# Presentation: 345100

## Failure Review Board

***Final Presentation****** *****Backup Material***** *****April 21, 2006**

**IMAGE FRB Website:  https://secureworkgroups.grc.nasa.gov**

## IMAGE Thermal Design

## Payload Heater Configuration

## SCU Block Diagram

## Predicted Dose-depth Radiation Curve for IMAGE

## Cause: Equipment failure due to electrostatic discharge.

Analysis: 
The IMAGE mission incorporated an EMC control plan.
Provided detailed design guidelines for the prevention of ESD (such as spacecraft charge up and arcing) and EMI related problems. 
The IMAGE mission also had an appropriate ESD control plan in place during the entire integration of the spacecraft.  A procedure was in place since 1987 and real-time monitors since 1990. 

Conclusion: The IMAGE mission utilized proper process control and design procedures and guidelines related to EMC, EMI, and ESD in the design and construction of the spacecraft. Standards of the day were employed that should have prevented ESD failures from occurring.  Thus, it is very unlikely that an ESD related problem could have resulted in any equipment failure at all.  The inability to contact the spacecraft is thus not likely to have been caused by an ESD induced anomaly or failure.

**Analysis:**
**The IMAGE mission incorporated an EMC control plan.**
**Provided detailed design guidelines for the prevention of ESD (such as spacecraft charge up and arcing) and EMI related problems. **
**The IMAGE mission also had an appropriate ESD control plan in place during the entire integration of the spacecraft.  A procedure was in place since 1987 and real-time monitors since 1990. **
**Conclusion:** The IMAGE mission utilized proper process control and design procedures and guidelines related to EMC, EMI, and ESD in the design and construction of the spacecraft. Standards of the day were employed that should have prevented ESD failures from occurring.  Thus, it is very unlikely that an ESD related problem could have resulted in any equipment failure at all.  The inability to contact the spacecraft is thus not likely to have been caused by an ESD induced anomaly or failure.

**Electrostatic Discharge (ESD)****(slide 1 of 2)**

## Supporting Details: 
Preventive measures incorporated into the design included: 1)All payload boxes being grounded to the payload deck with a ground strap and all surfaces were required to be conductive, 2) All payload cables were overshielded and the shields connected to ground at one end of the cable, and 3) The outer spacecraft structure panels were all grounded together along all joints (by springy metal fingers) so that the outer surface of the spacecraft formed a Faraday cage to isolate outside RF noise from inside instruments and vice versa.
The specific ESD control plan changed several times during the development phase of the IMAGE mission, however, core ESD requirements changed very little. The initial plan was MIL-STD-1686A, which later moved to NASA-STD-8739.7 (which was very similar to 1686A).  In recent years ANSI/ESD S20.20 was used, which was a very small change since the 8739.7 program was compatible with S20.20.

- Preventive measures incorporated into the design included: 1)All payload boxes being grounded to the payload deck with a ground strap and all surfaces were required to be conductive, 2) All payload cables were overshielded and the shields connected to ground at one end of the cable, and 3) The outer spacecraft structure panels were all grounded together along all joints (by springy metal fingers) so that the outer surface of the spacecraft formed a Faraday cage to isolate outside RF noise from inside instruments and vice versa.
- The specific ESD control plan changed several times during the development phase of the IMAGE mission, however, core ESD requirements changed very little. The initial plan was MIL-STD-1686A, which later moved to NASA-STD-8739.7 (which was very similar to 1686A).  In recent years ANSI/ESD S20.20 was used, which was a very small change since the 8739.7 program was compatible with S20.20.

**Electrostatic Discharge (ESD) ****(slide 2 of 2)**

## Cause: Short circuit caused by tin whisker growth
Analysis: Surfaces plated with pure tin have been observed to develop long, thin “whiskers” over the course of years.  Whiskers have been observed as long as 10mm.  A number of satellite on-orbit failures have been explained by such growths bridging between power and ground lines, causing a short circuit.  In a vacuum the whisker evaporates, but the metal vapor dissipates slowly, remaining as a highly conductive trace that consumes more material until something in the circuit acts as a fuse.  Pure tin plating is generally prohibited on part surfaces, but has been found despite this prohibition (especially on commercial parts).  It is not possible to completely investigate this possibility due to the lack of an as-built parts list for the IMAGE spacecraft bus.
Conclusion: It is unlikely that such an event would happen first on the transponder instead of in some other system which would have been detected previously.  Tin whisker growth is a possible but unlikely cause of the IMAGE downlink anomaly.

