WARP

1
Section 23 Wideband Advanced Recorder and
Processor
. . . Terry Smith EO-1 WARP Lead
2
WARP Function

• The Wideband Advanced Recorder and Processor
  (WARP) is a spacecraft solid state recorder that
  receives and stores high rate science data and
  its associated ancillary data, from the Advanced
  Land Imager, Hyperion, and Atmospheric Corrector
  instruments, and then transmits the data via an
  X-band or S-band transmitter to the ground
  station.

3
WARP on Spacecraft, Bay 1
4
Circuit Card Assemblies
5
(No Transcript)
6
As Run Verification Matrix
7
Projected Power On Time
8
WARP Status

• WARP is operating nominally
• Successfully completed the following since the
  LVPC fix
• Box-Level re-qualification testing
• Spacecraft Thermal Vacuum II (T/V II) testing
• Over 500 hours of nominal operation since LVPC
  repair
• Over 100 data collection events and playbacks
  since LVPC repair
• Resolving minor procedural problem reports
• No issues

9
Top Level Specifications

• Data Storage 48 Gbits
• Data Record Rate gt 1 Gbps Burst
• 900 Mbps Continuous (6 times faster than L7
  SSR)
• Data Playback Rate 105 Mbps X-Band (with
  built-in RF modulator)
• 2 Mbps S-Band
• Data Processing Post-Record Data Processing
  Capability
• Size 25 x 39 x 37 cm
• Mass 22 kg
• Power 38 W Orbital Average., 87 W Peak
• Thermal 0 - 40 C Minimum Operating Range (with
  heater mode)
• Mission Life 1 Year Minimum, 1999 Launch
• Radiation 15 krad Minimum Total Dose, LET 35 MeV

10
EO-1 Science Data System Architecture
11
WARP Flight Hardware Architecture
12
Flight Software Architecture
13
WARP Reliability

• Reliability prediction 0.896 for one year of
  operation
• WARP spacecraft IT performance
• The WARP has never had a design failure
• The WARP has had only 1 hardware fix - defective
  part in LVPC
• Stress analysis performed by independent
  contractor - no problems
• The WARP has never had a software modification
• Over 2500 hours of operation
• Over 1000 hours of temperature cycling
• Over 400 data collection events and playbacks

14
WARP as a Single-Point Failure

• The WARP is a single string component
• The WARP has an S-Band back-up to the X-Band
  Channel
• Memory chips can fail without any impact to the
  WARPs operation
• The WARP can map around large areas of failed
  memory
• An entire Memory Board can fail without impact to
  the other Memory Board

15
Risk Mitigation

• Heritage derivation of Processor, LVPC, and RSN
• Chip-On-Board proof of concept board
• Processor and LVPC Breadboards
• Full board computer aided engineering simulations
• Full mechanical and thermal modeling of the box
  and boards
• Extensive use of re-programmable logic devices
• Full QA involvement from the beginning of the
  project
• Full environmental program
• Extensive software acceptance testing
• Pre-Integration and test with certified
  instrument simulators
• Memory Interface Board replaced

16
Reliability Enhancement Features

• Extensive built-in-test capability that detects,
  isolates, and reacts to problems
• Memory Board power-up failure detection and safe
  reaction circuit
• Memory Data Bus over-current detection and safe
  reaction circuit
• Robust design that meets or exceeds all of its
  operational performance specifications

17
WARP Verification Matrix
18
WARP Verification Matrix
19
WARP Verification Matrix
20
Waivers

• The WARP has nine waivers
• Three waivers for EMI minor exceedences /
  susceptibilities
• Cold temperature operation (at low primary power
  voltage)
• Low voltage operation (at cold temperatures)
• FMEA omission
• Work order delegation
• Memory BIT failure at very high temperatures
• Part-level stress analysis omission

21
Summary of Action Items FromMarch Red Team Review

• Update WARP Status
• WARP is reintegrated and operating nominally. See
  Slide 23-8.
• Update IT schedule
• Reintegration and test complete.
• Verification matrix, unchanged. No need to
  update.
• Radiated EMI susceptibility performed at S/C
  level
• Successfully conducted. Performance is nominal.

