1、Lessons Learned Entry: 1796Lesson Info:a71 Lesson Number: 1796a71 Lesson Date: 2007-5-15a71 Submitting Organization: JPLa71 Submitted by: Todd BayerSubject: MRO Waveguide Transfer Switch Anomaly Abstract: A waveguide transfer switch failed five months after the insertion of Mars Reconnaissance Orbit
2、er into Mars orbit. The likely cause was debris-induced RF breakdown that pyrolized a polyimide tape window in the switch, injecting additional debris that jammed the switch. Thirteen measures are recommended in the areas of waveguide fabrication, RF system/materials design, mission design, and exem
3、ptions to the JPL single-point failure policy.Description of Driving Event: Jet Propulsion Laboratory (JPL) mission design principles place a high value on maintaining communications with Earth at all times when the spacecraft is not occulted (Reference (1). The Mars Reconnaissance Orbiter (MRO) fli
4、ght system achieves this for both the uplink and downlink radio frequency (RF) signals by antenna swaps accomplished by actuation of RF switches. (In contrast, some JPL spacecraft meet this goal using redundant RF amplifiers and transponders.) For the downlink signal, MRO employs a Waveguide Transfe
5、r Switch (WTS), an electromechanical device that allows RF energy entering through one port to be routed during spaceflight to one of several output ports (Figure 1). This switching allows a 100 watt microwave downlink signal to be sent from one of the two available amplifiers out to one of two diff
6、erent radiating antennas. Provided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-Figure 1 juxtaposes a color diagram of the TWTA panel with a color photo of the same item. The diagram depicts the layout of the approximately triangular panel. The panel appea
7、rs to be a fairly thick board on which is mounted a number of components that are spaced apart. Somewhat tubular items attached to the panel include two TWTA and two multiplexers. Two X-band and two Ka-band high voltage power supplies (HVPSs) stick up orthogonal to the panel, as does the waveguide t
8、ransfer switch located towards the center of the panel (and between the two TWTAs). The photo does not show the entire panel, but is a close-up of the portion with the waveguide switch. The switch is quite large relative to the other components: it appears to mass larger than a TWTA and at least hal
9、f the size of a HVPS. No dimensions are provided in the images.Figure 1. Traveling Wave Tube Amplifier (TWTA) Panel LayoutFive months after the insertion of MRO into Mars orbit, a WTS failed to actuate. The onboard software maintained the commanded downlink configuration by commanding a switch to th
10、e redundant X band amplifier. Telemetry indicates that the switch is stuck between its two nominal positions, causing the switch rotor (visible in the center of Figure 2) to partially block the RF energy passing through the switch. This has resulted in a downlink RF power loss (of about 1 dB), and a
11、 temperature increase (of about 15 deg C) caused by absorption and dissipation of the reflected energy (Reference (2). The most likely root cause of the switch failure has been identified as conductive debris (perhaps from flaked plating) floating in the zero gravity environment. This debris may hav
12、e eventually come into contact with one of the polyimide tape windows at Port 1 or 2 of the WTS during MRO aerobraking (Reference (3). These windows are used as a contamination barrier on the WTS RF ports, but they may have contributed to the severity of the anomaly. Vent holes in the windows can ad
13、mit contamination, adhesive on the inward-facing side of the tape can entrap it long enough to initiate RF breakdown, and the breakdown can cause the polyimide tape itself to pyrolyze (see Figure 3), injecting a large amount of polyimide debris into the switch and causing it to bind. Polyimide films
14、 or tapes are widely used in aerospace applications due to their light weight, durability, and performance in extreme temperature environments. The design of polyimide RF contamination barriers varies across JPL projects: they vary in thickness and type (i.e., tape vs. film), and MRO may have been u
15、nique in using vent holes. Also, the somewhat unusual MRO operational practices of (1) frequently switching antennas (720 times) to maintain communications during the orbit, and (2) using a switch to change antennas instead of powering alternating amplifiers, may have transformed a minor debris prob
