Copyright ©1996, American Institute of Aeronautics and Astronautics, Inc.

AIAA Meeting Papers on Disc, July 1996A9637321, AIAA Paper 96-3232

Design enhancement and improved post-actuation test method for a 1/4-inchnormally closed pyro valve

Timothy D. HeldLockheed Martin Flight Systems, Denver, CO

C. Alan SweetLockheed Martin Flight Systems, Denver, CO

Kamesh ManthaJPL, Pasadena, CA

AIAA, ASME, SAE, and ASEE, Joint Propulsion Conference and Exhibit, 32nd, Lake

Buena Vista, FL, July 1-3, 1996

The NASA/JPL Cassini mission to Saturn will launch in October, 1997 and arrive at Saturn in the year 2004 witha four-year mission to orbit the planet. The main propulsion thrust vector and attitude control for the spacecraft issupplied by the Cassini Propulsion Module Subsystem (CPMS). This system will use numerousordnance-actuated, normally-closed (NC) pyro valves to perform mission critical tasks over the 11 year meanmission duration (MMD). The proper operation of this NC valve requires it to isolate fluid flow until commandedopen. Once open, the valve must allow an unobstructed flow path and seal internally to prevent leakage external tothe valve. This paper documents a design evolution to a qualified, Viking heritage design with improvements indesign details that control external leakage to levels that support the planetary mission of this spacecraft. Inaddition, it addresses an improved post-actuation leak test technique, used to better detect gas leakage past thevalve's primary metal-to-metal internal seal. (Author)

Page 1

Design Enhancement and Improved Post-Actuation TestMethod for a 1/4" Normally Closed Pyro Valve

Timothy D. Held* and C. Alan Sweet*Lockheed Martin Flight Systems

Denver, Coloradoand

Kamesh ManthaJet Propulsion Laboratory, California Institute of Technology

Pasadena, California

Abstract

The NASA/JPL Cassini mission to Saturn willlaunch in October, 1997 and arrive at Saturn inthe year 2004 with a 4 year mission to orbit theplanet. The main propulsion thrust vector andattitude control for the spacecraft is supplied bythe Cassini Propulsion Module Subsystem (C-PMS). This system will use numerous ordnance-actuated, normally-closed (NC) pyro valves toperform mission critical tasks over the 11 yearmean mission duration (MMD).

The proper operation of this NC valve requires itto isolate fluid flow until commanded open.Once open, the valve must allow anunobstructed flow path and seal internally toprevent leakage external to the valve. Thispaper documents a design evolution to aqualified, Viking heritage design withimprovements in design details that controlexternal leakage to levels that support theplanetary mission of this spacecraft. In addition,it addresses an improved post-actuation leak testtechnique, used to better detect gas leakagepast the valve's primary metal-to-metal internalseal.

* Member AIAACopyright 1996 Lockheed Martin AstronauticsPublished by The American Institute ofAeronautics and Astronautics, Inc., withPermission

Introduction

The C-PMS has unique design requirementsbased on it's unique MMD (seven year cruise,eleven year total). Specific to this paper are tworequirements that limit 1) the total spacecraftGHe external leakage to <1 x 10~3 sec/sec and 2)any single component to <1 x 10'6 sec/sec forthe MMD. Considering the first NC pyro valve isactuated within days of launch, compliance tothese requirements is critical for missionsuccess.

For major bums, such as Trajectory CorrectionManeuvers (TCMs) and Saturn Orbital Insertion(SOI), a bi-propellant system consisting ofNitrogen Tetroxide (NTO) and Monomethyl-hydrazine (MMH) will be used. A monopropellanthydrazine (N2H4) system is used for attitudecontrol.

Pressurization for the bi-propellant tanks issupplied by a 3,742 psig regulated heliumsystem and attitude control by a separateblowdown hydrazine system with a one-shot2,553 psig recharge tank. The C-PMSschematic is shown in Figure 1.

The C-PMS is a robust design with redundancyadded whenever feasible. In April, 1994, a majordesign change was made to the functionalschematic based on findings from the MarsObserver (MO) accident investigation. As aresult, a number of additional NC pyro valveswere added to prevent propellant vapors frommigrating to critical components such as theregulator and high pressure latch valves. The

helium pressurization system now uses a total of25 pyro valves, 15 of them normally closed.

