Risk Assessment Visualization Study for Lunar Outpost Landing Zone Surface Preparation

Abstract

Landing zone surface preparation is one of the first teleoperated remote lunar construction activities to occur in NASA's plans for the buildup of a lunar outpost. This paper describes a risk assessment visualization study performed for a lunar outpost landing/launch pad excavation and construction scenario. A Visualization Analysis Sequencing Technique (VASTTM), developed by XArc Corp, was applied to the risk assessment. VASTTM provides visual "snapshots" of the sequence of an operational process simulated over time to drive out and understand complex variables in systems planning. Presented is an illustrated sequence of the outpost buildup with pictorials of mission snapshots to play out the operational scenario and visualize the sequence of risks along the way to how the prepared landing zone gets to its ready state in time for arrival of the next crewed Altair lunar lander. The study identified and ranked operational risks according to risk matrix priority scoring using Constellation Program criteria for risk consequence scoring. Recommended mitigation strategies are discussed.

Full text

Risk Assessment Visualization Study
for Lunar Outpost Landing Zone Surface Preparation
Samuel W. Ximenes
Exploration Architecture Corporation (XArc), San Antonio, TX, United States
sximenes@explorationarchitecture.com
ABSTRACT
Landing zone surface preparation is one of the first teleoperated remote lunar
construction activities to occur in NASA’s plans for the buildup of a lunar outpost.
This paper describes a risk assessment visualization study performed for a lunar out-
post landing/launch pad excavation and construction scenario. A Visualization
Analysis Sequencing Technique (VAST™), developed by XArc Corp, was applied to
the risk assessment. VAST™ provides visual “snapshots” of the sequence of an op-
erational process simulated over time to drive out and understand complex variables
in systems planning. Presented is an illustrated sequence of the outpost buildup with
pictorials of mission snapshots to play out the operational scenario and visualize the
sequence of risks along the way to how the prepared landing zone gets to its ready
state in time for arrival of the next crewed Altair lunar lander. The study identified
and ranked operational risks according to risk matrix priority scoring using Constella-
tion Program criteria for risk consequence scoring. Recommended mitigation strate-
gies are discussed.
INTRODUCTION
The Constellation Program (CxP) is the human spaceflight program within
NASA’s Exploration Systems Mission Directorate (ESMD) charged with developing
the architectural elements and technologies needed to carryout NASA human explo-
ration goals for returning to the moon and ultimately a Mars destination. Within the
CxP is the Lunar Surface Systems (LSS) Project Office, supporting ongoing agency
work for defining a viable lunar architecture, the framework for defining how to re-
turn humans to the moon. LSS is defining and organizing a broad set of reference
missions to allow comparison, analysis and framing of the trade space. LSS is in the
stage of formulating and analyzing various architectures nominally known as lunar
surface scenarios “families” (Vangen, 2009).
As part of this planning process a team from US industry has been collaborat-
ing with the NASA ESMD Directorate Integration Office (DIO) and the CxP LSS
team to identify, prioritize, and offer mitigation strategies for LSS operational risks
associated with lunar surface scenarios for establishing a lunar outpost (Cummings,
2009). The US industry team, comprised of aerospace industry companies with a
shared interest in space exploration are members of the Space Enterprise Council
(SEC) Space Transportation Working Group (STWG).

The STWG LSS Operational Risk Study Team was asked to assess one of the
LSS architecture scenario families identified by NASA as Scenario 4.2.1.20. The
build up manifest for the scenario is shown is Figure 1, (Refer to Appendix for no-
menclature of acronyms in figure 1).
Figure 1: LSS Scenario 4.2.1.20 - Surface elements build up manifest
The scenario version the study team was given is merely a reasonable repre-
sentative potential manifest and should not be viewed as the most likely outpost build
up or preferred approach. There has been no selection of a baseline architecture, and
no distinctions have been made as to which assets are provided between NASA, con-
tractors, commercial entities, or international partners.
The study team went through a rigorous process for selecting operational risks
associated with deploying Scenario 4.2.1.20, and identified a set of the top risks in