**Analysis**: Surfaces plated with pure tin have been observed to develop long, thin “whiskers” over the course of years.  Whiskers have been observed as long as 10mm.  A number of satellite on-orbit failures have been explained by such growths bridging between power and ground lines, causing a short circuit.  In a vacuum the whisker evaporates, but the metal vapor dissipates slowly, remaining as a highly conductive trace that consumes more material until something in the circuit acts as a fuse.  Pure tin plating is generally prohibited on part surfaces, but has been found despite this prohibition (especially on commercial parts).  It is not possible to completely investigate this possibility due to the lack of an as-built parts list for the IMAGE spacecraft bus.
**Conclusion**: It is unlikely that such an event would happen first on the transponder instead of in some other system which would have been detected previously.  Tin whisker growth is a possible but unlikely cause of the IMAGE downlink anomaly.

**Tin Whisker Growth**

## Solar Array FailureTypical Telemetry Profile

- I_load
- I_batt
- I_sam

- Rick Burley,
- IMAGE Mission Director
- Amri I. Hernández-Pellerano,
- GSFC, Code 563

## Chassis Current Review (1 of 6) 

**IMAGE has exhibited an intermittent chassis current since launch, which has increased over the life of the mission.**
**Increased in frequency with only small increase in magnitude.**
**Multiple causes of chassis current have been identified, including battery heaters, payload deck heaters, FUV instrument heater and solar arrays.**
**The chassis current has never had any detectable effect on the spacecraft, payload, or science data quality.**
**Level of current is not enough to effect the gate bias of the Transponder SSPC making it more susceptible to instant trips. **
**Instrument PIs have been queried and have indicated no effect on science.**
**Given the magnitude, trend, and history of the chassis current, it is highly unlikely that it had any correlation to the anomaly.**
**There is no evidence to suggest the chassis current was progressing toward a catastrophic system short and no evidence that it caused an SSPC instant trip.**

## Chassis Current Review (2 of 6) Payload heaters are a Current source

**Chassis Current Review (2 of 6) *****Payload heaters are a Current source***

**Payload anti-sunward during this season.  Heater cycling tied to orbit period, and extra heating from albedo.**
**CIDP reboot occurred on 2005/08/09 0411z due to SEU.  **
**Chassis Current increased when payload deck heater setpoints increased from their prior level.**
**Chassis Current ceased when setpoints reduced back to minimum on 2005/08/18 1606z.**
**Payload heater activity is clearly one source of chassis current.**

## Large fluctuations of battery SOC due to eclipses.
Small fluctuations of battery temperature match battery heater activity.
Chassis current closely correlates to battery heaters.  
Payload heaters were off during this event.

**Small fluctuations of battery temperature match battery heater activity.**
**Chassis current closely correlates to battery heaters.  **
**Payload heaters were off during this event.**

**Chassis Current Review (3 of 6)**** *****Battery heaters are a Current source***

## Chassis Current Review (4 of 6) Solar Arrays are Another Source

**This was a brief penumbra-only eclipse.**
**Payload deck heaters and battery heaters were off.**
**Chassis current occurred when SAMs 1 and 2 opened.**

## Chassis Current Review (5 of 6)SSPC Effect

- The maximum value of chassis current telemetry is 1A.  That accounts for 0.025V of reference shift at the bus return which is not enough to affect a MOSFET gate bias on the SSPC.  The chassis current telemetry is negative which means it is flowing from the structure to the bus return.  This supports a load return line shorted to chassis.

## Chassis Current Review (6 of 6)  I Chassis Observations

- Ichassis mirrors the load current.

## Mission Recovery Scenario Backup

## Eclipse Season Spring 2003

**‘****Safed’ Condition: SOC Alarms at 50% and 40% Tripped Due to Misconfiguration **(31-Mar-2003)
- PL Operational Heaters, Instruments All Turned On For Pre-Heating
- Current Exceeded Solar Array Power
- 50% Alarm Switched PL to Low Power
- 40% Alarm Powered Off Payload, including Operational Heaters
- Configuration After That Was Good Model of Present Configuration

