SEARCH · Engineering Papers
Results for “SAFE”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Lunar Reconnaissance Orbiter (LRO) Sun Safe Mode
The Lunar Reconnaissance Orbiter (LRO), a spacecraft designed and built at the National Aeronautics and Space Administration s (NASA) Goddard Space Flight Center (GSFC) in Greenbelt, MD, was launched on June 18, 2009 from Cape Canaveral. It is currently in orbit about the Moon taking detailed science measurements and providing a highly accurate mapping of the suface in preparation for the future return of astronauts to a permanent moon base. Onboard the spacecraft is a complex set of algorithms designed by the attitude control engineers at GSFC to control the pointig for all operational events, including anomalies that require the spacecraft to be put into a well known attitude configuration for a sufficiently long duration to allow for the investigation and correction of the anomaly. GSFC level requirements state that each spacecraft s control system design must include a configuration for this pointing and lso be able to maintain a thermally safe and power positive attitude. This stable control algorithm for anomalous events is commonly referred to as the safe mode and consists of control logic thatwill put the spacecraft in this safe configuration defined by the spacecraft s hardware, power and environment capabilities and limitations. The LRO Sun Safe mode consists of a coarse sun-pointing set of algorithms that puts the spacecraft into this thermally safe and power positive attitude and can be achieved wihin a required amount of time from any initial attitude, provided that the system momentum is within the momentum capability of the reaction wheels. On LRO the Sun Safe mode makes use of coarse sun sensors (CSS), an inertial reference unit (IRU) and reaction wheels (RW) to slew the spacecraft to a solar inertial pointing. The CSS and reaction wheels have some level of redundancy because of their numbers. However, the IRU is a single-point-failure piece of hardware. Without the rate information provided by the IRU, the Sun Safe control algorithms could not maintain the required pointing, so a sub-mode of the Sun Safe mode that does not use the IRU was designed. This submode, referred to as the Sun Safe Gyroless control mode, consists of an algorithm that estimates rate information from the CSS and the RW measurements. RW momentum information is used to estimate the body rate parallel to the target sunline, which CSS alone would not be able to observe. Sun Safe can be autonomously, or via ground command, entered from any other control mode and in the event the IRU is not providing rate information, the control mode is switched to the gyroless submode. This paper looks at the design of the Sun Safe modes and discusses the constraints placed on the algorithm and how the mode wored around these constraints. Items of particular interest include CSS placement on the Solar Array (SA) and its implications to design, estimation of body rate information for the Sun Safe Gyroless control mode, and the effect of solar eclipse on each of the Sun Safe modes. Placing CSS on the SA was necessary for the means to put the Sun along the targeted sun-line, nominally normal to the SA panels, for all operational considerations. This had design implications for determining a sun vector during normal SA operations, if one or both gimbals become inoperable and when the SA is in a stowed configuration. The ability of body rate estimation in Sun Safe Gyroless not only uses CSS sun vector data but requires RW momentum measuremens to estimate rates parallel to the sun-line. LRO encounters solar eclipses of some length for most of its orbits about the Moon. With the lack of CSS measurement data a design was implemented in both Sun Safe and Sun Safe Gyroless, they differ because of having or not having IRU measurement data, to carry the spacecraft through these eclipse periods. This paper also includes some discussion of sun avoidance and how it affected design decisions during nominal and eclipse perids for each of the Sun Safe modes.
Evolution of the Hubble Space Telescope Safing Systems
The Hubble Space Telescope (HST) was launched on April 24 1990, with an expected lifespan of 15 years. Central to the spacecraft design was the concept of a series of on-orbit shuttle servicing missions permitting astronauts to replace failed equipment, update the scientific instruments and keep the HST at the forefront of astronomical discoveries. One key to the success of the Hubble mission has been the robust Safing systems designed to monitor the performance of the observatory and to react to keep the spacecraft safe in the event of equipment anomaly. The spacecraft Safing System consists of a range of software tests in the primary flight computer that evaluate the performance of mission critical hardware, safe modes that are activated when the primary control mode is deemed inadequate for protecting the vehicle, and special actions that the computer can take to autonomously reconfigure critical hardware. The HST Safing System was structured to autonomously detect electrical power system, data management system, and pointing control system malfunctions and to configure the vehicle to ensure safe operation without ground intervention for up to 72 hours. There is also a dedicated safe mode computer that constantly monitors a keep-alive signal from the primary computer. If this signal stops, the safe mode computer shuts down the primary computer and takes over control of the vehicle, putting it into a safe, low-power configuration. The HST Safing system has continued to evolve as equipment has aged, as new hardware has been installed on the vehicle, and as the operation modes have matured during the mission. Along with the continual refinement of the limits used in the safing tests, several new tests have been added to the monitoring system, and new safe modes have been added to the flight software. This paper will focus on the evolution of the HST Safing System and Safing tests, and the importance of this evolution to prolonging the science operations of the telescope.
