Public Lessons Learned Entry: 1796
Lesson Number: 1796
Lesson Date: 2007-5-15
Submitting Organization: JPL
Submitted by: Todd Bayer
|MRO Waveguide Transfer Switch Anomaly
A waveguide transfer switch failed five months after the insertion of Mars Reconnaissance Orbiter into Mars orbit. The likely cause was debris-induced RF breakdown that pyrolized a polyimide tape window in the switch, injecting additional debris that jammed the switch. Thirteen measures are recommended in the areas of waveguide fabrication, RF system/materials design, mission design, and exemptions to the JPL single-point failure policy.
Description of Driving Event:
Jet Propulsion Laboratory (JPL) mission design principles place a high value on maintaining communications with Earth at all times when the spacecraft is not occulted (Reference (1)). The Mars Reconnaissance Orbiter (MRO) flight system achieves this for both the uplink and downlink radio frequency (RF) signals by antenna swaps accomplished by actuation of RF switches. (In contrast, some JPL spacecraft meet this goal using redundant RF amplifiers and transponders.) For the downlink signal, MRO employs a Waveguide Transfer Switch (WTS), an electromechanical device that allows RF energy entering through one port to be routed during spaceflight to one of several output ports (Figure 1). This switching allows a 100 watt microwave downlink signal to be sent from one of the two available amplifiers out to one of two different radiating antennas.
|Figure 1. Traveling Wave Tube Amplifier (TWTA) Panel Layout|
Five months after the insertion of MRO into Mars orbit, a WTS failed to actuate. The onboard software maintained the commanded downlink configuration by commanding a switch to the redundant X band amplifier. Telemetry indicates that the switch is stuck between its two nominal positions, causing the switch rotor (visible in the center of Figure 2) to partially block the RF energy passing through the switch. This has resulted in a downlink RF power loss (of about 1 dB), and a temperature increase (of about 15 deg C) caused by absorption and dissipation of the reflected energy (Reference (2)).
The most likely root cause of the switch failure has been identified as conductive debris (perhaps from flaked plating) floating in the zero gravity environment. This debris may have eventually come into contact with one of the polyimide tape windows at Port 1 or 2 of the WTS during MRO aerobraking (Reference (3)). These windows are used as a contamination barrier on the WTS RF ports, but they may have contributed to the severity of the anomaly. Vent holes in the windows can admit contamination, adhesive on the inward-facing side of the tape can entrap it long enough to initiate RF breakdown, and the breakdown can cause the polyimide tape itself to pyrolyze (see Figure 3), injecting a large amount of polyimide debris into the switch and causing it to bind.
Polyimide films or tapes are widely used in aerospace applications due to their light weight, durability, and performance in extreme temperature environments. The design of polyimide RF contamination barriers varies across JPL projects: they vary in thickness and type (i.e., tape vs. film), and MRO may have been unique in using vent holes. Also, the somewhat unusual MRO operational practices of (1) frequently switching antennas (720 times) to maintain communications during the orbit, and (2) using a switch to change antennas instead of powering alternating amplifiers, may have transformed a minor debris problem into a stuck switch.
| || || |
Figure 2. Post-failure tests showed that materials like polyimide tape or paper (shown here) could block rotation of the switch rotor and jam the switch.
Figure 3. Testing showed that, under RF power, foreign object debris (half-inch long aluminum sliver) on or near the polyimide tape window could induce RF breakdown, destroy the window, and produce additional debris.
The WTS had been exempted from JPL's policy prohibiting designs with single-point failures because a "stuck between normal positions" switch failure mode was not considered credible. Although the failure has decreased the downlink margin (from an available margin of at least 3 dB), neither the RF power loss nor the temperature increase poses a threat to the mission, and the system is performing as it would had the WTS failed in a nominal position. However, movement of the root cause debris could cause additional RF breakdowns and damage to other components, and movement of the WTS to a fully blocked position could cause loss of mission — both low likelihood events.
|(1)||"Design, Verification/Validation and Operations Principles for Flight Systems (JPL Design Principles Standard)", JPL Document No. D-17868, Rev. 3, Paragraph 3.1.2 ("Communications During Mission-Critical Events"), December 11, 2006.|
|(2)||"S/C Swap to TWTA 2," Incident/Surprise Anomaly (ISA) Report No. Z89130, Jet Propulsion Laboratory, August 16, 2006.|
|(3)||"Mars Reconnaissance Orbiter Waveguide Transfer Switch Final Report," Jet Propulsion Laboratory Document No. JPL D-31194, March 30, 2007.|
|(4)||"Flight Project Practices, Rev. 6," JPL Document No. DocID 58032, March 6, 2006.|
A telecommunications system design that places mechanical switches with polyimide tape windows in an active RF path may result in in-flight RF breakdown, followed by injection of pyrolyzed polyimide debris into the switch, jamming of the switch, and loss of a downlink or uplink string.
