ai-aerospace/ams_data_full_2000-2020 huggingface dataset:
1,50 1.00 0.50 70% _0.50" •-1.00- -1.50- -2.00- -2.50 Figure 15.Cooler coverejection (30me delay) I ! I i I I  I II. II 0.10_0.15 0.20 I I Detachment :', I i I30ms I -,(----#- time(I) SEVIRI coolercoverejection simulation Otherrequirements Tightness Soastoavoidthecontamination oftheinnercavities ofthesatellite duetotheexternal dust,thecover provided effective isolation. Asealmadeofsilicone rubberwasdesigned specifically forthisfunction. It absorbed highdisplacements withlowsealing pressure variations. ventin  Sincetheexternal pressure decreases duringtheascentofthesatellite toitsfirstorbit,theinnerpressure mustbereleased. Forthistohappen, preventing atthesametimethecontamination oftheinnersatellite elements, afiltering devicewasbuiltandasimulation oftheventing process wasperformed (Figure 16). Thefilterprovides alargefiltering surface (pliable supported PTFEmembrane), whichwasfoldedseveral timesforcompactness. Theentirefilterwassealed toavoidundesired leakage. Venting analysis Pint(Pal 180 100000 • --r_iffP_A_ 140 8000_ " "I\ T'2° i60OOO '"__ 10080 40000 ' 60 4O 20000 20 I 0 0 20 40 60 80 100 time(s) Figure 16.Venting analysis Verification Themostimportant testsperformed duringthequaliication stageofthemechanisms were: •Environmental tests:testingthevibration, thermal andacoustic environments. •Functional tests:themostremarkable testwasthejettisoning testwherethejettisoning speedwas measured andtheabilitytorelease thecoverswithout interference wasproved. Another functional testprovedtightness ofthecoverandthesealing system tobeadequate. 49
Figure 17.Bafflecoverjettisoning test Allthetestsweresuccessful, andinsomecasestheresultsmeasured werebetterthanrequired. Conclusion Specific lessons learned: •Detachable preloaded structural jointscanbecalculated sothattwice(instead ofthrice)theRMS valueofrandom external loadsislowerthanthepreload (2(_criterion). Thiscalculation wasusedfor VespelTM'Aluminum andTitanium-Titanium Carbide detachable preloaded joints. Ifthe3(_criterion wereused,itmayleadtoanimpracticable design. Majorachievements are: •Thedesign, analysis andtestofasupport concept forlow-mass structures (suchasprotective covers), including themechanisms torelease orjettison themoncetheyarenolongerneeded. •Thedesign, analysis andtestofahinge,capable ofsupporting highexternal lateralandaxialloads (support), allowing relative rotation motion between theparts(hinge), andofeventually disengaging thepartsforapredefined angle(release mechanism). 50
Misconceptions inMechanism Reliability WalterHolemans" andDonaldGibbons" Abstract Spacecraft mechanisms areinpractice lessreliable thanintended. Today's designs areincreasingly designed inshortertimeswithincreasing reliance onhistorical designdata.Asspacecraft mechanism designs areisreusedindifferent applications andmodified byengineers removed fromtheinitial mechanism designthereisincreasingly moreopportunity tointroduce newfailuremodes. Several misconceptions inmechanism reliability arepresented. Examples demonstrating misconceptions are provided anddiscussed. Themisconceptions presented are:(1)reliability ofamechanism canbe calculated fromthereliabilities ofthemechanism's components; (2)increasing forcewillincrease reliability; (3)themoreexpensive anddifficultthetest,thelessnecessary itistoexecute; (4)addingaback-up component willnecessarily increase reliability; (5)successfully operating amechanism onceindicates high reliability. Introduction Continuing failures ofspacevehiclemechanisms demonstrate alargediscrepancy between predicted reliability andactualsuccess. Despite strongmotivations tobuildreliable hardware, somepresent methods continue toyieldunacceptable results. Partoftheproblem resultsfrommisconceptions abouthow reliability