RD1 PSS-01-708 The Manual Soldering of High Reliability Electrical Connections
RD2 PSS-01-726 The Crimping of High Reliability Electrical Connections
RD3 PSS-01-728 The Repair and Modification of Printed Circuit Boards and Solder Joints for Space Use
RD4 PSS-01-05 Software Engineering Standards
RD5 FED-STD-209D Clean Room and Work Station Requirements, Controlled Environment
RD6 PSS-01-30 Reliability Assurance Requirements for ESA Space Systems
RD7 PSS-01-301 Derating Requirements and Applications Rules for Electronic Components
RD8 MIL-HDBK-217 Reliability Prediction of Electronic Equipment
RD9 ESA/SCC QPL ESA/SCC Qualified Parts List
RD10 ESA/SCC/608 Hermetic hybrid circuits
3. GENERAL REQUIREMENTS
3.1 Organisation
MSSL, as the PI, has appointed a product assurance manager for the instrument. The PA manager shall be responsible for the implementation of the PA requirements related to the project. He will be located at MSSL and will work with the instrument project manager. In case of conflict, the PA manager has direct access to MSSL management. The consortium PA manager will be involved in:-
1. Establishing a detailed consortium quality plan based on consortium quality requirements and based on requirements from NASA/ISAS
2. Establishing procedures related to the quality plan
3. Interfacing between the Instrument consortium and ISAS on quality matters and parts procurement
4. The verification of the implementation of the quality plan at the consortium members' institutes
5. Witnessing hardware inspections and instrument testing
6. Supporting consortium reviews
The Instrument Project Manager is the sole formal point of contact between ISAS and the consortium. All communications relating to PA matters will be routed from him to the Instrument PA manager.
The individual consortium members will establish their own quality organisation, responsible for the implementation and verification of requirements as defined herein, at their own facilities and at their subcontractors and suppliers. They will each nominate a person responsible for PA and he/she will be the point of contact for PA matters. The individual consortium members will establish their own PA plan tailored to the specific needs and characteristics of the hardware involved and tailored to the consortium members organisations and industrial approach. The requirements of this overall plan shall be contained in these individual plans.
3.2 Product Assurance Planning and Documentation
PA events will be highlighted in the Instrument project planning. Plans, specifications, procedures and design documentation for the project will be reviewed for compliance with PA requirements and will be subject to a sign-off procedure if critical. Documents and instructions applicable to interfaces will be available for ISAS for review and information, as required.
3.3 Contractor and Supplier Surveillance
PA requirements as defined herein will be implemented at subcontractors, the level being dependent on the type and criticality of the subcontract and also depending on the previous experience of the subcontractor. Regular contract reviews will be held and will include product assurance matters.
3.4 Status Reviews, Facility Reviews
Formal project reviews will be attended by PA personnel and the relevant PA documentation will be prepared. Visibility in implementation of PA requirements will be provided to ISAS at design reviews and progress meetings.
Where necessary, tools and equipment calibration will be checked before and during periods when major manufacturing is taking place. Otherwise materials, facilities, equipment, services will be checked as part of the normal operations. Documentation will be reviewed when a job is released for manufacture. A similar requirement will be placed on external contractors that the above items will be checked prior to manufacture of items under that contract. The statements made by the contractor under this requirement will be reviewed as part of the regular contract meetings if appropriate, or if the statements made by the contractor are inadequate, a formal facility review will be made. ISAS will be invited to attend these reviews if the results are critical to the project.
3.5 ISAS Participation in Inspections and Tests
For the purposes of Product Assurance and technical co-ordination, ISAS will be allowed access to all in-house facilities of consortium members wherever possible. This access will be for the purposes of test observations and documentation reviews only. However, this access is not guaranteed if national security regulations in the consortium countries do not allow it, i.e. some facilities may be in secure areas. ISAS access to all facilities will be planned at least one month in advance and be agreed with the PI and the Co-I group, if involved.
The consortium members will seek wherever possible to allow ISAS representatives access to contractor facilities for the same purposes as above. If possible, ISAS will be afforded the same rights as the consortium members. However, security regulations, or consequent excessive increases in contract cost, may not allow this in all cases.
It is not planned to allow ISAS access to any contractor for complete QA audits.
