4.23 Exhibit 4 JPL Design Principles.pdf

JPL/Caltech Proprietary Business Discreet. Caltech Record. Not for Public Distribution.

Reviewed and determined not to contain export controlled technical data

Dated: April 30, 2025 Subcontract No.:

Exhibit 4: JPL Design Principles for Mechanical Design of Flight Hardware

Reviewed and determined not to contain export controlled technical data.

Table of Contents

1 Introduction

2 Applicability

3 Scope of Requirements

4 Non-compliances, deviations and exceptions

5 Mechanical Design Principles

5.1 Configuration

5.1.1 Accessibility

5.1.2 "Blind" connectors

5.1.3 Sharp edges

5.1.4 Venting

5.1.5 Plume impingement

5.1.6 RF pattern distortion

5.1.7 Appendage deployments and separations

5.1.8 Design deployables for test

5.1.9 Clearances

5.1.10 Deployment Telemetry

5.2 Mechanisms

5.2.1 Deployment systems design margin

5.2.2 Actuator design margins

5.2.3 Use of kick-off springs for assured first motion

5.2.4 Spring Design Requirements

5.2.4.1 Mission-Critical Preloaded Springs

5.2.4.2 Safety-Critical Preloaded Springs

5.2.5 Stroke margin for linear actuators

5.2.6 Bolt catchers for pyrotechnic separation nuts

5.2.7 Spring energized bolt release for actuated separation nuts

5.2.8 Mechanisms cycle life testing

5.2.8.1 Mechanism cycle life design margin

5.2.8.2 Disassembly and Inspection

5.2.8.3 One-Time Deployment Mechanisms

5.2.9 Motor verification

5.2.9.1 Stepper Motors

5.2.9.2 Electronically-commutated DC brushless motors

5.2.10 Mechanism design for maximum output torque/force

5.2.11 Design temperature range for spacecraft mechanisms

5.3 Mass Properties

5.3.1 Control of mass properties

5.4 Structural Design

5.4.1 Structural design requirements

5.4.2 SC Lift Points & Ground Handling Limit Load

5.4.3 Joint slip factor of safety

5.4.4 Composite fittings factor of safety

5.4.5 Thermally-induced loading factor of safety

5.4.6 Structure design criteria for actuators

5.4.7 Design temperature range for spacecraft structure

5.4.8 Minimum design and test factors for glass and ceramics

5.4.9 Design validation

5.4.10 Wire Rope Design and Test Requirements

5.4.10.1 Wire Rope Design

5.4.10.2 Wire Rope Test

6 System Thermal Design

6.1 Temperature Control Design Performance

6.1.1 Temperature control design margin

6.1.2 Design margin under nominal and worst-case conditions

6.1.3 Recoverability of AFT limits

6.1.4 Design margin under anomalous conditions

6.1.5 Design margin to propellant freezing

6.1.6 Design margin to propellant condensation

6.1.7 Propellant vapor migration

6.1.8 Power density limit for film heaters

6.1.9 Maximum duty cycle of actively controlled heaters

6.1.10 Cryogenic Design Margin

6.1.11 Motor and actuator self-heating

6.1.12 Test limit-to-hardware capability limit margin

1 Introduction

This exhibit documents the JPL Mechanical Design Principles applicable to all flight hardware produced by the institution.

The content of this exhibit is a subset of the JPL Design Principles Rev 10, JPL DocID

43913. Only the design principles applicable to the engineering disciplines detailed in

Article 1. Statement of Work of the Subcontract are included in this document.

The design principles detailed in this exhibit have been copied without any modifications from the JPL document mentioned above. The numbering follows the sequential ordering of this document, however the original numbering is provided as reference as well.

2 Applicability

Reference: JPL DocID 43913, Paragraph 1.1 Applicability

This document applies to all persons participating in the design, verification/validation, and operation of flight systems intended for use in space.

The requirements of this document apply to spacecraft, payloads, and instruments.

Note that some of these requirements have explicit differences between what is required for a Type I mission vs a Type II mission. Type I and Type II missions are defined in the Flight Project Practices (FPP) (JPL Rules! DocID 58032).

The requirements of this document apply in all modes of project implementation for those deliverables for which JPL is responsible. This includes when the flight system effort is contracted, when the flight system is shared responsibility of JPL and a partner, as well as projects implemented in an “in-house” mode.

All space flight projects managed by JPL are required to meet the requirements herein, or secure timely approval for any deviations/exceptions taken.

3 Scope of Requirements

Reference: JPL DocID 43913, Paragraph 1.6 Scope of Requirements

The JPL Design Principles is an institutional requirement type document in the Directive category of institutional documents. Directive documents are required of those to which they apply. Applicability of the Design Principles is indicated in section 2.

Requirements herein are identified through the use of “shall”. Notes, Examples and

Rationale are explanatory, and do not contain any requirements. “Should” is used to describe a leading practice, such statements represent guidance rather than requirements. Where a design rule points to standard or requirements documents, the latest revision of the document will be used.

4 Non-compliances, deviations and exceptions

Reference: JPL DocID 43913, Paragraph 1.5.2 Waivers, and Paragraph 1.7 Deviations and Exceptions

Requirements non-compliances and/or deviations from the Design Rules require an approved waiver that includes the identification of the residual risk and the rationale as to the acceptability of the risk commensurate with the risk policy established by each project. Departures from established principles are controlled to ensure management awareness of and institutional involvement in project potential risk considerations.

If a waiver is required, the waiver process will be managed and executed by the JPL technical representative. The Subcontractor shall provide the technical support as defined in the task statement of work. Reference: JPL DocID 43913, Paragraph 4.2

Mechanical Configuration/Systems Designs.

5 Mechanical Design Principles

All the design principles listed in this section have been copied with no modifications from JPL DocID 43913, Paragraph 4.2 Mechanical Configuration/Systems Design.

5.1 Configuration

[Ref #4.2.2]

5.1.1 Accessibility

[Ref #4.2.2.1]

The design shall provide accessibility for:

a) assembly/disassembly, handling, and transportation,

b) testing and troubleshooting, including alignments, and calibrations, and

c) maintenance and servicing in the planned ground operations flow including integrated operations with the launch vehicle

5.1.2 "Blind" connectors

[Ref #4.2.2.2]

The design shall not use electrical connectors that require a blind mating in system level assembly, test and launch operations.

Note: "Blind" mating refers to the lack of a clear view of the connection being made by the person making the connection.

5.1.3 Sharp edges

[Ref #4.2.2.3]

Flight equipment corners and edges that represent a potential hazard in handling, assembly, and testing shall be designed to preclude injury to personnel and damage to flight hardware that otherwise might occur as a result of snagging of the garments worn by technicians working on the system.

Note: Precludes injury to personnel, or damage to hardware caused by snagging of garments.

5.1.4 Venting

[Ref #4.2.2.5]

When a spacecraft requires venting of gas or liquid, the potential for contamination, forces, or moments due to the vented material impinging on spacecraft surfaces shall be evaluated for accommodation in the configuration design.

5.1.5 Plume impingement

[Ref #4.2.2.6]

Thruster plume impingement should be precluded.

Note: A nominal 45-degree half-cone angle is a typical thruster plume exclusion zone for chemical propulsion thrusters to avoid excessive impingement forces and torques, although this guideline may not be adequate to address contamination hazards.

Note: For electric propulsion thrusters, a nominal 90-degree half-cone exclusion zone should be considered for acceptable levels of sputter erosion and impingement forces and torques, although this guideline may not be adequate to address redeposition, thermal flux, and possible electron current collection.

5.1.6 RF pattern distortion

[Ref #4.2.2.7]

The configuration design shall provide a clear view to the antenna aperture throughout the range of angles, relative to the boresight, that is required for telecommunications capabilities planned throughout the mission.

Rationale: Minimize RF antenna pattern distortion effects and multi-path reflections.

5.1.7 Appendage deployments and separations

[Ref #4.2.2.8]

Launch retention features and separation devices shall be aligned with the first motion vector of spacecraft appendage deployments at the interface of mechanical release.

Rationale: Minimize transverse motion at a separation joint.

5.1.8 Design deployables for test

[Ref #4.2.2.9]

Wherever practical, appendages and other deployables shall be capable of deployment under Earth-gravity conditions without off-loading by ground support equipment. When it is not practical to design for unassisted deployment (e.g., large appendages), the initial design shall incorporate appropriate interfaces for gravity off-load ground support equipment.

