REG NASA-LLIS-0885-2000 Lessons Learned Verify Configuration of Flight Hardware Prior to Test (1998).pdf

1、Lessons Learned Entry: 0885Lesson Info:a71 Lesson Number: 0885a71 Lesson Date: 2000-06-8a71 Submitting Organization: JPLa71 Submitted by: R. Menke, R. Welch, D. OberhettingerSubject: Verify Configuration of Flight Hardware Prior to Test (1998) Abstract: During a system-level ambient functional test

2、of the MPL spacecraft, the software test sequence commanded the gimbaled medium gain antenna through its full range of motion, striking one of the undeployed solar panels. Confirm that developmental and flight hardware is in a configuration that has been reviewed for hardware and personnel safety pr

3、ior to beginning any test sequence and that the appropriate procedure for powering down flight hardware in all test configurations under any potential emergency condition has been determined. Hold a thorough Test Readiness Review using the most current checklist that addresses personnel safety, soft

4、ware and hardware safety, test operations and constraints, fault protection actions, kinematics and interference analysis, commandability, emergency shutdown, and restart procedures.Description of Driving Event: Flight hardware was damaged, and personnel safety potentially compromised, during a syst

5、em-level ambient functional test of the Mars Polar Lander (MPL) spacecraft intended to simulate the mission profile immediately after landing. The software test sequence that was programmed into the vehicle commanded the gimbaled medium gain antenna (MGA) through its full range of motion. This inadv

6、ertently drove the MGA into one of the undeployed solar panels, cracking the composite antenna reflector dish and scratching the substrate of that solar panel.Provided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-refer to D descriptionD MPL in the “Landed“

7、 Configuration A previous test left the solar array configured on the lander in the stowed position. This undeployed mechanical configuration obstructs a full-range-of-motion test of the MGA. As the impending collision was observed, the test conductor attempted to command a halt to the motion. Howev

8、er, the commands did not execute because the uplink path was then in the process of being reconfigured from hard-line to radio frequency. Furthermore, the emergency power-off switch only governed the ground support equipment and could not shut down the spacecraft since it was in a battery-powered fl

9、ight configuration.The primary causes of this test incident were:1. Configuration Control. Failure to confirm, prior to testing, that the lander was in the “landed“ configuration with the solar array deployed to allow full motion of the MGA.2. Flight Design. Omission of a method for emergency remova

10、l of battery power to the vehicle. Reference (2) describes a similar omission.Reference:1. Jet Propulsion Laboratory Problem/Failure Report No. Z47115, September 8, 1998.2. Inadvertent Powering of the Deep Space 2 Mars Microprobe, JPL Lesson Learned No. 0626, June 21, 1999.Lesson(s) Learned: 1. It i

11、s necessary to confirm that developmental and flight hardware is in a configuration that has Provided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-been reviewed for hardware and personnel safety prior to beginning any test sequence.2. Real and potential st

12、ructural interferences should be mapped and documented for all deployable/articulated components on the spacecraft. This should be done for all spacecraft test and operational configurations.Recommendation(s): Where movement of articulated or deployable mechanism is commanded in any test of developm

13、ental and flight hardware:1. Determine the appropriate method and procedure of powering down flight hardware in all test configurations under any potential emergency condition. Never compromise the ability to command the spacecraft/test article while a test is in progress.2. Hold a thorough Test Rea

14、diness Review using the most current checklist that addresses personnel safety, software and hardware safety, test operations and constraints, fault protection actions, kinematics and interference analysis, commandability, emergency shutdown, and restart procedures. This review should include a vehi

15、cle walkdown prior to test and should be attended by subsystem and flight operations specialists to assure that the test remains consistent with constraints.Evidence of Recurrence Control Effectiveness: N/ADocuments Related to Lesson: N/AMission Directorate(s): a71 Exploration Systemsa71 Sciencea71

16、Aeronautics ResearchAdditional Key Phrase(s): a71 Flight Equipmenta71 Hardwarea71 Safety & Mission Assurancea71 Spacecrafta71 Test ArticleProvided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-a71 Test Facilitya71 Test & VerificationAdditional Info: Approval Info: a71 Approval Date: 2000-06-14a71 Approval Name: Eric Raynora71 Approval Organization: QSa71 Approval Phone Number: 202-358-4738Provided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-