** **

** **

****

** **

** **

** **

**31 March 2003 Eclipse**

## Initial Power State

**Default State after SCU reboot**
- SCU startup macro should power on:
- Payload Survival (Thermostatic) Heaters
- Transmitter (presumed not powered due to SSPC fault)
- Battery Heaters
- Sun Sensor Heater
- AST and Sun Sensor
- Historic model is 31-Mar-2003
- Previous Power-down due to 40% SOC macro activation
- Transmitter was on, rather than off
- Otherwise similar Solar geometry and power condition to Oct 2007
- Current Draw Averages 5.25 Amps
- Duty cycled due to heaters
- Includes Transponder Power

## Initial Thermal State

**Thermal State Prior To Eclipse Based on 31-Mar-2003 Conditions**
**Plot shows Temperatures during entry to eclipse **
- Battery Baseplate (heater cycling)
- CIDP and One Instrument
- SCU Power Supply
- Magnetometer
**Payload Equilibrium Temperatures Range From -15 C to -20 C**
**SC Equipment Temperatures range from +3 C (Battery) to -12 C (TAM)**
- Transponder was +5 C, but will be colder in Oct 2007 since it is presumed to be OFF.
**Estimated Error +/- 3 C**

## Survival Temperatures Reached

**Temperatures Decline to Survival Limits**
**Decline Rates Based on Rates of 08-Apr-2003**
- Battery (cycling due to heater)
- CIDP and MENA/FUV
- Note CIDP was powered Here
- SCU Power Supply
- Magnetometer
**At Survival Limits, Thermostatic Survival Heaters kick on**
**Lapse Rate for all PL elements is between 10 and 15 C per hour in eclipse**
**Survival Temperatures Reached in One Hour (+/- 10 minutes estimated)**

## Thermal Initial State Data

**Full Thermal Response for 31-Mar-2003 Eclipse**
- Payload Elements Track CIDP temperature closely

## Thermal Lapse Rate Data

**Complete Thermal Cool-Down Response During 08-Apr-2003 Eclipse**
- Payload Temperatures All Track at Similar Rates
- Battery warms during high-rate discharge, cools slowly thereafter

## Nominal Capacity Calculation Details

- Battery capacity degradation rate is estimated at 1.62 Ahr/yr.
- Representative on-orbit life between cycle 186 and 520 is 1.67 years
**2.6 yr (cycle 520) – 0.93 yr (cycle 186) = 1.67 yr.**
- Capacity degradation between cycle 186 and 520 is 2.7 Ahr.
**22.8 Ahr (cycle 186) – 20.8 (cycle 520) = 2.7 Ahr.**
- Rate of capacity degradation is 1.62 Ahr/yr.
**2.7 Ahr/1.67 yr = 1.62 Ahr/yr.**
- ‘Worst case’ estimate because capacity is represented by weakest cell.
- Assume linear degradation rate.
- Rate likely increases with age giving a actual lower capacity than assumed.
- On-orbit capacity estimate is _14.25 Ahr_.
- Flight battery new capacity was measured at 26.4 Ahr.
**Measurement taken upon flight battery delivery to I&T.**
**Crane test battery new capacity was measured at ~ 25 Ahr.**
**Nameplate capacity is 21 Ahr.**
- Capacity is 14.25 Ahr.
**26.4 Ahr new capacity – 7.5 Yr * 1.62 Ahr/yr degradation = 14.25 Ahr.**

## Capacity Calculation Notes

- Lifetime testing cycles were slightly different that on-orbit experience.
- On-orbit had 1203 cycles total with 180 discharge cycles to a DOD of 50-60%.
- Crane data of 2.6 years and regular 38% DOD.
- The larger DOD profile for the on-orbit battery will tend to reduce its capacity compared to the test battery.
**Not accounted for in the analysis due to uncertainty.**
- Test and on-orbit temperatures similar (5 vs 3-5 deg. C)

## Crane Super NiCd Test Data Nominal Capacity Estimation

**Crane Super NiCd Test Data**** ****Nominal**** ****Capacity Estimation**

**Cycle 186**

- Test Battery: 5 cell, 21 Ah.r
- On-orbit Battery: 22 cell, 21 Ahr.

**1.0**

**22.8**

**~1203 eclipses over 6 years  ********~200 cycles/yr**
**186 cycles/200 cycles per yr  ********~0.93 yr representative on-orbit life**

## Crane Super NiCd Test Data Nominal Capacity Estimation

**Cycle 520**

**~1203 eclipses over 6 years  ********~200 cycles/yr**
**520 cycles/200 cycles per yr  ********~2.6 yr representative on-orbit life.**

**1.0**

**20.1**

- Test Battery: 5 cell, 21 Ah.r
- On-orbit Battery: 22 cell, 21 Ahr.

