Why do most space probes survive for far longer than they were designed for?

Question

Looking back to Opportunity (Rest In Peace, little friend), it was apparently designed to operate for 90 days but it ended up going for 16 years which is approximately 64 times longer than the engineers hoped for. This blows my mind. The technology that we buy and use here on Earth seems so fragile and badly engineered compared to Opportunity.

Besides, Opportunity is not the only one. The second Mars rover, Spirit, was also meant to last for far shorter than it actually did (even though it wasn't nearly as tough as Opportunity). And if I remember correctly, both Voyagers were also estimated to lose connection with Earth far sooner.

Now of course I admire and appreciate the mental and physical work the engineers had to go through to design a rover that lasts for almost two decades on another planet, but I still don't understand how they did that.

How come so many space probes are able to survive for such long periods of time and why is the difference between the expected duration of service and the actual duration of service so dramatically large? Is it really that hard to predict how long a device will last?

Answer 1

Very good question! The answer boils down to statistics of failure. Some aspects involve the statistics of "random" failures—for some reason some critical component just bites the dust—and some involve event-driven failures, such as failures induced by landing shocks, long engine burns, atmospheric entry stresses, etc.

When someone (a government, usually) spends hundreds of millions to billions of dollars/euros (or the equivalent in yen, or rupees, or rubles, or whatever) for a scientific mission, they want the probability of failure to be "acceptably low", which usually means very low. The more is spent, usually the smaller the accepted probability of failure. Typical numbers I have seen working with NASA and JPL are 95% probability of success for a relatively inexpensive mission, and 99% or even higher for flagship-class missions (Probability of success = 1 - Probability of failure). Pushing to those high success probabilities gets really expensive.

Probabilities of random failures are not exactly normally distributed, but let's treat them as such. To get the expected probability of failure over the mission's intended lifetime to very low values, you have to make time to the 50% probability of failure a lot longer than that, sometimes many times that. You're way out on the wings of a normal distribution. At 95% probability of success, you're 2$\sigma$ (two "standard deviations") from the mean, that 50% probability of failure. If you're wanting a mission duration of, say, 5 years, with a 95% probability of success (5% probability of failure) and the standard deviation of failure is 4 years, then you have to design for a mean time to failure of $5 + (2 \times 4)$ years, or 13 years. So half the time, you expect this spacecraft designed for a 5-year mission to last 13 years.

Event-driven statistics can modify that further. Components for a lander or rover must be designed to survive the atmospheric entry (for a destination with an atmosphere) and landing. There is a statistical probability that those components will fail, but they have to be designed with the robustness to make that probability very low. But designing for survival during landing often means that, once they've successfully landed, the expected lifetime goes up a lot.

That is true of spacecraft other than landers, too. Spacecraft that are quiescent, i.e. not doing propulsive maneuvers, not doing a lot of radical attitude variations, not running scan platforms rapidly all over the sky, tend to last a long time. This is the case with the two Voyager spacecraft: since Saturn for Voyager 1, and Neptune for Voyager 2, they've largely been in "quiet cruise". Also, a small but dedicated operations team has come up with creative ways of conserving electric power. They figure out such tactics as turning off instruments that are no longer useful, turning off heaters in components that aren't needed anymore, etc. When I was working the Neptune encounter I remember the project saying that they expected to have enough power to operate until about 2015. We've gone well beyond that, mostly due to those power conservation strategies. Suzie Dodd, the Project Manager, says now they're thinking maybe 2025.

Answer 2

There are a lot of generic answers here about spacecraft. I will try to answer the question specifically for Spirit and Opportunity.

90 sols was deemed sufficient to conduct the primary mission of the rovers, so the systems were designed and tested to assure full capability through the entire 90 sols.

The first thing expected to take a rover below full capability was dust on the solar panels. The dust deposition rate and impact on solar panels was well known from Mars Pathfinder, a 0.3% multiplicative power loss per sol, and was considered to be a global constant in normal weather conditions. It turns out it is global. So the solar panels were sized to support all of the driving, instrument and arm operations, communication, and thermal control required for full capability given about 3/4 power from the solar panels. I.e. they were oversized by a third, compared to the power they could deliver with no dust.

(I know someone will then want to ask why there were no mechanisms to remove dust from the panels. There are many answers on this site and other places to that question. Suffice it to say that oversizing the panels by a third was far and away the cheapest and most reliable way to meet the 90-sol lifetime requirement. No money could be spent to go beyond the contractual requirements.)

We can see that even with the expected dust deposition, the rover would not just up and die at 90 sols. Its capability would only start to be reduced below "full". You could keep going for a long time, continuing to reduce the operations until the solar panels got so covered in dust that the rover could no longer communicate or maintain thermal control. Furthermore the power required for full capability was conservatively estimated during the design process, and the rover actually required less than those estimates for "full". As the rover was operated, we got smarter about how to conserve power, and could make each watt-hour drive that much further or send back that much more data.