priority order shown in Table 1 (Cummings, 2009). Team members volunteered to be
risk leads and were assigned ownership for the risk topics based on their particular
interests. Each risk lead applied their respective risk assessment methodology and
recommended mitigations in conducting the overall study.
Table 1: List of Selected Risks Addressed by the STWG LSS Risk Study Team
Risk
No. Risk List Company
1 LSS Commonality Between Elements and Partners The Boeing Company
2 Crewmember Operator Error Northrop Grumman Corporation
3 Premature Seal Deterioration Northrop Grumman Corporation
4 Damage During Unloading Operation USA
5 Emergency Donning of Pressure Suit ILC Dover
6 Micrometeorite Damage (was later withdrawn) N/A
7 Incapacitated EVA Crewmember ATK
8 Inventory Control System Error Hamilton Sundstrand
9 Operational Impacts of Solar and Nuclear Power ATK
10 Coupling Failure in Charging Interface Honeywell Defense & Space
11 Inadequate Surface Preparation Exploration Architecture Corporation
12 LER Failure During Distant Excursion Oceaneering Space Systems
13 ECLSS System Failure Hamilton Sundstrand
Note: Study Team leadership provided by Lockheed Martin, Boeing, ATK, Draper Labs
This paper describes the approach used by XArc Corp to assess Risk No. 11,
“Inadequate Surface Preparation” for the STWG LSS Operational Risk Study.
RISK CONTEXT
Scenario 4.2.1.20 includes excavation and construction of landing/ launch
pads early in the outpost build up phase. Landing zone surface preparation is one of
the first teleoperated remote lunar construction activities to occur. Construction of a
protective berm of lunar regolith around the landing zone is generally considered a
prospective approach for protection of surface assets from debris and ejecta caused by
the lunar lander’s engine plume during landing and launch operations. To address the
issues associated with surface preparation of the landing zone the following risk state-
ment was considered:
RISK STATEMENT - If the excavator system, Crew Mobility Chassis (CMC) with
excavator blade or other, fails to build the desired regolith protective berm, the em-
placed surface assets could be damaged by debris and ejecta from the arrival of the
next lander or departure of the ascent module.
In Scenario 4.2.1.20 the premise for Risk No. 11 occurs prior to Initial Sur-
face Capability (ISC) identified by the blue bar for Fiscal Year 2021, shown in Figure
1 above. ISC is when sufficient lunar surface assets are in place for the crew to live
outside the Altair lunar lander for a longer duration; in this case the Lunar Electric
Rovers (LERs) serve as initial living quarters for the 14 day stay. So the first need
date for a regolith protective berm for the landing pad is prior to the arrival of the ISC

14 day mission. All the emplaced major surface element assets delivered by four Al-
tair flight missions by the time of ISC are shown in Figure 2.
Figure 2: Scenario 4.2.1.20 Emplaced Surface Element Assets at ISC
RISK IDENTIFICATION METHODOLOGY
To play out the operational scenario and help visualize the sequence of risks
along the way toward how the prepared landing zone gets to its ready state in time for
the ISC mission a Visualization Analysis Sequencing Technique (VAST™), devel-
oped by XArc Corp, was applied to the risk assessment. VAST™ provides visual
“snapshots” of the sequence of an operational process simulated over time to drive
out and understand complex variables in systems planning. In this case an illustrated
sequencing of the Outpost buildup was created with pictorial snapshots of the four
lunar missions leading up to ISC. The pictorial analysis for each mission served to
identify and rank the operational risks. NASA guidelines for risk management were
Sortie Lander
Cargo Lander
Sortie Extended
Stay Lander
Test Flight Lander
Sortie M ission
Chassis Rover
Small Pressurized
Rover 1 Small Pressurized
Rover 2
Chassis A + Robot
Assistant
Lunar Surface
Manipulator System
Portable Utility
Pallet 1 Portable Utility
Pallet 2
Landing/Launch Pad
Crew Mobility Chassis
w/ excavation blade
Abandoned
Airlock 1
Abandoned
Airlock 2
Scenario 4.2.1.20
ISC Phase

used to assess risk likelihood and risk consequence scoring, and then prioritized by
determining its Priority Score as assigned via the Risk Matrix cell into which the risk
falls (NASA, 2009). Figure 3 shows the distribution of risk scores for mission opera-
tions to ISC landing zone surface preparation.
Figure 3: Distribution of Risk Scores for ISC Landing Zone Surface Preparation
ASSUMPTIONS
The complete landing zone protective berm construction sequence is shown in
Table 2, Panels A-K, beginning with Panel-A showing the outpost site in its initial
pristine condition, as a “blank canvas”, with arrival of the first lander. Mission pro-
files, risk descriptions, and recommended mitigation approaches are also described in
each panel as the outpost landing zone site builds up with robotic and human activity.
The following assumptions were used in development of the analysis:
Mission 1 is an Uncrewed Test Flight of the Altair Descent Module / Ascent Module
to lunar surface.
 Test Flight landing zone is in vicinity of future Outpost operations. Rationale
– Lander residual consumables may be needed for excavator system and/or
other future Outpost operations.
21 Mission Ops Risks to ISC Landing Zone Surface Preparation Identified
• 2 Scored Priority Red
• 14 Scored Priority Yellow
• 5 Scored Priority Green
5716202325
4613182224
3411151921
228101417
1135912
12345
CONSEQUENCE
LIKELIHOOD
R11 Risks Priority Distribution
0
1
2
3
4
5
6
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25
Risk Priority Score
# of Identified Risks