isattained andestimated. Inthespaceindustry, thebest-made launchvehicles andspacevehicles haveafailurerateof1in30while theworstseeafailurerateof1in3.Mostnewrocketcompanies failontheirfirstattempt. Themajority of newendeavors inspace(suchasanewlaunchvehicles ortraveltoanewlocation) endinsignificant degradation ofmission performance orevencomplete mission failure. Manyfailurereviewboardsdonot havedifficulty indetermining thecauseoffailureafterithasoccurred andmanyotherfailurereviewboards havetoolittleinformation onwhichtobaseacause. Itisatragedy thatwecontinue tousetheoperational mission todiscover thesefailures. Thecostofthesefailures issignificant. Twostraight yearsofmassive claimsfollowing satellite androcketfailurehaveknocked several space insurers outofbusiness andcouldresultina30percent dropintheamount ofunderwriting capacity this yearaccording toUSandEuropean insurance officials....figuresintheindustry showunderwriters paidout around$2.5billioninclaimsdunngthepasttwoyears....(Ref.9) Misconceptions canprevent engineers andprogram managers fromtakingsimpleandcost-effective stepsto achieve higherreliability andtheultimate goalofsuccessful operation oftheMechanism through outits' intended mission. Untilwecaneliminate predictable failures fromourmechanisms, including those resulting fromthemisconceptions presented below,ourindustry willcontinue toseeunnecessary catastrophic failureofexpensive satellites andlaunchvehicles. Thefollowing common misconceptions oftenleadtocatastrophic failure: 1.Reliability ofamechanism canbecalculated fromthereliabilities ofthemechanism's components 2.Increasing forcewillincrease reliability •Planetary Systems Corporation, Washington, D.C. •"Lockheed MartinSpaceSystems Company, Sunnyvale, CA Proceedings ofthe34_Aerospace Mechanisms Symposium, Goddard SpaceFlightCenter,May10-12,2000 51
Moreimaginative orexperienced individuals maycomeupwithmanymore(hard-earned) assumptions. If anyoneoftheseassumptions isinvalid,failuremayresult.Withoutverification, including processcontrol andverification testing,allassumptions arepresumptions andaresubjecttobeingwrong. Misconception #2:Increasing ForcewillIncrease Reliability. Thereisalwaysabalancebetween increasing deployment force(ortorqueusedhereinterchangeably) and thestructural marginsintherestofthemechanism. Thismethodisfrequently employed inhingesusedon deploying solararraysandantenna booms. Highforcemarginsareemployed because retarding forcesare oftenpoorlycharacterized orknowntovarywidelyovertemperature. However, theemployment ofhighforce marginsoftenproduce undesired highkineticenergies ofthedeployable leadingtohighloadingattheendof travelorevenovertravelofthedeployable leadingtocollisionandfailure.Whenthehighkineticenergy issueisrecognized, itoftenleadstotheuseofdampers, whichfurtherincreases complexity andcan necessitate evenhigherforcestomaintain deployment marginsagainstincreased parasitic loadsandcan induceevenhigherloadingwithinthemechanism. Asthecomplexity ofamechanism increases, the numberofpossible failuremodesincreases, andtheabilityofthedesignengineer tocomprehensively verify theabilityofthemechanism toperformits'missioniscompromised. Severaldeployables havefailedorbeendamaged, notbyovertravel,butbytheunanticipated behavior of auxiliary devicesaddedtocontroldeployment. OntheMarsGlobalSurveyor (MGS)thisisexactlywhat happened. +Z SolarCells C.P.  c.3 Y S_;_C_lldSHin, e/ _Aero Flow "---" (Nominal) Figure1.MarsGlobalSurveyor andJammed Hinge(Ref.6) Telemetry fromthespacecraft indicates thattheinnerpanelis20.5degrees awayfromfulldeployment. Testsshowthatthehingeisnotlatched. Thefailurescenario thatexplains boththebodyratesduring deployment andwhichisconsistent witha20.5degreeoffsetisthatthedeployment dampershaftsheared offduringdeployment andtheleverthatturnedtheshaftbecame wedgedbetween theinnerpanelandthe yokewherethedamperislocated. (Ref.7) 53
