24
\$\begingroup\$

I've been reading about the Voyager space probes and am very curious about how you design electronics and instrumentation for a very long life (40+ years) without any physical maintenance.

My guesses so far include:

  • Physical protection for components (sturdy metal box and potting compound)
  • environmental protection, keeping electronics warm and dry.
  • Redundancy (i.e. duplicates) where possible.

But what about the individual components themselves? How do you ensure a diode/transistor/capacitor actually lasts for that long? Or even harder, what about the (albeit primitive) microprocessors?

I guess under-rating components might help (i.e. using a 12 V capacitor in a 5 V circuit, or running a 8 MHz processor at 4 MHz, or using a 100 mA cable for a 1 mA current).

But there's got to be more to it than that? Or is this all part of the miracle of the probes, the fact that they're still working now?

\$\endgroup\$
  • 1
    \$\begingroup\$ Space is a very harsh environment. I have devices that I built 40 years ago with no special care, that are still working fine today. My stereo has no power switch, so it has been running continuously for 40 years. I expect it will outlast me! \$\endgroup\$ – Bruce Abbott Jan 10 at 18:01
  • 1
    \$\begingroup\$ There is also a fair amount of component selection - e.g. "stay away from electrolytic capacitors at all costs". (Why don't you avoid them all the time? electrolytics die relatively quickly, but are good in other regards.) \$\endgroup\$ – TLW Jan 11 at 3:12
  • \$\begingroup\$ Buy from AliExpress. Use RoHS solder. Use lots of capacitors. Those are the don'ts... \$\endgroup\$ – Harper - Reinstate Monica Jan 11 at 5:42
  • \$\begingroup\$ What they said. Overlaps others in some cases. Do not use electrolytic caps. Do not use tantalum caps. Look to see if Rad Hard is liable to help (even if not in a radiation intense environment). Temperature derate to take advantage of (or avoid) Arrhenius multiplier. Use a superb conformal coating. Vibration protect appropriately. Voltage derate excessively. \$\endgroup\$ – Russell McMahon Jan 11 at 11:02
  • 3
18
\$\begingroup\$

You asked about Space probes specifically, but your question also had a more general flavour. I've addressed "how to make things last" generally. In space the eg AC mains aspects is vanishingly unlikely to be relevant - but power supply issues still are.
This answer is necessarily incomplete and overlaps other comments and answers in some areas. These are "out of my head". I my come back and add more later. Or not :

Longish ago I set out to build portable solar lights, mass manufactured in China, with a target lifetime of 20 years. That's what the client wanted. The client, the manufacturers and Murphy conspired against me at every turn. I failed. But managed to make some seriously robust products in the process. One of these days ... :-).

Not all of the following derives from the above experience. But, a fair amount is "informed" by it.


Do not use wet Aluminum electrolytic caps.

Do not use Tantalum caps.

  • OK - you CAN use Tantalum caps if you REALLY know what you are doing.
    As a starting point, do not use Tantalum caps.

Look to see if Rad Hard is liable to help (even if not in a radiation intense environment).

Temperature derate to take advantage of (or avoid) Arrhenius multiplier.

Use a superb conformal coating.

  • A conformal coating MUST have low to no voids at PCBA surface, low dissolved water, low degradation in applicable environment, not produce damaging degradation products and/or scavenge degradation products.

    • ALL coatings pass water vapour - having an essentially void free surface against the PCBa and minimal water in the coating means that the concentration of water reaching the surface is very low and reaction rates are accordingly reduced.

    • As an example of degradation products and scavenging. Glass fronted PV (solar) panels have minimal water transmission through the glass (no surprise). The industry standard bonding material is EVA plastic which is heat and pressure polymerised to form an essentially clear void free adhesive layer between glass and PV cells. Over a decade plus gradual UV attack produces products which enhance cell corrosion. Modern glass front sheets contain scavengers to absorb these reaction products. Lifetimes of 30+ years are "easily enough" obtained. [I have an old tired but still operating BP 50 Watt PV panel more than 40 years old].