The proprietary rights of the PI and all third parties must be fully respected by ISAS.
3.6 Product Assurance Progress Reporting
Internal project progress meetings will be held regularly and PA topics shall appear on the agenda.
As part of the standard progress reporting, the ISAS project office will receive information on the PA aspects of the program.
.4. QUALITY ASSURANCE
4.1 General
Quality assurance tasks will be performed under the responsibility of the PA manager.
QA personnel will take part in the actual preparation of material, component, process or manufacturing specifications in close co-operation with designers and/or test engineers. In all cases the PA manager shall review the specifications to safeguard the PA requirements.
4.2 Procurement Controls
Orders are usually placed by senior research/engineering or technical staff. They are trusted to act responsibly and with reference to relevant guideline documents and lists of preferred parts and materials. Quality assurance provisions shall be defined in purchase orders and contracts. These shall be adequate to ensure and to verify/document that all requirements of the procurement specification are met. Copies of orders are kept and are available for examination by PA staff at their discretion.
Suppliers will be required to provide adequate documentation to support their deliverable items.
4.3 Incoming inspections
4.3.1 Mechanical / Optical
Incoming inspections are carried out by the individual placing orders or by delegated technical staff. Special attention shall being given to handling, visual inspection and measurements to confirm agreement with details specified on the order, e.g. cleanliness, interface measurements etc.
Following inspection care shall be taken:-
1. to place components and materials in appropriate storage.
2. to file Certificates of Conformance and other documents of identification to facilitate traceability
4.3.2. Electrical
For incoming inspection of High Reliability components:-
1. Items shall be checked for conformance to orders and certifications
2. Items shall be inspected for mechanical damage, taking care to follow anti static precautions where necessary (ref AD 1). Critical dimensions shall be verified. PCBs shall be visually inspected with a x10 binocular microscope for obvious faults and with x40 magnification on a sample number of pad sizes and track widths
3. Items shall be stored in appropriately labelled storage systems with records
4. If any ambiguities are seen in part numbers, essential properties of a sample component shall be verified
5. CCDs shall be treated in accordance with AD2
4.4 Surveillance of Manufacturing/Integration
Manufacturing, assembly and integration shall be the responsibility of the technical staff of the workshops and laboratories who are under the surveillance of the senior research/engineering staff who appoint them. The competence and dedication of technical staff shall be continually monitored by supervising staff. Inspection of items shall be carried out before any procedures occur that would prevent subsequent inspection, e.g. sleeving, assembly of small subsystems into a larger configuration etc. Mandatory inspections may be prescribed on the drawings in special cases only.
Completed PCBs shall be visually inspected and electrically verified before being conformally coated.
All harnesses and connectors shall be visually and electrically checked before being interfaced to any subsystems.
The consortium members shall be fully responsible for the final inspection and test of deliverable hardware. QA personnel shall monitor tests on PCB's, assemblies and equipment.
4.5 Test Witnessing, Pre-test, Post-test Review
QA personnel shall be involved in planning and execution of critical development and formal qualification and acceptance tests. It is not planned that QA personnel shall witness all tests.
Before the start of formal tests, a test readiness review will be held. The post-test review will be part of a regular project progress meeting.
4.6 Logbooks and Traceability
Equipment logbooks shall be established for all operations and tests starting with the final inspection of the flight hardware after the manufacturing/assembly phase and shall include the following items:-
1. Historical record sheets, typically
dates of operations/test/transport
name of operation/test/transport from/to
applicable procedure and/or report
responsible organisation and signature for entry
remarks e.g. on NCRs or unplanned events
2. Operating time/cycle record for limited life items
3. Connector mating records
4. Age sensitive item records
5. Pressure vessel history log
6. Temporary installations record
7. Open work/deferred work records
The log books shall accompany the flight hardware and form part of the Acceptance Data Package.
Critical materials and limited shelf life materials shall be traceable to manufacturers' lot/batch number. Active electronic parts shall be traceable to lot and serial number. Processes shall be traceable in the manufacturing records.
4.7 Cleanliness and Contamination Controls
A detailed cleanliness control plan has been prepared, reference AD3. This document has identified the requirements for cleanliness and the controls that shall be applied to achieve them. Facilities shall be provided to control the environmental cleanliness of instrument flight hardware during manufacturing and test.