Rationale: In order to allow the best validation during system testing, it is desirable for hinge bearings and cantilevered structure to be capable of sustaining gravity loading. Consideration should be given to the planned spacecraft or instrument orientation relative to gravity during environmental testing, where vertically orientated hinge-lines could allow unassisted deployment.

5.1.9 Clearances

[Ref #4.2.2.12]

The design shall ensure positive non-contacting clearances during launch dynamics and no recontact for all separations, deployments, releases, jettisons, and articulations under nominal and 3-sigma or worst-case conditions.

5.1.10 Deployment Telemetry

[Ref #4.2.2.15]

Deployable appendages, and any deployable that has a significant effect on the flight system mass properties, shall provide direct telemetry (such as a microswitch) to indicate the flight system configuration.

Note: All deployment events that change the flight system configuration are to be telemetered to be consistent with Section 4.4.6 and paragraphs 4.5.1.4, 9.1.3 and 9.1.4 of this document. When the deployable exhibits insignificant mass property changes (as approved by the flight system and attitude control subsystem), indirect secondary telemetry can be allowed for the mission operation such as proper instrument function or detectable temperature change.

Rationale: This paragraph emphasizes JPL telemetry requirements within the

Mechanical Section of this document, to ensure proper implementation for flight mechanical systems.

5.2 Mechanisms

[Ref #4.2.3]

Note: Mechanism functional Force and Torque Margins are defined as:

Force Margin = { [(min. force available) / (max. force required)] -1} * 100

Torque Margin = { [(min. torque available) / (max. torque required)] -1} * 100

5.2.1 Deployment systems design margin

[Ref #4.2.3.1]

Mission critical deployment and separation systems (e.g., solar arrays and other spacecraft appendages, spacecraft-to-launch vehicle separations, etc.) shall demonstrate a functional force or torque margin of at least 100% for the entire range of motion.

Note: The margin applies under worst-case conditions, including restart from any position within the range of motion including incipient latching events.

Verification: by testing under environmental conditions and supporting analysis, paying particular attention to quantifying worst-case force/torque losses due to cold, stiff cable bundles, the potential range of the coefficient of friction, and vacuum versus air effects.

5.2.2 Actuator design margins

[Ref #4.2.3.3]

Mission critical mechanisms and actuators (e.g., electromechanical motors and solenoids, phase-change and state-change actuators, piezoelectric and electrostrictive devices, and spring-energized devices, or mechanisms driven by these devices) shall demonstrate at least 100% torque/force margin for the entire range of motion.

Note: The margin applies under worst-case conditions at the end-of-life, including restart from any position within the range of motion.

Note: For piezoelectric devices, the depoling force limit is to be considered the device’s ultimate strength for stress margin analysis.

5.2.3 Use of kick-off springs for assured first motion

[Ref #4.2.3.4]

Kickoff springs (also called “helper” or “separation” springs) shall be used to assure first motion for all in-flight separation joints.

Note: An exception for the usage of kickoff springs in an in-flight separation joint is for entry, descent and landing systems, where combined forces from the descent parachute and gravity provide substantially more separation force than the implementation of any practical spring design.

Verification: by design review, analysis, and/or test.

5.2.4 Spring Design Requirements

[Ref #4.2.3.5]

5.2.4.1 Mission-Critical Preloaded Springs

[Ref #4.2.3.5.1]

Preloaded springs that are mission-critical for function shall be designed for positive stress margin at maximum preload using a factor of safety of 1.50 to yield and 1.65 to ultimate strength.

5.2.4.2 Safety-Critical Preloaded Springs

[Ref #4.2.3.5.2]

Safety-critical preloaded springs, that are not constrained from hazardous release of material should failure occur, shall be designed for positive stress margin at maximum preload using a safety factor of 1.65 to yield and 2.00 to ultimate strength.

Note: Caution: Preloaded springs often must be compressed more than the designed preload during installation. Consideration should be given by the design engineers to not overstress the springs during installation, using a factory of safety ≥ 1.0 for the compressed height at installation.

5.2.5 Stroke margin for linear actuators

[Ref #4.2.3.6]

Linear actuator output devices utilized for mission critical mechanisms shall demonstrate at least 10% stroke margin above the input stroke requirements of the mechanism. That is, the linear actuator output stroke capability shall provide 110% of the required input stroke to the mechanism to perform the mechanism function.

Note: Examples of linear input motion actuator devices are paraffin actuators, solenoids, and shape-memory metal devices.