UltimatelyMGSwasasuccess.Itwasonlyabletodosothroughaheroicefforttoredesigntheaero brakingmaneuvers, whichoriginallydependedonafullydeployedpanel,whileen-route. OnMGSacomplex andunreliable mechanism resultedfromtheinitialdesiretohavehightorquemargins. Compensating forthehighenergies thatcamealongwiththehightorquemarginsledtoamechanism of unknown failuremodes. Insteadofattempting tooverpower frictionandotherretarding forces,andthenneedingtoaddcontrolstothe drivingforce,amuchsimplerandmorereliablemechanism mayresultthroughthestudy,testandcontrol thesourceoftheretarding forces. Misconception #3:TheMoreExpensive andDifficult theTest,theLessNecessary itistoExecute. Program managers andcustomers ofteneliminate fullsystems testsbasedoncostandschedule limitations. Cost-Benefit analysis canbeeasytoswayinthedirection ofcostandschedule whenthe benefitsoftestingarenotdetermined untilafterlaunchandafailure.Unfortunately norelationship exists between thecostofatestanditsneedwhichisdrivenbytheengineering requirements. Furthermore, the morepermutations ofassembly, operation andenvironment, themorewaysamechanism canfail.Thusfull systems shouldbetestedmorethansubsystems, notless. 10000 1000 NUMBER OF DEVELOPMENT 100 FLIGHTS 10 1•TOWSURFACE LAUNCHED MISSILES •STINGER•TOMAHAWK •MX ARIANEV• I I I I UNITCOST(1978DOLLARS) Figure2.Development Testing ofSurface Launched Missiles (Ref.4) Manysystems inspacecraft mechanisms exhibitsimilarity tothetestinginFigure2:inseparation systems, boltcuttersareoftenlottested,buttheseparation systemasawholeisnot.Itisrelatively easy totestonehundred boltcutters. Boltcuttersarenot,however, separation systems. 54
Thesourceoffunding topayforincreased testingisnotintended tobewithinthescopeofthispaper. However, testingshouldonlybeforegone whenthevalueofanadditional testisknowntobenegligible. knowledge, however, canonlycomeaboutfromprevious testing.This Ifthereisdoubtthatpeoplemakethismisconception, lookatitanother way.Isitpossible thatatestthat isperceived assimpleandinexpensive torunisrunfrequently without respect totheusefulness ofthedata collected? Although anidealtestwouldbesimple, inexpensive, andgenerate alotofusefuldata,most usefultesting, isrelatively expensive, complex andrequires intimate understanding ofthehardware under test. Hereisanother lookatwhythismisconception isnottrue.Fromalogicalanalysis perspective ifthe misconception istruethenthecontrapositive isalsotrue.Thiswouldmean"Ifatestisexpensive thenitis notnecessary toexecute" and"Ifatestisnecessary toexecute thenitnotexpensive" arebothtrueorboth false.Necessary testsareoftenexpensive, therefore thismisconception isfalse. Engineers, managers andcustomers mustbeawarethatuntested hardware hasuntested reliability, and statements ofreliability aboutthishardware arecompletely speculative. Misconception #4:Adding aBack-Up Component willNecessarily Increase Reliability. Theassumption thataback-up component willincrease system reliability ispredicated ontheassumption thefailureofeithertheback-up orprimary component willnoteffectthereliability oftheother.Inother words,thefailuremodesareisolated. Onesuchplacethismethod isusediswithsprings (Figure 3).Upondetailed examination ofthisdesignit isapparent thatthisdesignhasseveral failuremodesthatwouldnotexistinadesignusingonespring: 1.Ifoneofthesprings isbrokenitmaylodgeinthepathofthenon-redundant components, blocking motion 2.Thereisasignificant difference inoperation oftheworking springwhentheotherspringfails.This canleadtohighstresses oftheunfailed spring. 3.Theredundant mechanism hasfourmodesofbehavior (compared totwointhesinglespring), allof whichwillneedtobetested. 55
