gemini reliability and qualification experience

8/7/2019 Gemini Reliability and Qualification Experience

1/36

!J

*

?I GEMINI RELIABILITY AND QUALIFICATION EXPERIENCE

byW. Harry Douglas

I NASA Manned Spacecraft Center

GPO PRICE $

zE (ACCESSION NUMBER) (THR U)

(PAGES) (CODE)

e> - ,u32

CFSTI PRICE^) $

Hard copy (HC) , TddmMicrof iche (M F)

ff 653 July 65

To be presented before the NATO Advisory Group for Aeronau-tical Research and Development, Guidance and Control Panel Sympo-sium, Paris, France on March 7 and 8, 1967.


2/36

FOREWORDThis paper i s an ed i t ed ver sion o f an ea r l i e r paper en t i t l ed

"Spacecraft R el ia bi l i ty and Qualificat ion" which was presented a t th eGemini Mid-Program Conference a t NASA Manned Spacecraft Center, Houston,Texas on February 23 t o 25 , 1966.were :

The authors of th e o ri gi na l paper

W . Harry Douglas, formerly Deputy Manager, Office of Test Opera-tions, Gemini Program Office, NASA Manned Spacecraft Center, and nowManager, Test Operations Office fo r t h e Apollo Applicatio ns ProgramOffice, NASA Manned Spacecraft Center.

Gregory P. McIntosh, Gemini Program Office, NASA Manned SpacecraftCenter .

Lemuel S. Menear, Gemini Program Advisor, Flight Safety Office,NASA Manned Spacecraft Center.

This paper d i f fers f rom t h e or ig ina l p resen tat ion i n t h a t t h eemphasis has been placed on the guidance and control system of theGemini spacecraft.

This paper i s t o be presented before th e NATO Advisory Group forAeronautical Research and Development, Guidance and Control PanelSymposium, P a r i s , Fr an ce on March 7 and 8, 1967.


3/36

GEMINI RELLABILITY AN D Q UALIFICATION EX PE RIE NC E

W. Harry Douglas*NASA Manned Spacecraft Center

1. SUMMARYThe Gemini reliability and qualification program was based on con-

ve nt io na l concepts. However, the se conc epts were modified wit h uniquefea tu res t o ob ta in the r e l i a b i l i t y r equ i red fo r manned space f l ig h t andt o op timize the r e l i ab i l i t y and qua l i f i ca t ion e f fo r t .

Ehphasis was placed on establ ishing high inherent rel iabi l i ty andl o w crew-hazard ch ar ac te ris t i cs ear ly i n the design phases of th e GeminiProgram. Concurrently , an in te gr at ed ground te s t program was formula tedand implemented by the prime contractor and the major suppliers of f l i g h thardware. All data derived from a l l t e s t s were c orre l a ted and used t oconf i rm the r e l i ab i l i t y a t t a ined .

Mission-success and crew-safety design goals were established con-tractually, and estimates were made for each of the Gemini missionswi thout conduct ing c l as s i ca l re l i ab i l i t y mean- time-to- fa ilure tes t i ng .

Design reviews were conducted by re l i a b i l i t y engineers sk i l le d i nt h e use o f r e l i ab i l i t y ana lys i s t echn iques .independently of the designers t o insure unbiased evaluat ions of the

The reviews were conducted

*Other con tri but ors t o th i s paper were Gregory P. McIntosh andLemuel S. Menear, NASA Manned Spa ce craf t Cen ter , Houston, Texas.


4/36

2

design fo r r e l i a b i l i t y and crew safety and were completed pr io r t o spec-ification approval and the release of production drawings.

An ambitious system t o co nt ro l qu ali ty was r i g i d ly enforced t o a t -t a i n and maint ain t he r e l i ab i l i t y i nherent i n t he spacec raf t de s ign .

A closed-loop f ai lu re -r ep or tin g and cor rec tiv e-a cti on system wasadopted which required the analysis, determination of the cause, and cor-r ec t i ve ac t i on fo r a l l f a i l u r e s , ma lfunc ti ons , or anomalies.

The in te gr at ed ground t e s t program con sis te d of development, qual-i f i ca t io n , and r e l i a b i l i t y t e s t s and was conducted under r i g i d qua l i t y-contr ol survei l lan ce. This t e s t program, coupled with two unmannedGemini f l ig ht s , qua l i f i ed the spac ecraf t f or manned f l i g ht s .

2. INTRODUCTIONApproximately 6 years ago, men ventured briefly into space and re-

turned safely. These i n i t i a l manned space f l ig h t s were, indeed, t r e -mendous achievements which s t i r r e d t h e im agin ation of peo ple worldwide.They a ls o served t o provide a focus fo r t he d i r ec t i on of f u t u r e e f f o r t s .Gemini was th e f i r s t United St at es manned space f l i g h t program th a t hadthe oppor tun it y t o t ake t h i s ear ly exper ience and carry out a develop-ment, t e s t , and f l ig ht program in an at tempt t o re f le c t the l essonslearned.

The lev e l of r e l i a b i l i t y and c rew safe ty , a t t a ine d i n the Geminispacecraft and demonstrated during the 1 2 Gemini missions, i s t h er e s u l t o f a concer ted e f for t by contractor and customer engineers,


5/36

te ch ni ci an s, and management personnel working to ge th er as one teamwithin a management structure which permitted an unrestricted exchangeof information and promoted a rapid decision-making process.

Str ing ent numerical design goals f o r Gemini mission su ccess andcrew safety were placed on the spacecraft contractor who incorporatedthese goals i n each spe ci f ica t ion wr i t te n f or f l i g h t hardware .t h i s sp ec if ic at io n requirement, the su ppl ier s had t o give prime con-s idera t ion t o the se lec t ion , in tegra t ion , and packaging of componentp a r t s i n t o a r e l i a b l e end item.from the major equipment su pplie rs t o as ses s th e design f o r th e inherentcapab i l i ty of meeting th e establ ished design goal .

To meet

Reliabi l i ty analyses were required

-The spacecraft contractor was required t o in teg rat e theI

I i n t h e spacec raf t t o meet th e ove ra l l r e l i a b i l i t y goa l.' subcontractor-supplied hardware and t o ef fec t th e necessary redundancy

IIExamples of the spacecraft redundant features were:(1) Duplicate horizon sensors were incorporated i n th e guidance

system.( 2 ) hrery funct ion in t h e pyrotechnic system incorporated a re-

dundant feature.( 3) Two completely independent reentry -con trol propulsion systems

were i n s t a l l e d i n t h e s p ac ec r af t.(4) Redundant coolant sulpystems were incorporated in the environ-

mental control system.


6/36

4

( 5 ) Six fue l -c e l l s tacks were i nc or po ra te d i n t h e e l e c t r i c a l sys-tem although only three are required for any long-duration mission.

Redundant systems or backup procedures were provided where a singlefa i l u r e cou ld be ca ta s t roph ic t o the crew or t he spacec ra f t .

Concurrent with design and developments, an integrated ground testprogram was established.t o form a basis for dec lar ing the Gemini spacecraf t qual i f ied for thevarious phases of the f l i g h t t e s t program.ground t e s t program can be st be app reci ated by viewing fi gu re 1, whichshow s the dens i ty o f the t e s t e f fo r t w i t h r e s pe c t t o t h e production ofthe f l ig ht equipment. The high l e v e l of ground t e s t e f f o r t commenceda t t h e o u ts e t o f the program and was sus ta ined pas t t he f i r s t s e v e r a lf l i g h t s . The a b i l i t y t o f l y w i t h some qualification testing underwayi s re la ted to the d i f ferences be tween t h e ea r ly spacec ra f t conf igura t ionsand the long-duration and rendezvous spacecraft configurations. I t washoped that th e ground test ing could be completed earl ier , but the prob-lems that were isolated and the required correct ive act ion preventedearlier accomplishment. I n s p i t e o f the g rea t e f fo r t i nvo lved , i t wasb e t t e r t o u t i l i z e a ground t e s t program t o f e r r e t ou t prob lems than t oencounter them i n f l i gh t .

Data from a l l t e s t s were co l le cte d and analyzed

The value of the integrated

Development t e s t s were i n i t i a l l y performed t o prove t he design con-cep t s .ration design and manufacturing techniques.beyond t he spec i f ica t ion requi rements t o es ta bl i s h reasonable des ign

Q ua l i f i ca t ion tests were conducted t o prove th e f l i g h t configu-Tes t s were then extended


7/36

5

margins of safety.th e v al id i t y of design assumptions and t o develop confidence i n space-cr af t systems and launch-vehicle inte rfa ces p r i or t o manned f l ig ht s .

The unmanned fl i g h t t e s t s were conducted t o confirm

Specific test-program reviews were held a t the prime cont ra c to r ' sp lan t and a t each major subcont rac tor 's fa c i l i t y t o preclude dupl ica t ionof te s t in g and t o insu re th a t every pa r t i c i pa nt i n the Gemini Programwas following the same bas ic guide l ines .

3. MISSION SUCCESS AND CREW SAFETYA numerical design goal was establ ish ed t o represen t the p ro ba bi l i t y

of the spacecraf t performing sat isfactor i ly for the accomplishment ofa l l primary mission objec t ives . The ar bi t r ar y value of 0.95, whichrecognizes a r i s k of f a i l i n g t o meet 1primary objective out of 20 oneach missio n, was se le ct ed . The 0.95 mission-success design go al wasincluded i n the prime con tract as a design goal ra t he r than a f i rm re-quirement, which would have required demonstration by mean-time-to-f a i l u r e t e s t i n g .f o r each of t he space craft systems and incorpo rated the apportioned

The prime contractor calculated numerical apportionments

value s i n major system and subsystem con trac tor requirements. Re li ab il -i t y estimates, derived primarily from component failure-rate data andmade during th e des ign phase, indica ted t h a t t he design would supportth e esta bl is hed design-mission success goal .by major spacecraft system, for th e Gemini I11 spacecraft, are shown

The r e l i a b i l i t y e st im a te s,

i n t a bl e I .


8/36

6Crew safety design goals were a l s o establ ished, but for the much

higher value of 0,995 f o r a l l m is si on s.having the f l ig h t crew safe ly survive a l l missions or a l l m is sio n a t -tempts .