The C-PMS program purchased a NC pyro valvedesign that had flown on many missions and was

therefore considered to have "heritage".Unknown at that time were the design iterationssometimes required by each subsequentcustomer that resulted in a different valve thathad been originally qualified.

Figure 1: CASSINI PMS SCHEMATIC

Discussion

With the addition of each propulsion systemcomponent, the potential for external leakageincreases. As a risk mitigating step, additionalprecautions were taken to ensure a leak freehelium system. One of these was to test postactuated NC pyro valves for leakage in a mannerthat is not typically done, is more time consumingand more expensive. This process involvesdrilling into the housing, beneath the lower ramO-ring, instead of merely removing one of theinitiators to test for primary metal-to-metal sealleakage.

An investigation began after two successive C-PMS valve lots failed Destructive LotAcceptance Test (DLAT) in post-actuationexternal leakage. Since this valve design isdependent on piece part geometry, materialproperties and strict control to prevent

contamination of the tapered seat, effortsfocused on manufacturing or machining errors,inadequate piece part cleaning or inspections,and test set-up methods. Additional tests wereperformed to determine if the output of theNASA Standard Initiator (NSI), theelectroexplosive device (EED) used to actuatethe valve, may have produced more pressure(i.e., energy) than past lots.

The results of all testing reported herein areshown in Table 1. [Valve test references withinthis paper will be referred to by test number.]

Failure Investigation

As shown in Table 1, two of three of the firstDLAT lot failed to meet the 1 x 10"^ sec/sec testcriteria. The valve actuated by a single NSI (no.1)

met the test requirement, while the two actuatedusing dual NSI's (no. 2 and 3) failed.

After finding a dimensional nonconformance inthe bore of one of the failed valves from the firstfailed lot, all valves in the build lot weredisassembled for further inspection. Thesubsequent discovery of improper rework by thehousing manufacturer resulted in scrapping allhousings in that lot.

The first of many valves (no. 4 and 5) actuatedduring the Failure Analysis (F/A) verified thatremachining of the valve housings "to print" wasstill inadequate to prevent post-actuationleakage. Two more test firings, performed todetermine the effects of the improper rework onvalve operation, were inconclusive showing anin-tolerance valve (no. 6) to fail and an out-of-tolerance valve (no. 7) to pass the post-actuationleak test. It was determined during the post-actuation testing of valve number 6 that bydrilling directly into the lower O-ring (no. 6A),instead of below it (no. 6B), the resulting leaktest readings could vary by two orders ofmagnitude. As a result, future post-actuationradiographic inspections were used to measurethe relative location of the lower O-ring to insurethe hole was drilled below this seal.

Concurrent with the build of the second flight lotof valves, testing continued to better define thefailure mechanism. One additional test firing (no.8) was planned to determine the effects of a 2.0msec stagger between initiator actuation (a testparameter based on a worst case output of C-PMS flight electronics). A mechanical failure ofan initiator cable prevented this stagger,resulting instead in another successful singleNSI actuated valve (no. 8A). Actuation of thesecond initiator days later (no. 8B) did notchange the test results, indicating the effects ofstaggered initiation were likely secondary to thefailure mechanism. Based on the testing to thispoint, the valve supplier recommended a designmodification to increase the length of thetapered region. Without significant data on thismodification, and biased toward product, thesupplier was directed to proceed without thedesign change.

[Unknown at this time was a related post-actuation leak failure of a similar NSI actuated NC

valve back in 1987. Five of six DLAT valves,three fired with a single NSI and three by dualsimultaneous actuation, failed the test at 3,500psig test pressure. Three of six still failed to meetthe requirement at 250 psig. This failure wasattributed to a low material strength and thesupplier had proposed the increase in taperlength to their customer at that time. Again, theissue of heritage convinced them to retain theirdesign and accept the hardware withoutmodification.]

Following the second lot build, the subsequentDLAT revealed the same pattern of post-actuation leak failures. The valves actuated by asingle NSI (no 9 and 11) sealed as required whilethe one powered by dual initiators (no. 10) failed.