Note: The margin applies under worst-case conditions at the end-of-life.

Verification: By testing under environmental conditions for beginning of life conditions, supported by test and/or analysis for end of life conditions.

5.2.6 Bolt catchers for pyrotechnic separation nuts

[Ref #4.2.3.7]

Where pyrotechnically-actuated separation nuts are utilized in the flight system, bolt catchers shall be incorporated in the design to ensure that the bolt is contained.

Note: It is also recommended to incorporate energy absorption features (such as crushable honeycomb) within the bolt catcher housing.

Rationale: Limit orbital debris and the necessity to perform separation analyses for the bolt. Assure that ejected bolts do not threaten personnel safety.

5.2.7 Spring energized bolt release for actuated separation nuts

[Ref #4.2.3.8]

Where actuated separation nuts are utilized in the flight system, a spring shall be incorporated in the design to ensure positive retraction of the bolt from the separation interface. The spring stroke shall meet or exceed the bolt stroke necessary for complete withdrawal of the bolt from the separation interface.

5.2.8 Mechanisms cycle life testing

[Ref #4.2.3.9]

Mission Critical mechanisms that function in a cyclic manner, and one-time usage deployment mechanisms, shall demonstrate a minimum life capability according to

Table 4.2.3-1.

Rationale: This requirement defines life testing of flight moving mechanical assemblies consistent with JPL heritage qualification practices.

Verification: By life test of a Qualification unit, incorporating nominal ground test and mission cycle requirements, with a portion of the life test performed under worst-case environmental conditions. (A guideline for the life test is 50% of the cycle life test under nominal temperature conditions, with 25% at Qual cold and

25% at Qual hot temperature conditions.)

Note: Qualification Cycle Life Test Margin is defined as:

Qualification Cycle Life Test Margin (%) = {[(cycles demonstrated by life-testing of a qual unit) / (ground test cycles planned for flight unit + flight operational cycles)] -1} * 100

There is no defined Cycle Life Test Margin for a one-time deployment mechanism in a Protoflight program.

5.2.8.1 Mechanism cycle life design margin

[Ref #4.2.3.9.1]

The mission critical mechanism shall operate within specified performance at the end of the life test as conducted according to Table 4.2.3-1.

5.2.8.2 Disassembly and Inspection

[Ref #4.2.3.9.2]

The life-test unit shall be disassembled and inspected for unacceptable wear or debris generation. Radiological evaluation such as Fein-focus X-ray, CT X-ray or

N-ray may be utilized instead of destructive disassembly for sealed systems

(Stirling pumps, cryo-coolers, sealed pumps, propulsion valves, etc.) as long as the resolution is adequate for assessment of wear, dimensional changes and wear-debris.

5.2.8.3 One-Time Deployment Mechanisms

[Ref #4.2.3.9.3]

One-time deployment mechanisms may be verified within a Protoflight (PF) program as long as inspections and other technical metrics are implemented to verify the post-life test condition of the hardware, and adequate testing of the deployable hardware after final assembly is performed. The protoflight ground test verification for a one-time deployable mechanism shall be at a minimum of four operations, defined as once at ambient temperature, once at PF hot bound, once at PF cold bound, and once in System Test on the flight system. (System testing may be limited to “first motion” actuations for large appendages.) The maximum protoflight ground test cycles, to avoid the need for a dedicated qualification life test unit in the design verification test program, should be limited to 10 operational cycles or less.

5.2.9 Motor verification

[Ref #4.2.3.10]

Motor performance testing shall be conducted using flight-representative drive electronics.

Note: The minimum risk flight program will ensure that the design of the flight drive electronics is completed prior to qualification testing of the motors, and flight-representative test electronics are utilized exclusively for qualification and flight acceptance testing all motor types.

5.2.9.1 Stepper Motors

[Ref #4.2.3.10.1]

Formal qualification/protoflight testing, and/or flight acceptance testing, of the flight stepper motor shall be conducted with a physical representation of the driven load (inertia and drag torque) powered by flight-representative drive electronics driven at the expected pulse-rate for flight usage.

Rationale: The performance of stepper motors is highly dependent on the input electrical drive pulse; the inertial loads and the torque drag loads. It can be extremely difficult to assess even minor differences in any of these parameters without conducting actual verification testing under environmental conditions.

