[Date Prev][Date Next][Thread Prev][Thread Next] - [Date Index][Thread Index][Author Index]

Re: What to do IF we regain control of AO-40

Leslie, W4SCO (sco@sco-inc.com) wrote:

> From what I have read here ... the valve failed on the ground test and
> was repaired by the manufacturer but not replaced. It then tested ok
> on the following ground test(s?). But it failed in space the only time
> it has been used. If we assume that there was one ground test and one
> use in flight then the part has so far demonstrated a 50 percent
> failure rate when used.

The valve between the helium tanks and the hypergolic fuel tanks failed
during ground testing and was repaired.  It was tested after returning
from repairs and was found to work.  During the first attempt to start
the 400N moter, the valve failed to open, so there was no fuel pressure
and no burn occurred.  Once that was diagnosed, the ground controllers
cycled the valve open and closed numerous times.  They did get it to
open.  They did pressurize the fuel tanks.  The first burn did occur.

To count up the successful and unsuccessful attempts at opening the
helium pressurization valves, you would need to know how many times
they were operated and failed to operate between the first and second
attempt to light the 400N motor.  We don't know those counts.

> Not encouraging.  Logic would then suggest that it has a 50/50 chance
> of working the next time.  But since it failed on the ground then
> worked after repair and then failed again we might assume that it may
> have a 66 percent failure rate?

Nope.  See above.  If the command team cycled the valves 10 times to
get them unstuck, and they worked 9 times out of 10, then we get 3
failures out of 12.  And this is simplistic, since the manufacturer
might have tested the valve after repairing it with a hundred successful
cycles, dropping the failure rate to 2 in 103 or some such figure.

More to the point, the number of observations is too small to make a
strong statistical prediction of future probabilities.

Take a penny.  It has a heads and a tails side.  The probability of a
fair toss coming up heads or tails is infinitesmally different than
50% : 50%.  However, if you only toss it 3 times, there is a 12.5%
probability of getting 3 heads.  It would look like the penny ALWAYS
comes up heads, but that's only due to lack of data.  (There is ALSO
a 12.5% chance of getting 3 tails.  The same disclaimer applies.) In
fact, the most likely result is 2 heads/1 tail (37.5%) or 1 heads/2
tails (also 37.5%).  There is a zero percent chance of getting the
right answer (50%/50%) from such a small number of observations.

The helium pressurization valves don't have to work 100% of the
time in order for the 400N motor to be used.  The command team made
a change to the procedure that allowed the first burn to happen.
Instead of pressurizing the fuel tanks just before the burn, they
pressurized the fuel tanks as soon as they diagnosed the problem,
made sure that adequate pressure had been attained, and then
programmed the burn to occur on the next orbit.  This could become
the new default procedure, and even if the helium pressurization
valves worked only one time in 10, the 400N motor could still be
used.  We might just miss a few planned burns by an orbit or two.

The valves between the MMH propellant, N2O4 oxidizer, and the
combustion chamber are the more critical valves with respect to
the operation of the 400N motor.

AFAIK, THESE VALVES NEVER FAILED in ground testing.  Some people are
assuming that they failed to close promptly at the end of the burn
because of a valve malfunction, causing the burn to exceed the
planned duration.  This is mere speculation by anyone who has not
been able to analyze the data recorded around the time of the event.
That means all of us, and per Peter's reports, that ALSO means the
command team, who were STILL STUDYING the data at the time that
telemetry abruptly ceased.  Maybe some event external to the valves
caused the unexpected operation.  A software bug?  A command error?
An uncorrectable (2-bit or more) RAM error in IHU-1?  We don't know

So how will we ever know?

Choice #1: Try to recover the data stored in the IHU surrounding
the event, if at all possible, and then study it long and hard.

Choice #2: Be impatient, issue the reset command, wipe out all
stored evidence of the event on board the spacecraft, and start
some experimentation.

The command team votes for #1.  So do I.  I think you do also.
The difference MAY be (and I am not trying to put words in your
mouth, but I *think* I follow your train of thought) that if
Choice #1 fails, I may be more willing than you to see them test
the 400N propulsion system, track down the problem, and then
decide whether or not to use it again.  It does boil down to
risk vs. benefit.  So far, the risk seems small to me -- if the
burn duration is uncertain by a larger percentage than planned,
we can take more time to reach our desired orbit by using a
larger number of smaller burns, within limits of available fuel
stores.  If the burn duration is extremely uncertain, including
the chance that once those valves are opened they won't shut
again, then the risk *might* outweigh the benefit.

But it's too early to tell yet.

Prescription:  Tincture of Time.  (i.e., be patient, gather more
data, analyze it carefully, weigh all the risks and all the benefits,
and THEN decide.)  Just my inexpert opinion, mind you.

John (KB0ZEV)
Via the amsat-bb mailing list at AMSAT.ORG courtesy of AMSAT-NA.
To unsubscribe, send "unsubscribe amsat-bb" to Majordomo@amsat.org