elements was found to exceed that of the no-spare Scavenger case, with the Pre-MTV tanker variant edging out the Propellant Depot approach.
In future work, the Monte Carlo simulations will be extended to the remaining architectures to more clearly demonstrate the dynamic interaction between launcher redundancies and loiter exposure risk. The relative risk-reduction potential among the three Commercial Tanker variants can also be further examined. In addition, future studies will test the hypothesis that given enough spare launchers, the near-Earth phase campaign reliability of the Commercial Tanker architectures can surpass the Scavenger architecture reliability. Finally, other dynamic effects such as missing launch windows and reliability maturity growth will be studied.