5.2.9.2 Electronically-commutated DC brushless motors

[Ref #4.2.3.10.2]

Formal qualification/protoflight tests and flight acceptance testing of the flight electronically-commutated brushless motor shall include characterization of torque holes at the commutation switching points, while powered by flight-representative drive electronics, and at a slow enough rotational speed that prevents inertial effects from masking the presence of a torque hole.

Rationale: Electronically-commutated motors must be demonstrated by test to operate compatibly with the commutation electronics and motor rotor position sensors, precluding exhibition of excessively low or zero torque rotor positions.

5.2.10 Mechanism design for maximum output torque/force

[Ref #4.2.3.11]

The entire drive train of a mechanism design shall be capable of sustaining the maximum output torque or force of the driving actuator under maximum input voltage and worst-case temperature conditions, as well as the combination of maximum actuator output torque and transient dynamic loading from mechanical stop impact at the maximum worst-case velocity of impact.

Note: This DP applies when operating with the defined motor electrical interface from the motor controller, e.g., with motor input current-limiting protective measures functioning as specified. It is also strongly encouraged to ensure motor input current-limiting features are in place during all ground testing when using electrical support equipment, to prevent flight hardware damage due to human error. (See related Flight Project Practices (JPL Rules! DocID 58032) paragraph

7.2.6 on fault propagation from non-flight equipment.)

Rationale: The mechanism will experience maximum motor torque if locked-rotor motor stall is encountered in test or flight. It should be capable of surviving the maximum torque/force exposure, including worst-case transient loading from mechanical stop impact at maximum velocity.

5.2.11 Design temperature range for spacecraft mechanisms

[Ref #4.2.3.12]

Spacecraft mechanisms shall be designed for Allowable Flight Temperature (AFT) limits extended by -15°C and +20°C, or for the wider temperature range that results from the effects of motor or actuator self-heating during functional operation. Furthermore, the upper design temperature bound for spacecraft mechanisms that are operated under ambient conditions shall be +35°C, or the higher temperature that may result from the effects of motor or actuator self-heating during ground testing, whichever is more severe.

Note: Ensure that the junction temperature limits for any silicon electronic devices that may be embedded within an electromechanical actuator comply with

Section 4.12.6.

5.3 Mass Properties

[Ref #4.2.4]

5.3.1 Control of mass properties

[Ref #4.2.4.3]

Methods of positive mass property control (e.g., propulsion latch valves, trim orifices, cover latches, retention of deployables) shall be incorporated into the design to preclude unacceptable fluid migration or mass property change.

5.4 Structural Design

[Ref #4.2.5]

5.4.1 Structural design requirements

[Ref #4.2.5.1]

Flight system structure shall meet the design and test requirements of NASA-STD-5001

“Structural Design and Test Factors of Safety for Spacecraft Hardware”, and the requirements below.

5.4.2 SC Lift Points & Ground Handling Limit Load

[Ref #4.2.5.2]

Hoisting provisions (attachment points and load paths) in flight hardware shall be verified to have a non-negative margin of safety for the Ground Handling Limit Load

(GHLL), with a safety factor of 1.40 to yield and 1.90 to ultimate strength for structure that is proof-tested (using a test factor of at least 1.20). If metallic flight structure is not proof-tested, then the design factor of safety for the hoisting attachment points and load paths shall be 1.9 to yield and 2.5 to ultimate strength. Mechanical Ground Support

Equipment (GSE) interfaces to flight hardware, that is not specifically used for hoisting, can be analyzed to the standard design factors of safety per NASA-STD-5001.

Note: The Ground Handling Limit Load (GHLL) is a design load, defined as the static weight supported by the ground handling structure times the ground handling dynamic factor Fd. The ground handling dynamic factor, Fd, in the vertical direction is equal to 2.0 unless there is reason to believe that a different dynamic factor is required. Dynamic factors for hoisting flight hardware can be based on actual crane tests with representative loads, but in no instance less than 1.25 is used. The ground handling dynamic factor in the lateral directions is equal to 0.25 unless there is reason to believe that a different dynamic factor is required.

Note: Refer to the JPL Standard for Systems Safety (JPL Rules! DocID 34880) paragraph 7.10.2 for other details of this Design Rule.

Rationale: To ensure design robustness and safety for critical hoisting of flight hardware, the design factors for hoisting attachment points and load paths are increased over the standard factors of safety.