4.7.1 Required Levels
No cleanliness control will be provided for mechanical workshop machining operations. As far as hand soldering is concerned, PCB's may be assembled in an area with restricted access that is kept clean. All mechanical parts shall be cleaned before final assembly. Components, PCB assemblies and mechanical items shall be cleaned after final assembly. Electronic and mechanical hardware will be assembled and handled in class 100,000 environments as defined in RD5. Additional cleanliness controls shall be implemented for assembly of the mechanisms and optics.
All components will be required to undergo vacuum bake-out.
4.7.2 Monitoring
Facilities designated as clean will be monitored on a regular basis for particulate and molecular contaminates.
4.7.3 Facilities
Test facilities for optical testing and vibration and vacuum testing shall be maintained to meet project requirements. Outside test facilities shall be evaluated for compliance with requirements prior to use.
4.7.4 Materials Selection
Materials shall be selected and processed in such a way as to minimise contamination.
4.7.5 Witness Mirrors and Flats
The Instrument consortium shall facilitate the application of witness mirrors and flats to monitor the dust and molecular contamination levels during handling, shipping and test after equipment manufacturing.
QCMs shall be used to assess molecular contamination
4.7.6 Instrument Design
The instrument design shall take account of the cleanliness levels expected during the integration and launch phases of the spacecraft programme.
4.8 Non-conformance Control.
4.8.1 Definitions
NCRs shall be defined as MAJOR or MINOR.
MAJOR NCR A non conformance or failure shall be defined as MAJOR if it affects an aspect of the instrument as defined below:-
1. Safety
2. Cleanliness
General Instrument cleanliness and materials outgassing, including magnetic cleanliness, where applicable
3. Electrical
Interface connections
Power consumption
EMC/EMI
4. Reliability of electrical circuits
5. Mechanical
Mass, moment of inertia, centre of gravity, mountings, instrument envelope
Mechanical performance relevant to the mechanical behaviour of the payload
6. Thermal
7. Processes and materials for electrical, mechanical and thermal interfaces
MINOR NCR A non conformance or failure will be defined as MINOR if it does not affect the aspects of the instrument as defined above. It must be inconsequential as regards the requirements and must not influence fitness for use and safety. Alternatively it must be trivial with regard to workmanship criteria applicable to deliverable items.
4.8.2 EEE Components
All EEE component failures after delivery from the supplier will be classified as MAJOR, except at incoming inspection where the following non-conformances may be classified as MINOR:-
- random failures where no risk for a lot related or quality problem exists.
- the form, fit or function of the accepted EEE part is not affected.
- minor inconsistencies in delivered documentation.
4.8.3 Software
Software non conformances will be treated as hardware non conformances.
4.8.4 Ground Support Equipment
Non-conformances on GSE will be treated as MAJOR only if safety is involved and the non-conformance occurred in formal acceptance testing.
4.8.5 Reporting of NCRs
The report on all NCRs will contain the following information:-
1. Unique NCR number
2. Identification of the non conforming item
3. Date and time of occurrence
4. Inspection or test and description of environmental conditions if relevant
5. Description of non-conformance
6. Cause of non-conformance as far as is already known
7. Immediate actions taken or proposed
8. Remarks on schedule etc.
A notification report on all MAJOR NCRs shall be submitted to ISAS within 10 working days of occurrence and will contain as much of the above information as possible.
The final NCR report shall contain the above items plus full information on failure analysis and actions to be taken to correct them. Any relevant actions to avoid reoccurrence will also be reported.
MAJOR NCRs shall be signed off only by the Instrument QA manager and the Instrument Manager.
MINOR NCRs will be treated in the same way, except that ISAS will not be informed as a matter of course. Documentation on minor NCRs will be made available to ISAS at convenient times, e.g. at formal instrument reviews.
The NCR approval procedure is shown in Figure 4.8.5.
ISAS will be invited to contribute to any Material Review Board on MAJOR NCRs.