rq_kV r_ 0"WORKING AREAOFI_3H FRICTION UNMATCHED SPRINGS WILLINDUCE HIGHER FRICTION INBEARING Figure3.Illustrative Example: Comparison ofaSingleSpring Driven Mechanism toaDesign withaBack-Up Spring Thedesignwiththeback-up springposesseveral challenging problems thesinglespringdesigndoesnot have: 1.Thesprings havetobewellmatched toavoidhighfrictioninthebearings andhighforcesinthe otherelements ofthemechanism 2.Failureofonespringwilldramatically increase frictionforcesinthebearing 3.Thesprings mayneedadditional support toprevent buckling 4.Required volume ishigher 5.Thenumber ofmodesofoperations toverifybytestincreases atleast2times 6.Massishigher 7.Thefailedspringmayinhibittheoperation oftheworking spring Although thedualspringdesignabove(Figure 3)couldbemodified tousetwoconcentric springs, the designed mustconsider theinteraction ofbothfailedandunfailed springs, andtheneedtomatchrateand forceoutputtocreateatrulyredundant system. Without acorresponding increase indesignandtesteffort,thedesignwiththeback-up springmaybeless reliable because itcanfailinmanymoreways. Thedifficulty ofanticipating andcontrolling newfailuremodesunderscores thechallenge ofmaking truly redundant spring-driven mechanisms. Thisisbecause theyarephysically connected; nomatterhow tenuous thatconnection, therestillexistsmanypathsbetween thefailedspringandtheworking one. Additionally, theintroduction ofnewpotential failuremodes, andtheresultant operation ofwithasingle 56
component failure,requirestheunderstanding ofamorecomplexsystemaswellastheneedfortesting additionalmodesofoperation. Somemechanism designpracticesadviseatleastatwotooneforceratio(100%margin)fordeployment in thenormaloperatingcondition.Doesthischoiceofforcemarginprovideredundancy? Notunlessthefailure ofonespringdoesnotaddanyadditionaldragtothesystem.Althoughhavingapositivemarginwithaone springfailedcaseisabasictenantofmechanism design,thisconditioncanbedifficulttocharacterize and equallydifficulttoverify.Also,withthecorresponding increaseinenergy, theimpactofthedeployable at theendoftravelisgreaterreducing thestructural margins orthebearing margins. Evenwiththeaddition of adamper todissipate additional energyfromaddedsprings, theaddedcomplexity andfailuremodesmust betakenintoaccount. Oftenthebestunderstood andcharacterized components arethefirstcomponents addedasbackups. Typical designs employ dualsprings anddualpyrotechnics. Adding redundant drivespringsfordeployables isaconfounding choiceinaback-up component, because springs areexceptionally wellunderstood components. Springs failfromoverstress, corrosion, orbecause ofinadequate manufacture, andare employed inanenormous number ofapplications. Asaresulttheyarewellunderstood andcanbemadeto lastforbillionsofcycles(asinintakeandexhaust valvesprings ininternal combustion engines). Acounter argument tothisMisconception isthataredundant springcompensates fortheprobability of failureduetoimproper designandorimproper manufacture. Ifwecannotmakeasinglespringworkreliably, whatreasondowehavetobelievethatwecanmakeamechanism thatusestwoormoresprings work reliably? Ifsystem reliability isthegoalthenwhynotdesignforreliability ratherthanforredundancy. Ifthereliability ofamechanism component item(spring, pyrotechnic, bearing, orothermechanism component) isknown, thensubstantial information derived fromeitherfailedorthoroughly testedpartsshouldbeavailable to substantiate allofthefailuremodes. Instead ofaddinganother component (ofunacceptable orunknown reliability), whynotsimplyremove thesources offailureoftheitemunderconsideration tobedoubled up withtheintentofproviding redundancy? Giventhehighburdenofachieving trueredundancy, andthecostof proving thereliability ofamorecomplex redundant system, consider thequestion: "HowdoIachieve reliability?" Itisnotatallclearthatinpractice addingaback-up springmustincrease reliability. Although itmay increase reliability, itmaywelldecrease reliability, whilesimultaneously increasing cost,weightandvolume. Misconception #5:Successfully Operating AMechanism OnceIndicates HighReliability Successfully operating amechanism onceonlyindicates areliability of0.5withaconfidence levelof50%. Inotherwordswithonetestyouare50%surethatthenextoperation willbeasuccess. Whatifthenext testisflight? Table1listshowtestingisrelatedtoreliability andconfidence level.Itisonlyvalidiftherehavebeenno failures inthesamples tested. 57
