Subject

MSL Backshell Crane Incident

Description

A “near miss” handling incident (Reference (1)) occurred during an Aeroshell Mass Properties Test conducted at the NASA Kennedy Space Center (KSC) on the Mars Science Laboratory (MSL) spacecraft Flight Backshell. Designed and built by the NASA/Caltech Jet Propulsion Laboratory (JPL), the MSL spacecraft (Figure 1) consists of a Cruise Stage, an Entry, Descent, and Landing System that ejects the protective Backshell immediately following Parachute Descent and just prior to Powered Descent, and the Rover.

Figure 1 is a color diagram of the nested components of the MSL spacecraft. The topmost element is a grey bar designated the Cruise Stage. Below it is an inverted cone similar to a diving bell designated Backshell; the upper part of the cone holds the Backshell Interface Plate and the Parachute. The next element below is a complex assembly of struts and tanks labeled the Descent Stage, which includes the bridle and umbilical device. Next is a complex drawing including a chassis and wheels identified as the Rover. At the very bottom is a nose cone shaped Heatshield with MEDLI. Several points on the various elements have a small symbol representing Separations & Pyros.>
Figure 1. Major elements of the MSL spacecraft

A crane was used for the installation of the Descent Stage Simulator (DSS) into the Backshell in preparation for a Backshell to Heatshield fit-check (see Figures 2 and 3). Just prior to the incident, the DSS had been secured to the Backshell, and the system test team prepared to unload the crane and remove the rigging. A “Hydra Set” load positioning system was used to lower the crane hook until the lifting slings went slack and the load cell read zero. The lift conductor then gave the "down slow" command. The "down slow" command was repeated by the crane operator, but the crane operator commanded the crane to go "up slow." The team observed the tautening of the lifting slings, and the “Stop” command was immediately issued. The crane was stopped, and then lowered. It was noted that the load cell peaked at 4,400 lbs., and it appeared that two of the legs (jacks) of the Backshell Cart were lifted slightly off the floor.

Figure 2 is a color photo taken in a high bay cleanroom. A wheeled, reinforced, metal scaffold that incorporates a crane rests on a concrete floor. Three lifting slings are visible, extending from the crane attachment to points on a dome-like structure (Backshell) that sits on a wheeled, reinforced, metal cradle or cart. Various metal fittings are visible between the Backshell and the Cart.

Figure 3, apparently photographed from the floor level, shows two ESD-robed technicians in a high bay cleanroom performing measurements on the lower rim of a saucer-shaped structure that is apparently suspended above a floor. An arrow extends from a text note to a set of inserts on the underside of the rim in proximity to a coiled spring with a square plate on its free end. Another arrow extends from a text note to a large metal plate suspended beneath the center of the underside of the saucer.
Figure 2. Backshell and Backshell Cart......................................................................................................................

[The topmost note (yellow font) in the photo states, “Crane pulled in up direction (while BS was attached to cart).”
The second note states, “Essentially, a large nut plate, Descent Stage Surrogate, is attached at the flight interfaces on
the bottom of the BIP (Backshell Interface Plate).” The third note (red font) states, “Backshell is attached to Cart at
nine (9) locations.” The bottom note states, “Red GSE fitting straddles flight interface. GSE fitting is attached into
4 inserts on bottom of BS (Backshell) on one side and to Backshell cart on the other.”]
Figure 3. Backshell and Descent Stage Simulator / Surrogate Suspended from Spacecraft
Assembly and Rotation Fixture (SCARF)

[The topmost note (yellow font) in the photo states, “4X size #10 inserts in Backshell Stiffening Ring used to attach the
Red GSE fitting that attaches the Backshell to the Cart.” The lower note states, “Descent Stage Surrogate in action.
Used to attach the Backshell to our rotation fixture (SCARF) by attaching to our flight like GSE LVA (Launch Vehicle
Adapter) Ring.”]

A loads analysis of the lift incident was performed. The area of concern was associated with the GSE fittings on the bottom of the Backshell where the structure connects to the Backshell Cart, and the area near these fittings. The structure was found to have been tested to loads that provided sufficient margin against the loads imparted during the incident. Analysis, inspections, and tap tests on the Backshell conducted by the Backshell manufacturer and JPL confirmed that the flight structure was not damaged.

