Several important lessons were learned from this design failure and were applied to the mechanism redesign. These are not new lessons for most experienced mechanisms engineers, but show how fault tree  analysis could have helped avoid the problems encountered. 

1. Avoid creating mechanisms with pre-load that transmits into the mechanism outside of its local  plane of operation. Such forces will inhibit ope ration of the mechanism. Tolerance stack-up of  multiple parts becomes a serious factor in loads transmission.  2. Redundancy of operation for a LL type mechanism must be applied with caution. Adding  mechanical mechanism type redun dancy only introduces complexity and gives another way for  the mechanism to release. Two  requirements must be met.  1) The unit will never open unless  commanded (mechanical redundancy often hurts this) 2) The unit will always open if commanded  to (mechanical redundan cy sometimes helps this if complexity does not cause problems). Dual  launch locks on a single deployed structure obviously should be avoided since such a design  would require two releases for successful deployment.  3. The attempt to balance out the forces and im plementation of a ramp were examples of trying to  fix an unstable system by introduction of unstable equilibrium. High sensitivity to being in a  correct locking state and correct placement of the balancing force elements were the variables in  unstable equilibrium. A correctly reset unit could not be visually verified because the mechanism  links were covered. A design should never be implemented which has such sensitivities. Reset  type designs must easily be confirmed to be correctly configured.  4. Avoid mechanisms that push through a pre-load. Pre-load release should usually initiate the  mechanism operation instead of mechanism operation initiating pre-load release. 

Many other problems for the origin al design were identified.   

1. Pre-load was considered as an afterthought. The design was sold on a low shock consideration  that assumed that the pre-load release would be gradual. Overcoming friction was sudden and high shocks resulted.    2. The required pre-load could not even be achieved without doing damage to the mechanism,  which was not observed in analysis because gaps were assumed to be zero.  3. Stiffness of the joint was evaluated as six linear spring constants that were derived from a linear  model. The modeling assumed entire sections of surfaces were welded. The joint stiffness is  actually a function of the pre-load and contact patch sizes that develop because of the geometry  to joint size ratios present. This analysis completely neglected off diagonal terms of a generalized  stiffness matrix.  4. Looseness of the mechanism was not evaluated. One HOP could misalign more than the  required 3 degrees.  5. The separation element (Figure 2) was a square peg in a square hole intended to provide a 6d.o.f  constraint. A good fit could not be achieved with th is design. The peg tended to jam into the  pocket. If it did not jam, it tended to wobble which leads to non-linear stiffness at low load levels.  6. Pre-load was applied through the main body of the entire design. The pre-loading tended to wear  and damage irreplaceable interfaces.  7. The release interface was Ti6Al4V to Ti6Al4V with only Tiodize as a protective coating. The  Tiodize tended to rub off. Probability of cold welding can be greatly reduced by using non-similar  materials, hard coatings, and lubrication.  Design Development Using a Fault Tree

Assuring reliability has several stages. It starts with a robust design that is built to the correct  requirements, continues with a qualification process that must envelope requirements, and must be  followed by correct integration, which does not introduce unknown damage or an un-qualified configuration before the mission commences. Difficulties can often arise due to the lack of passing  common knowledge of previous experts on to new personnel who do not know what is important and who  may be under pressure to finish  the job. A way to minimize this problem  and to establish a common  frame-work for methodically eliminating failure is to make a fault tree the central controlling entity of a  design. Explicit connections of failure mode numbers to analysis, detailed drawings, procedures, and  133