Table1.Number ofNoFailure Testsversus Reliability andConfidence (Ref.1) CONFIDENCE LEVEL RELIABILITY 50.0% 70.0% 90.0% 99.0% 99.5% 99.9% 0.999999 693,147 1,203,972 2,302,584 4,605,168 5,298,315 6,907,752 0.9999 6,931 12,039 23,025 46,049 52,981 69,074 0.999 693 1,203 2,301 4,603 5,296 6,904 0.99 69 120 229 458 527 687 0.98 34 60 114 228 262 342 0.97 23 40 76 151 174 227 0.96 17 29 56 113 130 169 0.95 14 23 45 90 103 135 0.94 11 19 37 74 86 112 0.93 10 17 32 63 73 95 0.92 8 14 28 55 64 83 0.91 7 13 24 49 56 73 0.8 3 5 10 21 24 31 0.7 2 3 6 13 15 19 0.6 1 2 5 9 10 14 0.5 1 2 3 7 8 10 Eventestingamechanism 10timeswillnotmeetthereliability requirements ofmostmissions. Itisnot untilamechanism istested100to1,000times(withsuccess) thatthereliability ishighenough with confidence thatitmaybeaddedtothegreater vehicle. Clearly, havingadesignthatisinexpensively tested isofconsiderable value.Conversely, amechanism thatcannotbetestedorwillnotbetestedshouldbe viewedwithalarm. Onetestofamechanism isoftenbetterthannonesincemanymechanisms uponinitialtestinghavea reliability ofzero.Themosttragicaerospace mechanism failurein1999illustrates thisbest: "AirForceSpaceCommand released todaytheresultsofitsinvestigation intothefailureoftheInertial UpperStage,or/US, duringaTitan/VB launchonApril9,1999,fromCapeCanaveral AirStation, Fla.The booster and/US werecarrying aDefense Support Program satellite. TheAccident Investigation Board, convened bythecommander ofAFSPC, determined thatthemission failedbecause ofanincomplete separation of/USStage1from/US Stage2caused whenaninterstage electrical connector plugfailedto release. Investigators concluded thatthermal wrapandtapeapplied totheharness andconnector prevented theproperdisconnection oftheplug."(Ref.5) ForDSP,theirtestingoccurred ontheflight.Thecostofthespacecraft andlaunchvehicle isestimated to exceed $650million. TheGalileoHighGainAntenna (HGA)failureresulted inreduced mission performance. Thecauseofthe failureissummarized below. ThefailureoftheGalileoHGAwasnotdetectable within-airtesting, duetothechoiceoftitanium forthepin material. Sincethismaterial reactswithoxygen soreadily, thein-airfrictionchange, duetothedamaged surfaces, wasnotdetectable because thehigherfrictioncoefficient (0.35vs.O.05)was nothighenough to berestrained bythe90degreeincluded angleofthereceptacles, Asaresultmoredeployment testsinair wouldonlyhavewornoutthednvesystem. Also,thevacuum deployment testoftheflightantenna didnot exhibitthisfailuremodeduetothelackofpinandsocketrelative motion[duetoshipment oftheantenna 58
assembly]. Thetestconditions werenotadequate forfindingthisproblem indicating thatjustafunctional testinvacuum isnotalwaysappropriate. (Ref.8) Basedonthisassessment, onefunctional testinthermal vacuum wasnotadequate tofullyscreenthe antenna forthemostimportant failuremode.Additional testsincluding investigation ofthewearbehavior on themechanism mayhavebeenabletopredictthisproblem. Inthebathtub failureratemodeltheso-called "infantmortality period"ofperformance isanother reasonto testwellbeyond several cycles. Inmanyterrestrial mechanisms, thebehavior ofamechanism duringthe firstfewusesissignificantly different thanthebehavior inthenextseveral thousand. Instead offailingonthe firstattempt, failuremayhappen