22
Summary of Action Items FromMarch Red Team Review

• Open PR WOA 846-50-2
• Microcircuit with zener diode was fixed prior to
  re-qualification
• Requalification included
• Full CPT functional tests
• 3 axis workmanship vibration
• 4 cycle temperature test, -15 C to 55 C
• Conducted EMI susceptibility
• Conducted EMI emissions

23
Summary of Action Items FromMarch Red Team Review

• Verification of WARP after reintegration
• All nominal.
• Full spacecraft CPT
• Over 500 hours of nominal operation since LVPC
  part failure
• Critical RFA 10.03
• FMEA and WARP testing are discussed in Section 3
  and Slides 23-17
• Back-up solid-state recorder pursued. Addressed
  as Special Topic in Section 3
• Update overall WARP performance during IT
• Performance is nominal.
• Over 2500 hours of operation on spacecraft
• Over 1,000 hours of temperature cycling on
  spacecraft
• Over 400 data collection events on spacecraft

24
Special Topic WARP Performance During Thermal
Vacuum II
. . . Terry Smith EO-1 WARP Lead
25
WARP Thermal Vacuum II Performance

• Totally nominal operation
• 8 Minor Problem Reports, mostly procedural
  errors
• Description Disposition
• 1773 Data Bus errors Spacecraft GSE software
  upgrade error
• Command errors Test procedure error
• Temperature red high limit Incorrect temperature
  limits in database
• RF Exciter telemetry error Power-Down transient -
  test procedure mod
• Primary input current - red low Mode change
  transient - test procedure mod
• Software Bus overrun error Operational quirk -
  increase data-base limit
• 1773 Data Bus error on power-up Researching -
  probably power up transient
• Software Bus telemetry error Researching -
  probably memory overflow

26
Special Topic Follow-Up WARP Cold-Start
Capability
. . . Terry Smith EO-1 WARP Lead
27
WARP Cold-Start Capability
Memory Board Power-Up at Low Temperatures Problem
Memory Boards Fail to Power-Up at 0 C
Requirement at Low Voltage Bay conditions 15 C
( 31V) nominal, 0 C (24V) worst case Minimum
Turn-On Temperature
Minimum Bus Voltage (with 5 C margin)
32 V 0 C 28 V 10 C 24 V 20
C Cause Oversight of large capacitive
loading Solution Add Heater Mode that is used
prior to Memory Board Power-Up Always Leave the
Memory Boards Powered-Up Result Thermal-Vacuum
Testing Verified Performance Residual Risk If
bus voltage and bay heater seriously degrade,
then boards may not power up
28
Heater Mode Temperature Rate of Change
29
WARP Cold-Start Capability

• Memory Board Power-Up at Low Temperatures
• RFA 9.08
• Show that cold start will not degrade over time
• Response
• An analysis was performed that showed that the
  LVPC power to the Memory Boards, and the Memory
  Board capacitance will not degrade over time due
  to radiation, stress, or life.

30
Special Topic WARP Low Voltage Power
Converter Failure Repair
. . . Art Ruitberg EO-1 WARP LVPC Engineer
31
WARP/LVPC Failure Overview

• Jan. 4, 2000 WARP/LVPC Power Output Stage 1
  output voltage went from 5V to 0V during
  quiescent operation on the EO-1 Spacecraft
• This stage powers the WARP Mongoose V Processor
  and Memory Interface Card (MIC)
• An on-orbit failure of this power stage would
  cause a loss of mission for EO-1 since all the
  mission science data is processed, stored, and
  downlinked via the WARP

32
WARP / LVPC Failure Overview

• The next day, the Spacecraft was powered up and
  the LVPC performed nominally
• The WARP/LVPC was removed from the Spacecraft,
  probed, and put through EMI, Thermal Cycling, and
  powered, 3-axis Vibration testing. The failure
  did not reappear during these tests.

33
WARP/LVPC Failure Characteristics

• The problem was isolated to the control board
  (10V regulator).
• Because the circuit was operating nominally and
  all probing produced nominal readings, the most
  likely candidate for the problem was an
  intermittent mechanical connection.
• The search produced a single pin 28V connection
  from the main board to the control board in a
  SAMTEC box connector strip. If this connection
  were intermittent, it would produce an
  intermittent 10V and could produce the symptoms
  seen (i.e. gating the power stages off for low
  bus voltage, noise on the telemetry monitors,
  etc.)
• This was confirmed by breadboard testing which
  showed the symptoms by placing a 300 ohm
  resistance in series with pin 1.
• There was extensive evidence incriminating the
  SAMTEC connector.

