1、Lessons Learned Entry: 1412Lesson Info:a71 Lesson Number: 1412a71 Lesson Date: 2004-04-19a71 Submitting Organization: JPLa71 Submitted by: Joseph Savino/Carol DumainSubject: Plasma Arcs from Pyro Firing May Cause Prolonged NSI Shorts (2003) Abstract: NSI firing circuit design has not previously take
2、n into account the high probability of plasma shorts and subsequent hard-shorting, as seen during testing on MER, which allowed ground (chassis) return current during pyrotechnic events. Mars Exploration Rover experience has shown that molten NSI fragments can cause a prolonged NSI pin-to-case short
3、 that can damage flight hardware. Thirteen design, analysis, inspection, and test recommendations in the areas of Parts Selection and Reliability Analysis, Power/Pyro Design, and System Grounding are offered to account for this possibility.Description of Driving Event: During integration and test of
4、 Mars Exploration Rover (MER-A), the 6-amp, Single Point Ground (SPG) fuse-located on the Rover Electronics Module (REM) chassis was found to be blown. The JPL MER SPG Fuse was part of a system design that provided a grounded power bus (through the fuse) while safely allowing for the fault condition
5、 of a high-side power bus short-to-chassis by blowing the fuse and operating in a “degraded“ mode (floating bus). (Since the NSI power source return was connected through the fuse to chassis, plasma short currents went through it.) The blown fuse was in turn attributed to the firing of six pyros fou
6、r weeks earlier to permit removal and rework of a circuit board. Electrical overstress analysis and tests cleared MER-A to fly with the embedded blown fuse, but the failure investigation revealed a previously unrecognized “plasma effect” failure mechanism for NASA Standard Initiators (NSIs).Provided
7、 by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-refer to D descriptionDProvided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-refer to D descriptionDProvided by IHSNot for ResaleNo reproduction or networking permitt
8、ed without license from IHS-,-,-refer to D descriptionDBy design, NASA pyro devices such as cable cutters, pin pullers, and separation nuts incorporate two NSIs. NSI firing always generates some conductive plasma, and MER firing circuits were designed to withstand a pin-to-pin or pin-to-case plasma
9、arc lasting around 5-6 milliseconds after the NSI bridgewire opened. However, designers were unaware that a prolonged NSI pin-to-case short could result due to deposition of molten NSI residual. Thus, the number and magnitude of plasma shorts/ hard shorts on MER were much higher than expected. Pin-t
10、o-case metal deposition occurs after the plasma arc is extinguished, due to zirconium fragments forming a conductive path across the ceramic charge cup. The MER investigation revealed that the path resistance will increase after NSI cool-down, but the resistance will remain too low to safely limit c
11、urrent until the firing relay opens (32 milliseconds) or until the SPG fuse blows. The results may damage circuit components because the firing circuit current is significantly higher during the short, and the circuit elements are not sized to withstand this higher current for a full 32 milliseconds
12、 Later bench tests showed that, depending on circuit parameters, ground fault currents of as much as 15-20 amps for 32 milliseconds were possible.This incident led to a JPL-wide search for all NSIs fired during ground test on flight hardware. They were examined to verify that their resistance, as m
13、easured from the “high side” to the case, post-fire, exceeded 100 kilohm, indicating little shorting effects.These shorting effects do not affect whether the NSI will fire properly since they occur after the firing. Once the NSI fires (within the first millisecond), its job is done and what happens
14、to the remaining circuit components afterwards is moot. The real problem is firing NSIs during test. That is when circuit components may be damaged to the point where the circuit will fail to fire the next time Provided by IHSNot for ResaleNo reproduction or networking permitted without license from
15、 IHS-,-,-(the actual operation). And, the reason that components may have been damaged on MER was that the pyro power bus was grounded through the fuse to chassis, allowing the short current to flow for up to 32 milliseconds. The SPG fuse blowing actually saved the circuit components by limiting the
16、 time of the impressed current on them.References: 1. JPL Problem/Failure Report No. Z80623, May 12, 2003.2. Linda Facto not a rare fault condition. Size pyro circuit elements (resistors, relays, PWB traces) to accommodate the calculated current during the NSI short.2. Include NSI short conditions w
17、hen performing the Parts Stress Analysis and interface failure modes, effects, and criticality analysis (FMECA). Include in the worst case short current calculations (MER had resistive circuit limits of about 10-15 amps) the temperature, age, and pulse duration effects on battery impedance. Also inc
18、lude the temperature and life effects on Provided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-(1) wire impedances and (2) stress limits on series resistors.3. Retain all NSIs and pyro devices that are fired during test on flight hardware in bonded stores
19、until the end of flight operations, and maintain a detailed installation traceability log for each device used.4. Read and record post-fire resistance for each NSI tested on a flight system, high side pin-to-case and low side pin-to-case. Generate a failure report for each NSI with low (out of famil
20、y), post fire resistance. (For example, 100 kilohms).5. If a Single Point Ground (SPG) fuse is used, (1) test the SPG fuse immediately prior to installation onto a spacecraft, after each removal, and after each reinstallation, (2) assure that the SPG fuse is accessible, and include explicit checks o
21、n SPG fuse state in each system test, and (3) exercise each pyro circuit after it is fired during ground NSI firing to verify parts functionality.Power/Pyro Design 6. Do not extend the fire relay pulse time beyond that required with adequate margin to open the NSI bridgewire.7. Minimize the activati
22、on voltage and/or current used in the firing circuit to reduce the potential for NSI arcing or electroplating.8. When using a chassis-grounded firing source, consider a constant current source for the firing circuits.9. Because pyro initiated plasma effects can propagate into other systems and compo
23、nents, it is important to understand, design and test for such effects in a configuration as similar to flight as possible. Be mindful of where the short circuit current will physically flow.10. Select and size the firing circuit components to survive at least 4 firings at maximum possible voltage w
24、ith a NSI high side short to case condition.11. Locate a current limit resistor in the high side line.12. Design the activation current, considering all circuit elements, to be 5-7 amperes for each NSI.System Grounding 13. Before deviating from the JPL “soft ground” design principle (or any other de
25、sign principle), assess the system impact and risk.Evidence of Recurrence Control Effectiveness: Corrective Action Notice No. Z83900 was opened by JPL on May 11, 2004 to initiate and document appropriate Laboratory-wide corrective action on the above recommendations.Documents Related to Lesson: a71
26、JPL Design, Verification/Validation & Ops Principles for Flight Systems” (JPL D-17868)Provided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-a71 JPL Interoffice Memorandum 340-03-020-JLS, “MER Pyro Firing Circuits “Lessons Re-Learned”Mission Directorate(s)
27、 a71 Aeronautics & Space Transportation Technologya71 Earth Sciencea71 Human Exploration & Development of Spacea71 Space ScienceAdditional Key Phrase(s): a71 Energetic Materials - Explosive/Propellant/Pyrotechnica71 Flight Equipmenta71 Ground Operationsa71 Hardwarea71 Parts Materials & Processesa71
28、 Payloadsa71 Safety & Mission Assurancea71 Spacecrafta71 Test & Verificationa71 Test ArticleAdditional Info: Approval Info: a71 Approval Date: 2004-05-20a71 Approval Name: Carol Dumaina71 Approval Organization: JPLa71 Approval Phone Number: 818-354-8242Provided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-