5.4.3 Joint slip factor of safety

[Ref #4.2.5.3]

The minimum factor of safety (yield or ultimate basis) for all spacecraft structure for non detrimental instances of joint slippage, bolt preload exceedance (joint gapping), or bolt contact or encroachment shall be 1.00. The minimum factor of safety for detrimental instances (e.g., critical instrument alignment, etc.) shall be 1.25.

Note: The required factor of safety is lower for joints that have room to slip in a benign way because the structure will not be strained, and the alignment isn’t critical to performance.

Verification: Analysis to demonstrate that preloaded friction joints will not slip or gap.

5.4.4 Composite fittings factor of safety

[Ref #4.2.5.4]

An additional factor of safety of 1.15 shall be applied for composite joints, bonds and fittings.

Note: This additional fitting factor of safety can be reduced to 1.00 if a comprehensive development test program has been performed for the specific joint configuration, tested under representative worst-case loading and environmental conditions.

5.4.5 Thermally-induced loading factor of safety

[Ref #4.2.5.5]

Thermal stresses which occur simultaneously with acceleration or applied forces shall be combined in a consistent manner using appropriate yield and ultimate factors of safety. Analysis shall verify that the yield and ultimate margins of safety are positive across the qualification/protoflight temperature range for all combined mechanical and thermal stresses.

Positive margins shall be demonstrated for metallic structure with the application of a yield factor of safety of 1.00, and an ultimate factor of safety of 1.17, for thermally-induced loading over the qualification/protoflight temperature range. Positive margin shall be demonstrated over the allowable flight temperature range using the normal design factors of safety of 1.25 to yield and 1.40 to ultimate. The stress contribution from the acceleration or applied forces shall apply the normal safety factors of 1.25 to yield and 1.40 to ultimate for structure verified by testing.

Positive margins shall be demonstrated for composite structure, and composite/metallic hybrid structure bond joints, with the application of an ultimate factor of safety of 1.17 over qualification/protoflight temperature range, and an ultimate factor of safety of 1.50 over the allowable flight temperature range. Both of the above cases must be investigated to determine worst-case thermally-induced loading. The stress contribution from the acceleration or applied forces shall apply the normal safety factor of 1.50 to ultimate for composite structure.

5.4.6 Structure design criteria for actuators

[Ref #4.2.5.6]

Flight system structure shall be designed to sustain the maximum output torque or force of mechanism’s motors, actuators or preloaded spring elements, with the appropriate design factors of safety from NASA-STD-5001 applied to this maximum level. Structural components shall maintain a positive margin of safety with the appropriate factors of safety applied when subjected to worst-case transient loads from mechanical stop impact at maximum velocity, or parachute (or other) snatch loads.

Note: If, when designing the structure, the mechanism maximum output torque or force is not known, then the maximum should be assumed to be 2X the nominal output value; and when the mechanism maximum output is known, the acceptability of the structure design will be assessed/validated.

5.4.7 Design temperature range for spacecraft structure

[Ref #4.2.5.7]

Spacecraft structure shall be designed for AFT limits extended by -15°C and +20°C.

The appropriate design factors of safety shall apply over this qualification/protoflight temperature range.

5.4.8 Minimum design and test factors for glass and ceramics

[Ref #4.2.3.8]

The minimum design and test factors for flight system glass, ceramics, and associated bonds shall meet the requirements of NASA-STD-5001B, with the following exceptions:

a. The ultimate design factor of safety for the usage of non-pressurized glass and ceramics in the flight system shall be 2.0 or larger.

b. While NASA-STD-5001B allows verification by analysis of some glass structures, proof-testing is required for all nonmetallic flight structures at JPL. An approved waiver is necessary if 100% proof-testing is not conducted for flight system glass, ceramics, and associated bonds.

Note: Proof-testing of non-pressurized glass elements and associated bonds within a flight instrument or structure, to the 1.2 test factor, is typically accomplished during protoflight dynamics testing, which subjects the test article to a factor of 1.4 over the predicted limit load. Only rare cases exist where the applied test factor will fall short of 1.2 times the flight limit load for non-pressurized glass elements, if tested to the protoflight level. Flight acceptance test levels may not be appropriate for flight hardware containing glass elements.