C r e w safety was defined as

Planned mission success, gross mission success, and crew safetyest ima tes were a ls o made pr i o r t o each manned mission, using th e f l i g h tdata and data generated by the inte gra ted ground te s t program; eachestimate reflected assurance of conducting the mission successfullyand safely.

A de tai le d f a i l u r e mode and e f f e c t ana ly sis was conducted on t h ecomplete spac ecr aft by t h e prime co nt ra ct or , and on each subsystem bythe cognizant subcontractor, t o in ve sti ga te each f a i l u r e mode and asse ssi t s e f f e c t on mission success and crew sa fe ty . The an aly sis includ ed anevaluat ion of :

(1) Mode of f a i l u r e( 2 )( 3 )( 4 ) Indica t ions of fa i lure( 5 )(6 ) Probability of occurrenceCorrective action was taken when i t was determined that the fai lure

Failure effect on system operationFai lure effect on the mission

Crew and ground action as a result of the failure

mode would grossly affect mission success o r j eopard ize the safe ty ofthe crew.


9/36

7

A sing le-p oin t f a i l u r e mode and ef fe ct a na ly si s was conducted f o ra l l manned missions t o i s o l a t e s ingle fa i l ur es which could prevent re-covery of the spacecraft or a safe recovery of the crew. The s ing le -point fa i l ur e modes were evaluated, and act ion s were taken t o el iminateth e single-po int fa i l ur e or just i f 'y the design adequacy, and t o pre-scr ib e th e necessary precaut ions t o minimize th e pr obab i l i ty o f occur-rence.

4. DESIGN REVIEWSCri t ica l re l iabi l i ty des ign reviews were conducted as soon as the

in te ri m design was esta bli sh ed. The reviews were conducted by r e l i a b i l -i t y pers onn el, independent of th e desi gn er, and re s u lt ed i n recommendedchanges t o improve the r e l i a b i l i t y of a l l the respect ive systems orsubsystems. The reviews include d t h e use of:

(1) Numerical analyses(2 ) Stress analyses(3) Analyses of f a i l u r e modes(4)

A typical design change i s shown sche matically i n fi gu re 2.Trade-off s tu die s t o evaluate th e need fo r redundant fe atu res

This

change was inco rpo rate d because the 2-day Gemini rendezvous f l i g h t re-qu i red four o f the s ix fue l - c e l l s t acks , t h ree s t acks t o a sec t ion , t omeet mission object ives . The fai lu re of a s i ng le supply pressure regula-t o r would have caused t h e l o s s of a fue l -c e l l sec t ion . Therefore, it wasnecessary th a t each of the two regula tors which co nt ro l th e rea c tan t


10/36

a

supply be capable of supplying rea c ta nts t o both fu e l - ce l l sec t ions .The crossover provided t h i s ca pab il i ty .power system r e l i a b i l i t y s l i gh t l y increased fo r th e 2-week mission.rel iabi l i ty was increased from 0.988 t o 0.993 for an assumed failurer a t e o f lom4 f a i l u r e s p e r h ou r.increased fo r the 2-day mission.

Figure 3 show s the e l ec t r i ca lThe

Figure 4 shows t h e r e l i a b i l i t y g r e a t l y

I t cannot be overemphasized that rel iabi l i ty i s an inherent charac-ter i s t ic and must be rea l ized as a result of design and development.Inhe ren t r e l i ab i l i t y canno t be inspected or tes ted in to an i tem dur ingproduction. A t bes t , t h a t which i s inherent can only be a t ta ined ormainta ined through r ig id qual i ty cont ro l .views and the numerical analyses were conducted as early as November 1962,p r i o r t o t h e f a b r i c a t i o n of t h e f i r s t production prototypes.

These r e l i ab i l i t y des ign r e -

5. DEVELOPMENT TESTSDevelopment t e s t s u sing engin eering models were conducted t o e st ab -

l i s h t he f e a s i b i l i t y o f design concepts.designs and demonstrated func t ion al performance and str uc tu ra l in te gr i t ypr i or t o committ ing product ion hardware t o formal qu al i f ic a t i on t e s t s .

These tes ts explored var ious

I n some cases , environmental t e s t s were conducted on the se u n it s t oob ta in in fo rm at ion p r io r t o the formal qua l i f i ca t ion .


11/36

96. INTEGRATED SYSTEM TESTS

Inte gra ted system t e s t s were conducted during progressive stages ofth e development t o demonstrate the co mpa tibi l i ty of system in te rf ac es .Such systems as the inert ial guidance system, the propulsion system,and the environmental control system were espec ia l ly subjected t o suchte s t s . Ear ly proto type modules were used i n s t a t i c a r t i c le s or mockups,which represented complete o r p a rt ia l vehicl es . They served t o acquaintopera ting personnel with th e equipment and t o i s o la te problems involvinge lec t r ica l -e lec t ronic in te r face , rad iof requency in te r fe rence , andsystem-design compatibility.

