Petri net semmiation of critical consumables aboard the International Space Station

The level of carbon dioxide (CO2), water (H2O), or oxygen (02) aboard the International Space Station (ISS) at any given time is a function of the number of crew and the availability of critical life support systems characterized by their respective mean time between failure (MTBF) and mean time to repair (MTTR) parameters. The non-linear interaction between these elements requires a simulation approach to probability calculations in lieu of a static fault or event tree model. We have chosen to implement our models as a particular type of finite state machine called a Petri net, an architecture that permits both stochastic (random) and deterministic events. To run the Petri net, we combined an existing freeware Petri net graphical user interface (GUI) with our own Exce/Visual Basic for Applications (VBA) simulation code in a platform that facilitates the design, analysis, and verification of model logic. A single run through the model represents a single possible timeline aboard the ISS, with random failures of equipment and repair times distributed according to the best available probability data. By running the model with the same input parameters a large number of times in a Monte Carlo analysis, we derived with high confidence the probabilities of occurrence of specific events of interest (in this case, exceedances of critical consumable thresholds) during a selected mission interval with much greater fidelity than is possible without simulation. The analytical approach presented in this paper has potential applicability to analogous integrated system simulation problems in a wide variety of settings. As part of the background leading to the theoretical development for ISS consumables, the paper starts with a synopsis of methods recently developed at ARES Corporation to address two related return-to-flight issues. The first concerns the determination of the likelihood that a fragment from the shuttle external tank could impact the orbiter and cause critical damage. The second involves evaluation of the uncertainties and confidence levels associated with computations of the safety margin for reentry after an impact that damages the orbiter's thermal tile.