16、lem into a stuck switch. Provided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-Figure 2 is a color photo of the body of the failed waveguide transfer switch. At the center of the all-metal switch body is a rectangular opening. Inside the opening is visible
17、 the outer surface of the metal switch rotor. A torn slip of paper has been inserted into the opening, between the rotor and the inside of the switch housing, indicating that there is barely enough tolerance between the housing and the rotor to insert such a slip of paper. No dimensions are provided
18、 in the image.Figure 3 is two color photos depicting two views of the polyimide tape window, labeled ?Front? and ?Back.? The photos show a thin silvery frame. Attached to the edges of the frame is a yellowish film. The film clearly covered the entire interior window of the frame, except most of the
19、film has melted away in both views. A black char lines the edges of the missing material.Figure 2. Post-failure tests showed that materials like polyimide tape or paper (shown here) could block rotation of the switch rotor and jam the switch.Figure 3. Testing showed that, under RF power, foreign obj
20、ect debris (half-inch long aluminum sliver) on or near the polyimide tape window could induce RF breakdown, destroy the window, and produce additional debris.The WTS had been exempted from JPLs policy prohibiting designs with single-point failures because a “stuck between normal positions“ switch fa
21、ilure mode was not considered credible. Although the failure has decreased the downlink margin (from an available margin of at least 3 dB), neither the RF power loss nor the temperature increase poses a threat to the mission, and the system is performing as it would had the WTS failed in a nominal p
22、osition. However, movement of the root cause debris could cause additional RF breakdowns and damage to other components, and movement of the WTS to a fully blocked position could cause loss of mission both low likelihood events. References: (1) “Design, Verification/Validation and Operations Princip
23、les for Flight Systems (JPL Design Principles Standard)“, JPL Document No. D-17868, Rev. 3, Paragraph 3.1.2 (“Communications During Mission-Critical Events“), December 11, 2006. (2) “S/C Swap to TWTA 2,“ Incident/Surprise Anomaly (ISA) Report No. Z89130, Jet Propulsion Laboratory, August 16, 2006. (
24、3) “Mars Reconnaissance Orbiter Waveguide Transfer Switch Final Report,“ Jet Propulsion Laboratory Document No. JPL D-31194, March 30, 2007. (4) “Flight Project Practices, Rev. 6,“ JPL Document No. DocID 58032, March 6, 2006. Lesson(s) Learned: A telecommunications system design that places mechanic
25、al switches with polyimide tape windows in an active RF path may result in in-flight RF breakdown, followed by injection of pyrolyzed polyimide debris into the switch, jamming of the switch, and loss of a downlink or uplink string.Provided by IHSNot for ResaleNo reproduction or networking permitted
26、without license from IHS-,-,-Recommendation(s): Prevention 1. When designing high power RF systems, serious consideration should be given to the role of contamination in causing RF breakdown.2. Consider materials other than polyimide tape or film for use as contamination barriers. Alternate material
27、s should not be damaged by RF breakdown, and should be thicker than the clearance between switch rotor and housing.3. Polyimide film may be an acceptable alternative to polyimide tape. Even though it is the pyrolysis of the polyimide material that produces debris, the adhesive on tape (1) adds signi
28、ficant entrapment mechanisms that encourage RF breakdown and (2) increases the likelihood that debris generated by window destruction will cause rotor stiction.4. The institution should review and standardize usage of polyimide materials as RF contamination barriers.5. Venting should be accomplished
29、 by some means other than holes in the RF windows. A polyimide tape window cannot function as both a contamination barrier and a vent path.6. To the extent practical, venting of the waveguide elements should be designed to direct gas flow away from contamination sensitive components such as waveguid
