REG NASA-LLIS-0766-2000 Lessons Learned - Reliability Considerations for Launch Vehicle Command Destruct Systems.pdf

1、Best Practices Entry: Best Practice Info:a71 Committee Approval Date: 2000-04-06a71 Center Point of Contact: MSFCa71 Submitted by: Wilson HarkinsSubject: Reliability Considerations for Launch Vehicle Command Destruct Systems Practice: Use built-in redundancies, safe and arm provisions, approved and

2、qualified initiators and detonators, shaped charge development testing to collect empirical data for design (empirical testing), and fail-safe designs to achieve reliability in launch vehicle command destruct systems.Programs that Certify Usage: This practice has been used on Saturn I, IB, and V, Ex

3、ternal Tank prior to 1996, and Space Shuttle Solid Rocket Booster (SRB).Center to Contact for Information: MSFCImplementation Method: This Lesson Learned is based on Reliability Practice number PT-TE-1438 from NASA Technical Memorandum 4322A, NASA Reliability Preferred Practices for Design and Test.

4、The benefits of implementing the practices spelled out herein are protection against inadvertent activation of the launch vehicle command destruct system, reliable activation and operation of the command destruct system in the event of vehicle malfunctions, and protection of the mission hardware and

5、 personnel prior to and during the launch.Implementation:Provided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-Introduction:The Space Shuttle Command Destruct System (CDS) is a triplex configuration providing a redundant subsystem on the SRB. The CDS consi

6、sts of RF receiving elements, dedicated power sources and pyrotechnics. When activated, the CDS terminates the thrust of the SRB by pyrotechnic charges that sever the Solid Rocket Motor (SRM) cases along 70 percent of their length.The SRB onboard command destruct system allows the Range Safety Offic

7、er to intentionally destroy the SRB in the event of flight path deviation, improper flight parameters, or inadvertent separations.The Command Destruct System consists of the components and quantities listed in Table 1.refer to D descriptionD Figure 1 is the SRB CDS Functional Diagram.Provided by IHS

8、Not for ResaleNo reproduction or networking permitted without license from IHS-,-,-refer to D descriptionD Ground commands arm the safe and arm (S&A) device approximately five minutes prior to SRB ignition. If destruct action is required, the nominal range safety destruct procedure will consist of e

9、nergizing the “arm“ command several times, application of a one second pause, then energizing the “fire“ command several times or until the destruct action is accomplished. The fire command to the Pyrotechnic Initiator Controller (PIC) discharges its capacitor, igniting the NSD. The detonation from

10、the NSD is propagated through the S&A device transfer charge and the CDF train to the linear shaped charge (LSC). The detonation output of the LSC cuts the case along 70 percent of the length of the Solid Rocket Motor causing destruction of the SRB.Reliability Considerations:The minimum overall syst

11、em reliability goal for the Command Destruct System is 0.999 at a 95 percent confidence level. Some reliability considerations considered during design, development, qualification, and acceptance testing are listed below:1. Elimination of single point failures.2. Redundancy.3. Fail-safe functions.4.

12、 Personnel properly trained in handling, assembly, installation, and checkout of command destruct systems.5. Development testing, qualification testing, and, especially, acceptance of every pyrotechnic device lot manufactured are monitored by engineering and quality personnel.Provided by IHSNot for

13、ResaleNo reproduction or networking permitted without license from IHS-,-,-6. Adherence to the provisions of NHB 5300.4 (ID-2), “Safety, Reliability, Maintainability, and Quality Provisions for the Space Shuttle Program.“7. Redundant paths are verified by test.8. Electronics and cables are checked o

14、ut after installation down to NSI installed in the NSD.9. NSD bridge wire resistance is verified after installation.10. Safe & Arm device function is verified after installation.11. Other reliability analysis such as Worst Case, Fault Tree, FMECA, Parts Stress, Single Event Effects, Thermal/Structur

15、al Strength, and Sneak Circuit Analysis should also be performed, where applicable.Design methods for reliable Command Destruct Systems are listed below:1. Separation of redundant equipment except the Range Safety Distributor, Hybrid Coupler, Safe and Arming Device, and dual systems mounted on the s

16、ame mounting panel.2. Provide a fail-safe design for ascent critical functions.3. The Command Destruct System operates in a standby mode for ascent and is exempt from in-flight redundancy verification.4. The Command Destruct System electronics include sufficient instrumentation to provide self-diagn

17、ostic ground indicators except for the PIC which uses built-in test equipment for the ground checkout of the pyrotechnic electronics. Demating of electrical cables is not permitted except for the NSD.5. Redundant components susceptible to contamination or environmental failure are separated.6. Inadv

18、ertent electrical shorting due to debris is prevented by design.Design engineering and quality engineering review and approve manufacturing procedures and processes. Quality engineering also reviews and approves inspection criteria required to ensure that qualification and flight hardware are free o

19、f defects.Development testing, qualification testing, and acceptance testing are principal methods by which pyrotechnic devices are proven to meet design requirements and to meet the reliability levels necessary for manned launch vehicles. All test records and data are reviewed by NASA and prime con

20、tractor engineering and quality personnel.The Eastern Space and Missile Center Range Safety Officers approval is required for Command Destruct System conceptual design, detailed design, qualification/acceptance test requirements, range prelaunch test requirements, test plans and procedures, installa

21、tion and checkout procedures, failure corrective action, and launch approval.Technical Rationale:The design, manufacture, testing, and launching of the Command Destruct Systems have been proven over a period of more than 30 years. The Command Destruct Systems for the SRB have Provided by IHSNot for

22、ResaleNo reproduction or networking permitted without license from IHS-,-,-flown on the Space Shuttle for over 70 flights without a failure.References1. AFETRM 127-1: “Eastern Range Regulation,“ Range Safety Space Command, United States Air Force, June 30, 1993.2. NSTS 007700: “Space Shuttle Flight

23、and Ground System Specification,“ Program Definition and Requirements, Volume X, Book 1, NASA, Johnson Space Center, Houston, TX, 77058, June 4, 1993.3. NSTS 08060: “Space Shuttle System Pyrotechnic Specification,“ NASA, Johnson Space Center, Houston, TX, 77508, February 11, 1994.4. 30A90506D: “Shut

24、tle Range Safety Command Destruct System Specification,“ NASA, Marshall Space Flight Center, Marshall Space Flight Center, AL, 35812, June 5, 1989.5. 10MNL-0030: “Solid Rocket Booster/External Tank Pyrotechnic System Handbook for Space Shuttle,“ Volume I and II, NASA, Marshall Space Flight Center, M

25、arshall Space Flight Center, AL, 35812, July 14, 1989.Impact of Non-Practice: Not adhering to the proven practices for the design, manufacture, and testing of the Command Destruct System could result in premature detonation of pyrotechnic devices which would terminate the SRB resulting in loss of mi

26、ssion, possible loss of crew, and possible injury and loss of life at the launch site.Related Practices: N/AAdditional Info: Approval Info: a71 Approval Date: 2000-04-06a71 Approval Name: Eric Raynora71 Approval Organization: QSa71 Approval Phone Number: 202-358-4738Provided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-