    • Parylene is king but not the only answer (See Here and Here ). Use the right PArylene - it's a family and some suit some areas better than others.
      Dow Corning* 1-2577 and family are "pretty good".

Do not rely on bonding agents to hold things together or in place.

  • Acid-free-cure Silicone Rubbers give 20+ years service if properly matched to surfaces. They may last 30 or 40 years, or more. Do you trust anyone to guarantee this to be the case.
    Surface materials matter - experts will tell you what's needed for tricky surfaces.
    But, not relying on binding agents is better.

Vibration protect appropriately.

  • Be aware that while ferrous materials have a lower stress limit below which fatigue failure does not occur, non-ferrous metals have NO LOWER STRESS LIMIT below which fatigue failure will not ultimately occur. So eg an Aluminjum bracket that is stressed to well below its tensile limit may still fail after say 35 years if stressed repeatedly to some lower limit.

Voltage derate excessively in areas where appropriate.
DO NOT voltage derate where inappropriate.

  • eg the wet Al ecaps that you are NOT using should not be run vastly below voltage spec.

Be aware of ceramic cap attributes that may hurt you.
eg voltage ringing on voltage steps, microphonic and major voltage spikes from apposite vibrations.

Be aware of corrosion mechanisms.

  • Some coatings provide electrochemical sacrificial protection of underlying metals.
    Some don't.
    Some are worse long term than no coating!. eg zinc "galvanised" coatings protect underlying iron/steel by being more active electrochemically.

    But eg Nickel (or the now far less often seen tin) do NOT provide electrochemical protection - rather just the opposite. These coatings provide mechanical barriers to corrosion products. If / once / when the coating is breached ober a small area an electochemical cell is formed that selectively targets the underlying layer and the small area exposed means the corrosion rate is higher than if the while item was NOT plated (!).

    In any case - DO NOT USE TIN COATINGS - see below

Do not use Tin coatings

  • Tin is nowadays renowned for growing whiskers on surfaces - sometimes at fast rates and sometimes with astounding lengths. In some cases whisker growth takes decades and is unimportant. In other cases failures can occur in very short periods (say under one year).
    At least one communication satellite is believed to have been lost due to tin whiskers.
    • I have some extremely old relays. Some of their metal surfaces are smooth to the touch. Other portions are extremely rough and the sprouting tin whiskers are clearly visible.

Be aware that EMI matters.

  • EMI (electromagnetic interference) at usual levels can be formally designed against. If you know with certainty that nobody is going to operate a 1 kW linear amplifier, unshielded Magnetron, high energy spark source, .... within a critical distance of your product for the next 40 or 50 years then you may decide to not protect against such. If you are not certain of this then protection may be in order.

Be aware of worst worst worst case mains and power supply issues.

  • A very long life device will usually have external energy supply. Typically mains AC, battery charged from some external source of maybe solar. Just maybe thermal, radioactive, ... .

  • If your mains input at eg 110 VAC oe 230 VAC will NEVER have an 11 kV line dropped onto its feeder in the next 40 years then you may not wish to protect against such a possibility. I occasionally hear of telephones leaping off walls or houses bursting into flames when this happens. It's rare. It happens. There is a limit to what you can choose to protect against. You have to choose what the limit is.

  • Lightning happens. In two years I lost 2 multifunction printers to lightning strike nearby in a residential area not known for overly much lightning activity. After the second I decided that having a fax line connected to my printer was overrated. No telephones were damaged.

    • Mains energy spikes can be "very enthusiastic". There are standards to be met to protect against such. Murphy does not care about standards.

Use only utterly reliable suppliers and ensure provenance for all parts sources.

  • These overlap. In some cases you may be dealing directly with suppliers or middlemen.

    • Be sure you know the standing of the entity you are dealing with. In Asia a supplier purporting to be the manufacturer may in fact be reselling product from elsewhere.