Fail-Safe Logic Design Strategies Within Modern FPGA Architectures
Fail-safe computing refers to computing systems that revert to a non-operational safe state when a fault occurs. In this paper, we investigate a circuit level technique as mitigation for single event upsets (SEUs) and fault injection attacks on field programmable gate arrays (FPGAs), and analyze the effectiveness of the technique as a fail-safe monitor for an encryption algorithm. The propagation of fault effects through FPGA primitives including lookup tables (LUTs) and programmable interconnect points (PIPs) is assessed within an FPGA architecture created using an open source tool, and validated using fault injection experiments on an FPGA. The analysis reveals additional vulnerabilities exist within reconfigurable architectures over those in equivalent fail-safe application specific integrated circuit (ASIC), thus requiring a more elaborate network of redundant circuits and checking logic. The configuration memory bits (CMBs), which configure routing and designate logic functions within the LUTs of the FPGA, add complexity to fail-safe design strategies by introducing additional fault conditions and fault propagation paths. A resource-efficient fail-safe circuit design technique called DEsign for Fail-safe in reCONfigurable systems (DEFCON) is proposed. The benefits and limitations associated with DEFCON are described in the context of fault injection experiments carried out as simulations and in FPGA hardware.
A Section 110 Evaluation of the Project 57 Rad-Safe Area Personnel Decontamination Building, Nye County, Nevada
Project 57 was an open-air, plutonium-dispersal safety test conducted by the United States in 1957 on a portion of the Nevada Test and Training Range (NTTR) (formerly the Las Vegas Bombing and Gunnery Range). The Project 57 test area, once known as Area 13, was a block of land abutting the northeastern boundary of the Nevada Test Site (NTS). The NTS was renamed the Nevada National Security Site (NNSS) in 2010. In keeping with the historical Cold War period designation, NTS will be used when discussing historic period events, while NNSS will be applied for contemporary activities. During Project 57, the high explosives of a nuclear weapon were triggered asymmetrically to simulate an accidental detonation. The test was conducted to study the extent of plutonium contamination from a nonnuclear yield accident, as well as assess the biological and environmental hazards such an event could create. Following the conclusion of the experiment, the contaminated area surrounding the ground zero (GZ) was fenced off and some of the contaminated equipment was buried in place. The Project 57 Rad-Safe area was abandoned. In 1981, the U.S. Department of Energy (DOE) decontaminated and decommissioned the Project 57 site. This Section 110 documentation was prompted by recognition that more than five decades have passed since the abandonment of the Project 57 Rad-Safe area, particularly the personnel decontamination building, which leaves the temporary structure vulnerable to natural forces of weathering and decay. However, these temporary facilities remain partially standing, allowing for a condition assessment and recommendations regarding the Rad-Safe area’s historical significance. The National Nuclear Security Administration, Nevada Field Office (NNSA/NFO) determined there was no area of potential effect (APE) (direct, indirect, or visual) because there is no planned undertaking and the Project 57 Rad-Safe area will continue to remain unused. Instead, a 4.5-acre study area was established to facilitate recording the Project 57 personnel decontamination building and the remaining accessory resources. The study area is bounded on the east by Valley Road and it extends to the east far enough to encompass the former Project 57 Rad-Safe area (Figure A-2). The Section 110 study area is located in the northwest quarter of Section 35, Township 07S Range 54E Mount Diablo Base and Meridian. It is on the 1962 Groom Mine SW USGS 7.5-minute series topographic quadrangle. Desert Research Institute (DRI) surveyed the Section 110 study area, resulting in the recording and evaluation of the Project 57 Rad-Safe area personnel decontamination building and four accessory resources (AR-1 through AR-4). Copies of the building form and report are on file at DRI and with the NNSA/NFO in Las Vegas, Nevada.