Mission 2 is a Lunar Sortie Crew Design Reference Mission (DRM) for the 1st Hu-
man Lunar Return (HLR) 7 day mission.
 Crew performs reconnaissance and emplacement of navigation aids for cargo
Mission 3 landing zone, and site survey for location of regolith protective
berm for Mission 4 landing pad (three landing pads are planned).
Mission 3 Arrival is an Uncrewed Cargo Altair DRM, and includes in its cargo ele-
ments delivery of a Crew Mobility Chassis (CMC) configured for tele-robotic exca-
vation and construction of the landing pad and regolith protective berm.
 Assume lander fuel cells can provide power on the surface to support offload-
ing the CMC prior to deploying the Portable Utility Pallet (PUP) solar array.
 Assume remaining cargo elements, i.e., Small Pressurized Rovers (SPR) and
associated PUP elements are crew-supervised EVA offloaded when crew ar-
rives in Mission 4.
Mission 3 Operations is an Outpost Remote Operations DRM and constitutes the ex-
cavation and construction phase of the first landing pad with regolith protective berm
in preparation for arrival of crew in Mission 4.
 Assume 6 month time period between flights to construct landing pad berm.
 Within the context of the berm construction there is an operational correlation
between location of the Mission 3 landing zone and location of the landing
pad for Mission 4. Rationale:
– CMC excavator system needs to minimize its traverse distance between
Cargo Altair power recharge station and landing pad construction site.
– Landing pad construction site needs to have sufficient separation from
Cargo Altair landing zone to:
1. minimize contamination of PUP solar power array from dust ejecta of
6 month berm construction activity.
2. avoid subsequent crewed landing plume ejecta debris damage to Cargo
Altair cargo elements in event of protective berm failure, or CMC ex-
cavator system is not successfully deployed, or fails to construct berm.
Mission 4 is a Visiting Lunar Outpost Expedition DRM for ISC. The Visiting Lunar
Outpost Expedition DRM is representative of a mission with a crew size of four,
where the crew is dependent on resources from Altair and resources from Lunar Sur-
face Systems to survive for the duration of the mission.
 Altair is in a Lunar Sortie configuration; however, resources from Lunar Sur-
face Systems are used to extend the length of the surface stay to 14 days.
 Site survey and construction of 2nd landing/launch pad commences during ISC
mission operations.
Note: The form factor of landing pad berm geometry illustrated in the pictori-
als of the outpost buildup sequence scenario is for reference only and is not intended
to convey a berm design solution.

Table 2, Panels A – K: Scenario 4.2.1.20 Outpost Buildup Sequence to ISC
Mission 1 - Test Flight
Mission Ops Risks to ISC Landing Zone Surface Preparation
 RISK 11-00 - None identified for lunar test flight mission
Un-crewed Test Flight of
Altair Lander
• Concept of Operations
(ConOps) shown is As-
cent Module departure.
• Test Flight landing zone
is in vicinity of future
Outpost operations. As-
sumption is lander resid-
ual consumables may be
needed for excavator sys-
tem and/or other future
Outpost operations.
Risk Matrix Priority Score
Mission 2 - Lunar Sortie Crew DRM
Mission Ops Risks to ISC Landing Zone Surface Preparation
 RISK 11-01 - Given lunar environment characterization is required to conduct
design studies for landing on and moving over the lunar surface, and given
that certain scientific data may not be available, there is a possibility of failure
to completely characterize the lunar surface at selected landing sites for such
environmental characteristics as surface geological environment, regolith
properties, dust, regolith electrical and photoelectric properties, optical proper-
ties, thermal environment, radiation environment, surface plasma environment,
and ejecta environment, which may impact safe operations and design solu-
tions for the protective berm construction and excavator system design.
 MITIGATION - Ensure lunar robotic precursor science missions (including
international missions) have appropriate instrument suite of sensors for charac-
terizing Lunar Outpost's specific locations for habitation, landing and launch
sites; requires ESMD and Science Mission Directorate (SMD) coordination on
International Lunar Network (ILN) for surface stations science network.
First Human Lunar Re-
turn (HLR)
• ConOps shown is Al-
tair Sortie configura-
tion in proximity to
Test Flight landing
zone; crew conducting
exploration with Sortie
Mission Chassis (SMC)
rover.
• Crew performs recon
and emplacement of
navigation aids for
cargo Mission 3 land-
ing zone.
• Crew conducts site sur-
vey verification for lo-
cation of Mission 4
landing pad and re-
golith protective berm.
Risk Matrix Priority Score
5716202325
4613182224
3411151921
22 8 10 14 17
1135912
12345
CONSEQUENCE
LIKELIHOOD
R11-01
5716202325
4613182224
3411151921
22 8 10 14 17
1135912
1234 5
CONSEQUENCE
LIKELIHOOD
n/a
A
B

