104 IRE TRANSACTIONS ON RELIABILITY AND QUALITY CONTROL July

The Role of Components in Satellite Reliability*

J. A. MORTONt, Fellow, IRE

Summary-The economics of satellite com- COMPONENT RELIABILITY REQUIREMENTSmunications depend critically upon the rel iabi I ityof the satellite components. Assuming that the The reliability problem divides logically intoprelaunch and launch requirements on reliability three phases-prelaunch, launch and orbit. Thehave already been demonstrated, attention is fo- stress-time conditions vary widely in these threecused on the orbital life requirements and the fail- phases, but they lead to the same order of allowedure modes to be expected. It is proposed that our component failure rate. Assuming, then, that theexperience with electronic components for sub- bird is in orbit operating as designed-what com-marine cable communications is applicable to the ponent failure rates are required?orbital phase of satellite component reliability. There is room for argument but perhaps mostThe philosophy and methodology of design, fabri- debaters would agree that a satellite life of 0.5cation, test and certification used in providing year would be a successful field trial, 2 years iscomponents for the Telstar experiment are out- questionable, whereas 10 to 20 years would pro-lined briefly. It is concluded that all four steps vide safe economic margins.coupled with a thorough knowledge of the operat- These same life requirements apply to thoseing environment are required to produce an eco- components used in small numbers, such as thenomical system. traveling-wave tube and mixer diodes. For those

components used in the thousands, these life re-quirements translate into maximum failure rates

SATELLITE RELIABILITY in the range of I to 20 per 109 component hours(0.0001 to 0.002 per cent/KHRS); i.e., just those

In principle, the technical existence proof of required for complex systems such as Minuteman,active satellite communications has been demon- Nike Zeus or electronic switching systems.strated. The combined component performance Such low failure rates are difficult enough torequired has been observed separately in the di- achieve and prove with confidence even for theverse ground-missile-space systems already de- known, stable environment of earth systems. Butveloped. Whether, however, a satellite system remember, that each phase, prelaunch, launch, andwill be economically practical will depend upon its orbit, imposes an additional set of stresses whichtotal cost. together determine tests a component must pass

Manufacturing and installation costs of the successivly in order to certify as a flyable com-ground stations will be very large but maintenance component.expense should be small. Satellite launching costs The wide variety and range of thermal, chemi-are also large while satellite maintenance essen- cal, mechanical, electrical and radiation stressestially amounts to new launchings. Hence satellite induced in testing, assembly, transport, launch andfirst costs should be minor compared to their orbit could well reduce the component certifiabil-'installation and maintenance costs." As in sub- ity or life in orbit to zero if applied to units notmarine cable systems, the repeater reliability designed expressly for these purposes. Selection,becomes the keystone of the economic structure. based upon the most high powered statistical tech-

Because of the large cost penalty of additional niques and computery, applied to ordinary com-size and weight, extensive redundancy is prohibi- ponents cannot be expected to produce the desiredtive. The system economics therefore depend results.critically upon the reliability of the satellite com-ponents. SATELLITE COMPONENT RELIABILITY

ACHIEVEME NT*Received February 15, 1962. This paper was presented Itat the 8th National Symposium on Reliability and Quality ln-Ivedogrbitthowthwencanno wes achieveournt ob-o

Control.loglvdobthothncnwacivouo-IBell Telephone Laboratories, Inc., Murray Hill, N. J. jective?

1962 MORTON: THE ROLE OF COMPONENTS IN SATELLITE RELIABILITY 105I propose that it can be done by essentially c) Extensive in-process test and inspection

those same principles and techniques originated coupled with well-designed statistical andfor submarine cable components and later applied quality control techniques throughout theto more complex ground and missile systems, fabrication process.taking account, of course, of the different Even so, some freaks will slip by. Most ofoperational-environmental requirements. these can be eliminated by rigorous, well-designed

To illustrate, let us consider a typical failure pre-aging tests, such as leak tests, temperaturerate-time distribution for a large batch of com- cycling, vibration and shock tests coupled withponents designed and made with such methods. step-stressing to produce significant failures for