Curiosity's Autonomous Surface Safing Behavior Design
The safing routines on all robotic deep-space vehicles are designed to put the vehicle in a power and thermally safe configuration, enabling communication with the mission operators on Earth. Achieving this goal is made a little more difficult on Curiosity because the power requirements for the core avionics and the telecommunication equipment exceed the capability of the single power source, the Multi-Mission Radioisotope Thermoelectric Generator. This drove the system design to create an operational mode, called "sleep mode", where the vehicle turns off most of the loads in order to charge the two Li-ion batteries. The system must keep the vehicle safe from over-heat and under-heat conditions, battery cell failures, under-voltage conditions, and clock failures, both while the computer is running and while the system is sleeping. The other goal of a safing routine is to communicate. On most spacecraft, this simply involves turning on the receiver and transmitter continuously. For Curiosity, Earth is above the horizon only a part of the day for direct communication to the Earth, and the orbiter overpass opportunities only occur a few times a day. The design must robustly place the Rover in a communicable condition at the correct time. This paper discusses Curiosity's autonomous safing behavior and describes how the vehicle remains power and thermally safe while sleeping, as well as a description of how the Rover communicates with the orbiters and Earth at specific times.
A Stellar Activity F-statistic for Exoplanet Surveys (SAFE)
In the search for planets orbiting distant stars, the presence of stellar activity in the atmospheres of observed stars can obscure the radial velocity signal used to detect such planets. Furthermore, this stellar activity contamination is set by the star itself and cannot simply be avoided with better instrumentation. Various stellar activity indicators have been developed that may correlate with this contamination. We introduce a new stellar activity indicator called the Stellar Activity F-statistic for Exoplanet surveys (SAFE) that has higher statistical power (i.e., probability of detecting a true stellar activity signal) than many traditional stellar activity indicators in a simulation study of an active region on a Sun-like star with a moderate-to-high signal-to-noise ratio. Also through simulation, the SAFE is demonstrated to be associated with the projected area on the visible side of the star covered by active regions. We also demonstrate that the SAFE detects statistically significant stellar activity in most of the spectra for HD 22049, a star known to have high stellar variability. Additionally, the SAFE is calculated for recent observations of the three low-variability stars HD 34411, HD 10700, and HD 3651, the latter of which is known to have a planetary companion. As expected, the SAFE for these three only occasionally detects activity. Furthermore, initial exploration appears to indicate that the SAFE may be useful for disentangling stellar activity signals from planet-induced Doppler shifts.
A model for a space shuttle safing and failure-detection expert
The safing and failure-detection expert (SAFE) is a prototype for a malfunction detection, diagnosis, and safing system for the atmospheric revitalization subsystem (ARS) in the Space Shuttle orbiter. SAFE, whose knowledge was extracted from expert-provided heuristics and documented procedures, automatically manages all phases of failure handling: detection, diagnosis, testing procedures, and recovery instructions. The SAFE architecture allows it to handle correctly sensor failures and multiple malfunctions. Since SAFE is highly interactive, it was used as a test bed for the evaluation of various advanced human-computer interface (HCI) techniques. The use of such expert systems in the next generation of space vehicles would increase their reliability and autonomy to levels not achievable before.
Safe Grid
The biggest users of GRID technologies came from the science and technology communities. These consist of government, industry and academia (national and international). The NASA GRID is moving into a higher technology readiness level (TRL) today; and as a joint effort among these leaders within government, academia, and industry, the NASA GRID plans to extend availability to enable scientists and engineers across these geographical boundaries collaborate to solve important problems facing the world in the 21 st century. In order to enable NASA programs and missions to use IPG resources for program and mission design, the IPG capabilities needs to be accessible from inside the NASA center networks. However, because different NASA centers maintain different security domains, the GRID penetration across different firewalls is a concern for center security people. This is the reason why some IPG resources are been separated from the NASA center network. Also, because of the center network security and ITAR concerns, the NASA IPG resource owner may not have full control over who can access remotely from outside the NASA center. In order to obtain organizational approval for secured remote access, the IPG infrastructure needs to be adapted to work with the NASA business process. Improvements need to be made before the IPG can be used for NASA program and mission development. The Secured Advanced Federated Environment (SAFE) technology is designed to provide federated security across NASA center and NASA partner's security domains. Instead of one giant center firewall which can be difficult to modify for different GRID applications, the SAFE "micro security domain" provide large number of professionally managed "micro firewalls" that can allow NASA centers to accept remote IPG access without the worry of damaging other center resources. The SAFE policy-driven capability-based federated security mechanism can enable joint organizational and resource owner approved remote access from outside of NASA centers. A SAFE enabled IPG can enable IPG capabilities to be available to NASA mission design teams across different NASA center and partner company firewalls. This paper will first discuss some of the potential security issues for IPG to work across NASA center firewalls. We will then present the SAFE federated security model. Finally we will present the concept of the architecture of a SAFE enabled IPG and how it can benefit NASA mission development.