Mission 2 - Lunar Sortie Crew DRM, cont.
Mission Ops Risks to ISC Landing Zone Surface Preparation
 RISK 11-02 - Given HLR SMC rover excursions will explore and perform on-
site verification of remote survey data, as well as demarcate selected landing
zones and excavation sites, there is a possibility that discovery of "real-time"
mission data does not coincide with remotely obtained planning data or does
not match pre-mission simulations, causing significant changes to future site
plans, e.g., pre-determined excavation sites not viable, or vehicle-terrain inter-
actions grossly mis-match simulations, causing incongruities in excavator sys-
tem design, etc.
 MITIGATION - Validate data through extensive simulations; Crew expertise
to include civil engineering and planetary geology disciplines (site surveying
as core activity for 7 day scouting mission); deploy integrated lunar sensor
network to enhance the spatial-orientation capabilities of astronauts on the lu-
nar surface.
7 Day HLR Mission End
• ConOps shown is crew
departure in Ascent
Module.
• Airlock and SMC rover
abandoned.
• SMC parked behind
Test Flight Descent
Module to minimize
damage from plume
ejecta debris.
Risk Matrix Priority Score
Mission 3 – Un-crewed Cargo Altair DRM
Mission Ops Risks to ISC Landing Zone Surface Preparation
 RISK 11-03 - Given the Mission 3 Initial Mobility Delivery is tele-robotically
operated, there is a possibility that a communications link failure will jeopard-
ize the mission, preventing construction of the landing pad and protective
berm.
 MITIGATION - Dependent on Space Communications and Navigation Archi-
tecture (SCaN) for routing, redundancy, and link protocols.
Initial Mobility Delivery
• ConOps shown is CMC
with attached excavation
blade and CDK offloaded
using LSMS.
• Deployed PUP solar ar-
ray, (PUP solar array de-
ployed after CMC is off-
loaded).
• CMC stationed at lander
base, testing power re-
charge station.
• SPR and associated PUP
cargo elements are as-
sumed crew-supervised
EVA offloaded when
crew arrives in Mission 4.
Risk Matrix Priority Score
5716202325
4613182224
3411151921
22 8 10 14 17
1135912
12345
LIKELIHOOD
R11-03 CONSEQUENCE
5716202325
4613182224
3411151921
22 8 10 14 17
1135912
12345
LIKELIHOOD
R11-02 CO NSEQUENCE
D
C

 RISK 11-04 - Given the lander fuel cells are assumed to provide power on the
surface to support the offloading of the CMC prior to deploying the PUP solar
array, there is a possibility the assumption is erroneous in that the lander fuel
cell design has not been sized to accomplish this operation.
 MITIGATION - Coordination with Altair Project Office; ensure Altair design
requirements aligned with LSS operational scenarios; to extent practical, align
schedule of Altair and LSS design reviews.
 RISK 11-05 - Given the Uncrewed Cargo Altair will utilize a deployed solar
array from one of the PUP cargo elements for providing power resources for
Outpost Remote Operations, there is a possibility the final landing orientation
of the Cargo Altair will preclude the solar panel articulating arm to maximize
the exposure of the solar panel to the sun.
 MITIGATION - Dependent on Altair navigation and beacon aids for landing;
employ astronaut/pilot spatial disorientation countermeasures during landing;
design mechanical articulation of solar array for all orientation contingencies,
and model extensively in Lunar Surface Operations Simulator (LSOS) for de-
sign impacts to power generation.
 R11-06 Given the Uncrewed Cargo Altair is tele-robotically operated, there
is a possibility offloading collision or damage to the CMC excavator system
can occur.
 MITIGATION - Refer to risk mitigation approaches identified in LSS Study
Team Risk #4 "Damage During Unloading Operations"
Mission 3 - Outpost Remote Operations DRM
Mission Ops Risks to ISC Landing Zone Surface Preparation
 RISK 11-07 - Given there is an operational correlation between location of the
Mission 3 Cargo Altair landing zone and location of the landing pad for Mis-
sion 4 ISC, there is a possibility the distance between the two landing zones
will not have sufficient separation to avoid subsequent crewed landing plume
ejecta debris damage to Cargo Altair cargo elements in event of protective
berm failure, or CMC excavator system is not successfully deployed, or fails
to construct berm.
 MITIGATION - Extensive use of simulations and modeling to characterize
optimized landing zone separations; regolith simulation of plume ejecta mod-
els; berm or landing/launch zone design alternatives.
Mission 3 Ops Landing
Pad Excavation Phase
Begins
• ConOps shown is CMC
tele-robotically preparing
landing zone for next mis-
sion.
Risk Matrix Priority Score
5716202325
4613182224
3411151921
228101417
1135912
1234 5
LIKELIHOOD
R11-07 CONSEQUENCE
5716202325
4613182224
3411151921
228101417
1135912
12345
LIKELIHOOD
R11-06 CONSEQUENCE
5716202325
4613182224
3411151921
228101417
1135912
12345
LIKELIHOOD
R11-05 CONSEQUENCE
5716202325
4613182224
3411151921
228101417
1135912
12345
LIKELIHOOD
R11-04 CONSEQUENCE
E