When production prototype systems became available , a completespacec raf t c ompat ib i l i ty te s t u ni t was assembled a t th e pr ime contrac-t o r ' s f a c i l i t y ( f i g . 5 ) . During these tes ts , system integrat ion wasaccomplished by end-to-end t e s t methods.reso lut i on of problems involving mechanical in ter fa ce, e l ec t r ic al -elect ronic interference, radiofrequency interference, spacecraf t com-p a t i b i l i t y , f i n a l t e s t procedures com pati bil i ty, and com pati bil i ty withaerospace ground equipment (AGE), p ri o r t o assembly and checkout of t h ef i r s t f l i g h t v e h i c l e .

These t e s t s permit ted the

One of t he more si gn if ic an t in teg ra ted system t e s t s was th e thermalqua l i f i c a t io n or the spacecraf t thermal -balance t e s t . This t e s t was


12/36

10

conducted on a complete production spacecraft.a cold-wal l a l t i t ud e chamber th a t s imulated a l t i tu de and or b i t a l hea t -ing charac ter i s t ics wi th the spacecraf t powered.

Te sts were conducted i n

The test resul ts demonstrated the need f o r heating devices on thepropulsion system and on water l i ne s t o prevent fre ezin g condit ion sduring the long durat ion mission.

7 . SYSTEM QUALIFICATION TEST IBecause flying all-up manned space vehicles i s expensive, t ime

consuming, and exceedingly c r i t i c a l t o fa il u re s , th e Gemini developmentwas based on th e premise t h a t conf idence could be achieved through aproperly configured program of ground t e s t s and that a very l imitednumber of unmanned f l i g h t s could se rve t o va li da te t he approach.

Each item of spa cecr aft equipment was qu al if ie d pr io r t o t h e m i s -si on on which th e item was t o be flown.qual i f ied when s uff ic i en t t e s t s had been successfu l ly conducted t odemonstrate that a production unit, produced by production personnel andw i t h production tool ing, complied with th e de sign requirements.t e s t s inc luded a t le as t one s imula tion of a long-dura tion f l i g h t , o r onerendezvous mission, o r bo th , i f necessary, with th e system operat ing t oi t s expected duty cycle.

The equipment was considered

These

Qual i f ica t ion requi rements were es t abl i shed and incorpora ted i n a l lspacecraft equipment specif icat ions. The specifications imposed varied


13/36

11

requirements on equipment, depending on the location of the equipment i nth e spa cec raf t, th e fun ction t o be performed by th e equipment, and th epackaging of the equipment.

The environmental l e ve ls t o which th e equipment was subj ected werebased on ant ici pat ed pr ef l ig ht , f l ig ht , and po st f l ig ht condi t ions . How-ever, th e environmental le ve ls were re vis ed whenever ac tu al te s t o rf l ight exper ience revealed tha t the or i g in a l an t i c ip a ted l eve l s wereu n r e a l i s t i c . T h i s i s exemplified by:

(1) The anticipated launch vibrat ion requirement for the spacecraftwas based on da ta accumulated on Mercury-Atlas f l i g h t s . The upper-two,sigma l i m i t of these data required a power sp ec tr al densi ty pr of i l e ofapproximately 12g random vibration.Gemini I f l ig h t dem onst ra ted th a t t he ac tua l f l i gh t l ev e l s were l e s s than

This le v e l was re vis ed because t he

expected. The new data permitted t h e power spe ct r a l d ens i t y t o bechanged, and by usi ng t he uppe r-three sigma l i m i t the requirement wasreduced t o an ov era l l rms accelera t ion l ev el of 7g random i n th e space-c r a f t a dapt er and t o 8.8g random i n th e re en try module.

( 2 ) An a nero id device used i n th e person nel parachute was expe ctedt o exper ience a re la t i ve ly severe humidity ; there fore , the q ual i f ic a t io nt e s t p l a n r eq u ir ed t h e aneroid device t o pass a 10-day 95-percent r e la -t i v e humidity t e s t . The or i g in a l des ign of the aneroid device could notsurvive t h i s requiremen t and was i n th e proc ess of being re des ign ed whenthe Gemini I V mission revealed that the actual humidity i n the space-craft cabin was considerably lower than expected. The requirement was


14/36

12

reduced t o an 85-percent r e l a t i v e humidity, and th e new aneroid devicesuccessf i l ly completed qual i f icat ion.

The tank bladders of the propulsion system did not pass the( 3 )or ig ina l qua l i f i ca t i on s l osh t e s t s . Analyses of the failures concludedtha t the s losh tes t s conducted a t one g were over ly severe relat ive t oac tua l s l o s h conditions i n a zero-g environment. The sl osh t e s t w a schanged t o simulate zero-g conditions more accurately, and the sloshr a t e w a s reduced t o a re a l i s t i c va lue . The t e s t s then w e r e repeatedsuccessful ly under the revised tes t condi t ions.

The development and t imely execution of a r e a l i s t i c qu ali fic at ionprogram can be a tt r i bu te d, i n pa rt , t o a vigorous e f f o r t by governmentand con trac tor personnel conducting test-program reviews a t th e majorsubcontractor p lan t s during the i n i t i a l qua l i f i ca t io n phase of theprogram. The ob je ct iv e of the reviews was t o al in e the respec t ive sys-tem test program t o conform t o an integ rate d t e s t phi losophy.i n a l te s t reviews were fol lowed with per iodic s t a t us reviews t o assureth a t the t e s t programs were modif ied t o r e f le c t the l a t e s t program r e-quirements and t o assure the t imely completion of a l l te s t in g whichrepresented constraints for the var ious missions.