A Self Contained Method for Safe and Precise Lunar Landing
The return of humans to the Moon will require increased capability beyond that of the previous Apollo missions. Longer stay times and a greater flexibility with regards to landing locations are among the many improvements planned. A descent and landing system that can land the vehicle more accurately than Apollo with a greater ability to detect and avoid hazards is essential to the development of a Lunar Outpost, and also for increasing the number of potentially reachable Lunar Sortie locations. This descent and landing system should allow landings in more challenging terrain and provide more flexibility with regards to mission timing and lighting considerations, while maintaining safety as the top priority. The lunar landing system under development by the ALHAT (Autonomous precision Landing and Hazard detection Avoidance Technology) project is addressing this by providing terrain-relative navigation measurements to enhance global-scale precision, an onboard hazard-detection system to select safe landing locations, and an Autonomous GNC (Guidance, Navigation, and Control) capability to process these measurements and safely direct the vehicle to this landing location. This ALHAT landing system will enable safe and precise lunar landings without requiring lunar infrastructure in the form of navigation aids or a priori identified hazard-free landing locations. The safe landing capability provided by ALHAT uses onboard active sensing to detect hazards that are large enough to be a danger to the vehicle but too small to be detected from orbit, given currently planned orbital terrain resolution limits. Algorithms to interpret raw active sensor terrain data and generate hazard maps as well as identify safe sites and recalculate new trajectories to those sites are included as part of the ALHAT System. These improvements to descent and landing will help contribute to repeated safe and precise landings for a wide variety of terrain on the Moon.
Managing Cassini Safe Mode Attitude at Saturn
The Cassini spacecraft was launched on October 15, 1997 and arrived at Saturn on June 30, 2004. It has performed detailed observations and remote sensing of Saturn, its rings, and its satellites since that time. In the event safe mode interrupts normal orbital operations, Cassini has flight software fault protection algorithms to detect, isolate, and recover to a thermally safe and commandable attitude and then wait for further instructions from the ground. But the Saturn environment is complex, and safety hazards change depending on where Cassini is in its orbital trajectory around Saturn. Selecting an appropriate safe mode attitude that insures safe operation in the Saturn environment, including keeping the star tracker field of view clear of bright bodies, while maintaining a quiescent, commandable attitude, is a significant challenge. This paper discusses the Cassini safe table management strategy and the key criteria that must be considered, especially during low altitude flybys of Titan, in deciding what spacecraft attitude should be used in the event of safe mode.
The application of ICASPA to critical and safe mass calculations - 14586
ICASPA, an Improved Critical and Safe Parameters Algorithm, calculates the size of a fissile body for a given value of k-effective. ICASPA uses an iterative predictor/corrector algorithm in which the MONK9A code is used to derive a precise k-effective value for a given candidate body size; auxiliary equations are then used to adjust the body size. The process is repeated until MONK9A outputs the chosen target value of k-effective. EDF Energy operates eight nuclear power stations comprising one Pressurized Water Reactor (PWR) and seven Advanced Gas-cooled Reactor (AGR) stations. At these sites, the term 'fuel route' is used to encompass all of the ex-reactor arrangements for the handling and storage of fuel. The criticality safety cases for these fuel routes are based on the use of geometrically safe arrangements for the required quantities of fuel. The allowed quantities and arrangements of fuel are safely sub-critical, even under the contingency of accidental moderator ingress. The fuel route safety cases consider all credible potential fault conditions, including events such as dropped fuel. Any such events might change the geometry of the fuel elements, but it is difficult to calculate exact k-effective values for realistic models of dropped fuel. This difficulty is overcome by the use of an alternative approach in which limiting safe masses are calculated for bounding (worst-case) rearrangements of fuel rods and moderators, using geometries similar to those covered by criticality handbook data. Where required, the resulting safe masses are used to set safety case limits and conditions. For example, some fire extinguishants, such as water and ABC dry powder, are also effective moderators. Hence, in some fuel route areas, administrative criticality controls are used to either prohibit or limit the permitted quantities of these materials. This paper describes the work that has been carried out to adopt ICASPA as the approved calculation method for these safe mass calculations. The work has been carried out within the company quality assurance requirements for nuclear safety related software. It has involved the development of a configuration controlled version of ICASPA and the local verification and validation of the resulting code. The benefits from the adoption of ICASPA are also presented. These include accuracy improvements and, because the method uses the MONK9A code for k-effective calculations, the ability to use more sophisticated models for limiting case geometries. (authors)
An all-electronic fail-safe for stimulated Brillouin scattering suppression
The mitigation of transverse stimulated Brillouin scattering (SBS) via phase modulation is mandatory to avoid damage in high-energy laser systems. A novel fail-safe system that indirectly monitors the optical bandwidth applied to suppress SBS by monitoring the input, reflected, and through rf power of the SBS-suppression lithium-niobate phase modulator is demonstrated. The fail-safe system has high sensitivity and reliability provided by optimized redundant circuits for power monitoring and fail-safe decision logic. Calibration of the fail-safe’s thresholds is straightforward. Furthermore, the fail-safe circuitry reacts within 45 ns to stop an incorrectly modulated pulse by blocking the propagation of an electronic timing trigger.
Eye-Safe 1.5 and 2.0 Micron Laser Power Conversion Using Metamorphic InGaAs Photovoltaic Devices
Laser power transmission at 1.5 and 2.0 microns are considered eye-safe up to 0.1 W/cm2 irradiance. Further, the atmospheric bands at these two wavelengths may provide the highest optical transmission through the atmosphere in hazy conditions. By slowly changing the lattice-constant of InGaAs with a Compositionally Graded Buffer (CGB), we have fabricated InGaAs photovoltaic (PV) devices over a wide range of bandgaps useful for multijunction concentrating photovoltaic devices, thermophotovoltaic devices, and Laser Power Converters (LPC). Here, we have demonstrated monochromatic power conversion of 1.5-micron light with an eye-safe efficiency of 39.8% at 0.1 W/cm2 with InGaAs devices lattice-matched to InP with an Antireflection Coating (ARC). We have also demonstrated 30.2% and 24.5% eye-safe LPC efficiency of metamorphic InGaAs devices grown on GaAs substrates using GaInP and AlGaAsP CGBs, respectively. Finally, we have demonstrated metamorphic InGaAs devices grown on InP and GaAs substrates that are estimated to have eye-safe LPC efficiencies at 2.0 microns of 27.4% and 20.9% respectively. The efficiencies of all these LPC devices continues to increase up to about 30-70 times the eye-safe irradiance.
Experimental Safe Extremum Seeking for Accelerators
Here, we demonstrate the recent designs of safe extremum seeking (Safe ES) on the 1-km-long charged particle accelerator at the Los Alamos Neutron Science Center (LANSCE). Safe ES is a modification of extremum seeking (ES) which, in addition to minimizing an analytically unknown cost, also employs a safety filter based on an analytically unknown control barrier function (CBF) safety metric. Tuning is necessitated by accelerators being large complex systems, with many drifting parameters due to thermal effects and degradation. At the same time, safe operation (the maintenance of state constraints) is crucial, as damage brings astronomical costs, both financially and in operation downtime. Our measured (but analytically unknown) safety metric is the beam current. We perform multivariable Safe ES on three accelerator applications, in which we adapt 4, 6, and 3 magnet strength parameters, respectively. Two of the three applications are for validated simulation models of beamlines at LANSCE: the first for the proton radiography (pRad) beamline of 800-MeV protons for spot size tuning; the second on a high-performance code, HPSim, for tuning the low-energy beam transport (LEBT) region that contains a beam of 750-keV protons. The third is an experimental tuning of the steering magnets in the LEBT at LANSCE.