inthesecond, thirdorfourthcycle.Mechanisms thatareexpected to seriously degrade withinseveral testsshouldbereconsidered: theinfantmortality periodmayoverlap with thewear-out period,theusefullifeperiodmaynotexist. Infant WearoutMortalityI --S-'IrY LLUsefulLife Operating Cycles Figure4.Bathtub Failure Rate TheSpaceShuttleattheignitioneventdemonstrates effortstotesthardware priortoflight.TheSpace ShuttleMainEngines (SSMEs) areignitedandgimbaled priortoignition ofthesolidrocketboosters (SRBs). Thisallowsautomated testingtodetermine iftheengines areoperating properly. Iftheyarenot, theycanbeturnedoffandtheentiremission aborted. Thiscapacity totestflighthardware decreases the possibility ofcatastrophic failure. Unfortunately thisisnotthecasefortheSRBs. Despite yearsof operational experience andwell-developed inspection requirements, onseveral occasions ithastakenuntil thefiringoftheSSMEs onesecond priortolift-offtodetectpotentially catastrophic failuremodes. The capacity totestmayhavesavedlivesanda$2billionvehicleonseveral occasions. 59
Conclusions •Thereliability ofamechanism oracollection ofmechanisms canonlybeknownwithconfidence through exhaustive testing. •Instead ofaddingaback-up component (attempting redundancy) itmaybeeasiertosimplytestthe singlestringitemandremove itsfailuremodes, thusattaining thedesired system reliability. •Increasing forcesofdrivingcomponents ofamechanism doesnotnecessarily increase thereliability of themechanism asawhole. •Thereisnorelationship between thecostofatestanditsnecessity. •Addingback-up components oftenonlyincreases complexity without affecting reliability. •Justbecause amechanism worked wellthefirsttimedoesnotindicate highreliability. •Without comprehensive testingofamechanism, estimates ofreliability arepurelyspeculative. References 1.Conley, Peter(Editor). SpaceVehicle Mechanisms: Elements QfSU(;:CeSSfUI Design. JohnWiley& Sons,1998 2.Mosher, Todd,etal._Evaluating SmallSatellites: Istheri_,kworthit?,Proceedings ofthe13_Annual AIAA/USU Conference onSmallSatellites, August23-26,1999. 3.Auer,Werner. Reliability andTesting, 30thAerospace Mechanisms Symposium, NASAConference Publication 3328,May1996,HeldinHampton Virginia May15-17,1996. 4.Augustine, Norman R.Augustine's Laws,Penguin Books,1983 5.AirForceSpaceCommand NewsService, DSP-19 Accident Investiqation BoardRelease RC'_ults, August 17,1999 6.Johnston, M.D.,P.B.Esposito, V.Alwar,S.W.Demcak, E.J.Graat,R.A.Mase.MarsGlobal Surveyor Aerobrakinq AtMars,AAS-98-112, JetPropulsion Laboratory, California Institute ofTechnology, Pasadena, CA,1998 7.Lyons,D.T.MarsGlob.a.!Surveyor: Aerobraking withaBrokenWina,AAS/AIAA Astrodynamics Specialist Conference, AAS-97-618, SunValley,ID,August4-7,1997. 8.Johnson, Michael R.,TheGatil@oHighAntenna Deployment Anomaly, Cleveland, Ohio,USA,May,1994. 9.Spacecraft Losses MakeInsurers Wary,SpaceNews,p3,7February, 2000 6O
Lessons Learned fromtheManufacturing andTest oftheInternational SpaceStationDriveLockAssembly CurtisAIImon" Abstract TheDriveLockAssembly (DLA)isapartoftheSolarAlphaRotaryJoint(SARJ)andfunctions asthe primarydriveforthejointanddoublesasalockingmechanism (seeFigure1).TheSARJDLA(SDLA) consists ofover200piecepartsthatwhenfullyassembled, formauniqueandcomplex mechanism. Through thecourseofmanufacturing andtest,manyinteresting problems wereencountered, producing the needforasignificant amountoftroubleshooting, andintheend,leadingtomanyimportant lessonslearned. Thefocusofthepaperwillbetheselessonsleamed,however, inordertofamiliarize thereaderwiththe assembly, sometimewillbespentaddressing themaindesignfeatures andthedesignevolution.  SDLA Figure1:SolarArrayAlphaJoint(SARJ) *Lockheed MartinSpaceSystems Company, Sunnyvale, CA Proceedings ofthe34_Aerospace Mechanisms Symposium, Goddard SpaceFlightCenter,May10-12,2000 61