 RISK 11-08 - Given there is an operational correlation between location of the
Mission 3 Cargo Altair landing zone and location of the landing pad for Mis-
sion 4 ISC, there is a possibility the distance between the two landing zones
will not have sufficient separation to minimize contamination of the Portable
Utility Pallet (PUP) solar power array from dust ejecta or dusty plasma electric
potential of approximately 6 month berm construction activity, (interaction of
lunar dust and solar wind plasma near the lunar surface at ~ 6 - 10 meters
high), thereby jeopardizing surface systems power recharge capability.
 MITIGATION - Deploy Lunar Dust Instrument (LDI) mission, i.e., Langmuir
Probe at approximately 10 meter height, as part of International Lunar Net-
work (ILN) of surface science stations or on Altair Test Flight mission to
characterize lunar dusty plasma environment on and near the lunar surface.
 RISK 11-09 - Given there is an operational correlation between location of the
Mission 3 Cargo Altair landing zone and location of the landing pad for Mis-
sion 4 ISC, there is a risk the distance between the two landing zones will not
minimize their separation to optimize the CMC excavator system traverse dis-
tance between Cargo Altair power recharge station and landing pad construc-
tion site.
 MITIGATION - Derive construction and excavation operations requirements
through development of regolith excavation simulation tools; consider rede-
ploying SMC left behind from Mission 2 as a carrier for a self-transporting
battery sysem which can shuttle itself to and from the charger while the exca-
vator continues to work.
Mission 3 - Outpost Remote Operations DRM, cont.
Mission Ops Risks to ISC Landing Zone Surface Preparation
 RISK 11-10 - Given the CMC excavator system's reliance on telerobotic con-
trol, (assumed to include High Definition line-of-sight video surveillance
monitored from the Cargo Altair landing zone location vantage point), there is
a possibility the remote teleoperator may loose orientation / situational aware-
ness if the HD camera becomes disabled.
 MITIGATION - Use an integrated lunar sensor network to enhance spatial-
orientation capabilities for teleoperators; integrate sensor information with
computational models to provide teleoperators with self-localization and path-
generation capabilities, e.g., relative positioning, generation of return paths in
reverse directions, path memorization, etc.
 RISK 11-11 - Given the CMC excavator system's reliance on telerobotic con-
Mission 3 Ops Berm
Excavation
• ConOps shown is CMC
tele-robotically construct-
ing protective regolith
berm around landing
zone.
Risk Matrix Priority Score
5716202325
4613182224
3411151921
22 8 10 14 17
1135912
1234 5
LIKELIHOOD
R11-09 CONSEQUENCE
5716202325
4613182224
3411151921
228101417
1135912
12345
LIKELIHOOD
R11-08 CONSEQUENCE
5716202325
4613182224
3411151921
228101417
1135912
12345
LIKELIHOOD
R11-10 CONSEQUENCE
F