Integral Battery Power Limiting Circuit for Intrinsically Safe Applications
A circuit topology has been designed to guarantee the output of intrinsically safe power for the operation of electrical devices in a hazardous environment. This design uses a MOSFET (metal oxide semiconductor field-effect transistor) as a switch to connect and disconnect power to a load. A test current is provided through a separate path to the load for monitoring by a comparator against a preset threshold level. The circuit is configured so that the test current will detect a fault in the load and open the switch before the main current can respond. The main current passes through the switch and then an inductor. When a fault occurs in the load, the current through the inductor cannot change immediately, but the voltage drops immediately to safe levels. The comparator detects this drop and opens the switch before the current in the inductor has a chance to respond. This circuit protects both the current and voltage from exceeding safe levels. Typically, this type of protection is accomplished by a fuse or a circuit breaker, but in order for a fuse or a circuit breaker to blow or trip, the current must exceed the safe levels momentarily, which may be just enough time to ignite anything in a hazardous environment. To prevent this from happening, a fuse is typically current-limited by the addition of the resistor to keep the current within safe levels while the fuse reacts. The use of a resistor is acceptable for non-battery applications where the wasted energy and voltage drop across the resistor can be tolerated. The use of the switch and inductor minimizes the wasted energy. For example, a circuit runs from a 3.6-V battery that must be current-limited to 200 mA. If the circuit normally draws 10 mA, then an 18-ohm resistor would drop 180 mV during normal operation, while a typical switch (0.02 ohm) and inductor (0.97 ohm) would only drop 9.9 mV. From a power standpoint, the current-limiting resistor protection circuit wastes about 18 times more power than the switch and the inductor configuration. In the fault condition, both the resistor and the inductor react immediately. The resistor reacts by allowing more current to flow and dropping the voltage. Initially, the inductor reacts by dropping the voltage, and then by not allowing the current to change. When the comparator detects the drop in voltage, it opens the switch, thus preventing any further current flow. The inductor alone is not sufficient protection, because after the voltage drop has settled, the inductor would then allow the current to change, in this example, the current would be 3.7 A. In the fault condition, the resistor is flowing 200 mA until the fuse blows (anywhere from 1 ms to 100 s), while the switch and inductor combination is flowing about 2 A test current while monitoring for the fault to be corrected. Finally, as an additional safety feature, the circuit can be configured to hold the switch opened until both the load and source are disconnected.
Safe Haven Configurations for Deep Space Transit Habitats
Throughout the human space flight program there have been instances where systems failures resulting in smoke, fire, and pressure loss have occurred onboard space vehicles, putting crews at risk for loss of mission and loss of life. In most instances the missions have been in Low-Earth-Orbit (LEO) or Earth-Moon vicinity, with access to multiple volumes that could be used to quickly seal off the damaged module or access escape vehicles for return to Earth. For long duration missions beyond LEO, including Mars transit missions of about 1100 days, the mass penalty for multiple volumes and operating in an environment where a quick return will not be possible have been concerns. In 2016, a study was done to investigate a variety of dual pressure vessel configurations for habitats that could protect the crew from these hazards. It was found that with a modest increase in total mass it should be possible to provide significant protection for the crew. Several configurations were considered that either had a small safe haven to provide 30-days to recover, or a full duration safe haven using two equal size pressure vessel volumes. The 30-day safe haven was found to be the simplest, yielding the least total mass impact but still with some risk if recovery is not possible during that timeframe. The full duration safe haven was the most massive option but provided the most robust solution. This paper provides information on the various layouts developed during the study and provides a discussion of the findings for implementing a safe haven in future habitat designs.
Safe Haven Configurations for Deep Space Transit Habitats
Throughout the human space flight program there have been instances where smoke, fire, and pressure loss have occurred onboard space vehicles, putting crews at risk for loss of mission and loss of life. In every instance the mission has been in Low-Earth-Orbit (LEO) with access to multiple volumes that could be used to quickly seal off the damaged module or escape vehicles for a quick return to Earth. For long duration space missions beyond LEO, including Mars transit missions of about 1000 days, the mass penalty for multiple volumes has been a concern as has operating in an environment where a quick return will not be possible. In 2016 a study was done to investigate a variety of dual pressure vessel configurations for habitats that could protect the crew from these hazards. It was found that for a modest increase in total mass it should be possible to provide significant protection for the crew. Several configurations were developed that either had a small safe haven to provide 30-days to recover, or a full duration safe haven using two equal size pressure vessel volumes. The 30-day safe haven was found to be the simplest, yielding the least total mass impact but still with some risk if recovery is not possible during that timeframe. The full duration safe haven was the most massive option but provided the most robust solution. This paper provides information on the various layouts considered in the study and provides a discussion of the findings for implementing a safe haven in future habitat designs.