4.9 Metrology and Calibration
All measuring instruments shall be carefully used and stored in order to avoid impairment of their original accuracy. Measuring instruments shall be selected to be appropriate in quality and accuracy for the task in question. For some critical tasks, where it is judged necessary, a special instrument shall be purchased of the type, quality, and accuracy needed, or a special calibration of an otherwise suitable existing instrument will be arranged, either in-house or by a suitable contractor.
Equipment used for verifying the performance of an electrical subsystem shall be calibrated to the required accuracy and the appropriate records kept. Critical characteristics shall be checked before and after the tests.
4.10 Handling, Storage, Packaging, Marking and Labelling, Transportation Control.
Handling, storage, packaging, marking/labelling and transportation shall be performed such as to avoid damage/degradation of the hardware. Procedures shall be written and used for these activities.
Implementation of the procedures will be monitored by PA personnel.
For transportation of units and assemblies, adequate shipping containers shall be used to control cleanliness and extremes of humidity, temperature, pressure and vibration/shock.
Electrical connectors shall be provided on the outside of the instrument case (if required), to enable power-ups in a safe mode. A dry nitrogen fill will be necessary with purging, according to a purging procedure. Gas connectors shall be provided on the instrument case for this purpose.
Labelling of boxes for packaging, storage and transport shall include:-
1. nomenclature, model name and serial number (if appropriate) of the item
2. cleanliness level, packing integrity indication
3. caution/warning notes for dangerous or toxic contents
4. package orientation arrows
5. for large items, weight and centre of gravity, handling and lifting points
6. conditions and instructions for handling and unpacking
7. name, address, phone number of sender and recipient
4.11 Alerts
The nominated PA Manager shall be the central point of contact for ALERTS. The PA Manager shall contact all Co-Investigator groups and respond to ISAS within 15 working days.
4.12 Software Quality Assurance
The software designs shall be guided by RD4.
Formal quality assurance shall be carried out only on software that interfaces to the spacecraft or spacecraft ground checkout equipment. The measures below refer only to such software unless otherwise stated. Software requirements and specification documents shall be maintained on the above software. Software verification shall be carried out including reviews and formal acceptance testing. Configuration control will be carried out on software delivered to ISAS or software which forms part of other delivered hardware. The NCR system applicable to software is described in 4.8.
ALL software media shall be labelled.
Adequate documentation will be provided with deliverable software to allow ISAS to accept and use the software.
5. RELIABILITY ASSURANCE
5.1 General
It is fundamental to reliability that each instrument design shall be designed and developed on sound principles established by a background of experience and then proven by test. Goals for orbital life may be specified. The process begins with appropriate analysis which, at the discretion of review boards, can be presented for review. The parameters for these analyses shall be settled by the responsible engineers during development model assembly and test.
Mechanical stress analysis shall be performed during design, held on file and be available for examination. The electrical subsystems shall be designed to perform as required, taking into account the total environment in which they have to survive and operate. This environment includes temperature extremes, vibration, radiation, vacuum, electrical surges and EM radiation. They shall also be designed not to adversely effect any other subsystems by the production of vapours, electrical interference etc. This shall be accomplished in a variety of ways, including de-rating, allowing for large margins of error on the required parameters, good thermal design, current and voltage surge limiting, good fabrication techniques, long burn in tests, adequate monitoring of all critical variables during burn in and environmental tests. Automatic or commandable recovery modes shall be designed into systems which may suffer from soft failure modes, such as bit-flips in microprocessors systems.
5.2 Failure Modes, Effects and Criticality Analyses
Failure modes and their effects shall be assessed during the design and development process.
The design of all critical interfaces shall be evaluated to ensure, where possible, no single point failure modes exist which can adversely effect the performance of other systems on the spacecraft.
Where power, volume and mass allow, automatic or commandable redundant interfaces may be included.
During the Design and PM Phases, possible failure modes will be induced to evaluate their effects on the system.
5.3 Single Point Failure and Critical Items List
Possible single point failures and critical items shall be identified and listed for review.
5.4 Numerical Reliability Assessments
The failure rates of critical interfaces will be calculated from the data available from the type of components used, in conjunction with RD8.
5.5 De-rating Analysis
All electronic components shall be de-rated consistent with RD7 and to a greater extent where practical.
