X-ray Missions Delta: AXSIO Redux

1. X-ray Missions Delta:AXSIO Redux Reliability Aron Brall 30 April – 1 May, 2012

2. Reliability Agenda • Reliability Requirements • Spacecraft Bus Configuration • Reliability Assumptions • Reliability Methodology • Reliability Block Diagram • Reliability Assessment • Conclusions and Recommendations

3. Reliability Requirements - 1 • Mission Parameters • Class B mission – Typical Target Reliability of 0.85 for mission based on previous MDL estimates of similar class missions (not a NASA requirement) • 3 year mission required, 5 year goal • L2 Orbit – No Controlled Re-entry • Critical SPFs (for Level 1 requirements) may be permitted but are minimized and mitigated by use of high reliability parts and additional testing. (NPR 8705.4) • Essential spacecraft functions and key instruments are typically fully redundant. Other hardware has partial redundancy and/or provisions for graceful degradation. • Reliability Assurance • Designs are validated with appropriate Reliability Analyses – FTA (Fault tree analysis), FMEA (Failure Mode and Effects Analysis), Parts Stress Analysis, Worst Case Analysis and PRA (Probabilistic Risk Analysis) • Parts and Equivalent Source Control Drawings are Level 2 or better.

4. Reliability Requirements - 2 • Designs meet NASA and GSFC specifications including: • EEE-INST-002 • GEVS (GSFC-STD-7000: General Environmental Verification Standard) • GSFC Gold Rules (GSFC-STD-1000) • NPR-8705.4 (SMA requirements) • NPR-8719.14 (De-Orbit requirements)

5. Reliability Assumptions - 1 • Reliability of Instrument • Rolled-up with spacecraft reliability for providing mission reliability estimate • Based instrument reliabilities on estimates provided by customer. • 5 year reliability estimate derived from 3 year estimate. • Software Reliability • Software reliability assumed to equal 1 • Pre-Launch Reliability • Pre-Launch Reliability assumed to equal 1 • Launch Reliability • 0.98 Launch Reliability based on historical data and assuming known problematic launch vehicles are not selected

6. Reliability Assumptions - 2 • The following are considered non-credible single point failures SPF: • Structural and non-moving mechanical components • Short or open on power bus • Propulsion fuel tank or plumbing rupture • Duty Cycles (relative to mission duration) • 22 N thrusters – 1% • Operational Heaters – 70% • Survival Heaters – 10% • HGA Gimbals – 10% • All other items assumed to have 100% duty cycle

7. Reliability Methodology • Failure Rate Sources • Failure rates are based upon previous NASA projects, heritage, vendor’s data based on similar hardware, and estimation based on engineering judgment. • Reliability prediction of most electrical components are based on MIL-HDBK-217F, Notice 2 with manufacturer’s predictions, or on-orbit performance data used where available. • Component Life Distribution • Exponential component models for electronics and non wear related items • Weibull component models for items subject to wear or aging – Pressure gauges and motor and mechanism bearings • Mathematical Models • Exact models were used to determine subsystem reliabilities • Series models for single string subsystems • Cold or Hot Standby for Redundant Systems • Binomial models for k of n subsystems • i.e. 300 of 302 Solar Array Strings in Power Subsystem

8. Spacecraft Functional Design • Attitude Control Systems • 4 Reaction Wheels (3 of 4 required) • 16 Course Sun Sensors (8 of 16 required) • 1 Star Tracker (internally redundant) • 1 Gyro (internally redundant) • Avionics • Fully redundant C&DH and power electronics • Composed of 13 circuit boards and a power supply card • Communications • Redundant S/Ka Band Electronics (Includes 2 switches) • 2 Additional switches • 1 Isolator • 1 Triplexer • 1Omni dipole antenna system • 1 High Gain Antenna • Thermal • 24 Redundant Operational Heaters • 48 Redundant Survival Heaters • 40 Thermistors for telemetry – 39 of 40 required

9. Spacecraft Functional Design (Cont.’d) • Power • 1 Solar Array (300 of 303 strings required) • 1 Lithium-Ion 8 cell battery (7 of 8 cells required) • 1 PSE • 2 Solar Array PWM Modules/Regulators • 20 Switching Power Transistors and Diodes • 1 Output Module • 1 Control Module • Backplane • One of either the Solar Array Regulators, Switching Power Transistor + Diode Combos or Single Power Diodes may fail without affecting functionality. • Propulsion • 2 sets of : 6 5-lb (22N) Thrusters and 2 Latch Valves – (1 of 2 sets required) • 3 sets of: 1 Fill and Drain Valve, 1 Tank and 1 Pressure Transducer – (2 of 3 sets required) • 1 Additional Fill and Drain Valve • 1 Filter • 2 Fuel tanks

10. Reliability Block Diagram

11. AXSIO Redux Mission Confidence Limits

12. AXSIO Redux Mission

13. Conclusions • Mission Reliability exceeds nominal requirement at 3 years, even at 200% failure rate. • Mission Reliability (3-year) is dependent on Instrument Reliability. • Mission Reliability as modeled is >85%, even at 5 year goal mission duration • There is no significant reliability driver for the spacecraft. • At present, Launch Reliability is most significant Mission Reliability driver • Most reliability is achieved through significant redundancy in all critical systems

14. Recommendations - 1 • Assess Common Cause failures to assure that redundancy is not compromised • Assure that graceful degradation is not lost due to requirement creep • Validate limited life items and duty cycles • Use High Reliability Components on potential Single Point Failures • Assure all parts meet at least Level 2 Requirements per NPR 8705-4 and EEE-INST-002 • Assure all assemblies (in and out-of-house) have Parts Stress Analysis (PSA), and Failure Modes and Effects Analysis (FMEA) performed to assure compliance with derating and fault tolerance requirements

15. Recommendations - 2 • Perform Probabilistic Risk Analysis (PRA) early in the program to identify high risk items and events, such as mechanism deployment • Wherever possible, perform Worst Case Analysis (WCA) to assure electrical circuit functionality over entire mission duration. • “Non-credible” Single Point Failures should be addressed with Probabilistic Risk Analysis, Failure Modes and Effects Analysis, or detailed Failure Modeling to assure they are truly “non-credible.” • Continue to track on-orbit anomaly information gathered for similar spacecraft configurations on databases such as SOARS.