REG NASA-LLIS-1711-2005 Lessons Learned - Deep Impact Reiterates the Need for Peer Review and Contractor Oversight (2005).pdf

1、Lessons Learned Entry: 1711Lesson Info:a71 Lesson Number: 1711a71 Lesson Date: 2005-08-29a71 Submitting Organization: JPLa71 Submitted by: Carol Dumaina71 POC Name: Doug Clark, Dan Karmona71 POC Email: Douglas.J.Clarkjpl.nasa.gova71 POC Phone: 818-354-3427Subject: Deep Impact Reiterates the Need for

2、 Peer Review and Contractor Oversight (2005) Abstract: The over-current detection scheme for Deep Impact spacecraft heater circuitry failed to detect an over-current condition during ground test due to an inadequate circuit design and test design. The root cause was inadequate contractor oversight a

3、nd peer review. The lessons learned from the MCO mission loss on the value of detailed technical review and contractor oversight must be re-emphasized, and test configurations should be subjected to FMEA and feature positive controls limiting electrical current.Description of Driving Event: During a

4、 test by a contractor on the heater circuitry in a Thermal Interface Board (TIB) for the Deep Impact Impactor, a ground support equipment (GSE) switch stuck in the closed position. This caused an opto-isolated field effect transistor (FET) switch (Figure 1) to fail in the ON condition (Reference (1)

5、. The TIB controls the heaters for the spacecraft panels, NiH battery, and thrusters, and it is located in the Remote Interface Unit (RIU), an assembly (Figure 2) responsible for engineering telemetry collection and remote subsystem control. Provided by IHSNot for ResaleNo reproduction or networking

6、 permitted without license from IHS-,-,-Figure 1, a color photograph of an FET die appears as a perforated, rectangular, metallic plate withFigure 1. Destructive physical analysis showed electrical overstress damage (indicated by arrow) to the Deep Impact TIB FET die. Figure 2 is a color photo of a

7、laboratory area, where a technician is bent over a partially assembleFigure 2. Installation of the flight Remote Interface Unit (RIU) on the Deep Impact Impactor spacecraft. The GSE switch was a momentary switch mounted on a GSE test box. Its purpose was to short the output of the FET switch to grou

8、nd to verify that the heater over-current detection circuitry and the field programmable gate array (FPGA) could detect a short and shut off the heater. A defect in the GSE switch is suspected to have caused repeated cycles of intermittent contact that kept the input voltage above the over-current s

9、ense voltage level that would have caused the FPGA to trigger a shutdown of the FET switch. In-flight failure or unintentional turn-off of an FET switch (optocoupler) in the TIB controlling the heaters could cause severe under-temperature conditions with catastrophic results. Both the TIB over-curre

10、nt detection circuit and the test configuration were poorly designed by a subcontractor to the JPL system contractor. There was very limited oversight by JPL, with an average of less than one JPL engineers time assigned to monitoring development and test of the Command & Data Handling Subsystem. In

11、addition, a detailed technical review of the circuit schematic performed by engineers with the appropriate expertise would have identified the design error, and a failure mode and effects analysis (FMEA) of the test configuration (Reference 2) would have shown the absence of current-limiting GSE to

12、protect the flight hardware. The value of detailed technical reviews at the assembly and subsystem levels was well established by the JPL Mars Pathfinder project, and JPL took corrective action several years later to require mandatory peer reviews (Reference 3) and contractor surveillance (Reference

13、 4) in the wake of the JPL Mars Climate Orbiter mission loss. References: 1. JPL Problem/Failure Report No. Z79614, February 27, 2003. 2. Flight Hardware Damage Due to Inadequate Test Planning and Insufficient QA Involvement, NEN No. 1201, NASA Engineering Network (NEN), January 1, 2002. 3. JPL Corr

14、ective Action Notice No. Z66277, MCO-JPL/SRB Finding #4.11 (Technical Provided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-Reviews), November 23, 1999. 4. JPL Corrective Action Notice No. Z69129, IG Report/Stephenson Report: Subcontractor Performance, Apr

15、il 28, 2000. 5. Current Limitation is Necessary for All Uses of Power Supplies, NEN No. 1358, NASA Engineering Network (NEN), July 29, 2003. Lesson(s) Learned: 1. Although NASA recognizes the value of contractor surveillance and detailed technical review (including peer review) of in-house and contr

16、actor designs, there is a tendency to sacrifice these functions on cost-capped projects. 2. A design that allows any GSE component failure to propagate to flight hardware or other critical equipment is unacceptable. In this case, a failed GSE switch caused a flight component to fail. Recommendation(

17、s): 1. Assure that adequate funding and provisions for detailed technical review and NASA surveillance of contractors are included in project proposals, project implementation plans, and contracts. 2. Perform adequate analysis (FMEA, etc.) of test equipment (GSE, Bench Test Equipment, etc.) to ensur

18、e that no test-setup failure propagates to critical equipment under test. Evidence of Recurrence Control Effectiveness: JPL opened Preventive Action Notice (PAN) No. Z87371 on August 30, 2005 to initiate and document appropriate Laboratory-wide action on the above recommendations.Documents Related t

19、o Lesson: a71 “Flight Project Practices, Rev. 5,“ JPL DocID 58032, February 27, 2003, Paragraph 5.16.10 (Reviews). a71 “Design, Verification/Validation & Ops Principles for Flight Systems (Design Principles),“ (JPL Document D-17868), Rev. 2, JPL DocID 43913, March 3, 2003, Para. 4.12.5.1 (Flight-Sup

20、port Equipment Interfaces). Mission Directorate(s): a71 Space Operationsa71 Sciencea71 Exploration Systemsa71 Aeronautics ResearchProvided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-Additional Key Phrase(s): a71 Additional Categories.a71 Additional Categ

21、ories.Flight Equipmenta71 Additional Categories.Ground Equipmenta71 Additional Categories.Ground Operationsa71 Additional Categories.Hardwarea71 Additional Categories.Payloadsa71 Additional Categories.Spacecrafta71 Additional Categories.Test ArticleAdditional Info: a71 Project: Deep Impacta71 Year of Occurrence: 2003Approval Info: a71 Approval Date: 2006-06-30a71 Approval Name: tmasona71 Approval Organization: HQProvided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-