trol, there is a possibility that human error from the telerobotic operators could
occur due to an improperly designed Human Computer Interface / Graphical
User Interface.
 MITIGATION - Design teleoperator control center with human-systems inte-
gration principals for workstation design; use/develop s/w tools for modeling
and analyzing workstation interfaces, crew station design and overall work-
flow environment; incorporate lessons learned from Soviet Lunokhod teleop-
erator control station experience.
 RISK 11-12 - Given the heavy excavation operations required of the CMC
excavator system and reliance on telerobotic control, there is a possibility that
lack of an optimized excavator system design integrated with a specific berm
design and construction methodology may diminish excavator system reliabil-
ity.
 MITIGATION - Derive construction and excavation operations requirements
with development of regolith excavation simulation tools for modeling various
teleoperated excavator system designs against various berm designs, using pa-
rameters of driving speed, payload ratios, excavation resistance forces, power
supply, etc.
 RISK 11-13 - Given the heavy excavation operations required of a single
CMC excavator system in Scenario 4.2.1.20, and that there are likely to be
high system consumable resource constraints, (e.g., power recharge time vs.
power storage capacity), there is a possibility that construction scheduling in-
efficiency will pose a threat to completion of the berm due to downtime
caused by duration and number of recharge events required in a single work
period for the CMC excavator system.
 MITIGATION - Derive construction and excavation operations requirements
through development of regolith excavation simulation tools; consider rede-
ploying SMC left behind from Mission 2 as a carrier for a self-transporting
battery sysem which can shuttle itself to and from the charger while the exca-
vator continues to work.
Mission 3 - Outpost Remote Operations DRM, cont.
Mission Ops Risks to ISC Landing Zone Surface Preparation
 RISK 11-14 - Given the preliminary estimated quantity of regolith required to
construct a protective berm is estimated as much as 1.2 million kg of regolith
(Astrobotic Technology, Inc, 2009), there is a possibility the top layer material
source field in proximity to the landing zone may be depleted before comple-
Mission 3 Ops Berm
Excavation (cont.)
• ConOps shown is CMC
tele-robotically nearing
completion of protective
regolith berm around
landing zone.
Risk Matrix Priority Score
5716202325
4613182224
3411151921
228101417
1135912
12345
LIKELIHOOD
R11-13 CONSEQUENCE
5716202325
4613182224
3411151921
22 8 10 14 17
1135912
12345
LIKELIHOOD
R11-12 CONSEQUENCE
5716202325
4613182224
3411151921
22 8 10 14 17
1135912
12345
LIKELIHOOD
R11-11 CONSEQUENCE
G

tion of the berm, requiring additional traversing distance for the excavator sys-
tem to haul regolith back to the berm site from another source field and/or
deeper digging into the regolith which will impact CMC excavator system
power storage/usage requirements and excavation timeline.
 MITIGATION - Characterize excavation site for determining distribution of
regolith source field and derive operational design requirements for CMC ex-
cavator through simulation of contingency traverse paths of CMC for "offsite"
material source fields.
Mission 3 - Outpost Remote Operations DRM, cont.
Mission Ops Risks to ISC Landing Zone Surface Preparation
 RISK 11-15 - Given the complexity of interacting forces between the lunar
environment, lunar surface features, and the Altair propulsion system causing
debris and ejecta during landing and launch, there is a possibility of not
achieving an optimized geometry (height, shape, mass, deflection angle) for
the protective berm's form factor, causing it to be over or under designed for
effective protection.
 MITIGATION - Evaluate other innovative design solutions for form factor
other than berm design against rigid set of criteria.
 RISK 11-16 - Given an over designed berm will place heavier and unneces-
sary requirements on the excavator system design for moving material and
constructing the berm, there is a possibility interfacing systems such as the
power generation, power storage, and recharge station design requirements
may be over specified.
 MITIGATION - Derive construction and excavation operations requirements
through development of regolith excavation simulation tools for modeling
various teleoperated excavator system designs with parameters of driving
speed, payload ratios, excavation resistance forces, power supply, etc.
 RISK 11-17 - Given the top layer of the regolith protective berm may be rela-
tively uncompacted, there is a possibility the outer skin of the berm will be a
source for discharging ejecta.
 MITIGATION - Evaluate alternative berm construction methods, compaction
techniques, geotextiles, etc.
 RISK 11-18 - Acoustical energy for berm design criteria is believed to be non-
existent in the lunar vacuum environment. QUESTION: Can the debris cloud
momentarily form a medium in which the berm design reflects or redirects
Mission 3 Ops, Landing
Pad Excavation Com-
plete
• ConOps shown is com-
pleted landing pad pre-
pared to receive next mis-
sion.
• CMC parked at lander
base power recharge sta-
tion.
Risk Matrix Priority Score
5716202325
4613182224
3411151921
22 8 10 14 17
1135912
12345
LIKELIHOOD
R11-17 CONSEQUENCE
5716202325
4613182224
3411151921
22 8 10 14 17
1135912
12345
LIKELIHOOD
R11-16 CONSEQUENCE
5716202325
4613182224
3411151921
228101417
1135912
12345
LIKELIHOOD
R11-15 CONSEQUENCE
5716202325
4613182224
3411151921
228101417
1135912
12345
LIKELIHOOD
R11-14 CONSEQUENCE
H