    • Factory visits help, but, do not be fooled. (I have been). And ensure that products which come from a given source continue to come from that source.

    • Name brand products with a good reputation will often be counterfeited. Be sure that what you receive IS from the claimed manufacturer. [eg GP (Goldpeak) AA NiMH (and other) batteries are relatively unknown by that name in the est - but GP are one of the largest battery makers in China. So much so that pirate GP lookalikes abound.

    • You do not HAVE to buy from a supplier who jealously defends their reputation (Digikey, Mouser, ....) or products from manufacturers of impeccable standing, but it certainly helps.

    • If you have to source a product and do not have time for adequate due diligence or source checking, if Panasonic make it, buy Panasonic. (That's sort of with a :-) - but I'm also serious. I have zero financial or business links with Panasonic, but I don't recall them ever doing other than superbly in any area they choose to touch).

Learn how Murphy works.

  • If something can go wrong it will.
    If you know that something can't go wrong Murphy will do his utmost to prove that your knowledge is false. Look at every possible multi-factor failure mode, and as many impossible ones that you can manage.

Impossible series of faults or conditions are not as impossible as we'd like

  • A large proportion of major disasters occur when 3 or 4 or 5 almost impossible events occur simultaneously. This happens often enough that 'you'd think that people may have noticed' - but people seem not to.
\$\endgroup\$
  • 2
    \$\begingroup\$ Wow. Nice answer. But let me recap it In a word: money. \$\endgroup\$ – Sredni Vashtar Jan 11 at 21:46
  • \$\begingroup\$ @SredniVashtar Money often helps :-). In some cases it costs much more and in others only somewhat more. eg if you MUST use aluminum wet electrolytic caps lifetime ~~= Liferatedrated x 2^((Trated-Tambient)/10) - ie Life rated is at rated temp which is always rather higher than actual . Caps are often 85C or 105C rated. 105-85 =20C . Increase in lifetime at same temperature = 2^(20/10) = 4 x. 105C caps are dearer but with care often not vastly so. | Now place the caps intelligently and channel airflow well and you get \$\endgroup\$ – Russell McMahon Jan 16 at 6:35
  • \$\begingroup\$ ... 2x lifetime per 10C reduction in mean temperature. In some cases heatsinking the caps (who ever heard of it? :-) ) can help. So if you say use 105C caps and reduce ambient by 10C by careful design then you increase lifetime by a factor of 4 x 2 = 8 . THEN look at actual ambient. If after redesign it's say 35C max and not too too much less mean then (105-35_ = 70C. 2^7 = 128 x. A 2000 hour cap will last (notionally) 2000x128/8765 hrs/year = 29 years. If you can get t_mostly down to 25C that's 58 years and you notionally meet the 40 year design aim. Notionally :-). \$\endgroup\$ – Russell McMahon Jan 16 at 6:36
20
\$\begingroup\$

In a nut shell, quality, quality, quality.

The first thing you do is to use high reliablity parts. NASA specifies 4 quality levels starting with commercial (the lowest grade), moving to '883B (a mil standard); then QML level Q, and finally QML level V. With each step up in level, the screening requirements become more stringent; the paper trail more onerous; and the cost ever increasing.

With increasing quality levels comes lower predicted failure rates. This means that when you do your reliability prediction (or more accurately, your probability of mission success), your Ps increases with better quality parts.

Adequate derating also plays into this, particularly with new technology or new parts for which there is no history. We are sometimes told to use a 100 V MOSFET for a 20V application because of this.

Redundancy helps a lot. But with redundancy comes added complexity and more parts, which actually degrades the serial failure rate.

With any hi-rel design, you need to do an analysis to identify and mitigate, to the extent possible, any single point failures (SPfs). An SPF is a failure that would degrade or cause the loss of the entire function, or mission. SPF analysis is particularly important when redundancy is employed because you do not want a single failure to cause both the primary and redundant set of hardware to not work.

Finally, on those Voyager missions, I'll bet they were designed for an 8 or 10 year mission life, not 40.