## Last Data Before Reset 07-Apr-2003

**DSN contact broken at end of data**
**SCU reset before Next Contact**
**Reset believed due to 24 Vdc Low-Voltage Reset**
- SCU had Rebooted
**40% SOC alarm probably did *not* trigger first**
- Would have removed CIDP and PL heaters from load, allowing bus voltage to recover
- Would have prevented SCU reset
**Telemetry reporting Alarm trigger counts not fully understood**

- Jim La/Code 444

## Lesson #1 Background:
The use of an SSPC to power the Transponder seems to have been chosen as a ‘smart’ replacement for the typical fused supply.  This allowed more flexibility during I&T testing and, theoretically, provided the same circuit protection.  Additionally, the desire was to have Transponder OFF during assent.
The first block diagram that shows the SSPC, actually shows two of them connected in parallel, but it does not say whether this was to handle higher output currents or for redundancy considerations; later diagrams show only one SSPC.
IC board space constraints were likely the reason for using only one SSPC.

- The use of an SSPC to power the Transponder seems to have been chosen as a ‘smart’ replacement for the typical fused supply.  This allowed more flexibility during I&T testing and, theoretically, provided the same circuit protection.  Additionally, the desire was to have Transponder OFF during assent.
- The first block diagram that shows the SSPC, actually shows two of them connected in parallel, but it does not say whether this was to handle higher output currents or for redundancy considerations; later diagrams show only one SSPC.
- IC board space constraints were likely the reason for using only one SSPC.

**Lessons Learned Background**

## Lesson #2 Background:
Knowledge of EO-1 SSPC anomaly should have been properly passed onto MAP and IMAGE operations to allow safeguards to be implemented.
IMAGE was launched on March 25, 2000.
First EO-1 SSPC anomaly occurred on September 14, 2001.
Second EO-1 SSPC anomaly occurred on a Wide-band Advance Recorder Processor (WARP) on August 25, 2004.
MAP anomaly occurred on February 17, 2005.
IMAGE anomaly occurred on Dec. 18, 2005.
GIDEPS are not always written for parts anomalies.  
GIDEPs could be useful, but need searchable parts list to really take advantage of.

- Knowledge of EO-1 SSPC anomaly should have been properly passed onto MAP and IMAGE operations to allow safeguards to be implemented.
- IMAGE was launched on March 25, 2000.
- First EO-1 SSPC anomaly occurred on September 14, 2001.
- Second EO-1 SSPC anomaly occurred on a Wide-band Advance Recorder Processor (WARP) on August 25, 2004.
- MAP anomaly occurred on February 17, 2005.
- IMAGE anomaly occurred on Dec. 18, 2005.
- GIDEPS are not always written for parts anomalies.
- GIDEPs could be useful, but need searchable parts list to really take advantage of.

**Lessons Learned Background**

## Lessons Learned Background

- The switched design of the Transponder is not depicted in existing operational documents nor in the PDR or CDR charts.
- - 	IMAGE FRB could not readily identify the Transponder power switching design until multiple sources were consulted.
- -	IMAGE PDR at LMMS was held on 1/21/97, followed by CDR on 8/13/97.  However, the PDU PDR at Litton was dated on 9/25/97, and the Littion PDR showed the “unswitched design”.  Then; the PDU CDR was in December 1997, whereas Litton received an updated copy of the spec (ML3-370B) on 3-10-1998. There was a TIM (Technical Interchange Meeting) on 3-25-1998 at which they marked up the spec, Therefore, the actual electrical design occurred well after CDR, probably extending into the summer of 1998.
- -	The ML3-370B spec, para. 3.6.1, required that "All 28VDC interfaces shall be current limited or otherwise protected with replaceable or resettable protection devices.

**Lessons Learned Background**

## Lesson #4 Background:
Could be accounted for in design if mission lifetime warrants or if possibility of an extended mission exists.
Without adjustments, safing test margins are slowly eroded until such tests are in effect, nullified.
IMAGE Battery 30% SOC test now fires at near depletion of usable battery capacity.
IMAGE might have benefited from the ability to make limited adjustments in Battery SOC tests during some of the longer eclipses.
IMAGE PDU FSW was never designed to be updated.  SCU FSW was designed to be updated and can be since most safing test parameters exist in FSW tables.