A third lot of valves, built for another NASA/JPLprogram, was tested (no. 12,13,14 and 15) andexperienced the same post-actuation leak testfailure. Since their housings were made from thesame material lot as the second C-PMS valves,the valves were scrapped and a new lot was builtconcurrently with the C-PMS build.

The dramatic leak rate of test unit number 10lead to the conclusion that the materialproperties used to fabricate these housingswere inadequate to absorb the energy impartedinto the ram upon dual NSI actuation. Furtherinvestigation revealed an inconsistency onsimilar housing drawings with respect to the yieldstrength requirements.

Some housing drawings, including the C-PMSdesign, specified only ultimate tensile strengthrequirements while others called out minimumyield strengths from 40Ksi to 65Ksi, dependingon the customers demands. It was determinedthe housings from the first C-PMS build, and theother NASA program lot, were manufacturedfrom a lot of 304L with yield strength ofapproximately 34Ksi. However, previoussuccessful valve lots used 304L and 321stainless steel housings with yield strengthsranging from 31.5Ksi to 64Ksi.

Based on testing to this point, it was concludedthat higher material strength alone would not besufficient to solve the problem.

Table 1 PYRO VALVE LEAK TEST SUMMARY

TestNo.

12345

6A6B7

8A8B91011121314151617181920

21

222324252627282930313233343536

Valve Lot -Serial No.

1-0181-0171-0021-0271-0051-0201-0201-026SN22SN223-0803-0603-0712-0322-0492-0392-0401-0033-0633-059VikingNoSN

NoSN

2-0524-0954-0964-0924-0904-1054-1044-1035-1395-1305-1165-1385-1255-1345-140

NSI^LotDesignator

MSKMSKMSKMSKMSKMSKN/AMSKMSKMSKMSKMSKMSKMSNMSN

(See note 4)(See note 4)(See note 4)

120% (5)80% (6)MSK

120% (5)

MSK

120% <5)MSKMSKMSKMSK

120% <5>120% <5>80% (6)

MSKMSKMSKMSK

120% (5)120%<5)80% (6)

FiringTemp(°C)-20+70+70+70+70+70+70+70+70+70-20+70+70+70+70-20+70+70-20-20+70+70

+70

+70+70-20+70-20+70-20-20+70-20-20+70+70-20+70

QtyFired

SingleDualDualDualDualDualN/ADual

SingleSingleSingleDual

SingleDualDual

SingleDualDual

SingleSingleDualDual

Dual

DualDualDual

SingleSingleDualDual

SingleDualDual

SingleSingleDual

SingleSingle

Through-holeLeak Rate (2' 3>

(sec/sec)1.0xlOE-77.2x1 OE-6

> lx lOE-41.4xlOE-7

5.0xlOE-51.4xlOE-7

3.2xlOE-51.6xlOE-80.4xlOE-90.2x1 OE-96.8xlOE-9

3.3xlOE-l1.0xlOE-8

3.3xlOE-39.3xlOE-27.4xlOE-8

>lxlOE-41.6xlOE-71.0xlOE-83.8xlOE-81.2xlOE-7

5.6x1 OE-7 (400)1.2xlOE-4(3800)2.4x1 OE-8 (400)3.2xlOE-8(3800)5.6x1 OE-8(3800)

2.0x1 OE-8l.Oxl OE-71.8xlOE-75.0xlOE-81.4x1 OE-82.0x1 OE-84.8xlOE-81.4xlOE-82.6xlOE-82.8xlOE-81.2x1 OE-85.0xlOE-82.8xlOE-83.2x1 OE-8