34
WARP/LVPC Initial Re-Work

• The SAMTEC box connector sockets were removed and
  wires were soldered to connect the main board and
  control board
• It was recommended that all SAMTEC box connectors
  be reworked to ensure reliability
• Because we could not be sure that the connectors
  were the source of the problem, we also
  recommended hardwiring jumpers in parallel with
  existing PC board traces from 28VFIL on the main
  board to the control board

35
Reworked LVPC with Jumpers
36
Testing Following Initial Rework

• LVPC card level, powered, 3-axis vibration
• Card level thermal test
• 4 card level ambient pressure temperature cycles
• 1 cycle unpowered to non-operational survival
  temperature excursions
• 3 cycles powered to acceptance test excursions
• Box level integration
• EMI (CE01/02, CS01/02)
• Unpowered, 3-axis vibration
• 4 ambient pressure thermal cycles following
  vibration

37
Other Initial Recommendations

• Perform as much testing as possible at the card
  level to help mitigate the risk associated with
  any other more subtle potential cause of the
  intermittent failure
• Complete the LVPC Circuit Modeling and Analysis
• Verify inherent stability and simulate parts
  failures that are impossible to test on the
  flight unit or breadboard

38
Failure Re-Occurrence 2/13/00

• Failure occurred during the first temperature
  cycle on the cold to hot transition at 0ºC.
• The LVPC had been off during the hot phase
  (65ºC) and the cold phase (-20ºC). The LVPC was
  turned on at 0ºC and was commanded to the low
  power mode (i.e. enabling the 5V Power Output
  Stage 1 to the Processor Board and Memory
  Interface Board).
• The 5V Power Output Stage 1 remained at 0V even
  though the switch was closed. The RSN
  converter continued to operate. The 28V primary
  power telemetry oscillated as before.
• The LVPC was left on continuously for several
  days to ensure that the anomaly would not go
  away.

39

• After extensive troubleshooting it was determined
  that the failure was due to a failed part
• The voltage reference part that failed caused a
  10V reference on the control board to reach as
  high as 18V, thereby stressing or damaging many
  parts on the control board and some on the main
  board
• The failure mechanism appears to have been bond
  wire that lifted off the pad and corrosion on the
  aluminum bond wire within the part
• The voltage reference failure is not related to
  any improper operation of the WARP it was
  probably due to improper handling during part
  manufacturing
• Extensive test and analysis has shown that this
  failure could not have propagated to any other
  boards within the WARP

Findings From Probing the Flight Unit in the
Failed Condition
40
Failed LM136 Reference Diode IC
41
Decision to Build a New Control Board

• Due to the large number (24 - 85 active and
  passive) of parts that were likely stressed or
  damaged on the flight control board, it was
  decided to build a new board. Why?
• Replacement of 24-85 parts is extensive rework
  and may be damaging to the control board.
• The control board has been through extensive
  testing and may be stressed by much more rework
  and testing

42
Box-Level Re-Verification

• Re-verification testing yielded two anomalies
  which prompted a thorough parts stress analysis
  to be conducted.
• Conducted susceptibility
• Conducted emissions
• 3 axis vibration at workmanship levels
• 4 cycle temperature test
• Comprehensive performance tests between each
  environmental test
• Two capacitors rated for 30V shorted during the
  over-voltage test which increased the input
  voltage to 40V.
• In flight the bus voltage will likely not go over
  32V. The parts were under-rated for the flight
  and test conditions.
• The amount of over-voltage applied, however,
  should not have caused the capacitors to short.
  The cause of the short is undetermined. It is
  believed that the parts may have been reverse
  biased sometime in their life. The parts were
  replaced with 100V rated capacitors.

43
Box-Level Re-Verification

• The WARP/LVPC failed to start-up at -15 Deg C
  however, was able to start at -8 Deg C.
• The start-up problem was determined to be due to
• 1. parts variances at cold temperature which
  reduced the 9.5V supply voltage for start-up and
  
• 2. low margin for the current available to bring
  up the reference voltage.
• The problem was resolved by the addition of a
  conventional diode to increase the startup
  voltage by approximately 800 millivolts, the
  removal of R5 to disable the U6C comparator, and
  a change of R38 from 51 Kohms to 75 Kohms to
  ensure proper 5V/10V power up rise times.
• These changes were verified and temperature
  tested on the breadboard, and on the original
  flight control board prior to incorporation in
  the flight unit. The breadboard cold start was
  successfully performed at 40 C at minimum input
  voltage with the changes installed.