Edit 1:

While you cannot test your way into a highly reliable system, testing plays a big part in weeding out marginal parts. All of our assemblies go through some type of environmental stress screening, which includes functional testing over the expected temperature range, and temperature cycling, both powered and un-powered. Systems destined for space go through testing in a thermal vacuum (TVAC) chamber. There also may be vibration or shock testing, but these are usually done on a test article.

\$\endgroup\$
  • \$\begingroup\$ Yes. Although you can't "test in" reliability, you can test each component for unreliability. I think a crucial part of this is high accelerated life testing, which weeds out components that won't last for 10 years. \$\endgroup\$ – Elliot Alderson Jan 11 at 13:09
  • \$\begingroup\$ You are correct about single points of failure. Even the most sophisticated redundant systems have a small core where a single point of failure can bring down the entire system. For example, in triple modular redundancy, it is the voting circuit that must never fail. \$\endgroup\$ – richard1941 Jan 17 at 4:07
10
\$\begingroup\$

I recall a business called Continental Testing Laboratories. They had the first computer I ever used. Punch cards existed for EACH resistor, capacitor, transistor, diode, that went thru the test/heat/test/heat/test/heat, where the parameters were examined for DRIFTING.

Components that DRIFTED differently from the other components were discarded.

They also XRAYed the components to look for voids and for foreign particles.

With all this, a 1 cent resistor becomes 100 cents, and has a small tag attached, so the final circuit documentation describes the recorded parameters for each component.

Transistors are assumed to track if they are differential_pairs inside a 6-lead metal case (such as 2n2020, if I recall rightly). Thus neutron bombardment is orbit is assumed to degrade the Beta of each transistor equally, and the "matching" is maintained.

The V_base_emitter is assumed to not perfectly drift, thus a design margin for offset voltage becomes part of your worst-case-design analysis (slide rules were used).

To implement anything better than about 8 bit or 10 bi ADCs is not possible using the allowed discretes. I think BurrBrown or TRW may have produced metal_hybird DAC networks that were show adequately stable for decades.

Additionally, the team I worked in was allocated a THERMAL ENGINEER; he used finite element methods (on an IBM 1630) to model the heat flows.

Since the applications were space-borne, the allocated powers were SMALL, and a simple ground plane to a mounting stud (or 4 or 6 of them, to handle shock) was all that was needed to let heat flow out of the circuit/PCB/module to the spacecraft chassis and then radiate out into space.

To prevent freezing the spacecraft, I've heard shutters are used, these regulating how much of the spacecraft is actually exposed to the coldness of space.

\$\endgroup\$
1
\$\begingroup\$

As a matter of fact, NASA PCB design guidelines addresses your question. Further to PCB, NASA Workmanship standards covers things like wire preparation, crimped terminals, discrete wiring, cable harness etc.

A sample extract from Section-6

NASA Workmanship Standard Section-6

\$\endgroup\$
0
\$\begingroup\$

Calculating MTBF would probably be the best way to do this. De-rating components is one way to increase MTBF.

\$\endgroup\$
  • 2
    \$\begingroup\$ MTBF is different from lifetime. Electrolytic caps can have a very long MTBF with a much shorter lifetime for example. MTBF is useful, but lifetime has to be taken into account as well. \$\endgroup\$ – John D Jan 10 at 19:02
  • \$\begingroup\$ This is also not actionable. \$\endgroup\$ – James McLeod Jan 11 at 12:50
0
\$\begingroup\$

The Voyager mission was a major event in the history of FAULT TOLERANT COMPUTING with its STAR (self test and repair) computer. The computer would monitor its own performance, check for errors, and test itself comprehensively from time to time. Any module found to be defective would be replaced with a spare. I do not know how far this process has gone, which modules have been replaced, or what the spare inventory presently looks like.

The computer architecture is way more complex than mere triple or quad redundancy.

If you find a text on FTC, you are likely to find a discussion of the STAR computer and its reliability model.

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.