Notes, Comments andFailure Analysis (F/A) Results1st DLAT Firing1st DLAT Firing; NSI's fired simultaneously1st DLAT Firing; 2.0 msec stagger between NSI's1st F/A Firing; 2 msec delay; Concave taper region2nd F/A; 2 msec delay; Nominal taper region3rd F/A; 2 msec delay; O-ring masked leak rateX-ray'd valve, redrilled hole below O-ring4th F/A; 2 msec delay; Re-machined taper to print5th F/A; tech error - only 1 of 2 NSI's firedFired 2nd NSI days later; No further ram stroke2nd DLAT Series Firing2nd DLAT; Bubble leak ;1.2xlOE-8 thru NSI port2nd DLAT; Dual init.; bad cable - only 1 NSI firedMGS Pre-DLAT; Dual simult.; Bubble leak testMGS Pre-DLAT; Bubble leak test6th F/A;Dual simult.;Ballistic press.= 14,500 psig7th F/A; Dual simult.; No gross leak test done8th F/A; Dual simult.; Increased taper by 0.085"9th F/A; Rejected valve using single 120% initiator10th F/A; Rejected valve using single 80% initiator1 1th F/A; Dual simult.; Original Viking valve lot12th F/A; Dual simult.; Housing with 62Ksi yield1st leak test done at 400 psig, 2nd at 3,800 psig13th F/A; Dual simult.; 62Ksi yield + longer taper1st leak test done at 400 psig, 2nd at 3,800 psig14th F/A; Dual simult.; 35Ksi yield + longer taperFinal DLAT (See note 7); Dual simultaneous init.Final DLAT (See note 7)Final DLAT (See note 7)Final DLAT (See note 7)Qualification of design modificationQualification of new designQualification of new designFinal DLAT (See note 7)Final DLAT (See note 7)Final DLAT (See note 7)Final DLAT (See note 7)Qualification of new designQualification of new designQualification of new design

NOTES;1. Unless otherwise noted, initiator was NASA part number SEE2610001-256.2. Unless otherwise noted, helium leak testing @ 3,800 psig through a hole drilled below the lower O-ring.3. Test no. 10, 15 and 16 were pressurized to 3,750 psig in alcohol; bubbles collected in graduated cylinder.4. Did not use an NSI; Used an "NSI equivalent" (in lOcc closed bomb); Supplier part number 4704100.5. Did not use an NSI; Supplier part number 4704100-10 with output 20% higher than that of a nominal NSI.6. Did not use an NSI; Supplier part number 4704100-3 with output 20% lower than that of a nominal NSI.7. Test no.s 23 through 36 used higher strength (62 vs. 33.7Ksi) housings with a 0.085" longer taper in housing.

The program and supplier agreed to enhancethe design to include a combination of highermaterial strength and longer taper region in thevalve housing. A successful test (no. 16) of theproposed increase in taper length alone addedconfidence in this design approach, althoughthe post-actuation radiograph revealed the tarnhad traveled through the tapered region, seatingat the bottom of stoke.

As the final phase of the F/A, another series ofvalves were tested to validate the proposedmodification. Tests 17 and 18, using the 34Ksihousings, repeated the single initiatoractuation's. A secondary test (no. 19) wasperformed using a valve from the original Vikingprogram along with dual simultaneous "MSK"initiators. The success of this test indicated theNSI's were secondary to the failure mechanism.Test firing number 20 was successful using ahousing with 62Ksi strength. Two more tests(no. 21 and 22) verified the design approach.

A combination DLAT and Qualification programwas initiated to validate the flight hardware. Alltest conditions were proposed, as well as overand under charged initiation to satisfy margin.The successful results of these tests aredocumented in Table 1.

NSI Characterization Testing

The Cassini program will rely on this NC pyrovalve to perform mission critical functions. That,coupled with the high rate of post-actuationleakage failures following dual initiator firings,made it necessary to test the NSI's to determinetheir output in comparison to previous flight lotsof initiators. The NSI's reserved for use on C-PMS were built in March, 1992 under the lotdesignator "MSK".

Lockheed Martin, formerly Martin Marietta,developed a Dynamic Test tool (DTt) to measurethe relative energy output from the NSI and havedata from 5 previous flight lots.O)

A population of 19 each of the Cassini "MSK"NSI's were fired in the DTt and results showed anaverage of 44.5 ft-lbs of energy output with astandard deviation of 3.74 ft-lbs. This isapproximately 5 to 14 % higher than previous lotenergy outputs shown below in Table 2.