Rationale: This Design Principle reduces the requirements of NASA-STD-5001B for ceramics and non-pressurized glass to the values commonly used for nonmetallics at JPL and has a long successful heritage in instrument piezoelectrics and optical glass elements. Most if not all applications using glass/ceramic elements in flight hardware will be adequately proof-tested by their participation in subsystem dynamics testing at protoflight levels, and thus compliant to this design requirement.

5.4.9 Design validation

[Ref #4.2.5.9]

Design verification and validation shall be accomplished by a combination of analyses and tests according to the requirements of JPL Standard Spacecraft System Dynamic and Static Testing (JPL Rules! Doc ID 55833). Where testing on a subset of structural elements may not be practical, these primary structural elements shall be designed with high safety factors (>2.0 ultimate) to reduce the risks of structural failure. Although structural loads testing is normally required on all primary structure, exceptions for this subset can sometimes be made if the structure is: all metallic ("no test" is not an option for composites), a high safety factor (>2.0) is used in the analysis, and the "no test" criteria enumerated in NASA-STD-5001 "Structural Design and Test Factors of Safety for Spacecraft Hardware" are met.

5.4.10 Wire Rope Design and Test Requirements

[Ref #4.2.5.10]

5.4.10.1 Wire Rope Design

[Ref #4.2.5.10.1]

Wire rope assemblies used in critical flight systems shall be designed using the factors of Table 4.2.5-1, with considerations of static preload, maximum launch/landing loading, and dynamic effects such as the functional shock loading in mechanisms when determining the flight limit load.

5.4.10.2 Wire Rope Test

[Ref #4.2.5.10.2]

Wire rope assemblies used in critical flight systems shall be pre-stretched and static-proof tested prior to flight usage according to the requirements of Table

4.2.5-1.

Note: Design factors of 4.0 and greater are strongly recommended for wire rope applications where numerous articulations over sheaves, and/or bending reversals, are necessary. Bending endurance capabilities of the wire rope must be considered.

Rationale: These rules follow the general philosophy of existing wire rope standards: pre-stretching where tension stability is necessary, the use of increased safety factors for wire ropes that demand articulation in their operational life, and consideration that wire-rope is functionally a moving mechanical assembly and is subject to degradation from bending and friction effects.

6 System Thermal Design

All the design principles listed in this section have been copied with no modifications from JPL DocID 43913, Paragraph 4.8 System Thermal Design.

6.1 Temperature Control Design Performance

[Ref #4.8.2]

6.1.1 Temperature control design margin

[Ref #4.8.2.1]

Thermal control design margin is defined as the difference between the Allowable Flight

Temperature (AFT) upper or lower bound, and the worst-case predicted hot or cold bound (respectively). Worst-case predicted temperatures are defined as the combination of realistic (non-anomalous) thermal extremes during the mission that may produce the maximum hot and minimum cold temperature extremes. Figure 4.8.2-1 illustrates the temperature control design margin as well as the relationship among temperature control ranges used in the verification of flight systems.

Figure 4.8.2-1 Temperature Control Limits and Margins

6.1.2 Design margin under nominal and worst-case conditions

[Ref #4.8.2.3]

The thermal design shall control temperatures within the defined Allowable Flight Temperature range

(AFT).

Rationale: To ensure no credible thermal threat to hardware when operating under nominal and worst-case operating conditions.

6.1.3 Recoverability of AFT limits

[Ref #4.8.2.4]

The AFT limits of any unit designated as critical to mission success shall (should for Type II) be recoverable upon detection and resolution of the single fault and subsequent ground intervention.

Note: Temperature control of flight system mission-critical functions must be single fault-tolerant, e.g., redundant heaters.

6.1.4 Design margin under anomalous conditions

[Ref #4.8.2.5]

The thermal design shall (should for Type II) control temperatures within the defined

Qualification/Protoflight (Qual / PF) temperature range during the mission under credible failure mode conditions that result from s/c potential single failures and ground operator errors.

Note: Examples of credible abnormal conditions are anomaly-induced power dissipation and/or off nominal sun attitude conditions. Constraints to analyzed abnormal conditions that are necessary to maintain the thermal control with these limits, e.g., duration of unplanned power-off states, duration of time that attitude control can be lost, etc., are identified and resolved via the system engineering process.

Note: Transient solar illumination into an instrument aperture or normal to an instrument radiator can result in violation of the detector PF temperature limits and permanent damage.