The distribution is characterized by two re- analysis and feedback to design and manufacturinggions of relatively high and changing failure rate; engineering. Further, the product can be aged forone early in life and one at end of life, separated a period substantially longer than the early failureby a region of low relatively constant rate. Obvi- interval to insure that the few remaining slipperyously, the useful life must lie well within this low customers will fail during this "prelife" period.constant rate interval. It is the joint objective of Let us turn now to the universe remaining, as-designer, maker and user to minimize this rate, suming we have performed all the previous opera-to maximize the interval and to stabilize and pre- tions to the best of our ability in the time availa-dict its end points with a high degree of confidence. ble. These remaining devices can be expected to

Let us first discuss the last region of rapidly exhibit low and constant failure rates until the on-increasing failure rate late in life-it has some- set of the "wear-out" interval. These failurestimes been labelled "Wear-Out Failure." Even are probably attributable to a large number of es-with perfect design and perfect fidelity in manu- sentially equally effective small causes, each offacture, there are fundamental limitations to the which occurs so rarely it would be exorbitantlystability of a given material configuration in any expensive, perhaps impossible, to identify andnonperfect environment (i.e., bounded by other eliminate them. In a real sense, these constitutematerials and not at absolute zero in tempera- the failures which singly are below the combinedture). Examples are bearing friction, oxide cath- random noise level of all. This failure rate canode evaporation and even the slow solid-state only be determined from the results of extensivediffusion of the significant impurities in semicon- life testing, accelerated aging and step-stressductor devices. It is reasonable that the end of techniques in combination with the extensive uselife of perfectly designed and fabricated solar of statistical design theory and computery. Forcells due to radiation bombardment should be the kinds of components required for space, it re-classed as a wear-out failure mechanism. quires many thousands of devices for thousands of

With a thorough knowledge of the operating- hours under a wide variety of test conditions. In-environmental requirements coupled with a basic deed, at present, it is desirable to put on life manyscientific understanding of the materials, proc- times the number of components needed in theesses and mechnisms of change, the designer can system. After a suitable length of time and de-place this wear-out point well beyond the required tailed analysis of the data, there is selected fromuseful life of the component. a batch only those components which have shown

Let us next consider the early failure interval. the minimum change and closest behavior to de-No matter how perfect the design or complete the sign predictions. This final process of certifica-manufacturing specification-errors in manufac- tion can only be performed by those having theture do and will occur. In high-fidelity manufac- greatest engineering knowledge and judgment ofture these will be small but there will always be the product. The duration of this "certificationsome errors sufficiently large so as to cause test" prior to selection will vary greatly depend-atypical early failure. Examples in both tubes and ing upon the nature of the product, the life re-semiconductors are defective seals, faulty con- quired in the system and the system schedule it-nections or foreign particles inside the capsula- self. For submarine cable tubes a "certificationtion. The incidence of such fabrication "sports" test" period of 7 months is used.(and the length of the early failure period) can be With such care, time and expense having beendrastically reduced by: lavished upon the finally certified components, it

a) Careful training and constant supervision of is important that they now be treated as the costlyoperations personnel by engineering; thoroughbreds they are. The circuits using them

b) Careful design and maintenance of the man- must provide operating conditions consistent withufacturing tools and environment-again those for which certification was made. Equip-with constant engineering supervision; ment, assembly, and further testing techniques

106 IRE TRANSACTIONS ON RELIABILITY AND QUALITY CONTROL

should not introduce new stresses not foreseen in tools which importantly aid the achievement ofthe design. All too frequently, the components reliable design and manufacture-based upon ac-coroners find that the demised died with his boots curate knowledge of the operating environment,on. material properties and mechanisms of change in

known stress fields.Indeed, no statistics or quality control would be

CONCLUSIONS necessary if we were as wise as Oliver WendellHolmes' Deacon who produced a "Reliability Mas-

To recapitulate-it is believed that economical- terpiece:"ly reliable satellites can be made provided they "Have you heard of the wonderful one-hoss shay,incorporate components of proven integrity which That was built in such a logical wayare used in a conservative design. This involves It ran a hundred years to a day.justifiable expense and time because of the key- You see of course if ou're not a duncestone economic importance of the components' How it went to pieces all at once.reliability. All at once, and nothing first-

For emphasis-the extensive use of statistical Alu as bubes dnowhen fthdesign of experiments, quality control and com-putery is a necessary but not sufficient condition End of the wonderful one-hoss shay,for meeting reliability requirements. These are Logic is logic. That's all I say."