SubjectMSL Backshell Crane Incident
AbstractIn May 2011, the Mars Science Laboratory (MSL) Flight Backshell was inadvertently lifted while attached to the Backshell Cart. The incident occurred at Kennedy Space Center (KSC) in the Payload Hazardous Servicing Facility (PHSF). The weight of the Backshell Cart imparted loads into the Backshell structure through the flight hardware ground support interfaces. The event was caused by a crane operator error in which the operator drove the crane in the up direction instead of the commanded down direction. The MSL project identified a set of actions to address the vulnerability experienced in this operation. Immediate corrective actions have been implemented, and longer-term corrective actions are in progress.
Driving EventA “near miss” handling incident (Reference (1)) occurred during an Aeroshell Mass Properties Test conducted at the NASA Kennedy Space Center (KSC) on the Mars Science Laboratory (MSL) spacecraft Flight Backshell. Designed and built by the NASA/Caltech Jet Propulsion Laboratory (JPL), the MSL spacecraft (Figure 1) consists of a Cruise Stage, an Entry, Descent, and Landing System that ejects the protective Backshell immediately following Parachute Descent and just prior to Powered Descent, and the Rover.
Figure 1. Major elements of the MSL spacecraft
|Figure 2. Backshell and Backshell Cart......................................................................................................................|
[The topmost note (yellow font) in the photo states, “Crane pulled in up direction (while BS was attached to cart).”
The second note states, “Essentially, a large nut plate, Descent Stage Surrogate, is attached at the flight interfaces on
the bottom of the BIP (Backshell Interface Plate).” The third note (red font) states, “Backshell is attached to Cart at
nine (9) locations.” The bottom note states, “Red GSE fitting straddles flight interface. GSE fitting is attached into
4 inserts on bottom of BS (Backshell) on one side and to Backshell cart on the other.”]
|Figure 3. Backshell and Descent Stage Simulator / Surrogate Suspended from Spacecraft |
Assembly and Rotation Fixture (SCARF)
[The topmost note (yellow font) in the photo states, “4X size #10 inserts in Backshell Stiffening Ring used to attach the
Red GSE fitting that attaches the Backshell to the Cart.” The lower note states, “Descent Stage Surrogate in action.
Used to attach the Backshell to our rotation fixture (SCARF) by attaching to our flight like GSE LVA (Launch Vehicle
A loads analysis of the lift incident was performed. The area of concern was associated with the GSE fittings on the bottom of the Backshell where the structure connects to the Backshell Cart, and the area near these fittings. The structure was found to have been tested to loads that provided sufficient margin against the loads imparted during the incident. Analysis, inspections, and tap tests on the Backshell conducted by the Backshell manufacturer and JPL confirmed that the flight structure was not damaged.
An assessment of the incident and the root cause, performed by the project and mission assurance representatives, concluded that the team was operating in accordance with JPL guidelines and practices:
- The lift lead provided correct direction to the crane operator.
- The lift lead’s command was clearly heard by the crane operator, and the crane operator properly repeated back the command.
- Hand signals were used as a backup due to some ambient noise in the area.
- The operator had appropriate line-of-sight to the floor lead.
- The team was using a Hydra Set in accordance with JPL standards.
- The team was well rested: fatigue was not a factor.
- The JPL crane operator received onsite training and was certified on this crane.
- Appropriate hardware quality assurance and safety personnel were present and participating.
- The crane operator inadvertently pushed the wrong button on the crane controller (Figures 4 and 5).
- Standard crane operation, as specified in Reference (2), does not provide any clear mechanism for avoiding hardware damage in the event of this type of operator error.
|Figure 4. KSC Payload Hazardous Servicing Facility (PHSF) crane |
control console. Unlike the standard pendant-type controls used at JPL,
this console can be wheeled around the PHSF highbay.
|Figure 5. Close-up detail of hoist control |
from Figure 4.
Some possible contributing causes were identified, but were not found to be directly correlated to the event:
- The crane controller panel does not have a physical separator between the up and down buttons.
- The crane operator had completed the required certification and training; however, he had somewhat less experience on this particular crane than other operators.
- "Backshell Crane Lift Incident," JPL Problem/Failure Report No. 48883, May 20, 2011.
- “JPL Standard for Systems Safety (D-560), Rev. D,” JPL DocID 34880, September 17, 2007.
- “MSL ATLO Response to Backshell Lift Incident at KSC/PHSF,” JPL Memo IOM 352M-BLT-1013, May 25, 2011.
Lesson(s) LearnedLift operations can be vulnerable to single mistakes by crane operators.
Recommendation(s)Following the incident, JPL Safety and the JPL ATLO (Assembly, Test, and Launch Operations) Mechanical Team reviewed JPL lift processes and made the following recommendations for improvement (Reference (3)):
- When releasing/disconnecting the load during a crane lift, utilize a Hydra Set to establish sufficient slack for the rigging to be disconnected, or for 3-5 seconds of movement at the highest crane speed in the wrong direction. This will provide sufficient time to execute an emergency stop.
- When mating/raising a load, utilize a Hydra Set beyond the point where there is 3-5 seconds of movement available at the highest crane speed. This will provide sufficient time to execute an emergency stop.
- When a Hydra Set is not available or the Hydra Set functionality is lost, the Lift Lead should use limited movements or ‘bump commands’ for the activities described above.
- Ensure an unencumbered individual is available to monitor the load cell during lifts.
Evidence of Recurrence Control EffectivenessJPL has referenced this lesson learned as additional rationale and guidance supporting Paragraph 220.127.116.11 (“Engineering Practices: Protection and Security of Flight Hardware”) in the Jet Propulsion Laboratory standard “Flight Project Practices, Rev. 7,” JPL DocID 58032, September 30, 2008.
Since this incident, JPL System Safety has published the document, "Critical Lift Operations Checklist, Rev. 0," JPL Document No. DocID 78603, November 11, 2011. The checklist items cover pre-lift inspection and verification, and pre-lift briefing. Pre-lift briefings are to be conducted in the presence of all critical lift personnel and the QA and Safety representatives.
Program RelationMars Science Laboratory
Program/Project PhaseImplementation » Phase D
- Aeronautics Research
- Human Exploration and Operations
- Integration and Testing
- Flight Equipment
- Ground Equipment
- Ground Operations
- Industrial Operations
- Safety and Mission Assurance
- Test Article
- Training Equipment
- Advanced planning of safety systems
- Product Assurance