44
Parts Stress Analysis

• Strategic Technology Institute, Inc. (STI) was
  tasked to perform an independent parts stress
  analysis. In addition, they were tasked to
  analyze the start-up circuitry to assess the
  start-up circuit margins.
• The stress analysis was performed manually under
  worst-case conditions.
• The board temperature was assumed to be 70 deg C
  where not provided.
• The loads were assumed to be 50 greater than the
  test loads, which are higher than the flight
  loads Worst Case Load Actual Flight
  Load
• Processor MIC Bus (5V) 3.75A 2.5A
• Memory (5V) 3.75A (20A for 30ms at turn-on)
  2.7A
• FODB (5V) 4.5A not used
• RS-422 (5V) 5.1A 1.9A
• RF Exciter (5V) 3A 1.5A
• RF Exciter (NS_2) 3.75A 1.5A
• RF Exciter (15V) 1.5A 0.7A
• Analysis did address overstress conditions caused
  by parameter drift under worst-case environmental
  conditions.
• Bus Voltage 21-35V

45
Parts Stress Analysis Conclusions

• STI flagged 30 parts which were potentially
  stressed under worst case conditions.
• All other parts met the derating requirements
  under PPL-21 under worst case conditions.
• Each of the 30 parts flagged were examined at
  GSFC. None of the parts were determined to be
  stressed.
• 7 resistors exceed the derating requirement for
  power dissipation by a small margin under
  worst-case conditions. PPL-21 requires the power
  rating to be derated to 60. R323 and R327 are
  at 64.2 of the power rating. R52, R60, R63,
  R72, and R167 are at 61.9 of the power rating.
  Because of the extremely small exceedance and the
  fact that the exceedance occurred under
  worst-case conditions, the parts were determined
  not to be stressed.
• 10 capacitors exceeded the ripple current rating
  assuming the worst case load on each of the
  output stages. STI re-ran the analysis to
  determine what the maximum loading for each of
  the output stages where capacitors met the
  ripple current rating. It was then verified that
  the flight loads were lower.
• 2 capacitors were thought to exceed the 50
  derating for voltage under worst case conditions.
  C15 and C99 are CWR-type solid tantalum which
  require a derating factor of 0.5 at 70? and 0.3
  at 110?C. C15 and C99 are 22uF capacitors rated
  for 20V. The steady-state voltage across them is
  a regulated 10V. The 10V is regulated to 1-2
  so there is no issue with transient voltages.
  Although the capacitors are just at the derated
  limit, they are not stressed.
• 9 transistors are right at the derated voltage
  requirement. Q301, Q402, Q403, Q405, Q408, Q409,
  Q410, Q414, Q418 have a peak voltage of 73V. The
  derated voltage requirement is 75V
  (.75x100Vrating). The peak should not increase
  in flight since the switching frequency normally
  goes down slightly with radiation.
• 2 transformers, T406 and T409, exceeded the
  current ratings under the worst case conditions.
  T409 is not used for EO-1. T406 only exceeded
  the current derating for the wire (125 of the
  rating) assuming a load of 1.5 x test load during
  start-up for 30ms. T406 has a normal operating
  current of 2.5A and has 12AWG magnet wire.
  Because of the short duration of the pulse of
  current, T406 is not a concern.

46
Analysis of Start-Up Circuit

• It was determined that there is approximately
  1.89mA (30) of current margin for start-up after
  1 year radiation exposure in flight.
• Sti modeled the start-up circuit in PSPICE and
  performed an analysis to determine how much
  margin is available for start-up after radiation.
  
• A detailed PSPICE analysis was required because
  hand calculations showed the start-up was
  marginal at cold temperature after radiation.
  The WARP/LVPC requires that enough current be
  supplied off the 28V to the 5V reference to
  bring the reference and the LVPC up fully. The
  circuitry can supply about 4.2-5.5mA at 0?C which
  is the worst-case start-up temperature. The 5V
  reference requires about .5mA to come up fully
  and there is about 3.3-3.5mA of additional load
  connected to the 5V. Radiation may increase
  that load to 3.6-3.8mA, making the total current
  demand 4.1-4.3mA.
• If the 5V is not fully up (i.e. getting less
  than .5mA) the circuit will start down to some
  minimal current. There is feedback from the
  9.5V supply rail, which is proportional to the
  5V, to increase the supply current to the 5V
  reference. PSPICE simulation including this
  feedback shows that the WARP/LVPC will actually
  start with 6.26mA total load on the 5V. The
  PSPICE simulation also factors in the dynamic
  voltage characteristics of D1, D39, Q1, and the
  5V reference. The total load calculated by STI
  is 3.84mA. The current loading on the 5V was
  measured to be between 3.3-3.5mA. There is
  currently about 2.2mA of current margin.
• A radiation analysis was performed by Dr. Ray
  Ladbury to determine how much the current loading
  on the 5V would increase with radiation exposure
  on EO-1 over the 1 year life. He determined that
  the load would increase, under worst-case
  assumptions, by .31mA leaving us 1.89mA (30)
  margin.
• Based on this analysis, the design and parts are
  adequate to meet the EO-1 requirements.