The orig-

Figure 6 i s a block diagram of the Gemini guidance and control sys-The qu al ifi ca tio n te s t environments requir ed for t h e d i g i t a l com-tem.

mand system ar e shown i n ta b l e 11. These data were extracted from the ,Spacecraf t qua l i f i ca t i on s t a t us repor t , and show the qu a l i f i c a t i on Sta tus .Although the d i g i t a l command system did n ot exper ience a l l the


15/36

13

environments shown here, the data provide a typical example of theGemini guidance and control component qualification test requirements.All environmental requirements were not applicable since the digitalcommand system was located in the adapter and did not experience suchenvironments as oxygen atmosphere and salt-water immersion. Thoseenvironments which were required are noted with a C o r S in the appro-priate column. The C designates that the equipment has successfullycompleted the test, and the S designates that the equipment has beenqualified by similarity. A component or assembly is considered quali-fied by similarity when it can be determined by a detailed engineeringanalysis that design changes have not adversely affected the qualifica-tion of the item.

8. RELIABILITY TESTINGFor programs such as Gemini, which involve small production quan-

tities, the inherent reliability must be established early in the designphase and realized through a strict quality control system.feasible to conduct classical reliability tests to demonstrate equip-ment reliability to a significant statistical level of confidence.sequently, no mean-time-to-failure testing was conducted.Gemini hardware was established by analyzing the results of all test dataderived from the integrated ground and flight test program, and by con-ducting additional reliability tests on selected components and systemswhose functions were considered critical to successful mission accom-pli shment.

It was not

Con-Confidence in


16/36

14

Equipen t w a s s e l e c t e d f o r r e l i a b i l i t y t e s t s a f t e r eva lua t i ng t hemore probable f a i l u r e modes.design margins o r t o revea l marginal design ch ar ac te r i s t i cs , and theyincluded exposure t o environmental extremes such as :

The t e s t s were designed t o confirm the

(1)(2 )

Temperature and vibration beyond the design envelopeApplied voltage or pressure beyond th e normal mission condi-

t i o n(3)( 4 )The r e l i a b i l i t y t e s t s conducted on the d i g i t a l command system are

shown i n t ab le 111. These te s t s o verstr essed t h e d i g i t a l command sys-tem i n accele ration , v ibra tion , voltag e, and combinations of a l t i t u d e ,temperature, voltag e, and time. These ov er st res s t e s t s confirmed anadequate design margin i nhe ren t i n th e d i g i t a l command system.

Combined environments t o produce more severe equipment s t r e s sEndurance beyond the normal mission duty cycles

Typical r e l i a b i l i t y t e s t s on other systems and components includedsuch environments as proof-pressure cyc lin g, repea ted simulated missio ns,and system operation w i t h induced contamination. The contamination t e s twas conducted on the reentry control system and the orbital at t i tude andmaneuver system because th es e systems were designed wi th f i l t e r s andpressure regulators which contained smal l or i f ic es suscep t ible t o c log-ging.

Some re l i ab i l i t y t e s t s were eliminated when Gemini f l ight data re-vealed th a t i n some ins tances qu a l i f i c a t i on t e s t s had ac tu al ly been over-s t r e s s t e s t s . This was p a r t i c u l a r l y t r u e w i t h r e sp e c t t o v i b r a t i on .


17/36

A l l fa i l ur es which occurred dur ing th e re l i ab i l i t y t e s t s were ana-lyzed t o determine th e cause of f a i l u r e and t o e s t ab l i sh t he r equ i redcor rec t iv e ac t ion . Decis ions t o redes ign , r e t es t , o r change processesi n manufacturing were rendered a f t e r care fu l cons iderat ion of t h e prob-a b i l i t y of occurrence, mission performance impact, sch edule, and co st .

For t h e most p a r t , t h e r e l i a b i l i t y t e s t s were conducted as a con-t in uat ion of the formal qua l i f ic at io n te s t s on the same t e s t specimensused i n th e qua li fi ca ti on t e s t s after approp riate refurbishment and

acceptance te st in g. When th e previous te st in g expended th e t e s t speciment o a s ta te th a t precluded refurbishment , add i t io nal new t e s t un i t s wereused.

9. QUALITY CONTROLA r i g i d q ua li ty c on tr ol system was developed and implemented t o a t -

t a in and main tain the r e l i a b i l i ty t ha t was inherent i n the spacecraf tdesign. This system requir ed fl ig h t equipment t o be produced as near ly

. as poss ib l e t o th e qual i f i ed conf igura t ion .The unique fea tur es of t he qua li ty c on tro l system which contrib uted

t o th e success of t he Gemini f l i g h t program were:(1) Configurat ion control

( 2 ) Mater ia l cont ro l(3 ) Qu al it y workmanship(4 ) Rigid inspect ion( 5 ) Spacecraf t acceptance cr i ter ia


18/36

16Configurat ion con trol i s necessary t o mainta in spacecraf t qual i ty ;

therefore, contractor and customer management developed and implementeda rigid and rapid change-control system which permitted required changest o be documented, approved, implemented, and v er if i ed by qu al it y con tr ol ,w i t h the inspector being fully cognizant of the change before i t wasimplemented on the spacecraft.and the program impact had been eva lua ted f o r desi gn val ue, sch edu le,and c os t, th e proposed change was fo rmally p res en ted t o t he managementchange board f o r approval and implementation. All changes made t o t h espacecraft were processed through the change board.

