A recent conversation with engineers at NASA’s Johnson Space Center in Houston revealed that there’s often “a world of difference” between the standards for circuit protection components for a typical Earthbound electronics engineering application, and those intended for use in spacecraft. However, for both environments, engineers have essentially the same goals: safeguarding life and protecting technology. Carlton Faller, a NASA electrical, electronic, and electromechanical (EEE) parts engineer, and Paul Delaune, Deputy Branch Chief - Command and Data Handling, shared some insights on the differing requirements associated with creating circuit designs for use in low-Earth orbit (LEO) and beyond.
Faller was a NASA contractor for Lockheed Martin prior to joining NASA as an employee in 2004. “We have a wide variety of specifications that govern the selection of micro-circuits, resistors, fuses, switches, relays, capacitors, wiring — all the component parts that go into the design of a circuit board or piece of electronics,” he said. “The requirements for each component are dependent upon the criticality of the application, the specific environment in which it will operate, and other factors relating to ensuring parts are appropriate for the application.”
In contrast with designers of terrestrial products, NASA designers and contractors are far less concerned about conformance with commercial standards from IEEE, UL, IEC, and other standards bodies, and more with compliance to guidelines set out in internally developed documents for each program. Faller noted, “For example, Document SSP 30312 is the International Space Station’s EEE parts control plan. That governs the rating of all parts and includes a section that addresses the proper rating and de-rating of fuses and other circuit protection devices. It says, ‘If your nominal current is X amps, then you must use a circuit protection device rated at somewhat greater than X amps. And then you must use a wire that is able to withstand the maximum current that the circuit protection device can pass without tripping.’”
Parts control plans for the various NASA development programs, including the Orion Multi-purpose Crew Vehicle NASA will launch later this year (Figure 1), are more likely to reference military specifications than commercial ones. For example, MIL-PRF-23419 covers instrument-type fuses designed to protect electrical, electronic, and communication equipment on DC and AC circuits up to 400 Hz. However, in addition to military specifications, these parts control plans include guidelines based on the agency’s experience with various types of components. Faller explained, “We’ve got some use limitations on certain part types based on their construction. This is historical knowledge that says, ‘In a vacuum, you can only use a certain type of fuse that’s rated lower than a specific current, because otherwise it tends to act funny.’ But that’s not an industry standard so much as in-house ‘tribal knowledge’ that we’ve developed over the decades.”
Paul Delaune manages a team of NASA engineers involved in electronic design and system management work. His branch focuses on spaceflight processors, networks, and instrumentation, including command and data handling systems for complete manned spacecraft, all the way down to small, independent data acquisition systems. He noted, “Often, we’re developing equipment that will experience significant vibration and thermal stresses. Carlton mentioned how we have to de-rate fuses — we often have to end up de-rating fuses right at 50 percent because fuses are designed to open when they get too hot due to the level of current flowing through them. On Earth, heat rises. In space, it doesn’t. All that heat from current flow gets concentrated right there, so fuses can blow at half the regular amperage rating.”
Delaune said, “Every function on a spacecraft has a different level of criticality assigned to it, which affects the way our electronics are designed. We classify items according to the worst-case effect of a failure on the vehicle, crew, and mission. A Criticality 1 dysfunction, such as a failure of the onboard computers, would result in the loss of a life or a vehicle. A Criticality 2 function loss would mean the loss of a mission. All other function losses are classified as Criticality 3. What that means is that we have a lot of older technology associated with Criticality 1 equipment because its performance has been proven, and the reliability testing required to meet the Criticality 1 standards is very rigorous.”