Where appropriate, the project defines the required duration of boresight or radiator solar exposure that must be tolerated during a loss-of-attitude recovery.

6.1.5 Design margin to propellant freezing

[Ref #4.8.2.6]

Hardware shall be thermally controlled to remain a minimum of 10°C above the propellant freezing temperature whenever the hardware is in contact with propellant or propellant vapor.

6.1.6 Design margin to propellant condensation

[Ref #4.8.2.7]

Pressurization system hardware that will come in contact with propellant vapor shall be thermally controlled over the entire mission to remain a minimum of 10°C above the temperature at which propellant condensation will occur when such condensation presents a threat to the safe operation of the system.

Note: Threats to safe system operation include condensation in pressure regulator sensing ports, lines which will be swept by high velocity pressurant, and condensation which could make a significant quantity of propellant unusable.

6.1.7 Propellant vapor migration

[Ref #4.8.2.8]

Temperature control of propulsion hardware shall avoid temperature gradients that cause migration of propellant vapors when such migration presents a threat to safe operation of the system.

Example: In propellant tanks with elastomeric diaphragms, the time-averaged bulk temperature on the gas side is maintained higher than the time-averaged bulk temperature of the liquid.

6.1.8 Power density limit for film heaters

[Ref #4.8.2.9]

Film heaters, when bonded to a metallic or composite substrate, shall (should for Type II) be limited to a maximum power density according to the requirements of the JPL Derating Standard (JPL

Rules! DocID 34885).

6.1.9 Maximum duty cycle of actively controlled heaters

[Ref #4.8.2.10]

The maximum duty cycle shall be 80% or less under worst-case cold environmental conditions when actively controlled heaters are implemented in a flight system thermal control design.

Note: The purpose of this requirement is to ensure that positive heater control authority exists during the design phase of the flight system thermal control. Heater duty cycling can fall outside of the prescribed design range during the mission, but should generally meet the above maximum duty cycling criteria during ground testing to validate the thermal control design.

Note: This principle applies to systems above -70 degrees C. Active controllers include mechanical thermostats and Proportional-Integral-Derivative (PID) or pulse wave modulated controllers. To conserve power consumption throughout the mission due to typically large spacecraft bus voltage ranges, the maximum 80% duty cycle applies to the condition of a minimum nominal voltage, and not a minimum failed voltage, e.g., failed battery cell or solar cell string.

6.1.10 Cryogenic Design Margin

[Ref #4.8.2.11]

The total power load margin for passive coolers, mechanical coolers and stored cryogen systems designed to operate below –70°C shall be greater than 25%, as determined by Qual/PF and Flight

Acceptance (FA) testing.

Rationale: Small additional detector heat loads in the range of a few milliwatts to tens of milliwatts (both active and parasitic) can have large adverse thermal impacts on some cryogenic systems. Margins are protection for uncertainties and modeling errors on a cryogenic system with a large thermal sensitivity. This requirement provides design robustness for cryogenic systems operating below -70 degrees C.

Note: The cryogenic margin is to be used in conjunction with the realistic (non-anomalous) stacked worst-case thermal analysis of the cryogenic system enclosure and adjacent spacecraft hardware.

Note: See 6.3.10 for margin definition, and margin limits at key development milestones.

6.1.11 Motor and actuator self-heating

[Ref #4.8.2.12]

Motor or actuator operating AFT and qualification/protoflight temperature ranges shall be defined by the interface or environmental temperature extremes, prior to energizing a motor or actuator. The maximum allowable temperature limit of the motor or actuator due to self-heating shall be separately defined.

Rationale: This requirement is to ensure consistency between the definition of operating and non-operating Allowable Flight Temperature limits, while accommodating the characteristic of motor or actuator self-heating during ground testing.

6.1.12 Test limit-to-hardware capability limit margin

[Ref #4.8.2.13]

When the hardware capability temperature limit is known and presents a hard constraint on the thermal control design, the qualification/protoflight temperature limit shall be chosen to provide a minimum of 10 degrees C margin to the hardware capability temperature limit.

For example: Temperature limits of hardware capabilities occur when essential mechanical clearances are reduced to zero, or component materials reach their maximum usable temperature, or the manufacturer's limit above (or below) which component operation is not guaranteed. With respect to electronic parts, hardware capability limit refers to the manufacturer's component specification upper and lower temperature extremes, and not the end-user de-rating requirements.