- Could be accounted for in design if mission lifetime warrants or if possibility of an extended mission exists.
- Without adjustments, safing test margins are slowly eroded until such tests are in effect, nullified.
- IMAGE Battery 30% SOC test now fires at near depletion of usable battery capacity.
- IMAGE might have benefited from the ability to make limited adjustments in Battery SOC tests during some of the longer eclipses.
- IMAGE PDU FSW was never designed to be updated.  SCU FSW was designed to be updated and can be since most safing test parameters exist in FSW tables.

**Lessons Learned Background**

## Acronyms and Terms (1 of 3)

**A-I**
- ADAC	Attitude Determination and Control System
- AFB	                  Air Force Base
- AMOS               Air Force Maui Optical & Supercomputing or  Air Force Maui Observation System
- AST                  Automatic Star Tracker
- BGS                  Berkeley Ground Station
- C&DH	Command and Data Handling
- CDR  	Critical Design Review
- CCSDS	Consultative Committee for Space Data Systems
- CIDP	Central Instrument Data Processor
- COTS	Commercial Off-The-Shelf
- DDC   	Data Device Corporation
- DPS		Digisonde Portable Sounder
- DSN		Deep Space Network
- EEE		Electrical, Electronic, Electromechanical
- EMC		Electromagnetic Compatibility
- EMI		Electromagnetic Interference
- EOL		End of Life
- ESN		Essential Services Node
- EUV		Extreme Ultraviolet Imager
- FOV		Field of View
- FRB    	Failure Review Board
- FSS		Fan Sun Sensor
- FUV		Far Ultraviolet Imager
- FUV-SI	Far Ultraviolet Spectrographic Imager
- GSE 	Ground Support Equipment
- GSFC	Goddard Space Flight Center
- HENA	High-Energy Neutral Atom Imager
- HK		HouseKeeping
- HLD    	High Level Discrete Driver
- HV		High Voltage
- HVPS	High Voltage Power Supply
- IMAGE	Imager for Magnetopause-to-Aurora Global Exploration

## Acronyms and Terms (2 of 3)

**J - Q**
- JPL		Jet Propulsion Laboratories
- LBH		Lyman-Birge-Hopfield (bands of FUV emissions from N2
- LENA	Low-Energy Neutral Atom Imager
- LEO		Low Earth Orbit
- LGA  	 Low Gain Antenna
- MCP		Microchannel Plate
- MECO	Main Engine Cut-Off
- MD      	Mission Director
- Med-Lite	Medium-Light Expendable Launch Vehicle
- MENA	Medium-Energy Neutral Atom Imager
- MEP		Main Experiment Processor
- MET		Mission Elapsed Time
- MEU		Main Electronics Unit
- MGA   	Medium Gain Antenna
- MI		Magnetosphere Imager
- MIDEX	Medium Explorer
- MMM	Mass Memory Module
- MOMS	Mission Operations and Mission Services
- MOR	Mission Operations Review
- NAI		Neutral Atom Imager
- NASA 	National Aeronautics and Space Administration
- NiCd   	Nickel-Cadmium
- NORAD 	North American Aerospace Defense Command
- PA		Performance Assurance
- PAF		Payload Attachment Fitting
- PDU		Power Distribution Unit
- PVMS	PV Mosfets
- QA		Quality Assurance
- QAE		Quality Assurance Engineer

**R - Z**
- RAAN	Right Ascension of the Ascending Node
- RAD6000 	Radiation-hardened single board computer
- RE		Earth Radius
- RF		Radio Frequency
- RP     	 e.g., in MODEL: RP-212XX , Remote Power
- RPI		Radio Plasma Imager
- S/C		Spacecraft
- SCU		System Control Unit
- SECO	Second Stage Engine Cut-Off
- SEU		Single Event Upset
- SI		Science Instrument
- SMOC	(GSFC) Science Mission Operations Center
- S/N		Signal-to-Noise
- SOW   	Statement of Work
- SRM		Solid Rocket Motor
- SSD   	 Solid State Detector
- SSPC 	 Solid-State Power Controller
- SwRI	Southwest Research Institute
- TAS   	Time-Attitude-Synchronization
- TBD		To Be Determined
- TLM		TeLeMetry
- USSTRATCOM US Strategic Command
- UV		UltraViolet
- VME		Versamodule Europe
- WIC		Far Ultraviolet Wideband Imaging Camera
- WR		Western Range (Vandenburg Air Force Base)
** **