- When designing high power RF systems, serious consideration should be given to the role of contamination in causing RF breakdown.
- Consider materials other than polyimide tape or film for use as contamination barriers. Alternate materials should not be damaged by RF breakdown, and should be thicker than the clearance between switch rotor and housing.
- Polyimide film may be an acceptable alternative to polyimide tape. Even though it is the pyrolysis of the polyimide material that produces debris, the adhesive on tape (1) adds significant entrapment mechanisms that encourage RF breakdown and (2) increases the likelihood that debris generated by window destruction will cause rotor stiction.
- The institution should review and standardize usage of polyimide materials as RF contamination barriers.
- Venting should be accomplished by some means other than holes in the RF windows. A polyimide tape window cannot function as both a contamination barrier and a vent path.
- To the extent practical, venting of the waveguide elements should be designed to direct gas flow away from contamination sensitive components such as waveguide switches.
- Although the data does not support atmospheric pressure being the cause of the MRO RF breakdown, it has not been completely ruled out as a contributing factor. The lack of absolute proof suggests that a prudent course for future aerobraking or aerocapture missions would be to design for critical pressure from the outset.
- Future projects should consider alternative ways of meeting the twin goals documented in the JPL Design Principles (Reference (1)) of continuous spacecraft-Earth communication and (2) minimizing component power cycles and/or RF switch cycles, by such means as passive coupling, polarization diversity, etc.
- When a telecommunications design features active switching like MRO, consider alternate switching methods. For some designs, use of redundant amplifiers and transponders may be less risky than RF switch actuation. The cycle life of electronics is probably easier to verify than the cycle life of electromechanical devices, particularly where there may be contamination.
- The flex waveguide is a potential (though not proven) source of the MRO debris. The MRO flex waveguide was manufactured by mechanical corrugation ("crunching") of rectangular copper tubing, which may create debris in a hard-to-inspect part. Consider electroforming, a newer process for fabricating flexible waveguides that is less likely to produce manufacturing debris.
- The institution should assure that the spacecraft and mission design reflect the provisions relating to redundant hardware, electromechanical devices, and continuous spacecraft-Earth communication that are found in the JPL Design Principles (Reference (1)) and JPL Flight Project Practices (Reference (4)) requirements documents.
- Flight projects should reconsider requesting an exemption to the single-point failure policy that would permit an intermediate position for a waveguide switch similar to the waiver granted MRO (and other recent projects). Projects using waveguide transfer switches should ideally design their spacecraft to be robust in the face of a failure between positions, including such considerations as:
- Protecting amplifiers from reflected RF power (e.g., use of isolators)
- Verification of relevant component performance in the presence of reflected RF power
- Telemetry points sufficient to unambiguously diagnose the condition
- Onboard fault protection response (e.g., redundancy management, logic for retries)
- When evaluating electromechanical devices such as waveguide switches, add torque margins to mitigate against contamination.
Evidence of Recurrence Control Effectiveness:
JPL will reference this lesson learned as additional rationale and guidance supporting Paragraphs 126.96.36.199 (Redundant Data Paths), 188.8.131.52 (Contamination Avoidance), 184.108.40.206 (Actuator Design Margins), 220.127.116.11 (End-to-End System Design), 4.5.5 (Telecommunication System Margins), 18.104.22.168 (Fault Containment Regions), 22.214.171.124 (Contamination), and 126.96.36.199 (High Voltage Designs) in the Jet Propulsion Laboratory standard ?Design, Verification/Validation and Operations Principles for Flight Systems (Design Principles),? JPL Document D-17868, Rev. 3, December 11, 2006.
Documents Related to Lesson:
- Space Operations
- Exploration Systems
Additional Key Phrase(s):
- Missions and Systems Requirements Definition.
- Missions and Systems Requirements Definition.Planetary entry and landing concepts
- Systems Engineering and Analysis.
- Systems Engineering and Analysis.Mission and systems trade studies
- Systems Engineering and Analysis.Mission definition and planning
- Engineering Design (Phase C/D).
- Engineering Design (Phase C/D).Orbiting Vehicles
- Engineering Design (Phase C/D).Spacecraft and Spacecraft Instruments
- Safety and Mission Assurance.
- Safety and Mission Assurance.Reliability
- Additional Categories.
- Additional Categories.Communication Systems
- Additional Categories.Flight Equipment
- Additional Categories.Flight Operations
- Additional Categories.Hardware
- Additional Categories.Risk Management/Assessment
- Additional Categories.Spacecraft
Project: Mars Reconnaissance Orbiter
Approval Date: 2007-07-13
Approval Name: ghenderson
Approval Organization: HQ