Still, that 0.3% per sol is relentless. You can't go forever. Before we launched, I predicted that the rovers would each last for at least nine months before succumbing. They would be down to 44% power on the panels, and even more loss due to the seasonal movement of Sun north and so less light on level panels. Other folk on the project thought I was nuts. They were thinking six months, tops. In any case, there was no way they could go indefinitely, even if they were parked on the sides of hills to try to point the panels more at the Sun.

So what happened? How did they keep going after nine months? For years?!

Luck.

Every once in a while, around the same time of the Martian year, the rovers would experience "cleaning events". For terminology, "dust factor" is a percentage of energy delivered by the solar panels compared to when they were shiny and new, taking into account tilt, the latitude of the Sun, and atmospheric opacity. When a cleaning event occurred, the dust factor would jump up suddenly by 10's of percents overnight! This could occur for a few nights, removing the majority of the dust on the panels. Here is a before and after picture of Opportunity from the 2014 cleaning events:

(click, and click again to embiggen)

Each time this happened, the rovers would get a new lease on life. We got cleaning events reliably every Martian year. Until one year we got none for Spirit. Spirit died shortly thereafter.

The other expected life-limiters on the rovers were the brushed DC electric motors, and the lithium-ion battery. In fact, one of the wheel drive motors went out on Spirit, about two Earth years into the mission. Spirit continued to limp along for four more years, dragging that wheel through the dirt. (Once resulting in a scientific discovery found in the trench left behind. In image below, you can see white silica in part of typical Spirit trench dug by stuck wheel.) Due to the failed wheel, Spirit became stuck and could not free itself. Its inability to position on the side of a hill when the Sun moved North again contributed to its loss when the cleaning events didn't return.

Opportunity also lost a motor, but it was a steering motor, and so had less impact on mobility. And Opportunity continued to see cleaning events each Martian year, up until it got hit by the giant global dust storm.

The motors were only tested to three times the 90 sols, simulating the operation and environmental temperature swings. And there were failures in some of the those tests, which resulted in some changes. So it is quite amazing that those motors lasted as long as they did, even with the two failures.

Though we were worried about the lifetime of the batteries in the rovers, they were remarkably reliable through their many years of operations, and lost very little of their capacity.

In general, electronics is not expected to degrade over time, so long as thermal control is maintained. You are only subject to random failures, which can occur. There were some failures in the flash memory on Opportunity, as it got older. Flash memory has a wear out mechanism, though we tend to not notice it since we don't use the same flash memory for a decade. Eventually the operations team gave up on the flash.

Bottom line, Mars cleaned off the solar panels most of the time, but in the end both rovers died because of dust. There were in fact two motor failures, but the rovers were able to keep going. The batteries held up way better than we expected. The electronics I would expect to keep working, though the flash memory failed on one of the rovers.

That's how the rovers lasted so long. Every spacecraft's story is different.

Answer 3

They needed to guarantee that it would operate for its expected duration. Each component has a Mean Time Between Failure (MTBF). The important thing here is that the MTBF is an average. That means that half of the similar components will fail before that time. The MTBF like most statistical measurments follows a bell curve (see below):

In this chart, figure that the horizontal axis measures time and that the MTBF is at the zero position.

The trick is to make the part rugged enough and/or have enough backups (NASA generally goes with the "and" here) that the expected life falls in the -3 range.

That makes it extremely unlikely for the part to fail before its expected life to run out and much more likely to last until a bit after the MTBF.

Every component and group of components is designed this way. That means that anything they build will, in most cases, last much longer than its MTBF.

Answer 4

Although they're up for purchase, the fruits of labor from 58 years of space traveling excellence are not available at Radio Shack.

Is it really that hard to predict how long a device will last?

Yes. Quality control tells you how many cycles something should be able to go through until it is unreliable. The parts you choose to use should be based on their reliability. Your Earth based purchases (aside from planned obsolescence*, economics, and availability), have no such requirements.

I still don't understand how they did that : design a rover that lasted for almost two decades on another planet, and the now +30yo extra-solar probes?

What you're not understanding is that humans know how to build things*, to do whatever/anything you can pay for, for as long as is required. And If you're going to spend a billion dollars to launch a million dollar probe, you buy the expensive gears and put expensive circuits. - I have to buy a new 10 dollar coffee maker about once every two years. Pay me $10k and I'll build you one that you can pass on for the next several generations. How many zeros in your check book?

People might have been promoted for having been able to say, "Yeah, I worked on Opportunity." - but not if it had gone dark 12 hours in. At NASA, everyone does everything exactly right and above par, or they might as well have all of stayed in bed.

In the early days, most probes didn't survive launch or for very long - but that's why we now know how to make a one year mission probably last ten. Mission critical was the first 90 days. It had to work that long to fulfill it's own statement. Any longer is gravy, but if it died 89 days in, that's mission failure.