Table 2 NSI Lot Energy Outputs

NSI LotXPAXPCXPGXPJXRY

MSK

EnergyOutput40.57 ft-lb42.26 ft-lb40.12 ft-lb40.69 ft-lb38.22 ft-lb

44.50 ft-lb

Std Dev.1.1 5 ft-lb2.73 ft-lb2.59 ft-lb1.73 ft-lb1.30 ft-lb

3.74 ft-lb

Date ofManufacture

9/8411/843/855/8510/89

3/94

These data would indicate that the higher outputfrom this lot of NSI's could have contributed tothe DLAT post-actuation leak test failures. Asmentioned earlier, all of the single NSI actuatedvalves passed the post-actuation leak test, the"worst" unit leaking at a rate equal to 1.0x10"7

sec/sec while pressurized to 3,800 psig. Thevalves failed to seal when dual NSI's were fired.

It was determined during the F/A that properoperation of the valve is dependent upon,among other things, the yield strength of thehousing. One postulated failure mechanisminvolved a scenario where the dual initiatorsproduced an excessive ballistic pressure for therelatively low material yield strength to absorb,accelerating the ram through the critical taperedregion and rendering the metal-to-metal sealineffective. The rate of failure in the dual initiatormode would indicate this was the case.

In compiling the supplier data from previous NCvalve single initiator actuation's, it was evidentthat this lot of NSI's was not producing peakpressures higher than had been recorded sincethe original Viking valves used the VikingStandard Initiator (VSI). The following tableshows examples of average peak ballisticpressures, from a single initiator, recordedduring the actuation of NC valves using both theVSI and NSI. The data presented below wastaken from supplier ATP data sheets.

yiM^ ••••-*-• .Quantity Avg. 'Peak BallisticInitiator Lot of NC Pressure ,&x,.a NC

|?§isignator Valves Pyro Valve tpstg)»04 (VSl)Q&(v%l)

v?XPF.<NSQe UBL(NSI):,MBJ(NSI)MSK (NSI)

-MBW^NSI)K/!CB(NSl)

104

' 2 ..... . . .2263

' ""2

8,49010,1554,3707,69013,14013,92014,09014,520

Though not an exhaustive nor even scientificallysignificant data body of ballistic pressure, it doesindicate that NSI lot "MSK", planned for use onthe C-PMS, does not seem to produceexcessive ballistic pressure. Since none of theinitiators shown, with the exception of "MSK",were ever tested in the DTt, no quantifiableconclusion can be reached without further tests.

Viking/Cassini Test Technique

Depending on the application and/or function ofa NC pyro valve in any given propulsion system,the test method chosen to determine post-actuation internal leakage can and will vary. Post-actuation external leakage from the pressurizedflow tube, past the seated ram into the ballisticcavity, can over time, result in external loss of

pressurant, fuel, or both, ff this occurs, systemdegradation or total mission loss is conceivable.

Figure 2 shows the typical pre-actuation stateof the C-PMS NC pyro valve design. Sincethese devices do not lend themselves to befunctionally tested before flight, the aerospaceindustry has adopted the random sampling ofthese valves, such as is done in a DLAT. One ormore valves may be exposed to projected flightenvironments then actuated in a flight condition.This 'Test as you Fly" approach is the onlymeans of determining hardware integrity prior toactual system operation. It is incumbent uponthe engineer to determine if the hardwareperformed in accordance with the designspecification.

NSI O-Ring

Ram O-RingsTapered Seat

Figure 2 Pre-Actuated Normally Closed Pyro Valve

Leak CheckHole Location

Typical Leak"Check Path

Ballistic Cavity

Metal-to-Metal Seal

Measurementfrom x-ray

Flow Tube

Figure 3 Post-Actuated Normally Closed Pyro Valve

Typically, in the case of a dual initiated valve,post-actuation external leakage testing is donesimply by removing one of the two initiators,pressurizing the flow tube with helium, and"sniffing" to detect and measure helium leakingpast the ram. Measurements can be obtainedusing a hand held gas detecting probe in thehermetic confines of a bell jar. Figure 3 showsthe typical pre-actuation state of the C-PMS NCpyro valve.