acoustical and pressure energy from ignition blast back to the Altair at the
launch pad at the beginning of the flight or while descending along the flight
path?
 MITIGATION - Perform phenomenological modeling of interacting forces.
Mission 4 - Visiting Lunar Outpost Expedition DRM
Mission Ops Risks to ISC Landing Zone Surface Preparation
 RISK 11-19 - Given the completed launch pad and berm are tele-robotically
constructed, and given the CMC is only configured for excavation duty, there
is a possibility emplacement of navigation aids for delineating the berm during
construction and for landing at the pad will not be possible prior to arrival of
the Mission 4 Altair flight.
 MITIGATION - Ensure CMC tool kit and Mission 3 Altair Cargo manifest
includes capability for CMC to reconfigure itself for robotic emplacement of
navigation aids and beacons for construction phase and upon completion of
built berm/landing site.
Initial Surface Capability
(ISC)
• ConOps shown is suc-
cessful landing of Altair
at landing pad.
• Altair is in Lunar Sortie
Crew configuration, and
relies on Lunar Surface
Systems resources to ex-
tend surface stay to 14
days.
• PUP 1 moved to landing
pad by SPR 1; LSMS off-
loads remaining SPR
2/PUP2.
• Chassis A with Robotic
Assistant (RA) is deliv-
ered.
• CMC initiating excava-
tion of 2nd landing pad.
Risk Matrix Priority Score
Mission 4 - Visiting Lunar Outpost Expedition DRM, cont.
Mission Ops Risks to ISC Landing Zone Surface Preparation
 RISK 11-20 - Given CMC excavator system may need to excavate as much as
1.2 million kg of regolith (Astrobotic Technology, Inc., 2009), there is a pos-
sibility spares and provisioning for CMC excavator system maintenance and
ISC Operations
• ConOps shown is Crew
mem
b
er performing CMC
excavator maintenance
check, assisted by RA.
• SMC Rover is revived
and powered after 1 year
dormancy period.
• SPRs performing explora-
tion and science activities.
Risk Matrix Priority Score
5716202325
4613182224
3411151921
228101417
1135912
12345
LIKELIHOOD
R11-19 CONSEQUENCE
5716202325
4613182224
3411151921
22 8 10 14 17
1135912
12345
LIKELIHOOD
R11-18 CONSEQUENCE
I
J

refurbishment may not be sufficiently accommodated in Mission 3 or Mission
4 Altair manifests.
 MITIGATION - Ensure spares provisioning and spares ConOps for CMC ex-
cavation activity is sufficiently accommodated; develop CMC spares ConOps
for Mission 3 telerobotic remote Outpost operations, e.g., CMC tool kit and
Mission 3 Altair Cargo manifest includes capability for CMC to reconfigure
itself for spares changeout task.
Mission 4 - Visiting Lunar Outpost Expedition DRM, cont.
Mission Ops Risks to ISC Landing Zone Surface Preparation
 RISK 11-21 - Given the initial landing/launch pad is completed by ISC, and
given Scenario 4.2.1.20 calls for a total of 3 landing pads, there is a possibility
post-ISC site construction for the landing pads #2 and #3 will be incongruous
with the ConOps for the remaining 9 Altair landings planned for achieving
Continuous Human Presence Capability (CHPC) by FY2025.
 MITIGATION - Develop complete ConOps for optimized usage of land-
ing/launch zones through CHPC to characterize potential design opportunities
or shortfalls.
14 Day ISC Mission End
• ConOps shown is crew
departure in Ascent Mod-
ule.
• 2nd Airlock abandoned.
• Outpost surface assets
placed in Safe Mode qui-
escent state prior to depar-
ture.
• SMC Rover parked be-
hind protective berm
(serves as crew’s trans-
portation to launch pad
from SPR’s parked loca-
tion).
• CMC excavator posi-
tioned at new power re-
charge station, (resumes
tele-robotic excavation of
2nd landing pad after
Crew departure).
Risk Matrix Priority Score
SUMMARY
The top five operational risks for the landing zone construction scenario are
identified in Table 3, while Table 4 summarizes the main mitigation themes sug-
gested for retiring the all identified risks.
Table 3: Top Five Operational Risks to ISC Landing Zone Surface Preparation
Risk # Risk Title
R11-07 Failure to optimize landing zone separations to protect surface assets in event of descent abort
R11-15 Berm design form factor not optimized for sufficient protection
R11-04 Lander fuel cells fail to provide surface power for off-loading CMC excavator
R11-06 Off-loading collision or damage to excavator
R11-17 Ejecta discharge from top layer of berm
5716202325
4613182224
3411151921
228101417
1135912
12345
LIKELIHOOD
R11-21 CONSEQUENCE
5716202325
4613182224
3411151921
228101417
1135912
12345
LIKELIHOOD
R11-20 CONSEQUENCE
K