---

Guaranteeing something to work for a time period is easy: just run the numbers and apply a good safety factor. But knowing when something will fail can only be gauged with sacrificial test data. Which now we have for Mars rovers, and the Pioneer probes had told us that the Voyagers would be able to handle passing through, e.g., Jupiter's radiation (and now even, past the sun's bow shock).

---

(*) humans know how to build things (to make them break) that shouldn't ever break, to get you buy them repeatedly, or things that don't physically exist like, The White Album.

If there's a reverse single word for planned obsolescence, that would be the word for the LOVE that got put into all these probes.

---

How can you love something that much? Pay for it, and pay the right people to do it.

They Write the Right Stuff, "The Onboad Shuttle Group" : 260 women and men based in an anonymous office building across the street from the Johnson Space Center in Clear Lake, Texas, southeast of Houston.

This software never crashes. It never needs to be re-booted. This software is bug-free. It is perfect, as perfect as human beings have achieved. Consider these stats : the last three versions of the program — each 420,000 lines long-had just one error each. The last 11 versions of this software had a total of 17 errors. Commercial programs of equivalent complexity would have 5,000 errors.

The group writes software this good because that’s how good it has to be. Every time it fires up the shuttle, their software is controlling a $4 billion piece of equipment, the lives of a half-dozen astronauts, and the dreams of the nation. Even the smallest error in space can have enormous consequences: the orbiting space shuttle travels at 17,500 miles per hour; a bug that causes a timing problem of just two-thirds of a second puts the space shuttle three miles off course.

Space may be really, really big. But there's absolutely no room to effaround.

Answer 5

Most space probes don't survive far longer than they were designed for.

Example: Mars missions. 30 failures, 18 successful missions and 8 missions in progress. I count 4 missions (Viking 1 and 2 landers, Spirit and Opportunity) that lasted far longer than their primary mission. So 4/56 is 7% of Mars missions.

There's a bathtub curve at work: if a mission survives launch and orbit insertion/landing, there's a good chance it will fulfill its primary mission (due to the reasons given in other answers). At some point the hardware starts reaching the end of its life, and you get component failures (some of which have redundancy or can be compensated for, like Voyager's camera platform seizing or MER wheel failure, computer failure etc.).

Some types of mission live longer than others:

• stationary landers have a limited amount of science they can do. At some point, science return diminishes and the mission is ended.
• rovers can drive to a new spot, so it makes sense to design them with extended missions in mind
• orbiters run out of stationkeeping fuel eventually
• flyby missions run out of targets (but the few deep-space missions we have, give interesting information on deep space so we keep them powered up as long as we can).

Answer 6

There's some very good answers here on failure modes and statistics, looking at the specific cases of Spirit and Opportunity there is a bit more to it. NASA had just experienced 2 consecutive failures with the Mars Climate Orbiter and Mars Polar Explorer, both of which were caused by errors in development, seen as the result of NASA's "Better, Faster, Cheaper" approach (for more details on that see my answer here).

NASA needed a win to show the US taxpayer, congress and the world they were still in business, so they built 2 probes instead of 1 to double their chances of success and then they worked hard to get the designs right, putting in the best parts and materials they could get. NASA always tries to under-promise and over-deliver, but in this case they were even more conservative than usual when it came to mission duration, 90 days was a target they were reasonably certain to meet if the probes got there.

Answer 7

Might be better to see this as: "Why are some estimates of longevity so conservative?".

I think this is clear. They deal with a lot of unknowns. The mars rovers are a great example of this. "How long before dust accumulates?" is a difficult question to answer without having been there. This isn't always the case BTW. Sometimes the limiting factor is something that's very well understood, and I am always surprised by how accurate some of the predictions of failure are.

Answer 8

As a tech guy at work, I'm sometimes faced with with the question "Why didn't it work?". It's sometimes difficult to get people to grasp that things like The Internet requires lots and lots of things to work and, if any of them fail, the whole thing falls apart. I call this a Logistics Chain.

Any space project is going to face lots and lots of failure points. Your missions to Mars have to be (oversimplified list for discussion)

1. Built in a failure-resistant way
2. Loaded on a rocket
3. Launch into orbit
4. Break free from orbit on a trajectory to Mars
5. Survive a ride in the void to Mars (a single meteor strike could ruin your trip)
6. Insert to Mars orbit
7. Descend into Mars' atmosphere
8. Land safely
9. Operate in a harsh environment that we still know little about

Not everyone makes it that far. The unforeseen issues and bad assumptions can eat your lunch (like a typo destroying the entire thing during Step 3)

What made Spirit and Opportunity different was they had to operate under some bad assumptions about Mars (because we know little about the planet's long term surface conditions on hardware). The most notable bad assumption was that Martian dust would permanently coat the solar panels, rendering them useless after 90 days. We learned that assumption was wrong, and it's believed Martian wind knocks it off. With the solar panels being cleaned, the rovers could continue to function longer. Spirit died after its wheels stopped working and it was unable to orient itself for Winter. Opportunity (which fared better with its wheels) died when a dust storm likely cut off power for too long.