When a change was considered necessary,

Each a r t i c l e of f l i g h t equipment was i de nt if ie d by a pa rt number.Components, such as relay panels, t a n k assemblies, and higher orders ofe l ec t r ic a l o r e lec t ron ic assembl ies , were se r ia l i zed , and each se r ia l i z edcomponent was accounted and re co rd ed i n the spacecra f t inven tory a t thetime i t was ins ta l l ed i n the spacecra f t .

Exotic materials such as t i tanium, Rene' 41, and explosive materialsused i n pyrote chnics were accounted fo r by l o t s t o p e r m i t i d e n t i f i c a t i o nof any suspect assembly when i t was determined t h a t a p a r t was defec-t i v e because of m ater ia l def ic iency.

Inspec tion personnel and fab ri ca ti on tech nic ians who required ap a r t i c u l a r s k i l l such as sol deri ng, welding, and braz ing were tr ai ne dand ce r t i f i ed fo r the respec t ive s k i l l and r e te s ted f o r p r o f ic i e n cy a tregu la r in te rva l s t o re ta in qua l i ty workmanship.


19/36

17

The very s t r i c t c ont rol of p ar ts and fab ric ate d assemblies was main-ta in ed by r ig id inspect i on methods.

or t e s t anomalies were recorded and resolved regardless of the s ignif i -cance tha t was apparent t o the inspector a t the t i m e of occurrence.equipment installations and removals required an inspection approvalpr io r t o making or breaking any system int erf ac es.

A l l def ic ienc ies , d i sc repanc ies ,

A l l

Formal spacecraft acceptance reviews were conducted a t s t ra te gi cThe reviews werestages of the spacecraft assembly and t e s t p r o f i l e .

conducted with both the customer and th e co ntractor reviewing a l l t e s tda ta and inspection records t o is ol at e any condition which occurredduring the preceding manufacturing and t e s t ac t iv i ty tha t cou ld adverse lyaffect the performance of the equipment.

All fa i l ur es , malf inct ions , or out-of- to lerance condi t ions th athad not been reso lve d were brought t o th e a tt en ti on of th e managementreview board for resolution and corrective measures.c ondu cted p r io r t o f i n a l s p ac e cr a ft system t e s t s a t t h e c o n t r a c to r ' spl an t immediately p ri or t o spacecr aft delive ry, and approximately10 days preceding the impending flight.

The reviews were

10. FLIGHT EQUIPMENT TESTSA se r i es of t e s t s were conducted on a l l f l i g h t a r t i c l e s t o provide

assurance tha t t he re l i ab i l i t y po te n t ia l o f th e design had no t been


20/36

18

* degraded in the fabricat ion and handlingconducted on flight equipment included:

of th e hardware. The t e s t s

Receiving inspect ionIn - l ine p roduc t ion t e s t sPredelivery acceptance t e s t s (PDA)Pre ins t a l l a t ion accep tance t e s t s (PIA)Combined spa ce cr af t system t e s t (SST)Spacecraft- launch vehicle joint combined system testsCountdown

In rece iv ing inspect ion , c r i t i c a l p a r t s w ere g i ve n a 100-percentinspect ion th a t could have included X-ray, chemical analy sis , spec tro-graphs , and funct ional te s t s .

While the equipment was being assembled, a ddi t io nal te s t s were per-Mandatory inspec-formed t o de te c t def i c ien cies ear ly i n manufactur ing .

t ion points were es tabl i shed a t s t r a t eg ic in t e rva l s dur ing the p roduc-t ion process .for p otted modules and prio r- to -clos ure fo r hermetical ly-sea led packages.A s an example, certain electronic modules of the onboard computer re-ceived as many as 11 f 'unc tional t e s t s be fore they went in to the f i na lacceptance te s t .

These were e sta bl i she d a t such poi nts as prior - to-p ott in g

A predel ivery acceptance tes t ver i f ied the funct ional per formanceof th e equipment and was performed a t t h e vendor's pl an t i n th e presenceof vendor and government q u a l i t y c o n t r o l r e p r e s e n t a ti v e s .for the in e r t ia l measur ing uni t inc luded envi ronmental exposure t o

These tes ts


21/36

vi br at io n and temperature because thes e environments were conside red t obe pr ime con tr ib uto rs t o the mechanics of fa i l ur e .c r i t i c a l equipment , space craf t contrac tor engineer ing and qu al i ty con-t r o l and government engineer ing represen tat ives were als o present t ow it ne ss t h e t e s t f o r i n i t i a l d e li v er i es .