Table 4: Summary of Main Mitigation Themes
Mitigation Themes Captured from Risk Descriptions and Mitigation Approaches Worksheets
 Utilize SMD's International Lunar Network (ILN) of surface science stations to characterize envi-
ronment of Outpost specific landing /launch sites.
 Validate data through use of extensive simulation and phenomenological modeling of lunar surface
at excavation and construction sites.
 Include civil engineering and planetary geology disciplines as core crew expertise for Mission 2 sor-
tie scouting and surveying mission.
 Deploy an integrated lunar sensor network to enhance the spatial-orientation capabilities of teleop-
erators and astronauts on the lunar surface.
 Ensure Altair design requirements align with LSS operational scenarios; to extent practical, align
schedule of Altair and LSS design reviews.
 Design mechanical articulation of solar array orientation in Mission 3 for any positioning contin-
gency of Cargo Altair landing.
 Extensive use of discrete modeling and event simulation tools for understanding processes and pro-
cedures, and design impacts.
 Utilization of abandoned Mission 2 Sortie Mission Chassis (SMC) redeployed as a transportation
carrier for a self-transporting battery system to shuttle itself to and from the charging station to the
excavator while the excavator continues to work; and for shuttling crew from parked SPR's or habita-
tion modules to landing/launch site.
 Deploy a Lunar Dust Instrument (LDI) mission, i.e., Langmuir Probe to characterize lunar dusty
plasma environment on and near the lunar surface.
 Design teleoperator control center with human-systems integration principals for workstation design.
 Use/develop software tools for modeling and analyzing workstation interfaces, crew station design
and overall workflow environment
 Incorporate lessons learned from Soviet era Lunokhod teleoperator control station experience.
 Ensure CMC tool kit for Mission 3 Altair Cargo manifest includes capability for CMC to reconfigure
itself for emplacement of navigation/beacon aids.
 Ensure spares provisioning and spares ConOps for CMC excavation activity is sufficiently accom-
modated.
 Develop CMC spares ConOps for Mission 3 telerobotic remote Outpost operations.
 Develop complete ConOps for optimized usage of landing/launch zones through CHPC to character-
ize potential design opportunities or shortfalls.
VAST™ was developed as a risk and mitigation assessment methodology and
applied to a lunar site characterization analysis for the operational sequence of a lunar
outpost buildup scenario. Use of VAST™ as an analysis methodology provides a
straightforward way to "visualize" operational processes, providing easy to follow
and easy to envision operational risks that may not be readily apparent from mission
timelines.
Risk retirement mitigation strategies derived as a result of the risk analysis
help to prioritize research and development of lunar site characterization techniques
and tools needed for lunar outpost planning and construction applications. For exam-
ple, planned or in the proposal stage by XArc Corp are development of software
modeling tools for physics based simulation of lunar regolith for excavation and con-
struction, and development of a Near Surface Lunar Dust Instrument (NSLDI) for site
characterization measurements.

REFERENCES AND ACRONYMS
Table 5 lists the acronyms for the scenario surface system assets.
Table 5: Acronyms List for Scenario 4.2.1.20 Manifest
Acronym Name Function
ATHLETE All-Terrain Hex-Legged Extra-Terrestrial Explorer Surface Mobility
CDK Chassis Driving Kit Surface Mobility
CMC Crew Mobility Chassis Surface Mobility
DPLM Disposable Pressurized Logistics Module Logistics & Supportability
LCT Lunar Communications Terminal Communications
LER Lunar Electric Rover Surface Mobility
MCT Mobility Chassis Toolkit Site prep/science
OPS Oxygen Production System ISRU
OSE Offloading & Support Equipment Surface Operations & Unloading
PSU Power & Support Unit Power and Structural Interface
PUP Portable Utility Pallet Power
RPLM Reusable Pressurized Logistics Module Habitation, Logistics & Support
SPR Small Pressurized Rover Extended Surface Mobility
SSU Structural Support Unit Structural Interface
References
Astrobotic Technology, Inc. (2009). “Configuring Innovative Regolith Moving Tech-
niques for Lunar Outposts”, US Chamber of Commerce Programmatic Work-shop on
NASA Lunar Surface Systems Concepts, Washington, D.C., Feb 27, 2009.
Cummings, Thomas K. (2009). The Boeing Company, “Lunar Outpost Operations –
An Industry View of Risk”, AIAA Space 2009, Pasadena, CA, Sept 14-17, 2009.
NASA (2009). “Guidelines for Risk Management”, S3001, Rev B, March 25, 2009.
Vangen, Scott (2009). “NASA Lunar Surface Systems Concepts – Lunar Surface
Systems Project Overview” Space Transportation Working Group, LSS Risks Effort
Workshop, Washington, D.C., March 19, 2009.