5.6 Worst Case Analysis
The basic design for critical interfaces shall allow sufficient margin for worst case parameters at extremes of temperature and after radiation damage at the end of life of the spacecraft, not to effect the performance of the subsystem beyond acceptable limits.
6. SAFETY ASSURANCE
6.1 General
All personnel shall be alert to the need to identify potential hazards. Once identified, steps shall be taken to eliminate them, or reduce them to levels judged acceptable. Effort shall be concentrated on the essential objective of safety.
The central point of contact for safety matters will be the Instrument Manager.
6.2 Applicable Requirements
In matters of safety the objective shall be to conform with applicable parts of National Standards and of any other regulations judged relevant, such as the payload safety policy for the launcher in question.
6.3 Safety Assurance Tasks
Potential hazards shall be identified as a part of the normal design process and eliminated or reduced as far as possible. Safeguards shall be determined for outstanding hazards which will reduce their possible effects to the lowest reasonable level. These outstanding hazards shall be reported to the central programme authority at the earliest opportunity and subsequent progress shall be reported, including necessary proof that the relevant requirements have been satisfied.
7. COMPONENT QUALITY, SELECTION AND PROCUREMENT ASSURANCE
7.1 General
The selection and application of electronic and electrical parts shall be monitored by PA staff for implementation of project requirements.
7.2 Component Management
Each consortium member shall be responsible for its parts procurement. Each consortium member shall procure its own unique parts and shall carry out relevant evaluation programs.
7.3 Prohibited Materials and Components
Only high quality components of sensible construction which do not contain materials which may constitute a safety hazard or cause contamination shall be used.
The use of some ferromagnetic material such as in the leads of some components and the cans of some integrated circuits is inevitable, however, every effort will be made to minimise this concern.
7.4 Radiation - Sensitive Components
Components shall be chosen to withstand the radiation environment at the component, without degrading beyond limits defined by the correct operation of the subsystem. This radiation level is specified as 30krads. If this is not possible, additional local radiation screening shall be provided to meet the requirements, but no component shall be used that has a radiation tolerance of less than 10krads. Sample radiation testing shall be carried on components where insufficient radiation tolerance data is available.
7.5 Component Approval
Component types will be approved to ESA SCC level C or the US Mil equivalent, except at interfaces to the spacecraft, where they shall be to ESA SCC level B, or their equivalents.
7.6 Preferred Components, Non-PPL Listed Components
Systems shall be designed, as far as possible, to use components specified in RD9 or the relevant NASA approved parts lists. Separate storage facilities will be provided for the High Reliability items with their associated certification and usage records.
7.7 Non-qualified Components
The selection of non-standard parts shall be based on previous application history of parts and manufacturer. If no previous procurement history of a non standard part is available, a dedicated evaluation program shall be carried out. Radiation degradation of parts shall be one of the selection criteria.
7.8 Hybrid Circuits
Hermetic hybrid circuits shall be procured to meet the requirements of RD10 or the US Mil equivalent.
7.9 Lot Acceptance Testing (LAT)
This is an activity carried out by manufacturers supplying components to ESA/SCC specifications levels B and C, the appropriate testing levels being in accordance with the ESA/SCC requirements.
7.10 Declared Components Lists (DCL)
A list of components used for flight hardware shall be provided.
7.11 Manufacturer Surveillance
Such surveillance is only applicable to centrally procured components and should be carried out by the procurement agency.
7.12 Receiving Inspections and Destructive Physical Analysis (DPA)
Incoming components shall be visually inspected for mechanical damage. Destructive physical analysis shall only performed on samples of components which have come from the same batch from which a component has failed.
8. MATERIALS AND PROCESSES SELECTION AND CONTROL
8.1 Materials
Consortia shall select materials, as far as possible, from their preferred list which has been established for many years. Even when using materials from this list, personnel must be aware of the varying needs and sensitivities of spacecraft and payloads and must select materials with great care, not only for their fitness for the immediate purpose, but also to avoid possible undesirable effects on other systems.
Plastics: Material to conform to AD4, where possible, with TML<1% and CVCM<0.1%
Wiring: PTFE extruded insulation over silver plated copper, unless special requirements apply.
PCBs: Manufactured by a company with a proven reliability record in the production of Space Flight hardware.
Materials sometimes have to be used which do not appear on the preferred list. In such cases they must be very carefully screened for total suitability before use.