For complex o r

Pr io r t o i n s t a l l a t i o n i n t he spacecra f t , t he u n i t was g iven a p re -i n s t a l l a t i o n ac cep tan ce t e s t t o v e r i f y t h a t the func t i ona l cha rac t e r i s t i c so r ca li b ra ti on had not changed during shipment. This t e s t was conductedi d e n ti c a ll y t o t h e predelivery acceptance t e s t where feasible, exceptwhen a difference i n t e s t equipnent nec ess itat ed a change. When d i f -fe rences i n t e s t equipment d ic ta ted a d i f fe rence i n the t es t i ng procedure ,the t e s t media (such as f lui ds , appl ied vol tages , and pressu res) wereid en t ic a l , and t e s t da ta were recorded in the same u n it s of measure i norder t o compare t e s t resu l t s with previous t e s t ds ta . This permitteda rap id de tec t ion of th e sl ig ht es t change i n the performance of th ee quipment .

Spacecraft systems tests were performed on the systems after instal-l a t i o n i n t he s pa ce c ra ft , p r i o r t o del ive ry. They included ind ivi dua lsystems t e s t s pr io r t o mat ing the spacecraf t sec t ions , in tegr a ted sys-tems t e s t s , s imulat ed f l i gh t t e s t s , and a l t i t ude chamber t e s t s a f t e r

mat ing a l l o f t h e spacecraf t sect ions. These t e s t s used spe cial con-nec tors b u i l t in to th e equipment t o prevent equipment disconnect ion whichwould invalidate system interfaces.


22/36

20

Similar systems tests were repeated during spacecraft prematever i f i ca t ion a t the l aunch-s i te checkout fa c i l i ty . After the space-c ra f t had been e l ec tr ic a l ly connected t o the launch vehic le , a s e r i e sof in tegr ated system fun ctio nal t e s t s were performed.of t h e s e t e s t s , simulated fl i g h t s which exe rci se th e a bort mode sequenceswere conducted i n combination with th e launch v eh icl e, the MissionControl Center, th e Manned Space F li gh t Network, and th e f l i g h t crew.

Upon completion

The countdown was the l a s t i n a s er ie s of systems func tion al t e s t st o ve r i fy tha t the spacecra f t was ready fo r f l i gh t .pointed out again t h a t any abnormality, out-of-tolerance conditi on, mal-funct ion, o r fa i lure resul t ing f rom any of these tes ts , was recorded,repo rted , and evaluated t o determine th e cause and the e ff ec t on missionperformance.

It should be

11. FAILURE REPORTING, FAILURE ANALYSIS, ANDCORRECTIVE ACTION

Degrada tion i n the inheren t re l i a b i l i t y of the spacecra f t sys temswas minimized through the rigid quality control system and a closed-loop fail ure- repo rtin g and corr ecti ve-a ctio n system.flight-configured equipment, during and after acceptance t e s t s , wererequire d t o be repor ted and analyzed.al y was considered t o be a random f a i l u r e .expended t o determine th e cause of t he anomaly t o permit immediate cor-rec t ive ac t ion .

A l l f a i l u r e s o f

No fa i lu re , mal func t ion , o r anom-A l l poss ib le e f fo r t was


23/36

21

Comprehensive fai lur e-an aly sis lab ora tor ies were est abl i she d a t theKennedy Space Center and a t the space craft c on tra cto r 's pl an t t o providerapid response concerning fai lures or malfunctions which occurred imedi-a t e ly p r i o r t o spacec ra f t de l i ve ry o r l aunch.

However, i n cases where the el ec tro ni c o r electro-mechanical equip-ment was extremely complex, the f a i l e d part usual ly was returned t o th evendor when the failure analysis required special engineering knowledge,techni ca l sk i l l s , and sophis t i ca ted te s t equipment.

A tab ula ted , na rr ati ve summary of a l l fa i l u re s which occurred on th espacecraft and spacecraft equipment was kept current by the prime con-t r a c t o r . This l i s t was continuously reviewed by the customer and thecontra ctor t o assure acceptable and t imely fa i l ur e analyses and re su l t -ing cor rec t ive act ion. The contra ctor es tabl ished a p r i or i t y system t oexpedi te those f ai lu re analyses which were most s i gn if i ca nt t o t h e

pending missions.A simplified flow diagram of the correct ive act ion system i s shown

i n f i gu r e 7.A mater ial review board determined the disposi t ion of the fai led equip-ment, and an ana lys is of the f ai lu re was conducted a t ei t he r the suppl i-e r ' s p l an t , t he p r ime con t r ac to r ' s p l an t , or a t t h e Kennedy Space Center ,

depending on the nature of the condit ion, the construction of the equip-ment, and the a v a i l a b i l i t y of t he f a c i l i t i e s a t each of the r e spect i velo ca ti on s. When th e ana ly si s of a su pp li er 's equipment was conducted

All failures or malfunctions were recorded and reported.


24/36

22

at the prime contractor's plant or at the Kennedyrespective supplier's representative was expectedanalysis.