30、e switches.7. Although the data does not support atmospheric pressure being the cause of the MRO RF breakdown, it has not been completely ruled out as a contributing factor. The lack of absolute proof suggests that a prudent course for future aerobraking or aerocapture missions would be to design fo
31、r critical pressure from the outset.8. Future projects should consider alternative ways of meeting the twin goals documented in the JPL Design Principles (Reference (1) of continuous spacecraft-Earth communication and (2) minimizing component power cycles and/or RF switch cycles, by such means as pa
32、ssive coupling, polarization diversity, etc.9. When a telecommunications design features active switching like MRO, consider alternate switching methods. For some designs, use of redundant amplifiers and transponders may be less risky than RF switch actuation. The cycle life of electronics is probab
33、ly easier to verify than the cycle life of electromechanical devices, particularly where there may be contamination.10. The flex waveguide is a potential (though not proven) source of the MRO debris. The MRO flex waveguide was manufactured by mechanical corrugation (“crunching“) of rectangular coppe
34、r tubing, which may create debris in a hard-to-inspect part. Consider electroforming, a newer process for fabricating flexible waveguides that is less likely to produce manufacturing debris.11. The institution should assure that the spacecraft and mission design reflect the provisions relating to re
35、dundant hardware, electromechanical devices, and continuous spacecraft-Earth communication that are found in the JPL Design Principles (Reference (1) and JPL Flight Project Practices (Reference (4) requirements documents.Mitigation 12. Flight projects should reconsider requesting an exemption to the
36、 single-point failure policy that would permit an intermediate position for a waveguide switch similar to the waiver granted MRO (and other recent projects). Projects using waveguide transfer switches should ideally design their spacecraft to be robust in the face of a failure between positions, inc
37、luding such considerations as: - Protecting amplifiers from reflected RF power (e.g., use of isolators) - Verification of relevant component performance in the presence of reflected RF power - Telemetry points sufficient to unambiguously diagnose the condition - Onboard fault protection response (e.
38、g., redundancy management, logic for retries)Provided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-13. When evaluating electromechanical devices such as waveguide switches, add torque margins to mitigate against contamination. Evidence of Recurrence Contro
39、l Effectiveness: JPL will reference this lesson learned as additional rationale and guidance supporting Paragraphs 3.1.2.2 (Redundant Data Paths), 4.2.2.11 (Contamination Avoidance), 4.2.3.3 (Actuator Design Margins), 4.5.1.2 (End-to-End System Design), 4.5.5 (Telecommunication System Margins), 4.12
40、.1.6 (Fault Containment Regions), 4.12.1.7 (Contamination), and 4.12.2.3 (High Voltage Designs) in the Jet Propulsion Laboratory standard ?Design, Verification/Validation and Operations Principles for Flight Systems (Design Principles),? JPL Document D-17868, Rev. 3, December 11, 2006.Documents Rela
41、ted to Lesson: N/AMission Directorate(s): a71 Space Operationsa71 Sciencea71 Exploration SystemsAdditional Key Phrase(s): a71 Missions and Systems Requirements Definition.a71 Missions and Systems Requirements Definition.Planetary entry and landing conceptsa71 Systems Engineering and Analysis.a71 Sys
42、tems Engineering and Analysis.Mission and systems trade studiesa71 Systems Engineering and Analysis.Mission definition and planninga71 Engineering Design (Phase C/D).a71 Engineering Design (Phase C/D).Orbiting Vehiclesa71 Engineering Design (Phase C/D).Spacecraft and Spacecraft Instrumentsa71 Safety
43、 and Mission Assurance.a71 Safety and Mission Assurance.Reliabilitya71 Additional Categories.a71 Additional Categories.Communication Systemsa71 Additional Categories.Flight Equipmenta71 Additional Categories.Flight Operationsa71 Additional Categories.Hardwarea71 Additional Categories.Risk Management
44、/Assessmenta71 Additional Categories.SpacecraftAdditional Info: a71 Project: Mars Reconnaissance OrbiterProvided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-Approval Info: a71 Approval Date: 2007-07-13a71 Approval Name: ghendersona71 Approval Organization: HQProvided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-