An assessment of the incident and the root cause, performed by the project and mission assurance representatives, concluded that the team was operating in accordance with JPL guidelines and practices:
  • The lift lead provided correct direction to the crane operator.

  • The lift lead’s command was clearly heard by the crane operator, and the crane operator properly repeated back the command.

  • Hand signals were used as a backup due to some ambient noise in the area.

  • The operator had appropriate line-of-sight to the floor lead.

  • The team was using a Hydra Set in accordance with JPL standards.

  • The team was well rested: fatigue was not a factor.

  • The JPL crane operator received onsite training and was certified on this crane.

  • Appropriate hardware quality assurance and safety personnel were present and participating.
This ground handling incident was attributed to the following factors:
  1. The crane operator inadvertently pushed the wrong button on the crane controller (Figures 4 and 5).

  2. Standard crane operation, as specified in Reference (2), does not provide any clear mechanism for avoiding hardware damage in the event of this type of operator error.
Figure 4 is a yellow-tinged photo of an industrial panel. The panel appears to be constructed as a heavy metal box mounted above a concrete floor. Arrayed across the box are affixed six small rectangular boxes—each with two buttons recessed in the top surface. The electrical boxes are hand-labeled from the left as “Micro-Norm,” “On-Off,” “Bridge,” “Trolley,” “Hoist,” and “E-Stop....................... Figure 5 is a close-up of the “Hoist” control box in Figure 4. In the close-up, labels on the dual buttons are more visible. The button closest to the operator position is labeled “Down,” and the button furthest from the operator is labeled “Up.
Figure 4. KSC Payload Hazardous Servicing Facility (PHSF) crane
control console. Unlike the standard pendant-type controls used at JPL,
this console can be wheeled around the PHSF highbay.
Figure 5. Close-up detail of hoist control
from Figure 4.

Some possible contributing causes were identified, but were not found to be directly correlated to the event:
  1. The crane controller panel does not have a physical separator between the up and down buttons.

  2. The crane operator had completed the required certification and training; however, he had somewhat less experience on this particular crane than other operators.
References:
  1. "Backshell Crane Lift Incident," JPL Problem/Failure Report No. 48883, May 20, 2011.
  2. “JPL Standard for Systems Safety (D-560), Rev. D,” JPL DocID 34880, September 17, 2007.
  3. “MSL ATLO Response to Backshell Lift Incident at KSC/PHSF,” JPL Memo IOM 352M-BLT-1013, May 25, 2011.

Lesson(s) Learned

Lift operations can be vulnerable to single mistakes by crane operators.

Recommendation(s)

Following the incident, JPL Safety and the JPL ATLO (Assembly, Test, and Launch Operations) Mechanical Team reviewed JPL lift processes and made the following recommendations for improvement (Reference (3)):
  1. When releasing/disconnecting the load during a crane lift, utilize a Hydra Set to establish sufficient slack for the rigging to be disconnected, or for 3-5 seconds of movement at the highest crane speed in the wrong direction. This will provide sufficient time to execute an emergency stop.

  2. When mating/raising a load, utilize a Hydra Set beyond the point where there is 3-5 seconds of movement available at the highest crane speed. This will provide sufficient time to execute an emergency stop.

  3. When a Hydra Set is not available or the Hydra Set functionality is lost, the Lift Lead should use limited movements or ‘bump commands’ for the activities described above.

  4. Ensure an unencumbered individual is available to monitor the load cell during lifts.

Evidence

JPL has referenced this lesson learned as additional rationale and guidance supporting Paragraph 6.12.5.3 (“Engineering Practices: Protection and Security of Flight Hardware”) in the Jet Propulsion Laboratory standard “Flight Project Practices, Rev. 7,” JPL DocID 58032, September 30, 2008.

Since this incident, JPL System Safety has published the document, "Critical Lift Operations Checklist, Rev. 0," JPL Document No. DocID 78603, November 11, 2011. The checklist items cover pre-lift inspection and verification, and pre-lift briefing. Pre-lift briefings are to be conducted in the presence of all critical lift personnel and the QA and Safety representatives.

Mission Directorate(s)

  • Exploration Systems
  • Aeronautics Research
  • Science

Approval Info

  • Approval Date: 2011-09-30
  • Approval Name: mbell
  • Approval Organization: HQ
  • Approval Phone Number: