Launch Lock Mechanism Design Fault Tree Use and Coatings Study 

Daniel Villa* and Gustavo Toledo* 

Abstract  Characteristics of a desi gn process of a launch lock (LL) mechanism are described. This process began  with generation of data that proved a previous design would not perform its function reliably. The redesign was then accomplished through the use of fault tree analysis, which helped make a better connection between requirements and actual failure scenarios. FEA modeling techniques for proper  stiffness verification through testing are explored. Prot o-type testing revealed that coatings at a volatile  spherical joint interface became the primary area of concern as multiple configurations failed. Boron  Carbide, bare AM355 to Ti6Al4V with Braycote 600EF, Tiodize, Diamond-like nano-carbon (DLN), and  improperly configured coatings of MoS 2 and TiCN were all shown to have unacceptable particle  generation. TiCN and MoS 2 doped with SbO 3 and Au were shown to meet cleanliness requirements once  coating parameters were properly controlled.   

Introduction  Launch lock (LL) mechanisms are critical to mission success because they release payloads or unlock  other deployable mechanisms such as gimbals or solar panels. Failure of these mechanisms often  causes complete mission failure. Release and retention mechanisms in just the category of pyro-pin  pullers have had 84 failures over 23 y ears of space mission applications. Investigation has revealed that  35 of these failures were caused by lack of understanding on the part of the personnel in charge of  assuring the devices would work. Twenty-four were caused by poor design practice and incorrect use of  the hardware and twenty-three were attributed to manufacturer’s errors [1].     When an original LL device failed laboratory evaluation, considerable attention and oversight were given  to the reliability and performance requirements of a replac ement design. It was required that a fault tree  be used to analytically demonstrate a mechanism reliability greater than 0.999. The analytical approach  was necessary because reliabilities of these magnitudes require hundreds and even thousands of tests.  For example, to demonstrate 0.999 with a 50% upper confiden ce limit requires 700 te sts with no failures  occurring [13]. Even after such testing, the reliability is strictly based on the testing methodology. The  problem with demonstrating reliability analytically is that it can lead to considerable effort to get the “correct” reliability that may have little practical value. Its usefulness is found in the effort to understand  reliability through a fault tree.       The traditional success criterion for system development is demonstrating requirements have been met  through a qualification process. The problem with this approach is that it often leads the design to not be  subjected to scrutiny beyond the designer’s und erstanding of the requirements. This understanding often  misses how a mechanism is going to fail. An enhanced approach is to include a requirement that  designers think about failure modes through creating a fault tree early in the process. The fault tree could  greatly aid in avoiding much more costly changes when hardware has been made, give a foundation for systematically developing the qualification process, and give a means of centralizing communication of  failure modes for a mechanism.   Proto-type testing revealed that the major issue for the redesign effort was the spherical interface  between the LL unit and the separation element. A spherical interface was chosen to permit an adjustable  design that could meet an unknown tolerance stack -up without any required match  machining operations.  This interface turned out to damage surface coatings  under random vibration due to its nearly underconstrained condition.    * Sandia National Laboratories, Albuquerque, NM 

Proceedings of the 39th Aerospace Mechanisms Symposium, NASA Marshall Space Flight Center, May 7-9, 2008  131