Outgassing performance of materials, such as TML and CVCM should usually be determined from AD5, but importance is also given to other parameters such as the quantity of the material present.
Materials shall be purchased from reputable specialist suppliers and stored in suitable conditions, labelled as to specification. Short life materials shall be dated on receipt and not used for flight or flight representative hardware beyond their expiry date. Materials such as adhesives shall be kept refrigerated (if appropriate) in order to control their chemical degeneration and ensure that their shelf life will be achieved without doubt. In exceptionally critical cases, appropriate composition and performance tests shall be carried out on a material.
The material to be used shall be defined on each component detail drawing, but a separate materials list shall be provided for the project.
8.2 Small Parts
Small mechanical parts such as nuts, bolts, rivets, screw locking devices etc., shall be regarded as standard items, held in stock, and replenished from reputable suppliers to National Specifications. Special fasteners and other small parts shall be screened for suitability for the particular application.
8.3 Processes
Processes shall also be defined on the detail drawings, but a separate list of processes shall be prepared.
Process specifications shall be written as judged necessary, usually for safety critical items only.
Key processes relating to printed circuit boards are referred to in RD 1, 2 and 3.
9. CONFIGURATION MANAGEMENT AND CONTROL
9.1 General
A system of configuration control shall be employed to monitor the status of the instrument and ground support equipment hardware and software and also to ensure all organisations are informed of changes to designs, specifications etc. The document/drawing recording system shall be implemented from the start of the programme, but the formal change control procedure shall be introduced when the initial system or subsystem development has been completed and prior to the start of the FM programme.
9.2 Project Documentation
The requirements for the flight hardware and GSE shall be defined in a set of specifications. A project record of all documents and drawings shall be maintained by the MSSL project office, not only to provide a directory of available information, but also to act as a medium for approval and change control.
Each organisation shall maintain a list of drawings and documents related to its work packages and shall be responsible for communicating relevant changes, revisions etc. to the appropriate project personnel and to the central system at MSSL.
The issues/revisions of all specifications and drawings which define the instrument and its sub-assemblies shall be recorded in a configuration document, the Configuration Item Data List (CIDL). This system shall be used to identify the hardware design status at various points in the development programme, e.g. PM, FM, at associated verification tests and at reviews.
9.3 Configuration Management
Changes shall be subject to formal approval. The processing of these changes shall be performed by the MSSL project office involving co-ordinating approval inside the consortium and the re-issue of documentation. Other configuration changes, i.e. interfaces and specifications internal to one organisation or configuration item, shall not be formally monitored by the project office. Each consortium member shall be responsible for maintaining a list of current documents and drawings.
9.4 Configuration Baselines
After a unit has undergone formal qualification or acceptance test, the consortium members shall be responsible for maintaining the configuration of the unit, unless authorised by the project office.
9.5 Contractor and Supplier Configuration Management
The configuration of items supplied shall be controlled via the contract placed on the supplier. A procedure for changing or updating the contract shall be agreed when the contract is placed. The 'as-built status' shall be compared with the 'as-designed baseline' at formal reviews and on delivery.
10. ACCEPTANCE REVIEW, ACCEPTANCE DATA PACKAGE
Before shipment to ISAS, a formal acceptance review shall be held which will cover the following subjects:-
1. Identification of actual build status and differences from the design qualification baseline
2. Evaluation of test and inspection results for verification of specification and interface requirements
3. Applicable Non-Conformance Reports and Waiver Requests
4. Acceptability of residual hazards
5. Historical records, limited life item reports, open work records, temporary installation records
6. Availability and acceptability of manuals for the instrument and GSE
The following documents shall be supplied upon delivery of the flight model:
Experiment Logbook.
Waivers which have been granted.
NCRs and close out reports.
Mass property report.
Mechanical, optical, thermal and electrical conformance reports.
Test procedures and test reports for all functional and environmental tests.
Cleaning procedures.
Cleanliness verification records and certificate.
Calibration procedure and calibration report.
Interface control and manufacturing drawings (just for interface verification).
Parts, materials and processes lists for delivered model.
Bench test procedure.
Assessment criteria and reference data for bench test.
Handling procedure for model.