Space Center, theto participate in the

When the failure-analysis report was available, the recommended cor-rective action was evaluated, and a decision rendered to implement therequired corrective action.board action to correct a design deficiency, a change in manufacturingprocesses, establishment of new quality control techniques, and/orchanges to the acceptance-testing criteria.evaluated to determine whether qualification status of the equipment hadbeen effected. If the equipment could not be considered to be qualifiedby similarity, additional environmental tests were conducted to confirmthe qualification status.

This may have required management change

Each change was also

12. UNMANNED FLIGHT TESTSThe final tests conducted to support the manned missions were the

unmanned flights of Gemini I and Gemini 11.structural integrity of the spacecraft and demonstrated compatibilitywith the launch vehicle. Gemini 11, a suborbital flight, consisted ofa production spacecraft with all appropriate onboard systems operatingduring prelaunch, launch, reentry, postflight, and recovery. Each sys-tem was monitored by special telemetry and cameras that photographed thecrew station instrument panels throughout the flight.demonstrated the capability of the heat-protection devices to withstand

Gemini I verified the

The flight


25/36

23

the maximum heating rate and temperature of reentry.p l e t i on o f the Gemini I1 mission, combined with ground qualificationt e s t r e su l t s , formed the bas i s fo r dec la r ing the spacecraf t qua l i f i ed formanned space flight.

The s uc ce ss fu l can-

Subsequent t o Gemini XI1 del ive ry, th e f a i lu re his to ry was reviewedt o determine how adequate th e t e s t program had been i n meeting i t s objec-t i v e s .spacecraft-type equipment.can t t o re qu ir e a ct ion by a Materia l Review Board, which w a s composedof more than one engineering discipl ine.primary equipment fai lures, 1474 were induced fai lures , and 647 werefa i lu res such tha t t he cause could no t be determined. These malfunctionsa re shown i n t a b le I V . O f t h e 7792 malfunction reports analyzed, 2392were wr i t te n on non-fl ight-configured equipment used fo r qu al if ic at io n,

A t o t a l of 7792 malfunction re po rts had been wri t ten onThese r epo r t s were s u f f i c i e n t l y s i g n i f i -

O f t h i s t o t a l , 5671 were

I

1 r e l i a b i l i t y , l i f e , and engineering t e s t s , and 5400 were wri t ten onfl ight-configured equipment.

The predelivery acceptance (FDA) and pr e in s t a l l a t io n accep tance (PIA)t e s t s were des igned to de tec t equipment f a i lu re s a t t he e a r l i e s t poss ib let ime i n the spacecraft bui ldup sequence.malfu nctio ns analyzed, 52 perc ent occurred in PDA t es t ing ; ano ther

O f t he t o t a l f li gh t-hardware

36 percent occurred i n PIA t e s t i ng .ware malfunctions occurred during the conduct of these t e s t s be fo r e t h eequipment was i ns ta l l ed i n th e spa cecra ft .

Thus, 88 p e rc e nt o f a l l f l i g h t h ar d-


26/36

24

This indicates t h a t t h e acceptance tests effectively accomplishedthe purpose f o r which they were designed.


27/36

25

cumm dm mm m0. .

cod mm mm m0

cumO d\ o mm m0. .

cu P-L n \Dm m0

d0k-PE:00 m0.rlC0ka,dw::


28/36

26


29/36

27

i0V

IHHH

2B

c.dbo0o\

0a3\oM

08 a3 - 30 0M OM C U0 04 J - 9n oo c oM d

c0.d4JldkaJdaJ02

c0.d4JldkP.rl*El0acldP;

n

aJboaJ4Jd

8daaJ.ddpc4


30/36

20 pT7qT-WIn Ww

C O N 0m r lI*'m 0rl NO N C Ut - m nN

t - m wWc u f r lPI N

0

m c o

V

f m t -~mN

I I I I I I I I I

I I I I I I I I


31/36

99mrl

rn9mrl

w-9mr l

9mrl

cv9mrl

v)UlnaJ4USaJE0aJ>aJ-n

v)4v)aJUS0.-4m0c.-m3

v)v)aJ44

EaJv)hv)4

41In4v)aJ4

nmaJbc.--

H.-S.-%c3

4

.PVIa,-P

a,8

.-S.-5c3


32/36

HydrogencontainerCi rcu i t contro I

Oxygencontainer

Figure 2 . - Gemini reactant supply system.


33/36

31

Y-

4 7With regulator crossover capabil i ty5 1.000,aQh4.--m.--2! With out reguIatorcrossover capab il i ty5 0 * 9 9 t94v)m 0.98

1o - ~Regulator fa ilu re rate, per hrFigure 3.- Gemini f u e l c e l l power system rel iabi l i ty - 2-week mission.

1 .oo0.99

USaJEX 0.98

$ 0.96Uv)hv) 0.95

cI kcro ssover capab i

--- With out regulatorcrossover capab iI i t y

W ith regulatorcro ssover capab i

With out regulatorcrossover capab iI i t y

Ii t y

n -941Regulator fa il ur e rate, per hr

Figure 4 . - Gemini f u e l c e l l power systemr e l i a b i l i t y - 2-day mission.


34/36


35/36

33

c ----.

0L,,, J

v)-uSmEE00YSmIIF44Saaoi


36/36

34

A

gemini reliability and qualification experience

Documents