The problem with this leak test method istwofold. First, the two ram O-rings, designed toreact and contain the NSI ballistic gasses duringactuation, are still viable sealing surfaces afterthe ram has stroked and seated in the taperedportion of the housing. Second, unless the fluidmedium has degraded the O-ring material, orpermeation occurs, these O-rings couldconceivably maintain a seal beyond MMD of thesystem. For most short duration (1-3 years),Earth orbiting, low pressure propulsion systems,this test method may be satisfactory. If however,internal leakage is of major concern, as it was forthe original Viking Landers and will be for anyplanetary mission, it is critical that the internalleakage be measured as accurately as possible.The test method described herein is a derivationof that developed during the original Viking pyrovalve test program.

This test method requires a number ofinspections and accurate measurements prior tomeasuring leakage. Following actuation, aradiographic inspection of the valve willdetermine the exact position of the lower O-ringgroove of the ram relative to a defined, externalreference frame; in this case the bottom of thevalve housing.

Once this dimension is known, a small hole (e.g.,0.040" dia) can be precisely drilled into this glandbelow the O-ring. The valve is now configuredsuch that, once the flow tube is pressurized, theactual leakage past the metal-to-metal seal canbe measured without the dual O-rings impedingor masking the actual leakage rate. Data from testnumber 5 is an example of how, in one case,drilling into the O-ring instead of below it candistort the actual leak rate. Test number 10confirmed the difference in leak rates as testedthrough the initiator port, versus through aproperly drilled hole just above the seal, candiffer by many orders of magnitude.

In every case a calibrated leak detector was usedwith the valve pressurized in an evacuated belljar. The C-PMS nominal test pressure was 3,750

psig, but it was observed that leak rates obtainedby any test method are heavily influenced by theflow tube test pressure (no. 20 and 21). It isimportant to always test using the maximumexpected operation pressure (MEOP) of thesystem. The difference in leak rates between anarbitrary test pressure and system MEOP couldbe enough to violate system acceptance testcriteria.

Conclusions

1) There have been a number of designchanges in this NC pyro valve since it wasoriginally qualified for Viking. The extent to whichthose changes affected the valve's performanceis still not fully understood.

2) Contributors to the post-actuation leakagefailure experienced on the C-PMS hardwareincluded low housing material yield strength, NSIoutput and machining errors. Other possiblecauses include piece part contamination,inadequate cleaning agents (a result of changingEPA standards).

3) The use of a specified material yield strengthand 0.080" increase in the length of the housingtaper has been qualified.

4) The current lot of NC pyro valves are qualifiedto meet the C-PMS flight requirements.

Recommendations and Comments

1) Since NSI outputs vary from lot to lot, thedesignated flight lot should be incorporated intotesting the flight hardware.

2) Dual, simultaneous actuation of NSI's in thistype of 1/4" NC pyro valve design should beavoided if system constraints do not requiresuch actuation.

3) Design heritage is not always fool-proof. Athorough examination should be made of flighthardware prior to system application.

4) The test methods used to determine theactual leakage past the metal-to-metal sealshould be incorporated into the DLAT of futureflight hardware where component externalleakage is a critical design parameter. The dataobtained from those tests should be comparedwith system parameters to determine system testsuccess criteria.

5) The test methods described in this paper forthe 1/4" pyro valve will apply to any size pyrovalve of similar design.

Acknowledgments

We greatly appreciate the work and assistancefrom Mr. Ralph Eberhardt, Mr. Robert Berry, Mr.Albert Herzl, and Mr. Harold Thompson ofLockheed Martin, Mr. Carl Guernsey of JPL andMr. Dan Frederick and Mr. Prakash Tripathi ofOEA Aerospace, Inc.

The work described in this paper was carried outby Lockheed Martin Flight Systems and OEAAerospace, Inc. under the Cassini PropulsionModule Subsystem contract with the JetPropulsion Laboratory/NASA.

References

1. Butterfield, N.J., "Dynamic Output (Energy)Available from the NASA Standard Initiator,"Martin Marietta Aerospace Group Technical NoteTN-1009-92, October 1992.

2. OEA Aerospace, Inc., "Failure AnalysisReport for Cassini Valves", document number60-1430-34, October 1995.