# Why do most space probes survive for far longer than they were designed for?

Looking back to Opportunity (Rest In Peace, little friend), it was apparently designed to operate for 90 days but it ended up going for 16 years which is approximately 64 times longer than the engineers hoped for. This blows my mind. The technology that we buy and use here on Earth seems so fragile and badly engineered compared to Opportunity.

Besides, Opportunity is not the only one. The second Mars rover, Spirit, was also meant to last for far shorter than it actually did (even though it wasn't nearly as tough as Opportunity). And if I remember correctly, both Voyagers were also estimated to lose connection with Earth far sooner.

Now of course I admire and appreciate the mental and physical work the engineers had to go through to design a rover that lasts for almost two decades on another planet, but I still don't understand how they did that.

How come so many space probes are able to survive for such long periods of time and why is the difference between the expected duration of service and the actual duration of service so dramatically large? Is it really that hard to predict how long a device will last?

• Quite a few probes survive infinitely less than their designed lifetime. popularmechanics.com/space/moon-mars/a17407/…
– IMil
Feb 15, 2019 at 6:09
• I am reminded of people in the dystopian novel This Perfect Day who find it hard to believe people can live much beyond the age of retirement of 65 years. It says a lot about our baseline of planned obsolescence that we don't expect stuff electronics for 40 years. Feb 15, 2019 at 8:13
• Also, worth noting that lots of things on Opportunity did fail, and at the time we lost contact, it was more work-around than original design - things like two of the wheels not working any more, memory failures etc. The battery is the most remarkable achievement imho - the best in the Solar system - 15 years of harsh charge/discharge cycles in rapid temperature changes, and still charged to ~75% Feb 15, 2019 at 12:39
• @jamesqf You're right about it being easier to get extended mission funding than to get full-up long mission funding to start with, but it's getting harder. NASA Projects whose spacecraft have finished their Prime Mission (the part that was originally funded) now have to go through a "Senior Review" to get extended mission funding, & approval isn't guaranteed. I worked on NASA's Genesis project & after delivering the sample return capsule to Earth the carrier spacecraft was still functioning perfectly well. We proposed a sun-monitoring mission but were turned down; spacecraft abandoned. Feb 15, 2019 at 19:40
• Please do not answer in the comments. I have cleared a lot of comments that attempted to do so. Feb 19, 2019 at 16:37

Very good question! The answer boils down to statistics of failure. Some aspects involve the statistics of "random" failures—for some reason some critical component just bites the dust—and some involve event-driven failures, such as failures induced by landing shocks, long engine burns, atmospheric entry stresses, etc.

When someone (a government, usually) spends hundreds of millions to billions of dollars/euros (or the equivalent in yen, or rupees, or rubles, or whatever) for a scientific mission, they want the probability of failure to be "acceptably low", which usually means very low. The more is spent, usually the smaller the accepted probability of failure. Typical numbers I have seen working with NASA and JPL are 95% probability of success for a relatively inexpensive mission, and 99% or even higher for flagship-class missions (Probability of success = 1 - Probability of failure). Pushing to those high success probabilities gets really expensive.

Probabilities of random failures are not exactly normally distributed, but let's treat them as such. To get the expected probability of failure over the mission's intended lifetime to very low values, you have to make time to the 50% probability of failure a lot longer than that, sometimes many times that. You're way out on the wings of a normal distribution. At 95% probability of success, you're 2$$\sigma$$ (two "standard deviations") from the mean, that 50% probability of failure. If you're wanting a mission duration of, say, 5 years, with a 95% probability of success (5% probability of failure) and the standard deviation of failure is 4 years, then you have to design for a mean time to failure of $$5 + (2 \times 4)$$ years, or 13 years. So half the time, you expect this spacecraft designed for a 5-year mission to last 13 years.

Event-driven statistics can modify that further. Components for a lander or rover must be designed to survive the atmospheric entry (for a destination with an atmosphere) and landing. There is a statistical probability that those components will fail, but they have to be designed with the robustness to make that probability very low. But designing for survival during landing often means that, once they've successfully landed, the expected lifetime goes up a lot.

That is true of spacecraft other than landers, too. Spacecraft that are quiescent, i.e. not doing propulsive maneuvers, not doing a lot of radical attitude variations, not running scan platforms rapidly all over the sky, tend to last a long time. This is the case with the two Voyager spacecraft: since Saturn for Voyager 1, and Neptune for Voyager 2, they've largely been in "quiet cruise". Also, a small but dedicated operations team has come up with creative ways of conserving electric power. They figure out such tactics as turning off instruments that are no longer useful, turning off heaters in components that aren't needed anymore, etc. When I was working the Neptune encounter I remember the project saying that they expected to have enough power to operate until about 2015. We've gone well beyond that, mostly due to those power conservation strategies. Suzie Dodd, the Project Manager, says now they're thinking maybe 2025.

• @Mindwin normal distribution is defined from -infinity to +infinity. A negative life time doesn't really make sense so it can't be normally distributed. I think a better match is probably the Beta negative binominal distribution. The average to +infinity side of both looks pretty similar but the -infinite side to average is "compressed to" zero to average which makes a lot more sense. Actually we rarely have a full normal distribution (you can't be -1cm tall) but it closely matches many different observations. Feb 15, 2019 at 13:05
• Does the operational lifespan of a probe take into account those "infant mortality" events? If there's a 20% chance the probe goes splat upon landing, but a near-certainty of surviving 10 years after that if it doesn't, is it expected to operate for 10 years, or 8? Feb 15, 2019 at 13:49
• @NuclearWang you are trying to oversimplify the situation down to a single number. In reality every different failure scenario is assessed against not only its likelihood, but also the consequences of it happening. For example if 5 experiments out of 10 on the lander "fail", that has less effect on the mission than if all 10 "work" but there is no communication link to get any of the results back to earth - the overall success rating would be "50%" in one case, but "0%" in the other. Feb 16, 2019 at 15:08
• Random electronics failures are considered to have a Poisson distribution. That needs just one rate parameter, for which there is a fair amount of published data, e.g. MIL-HDBK-217F. Sometimes they are argued to have a Weibull distribution with some memory, which requires two parameters, and so much more data to get a useful estimate. I rarely see those used. Feb 16, 2019 at 18:03
• @Barmar For the reasons given above, and by ShadoCat, the individual components' (parts') expected lifetimes must be much longer that the desired mission duration. Feb 17, 2019 at 2:13

There are a lot of generic answers here about spacecraft. I will try to answer the question specifically for Spirit and Opportunity.

90 sols was deemed sufficient to conduct the primary mission of the rovers, so the systems were designed and tested to assure full capability through the entire 90 sols.

The first thing expected to take a rover below full capability was dust on the solar panels. The dust deposition rate and impact on solar panels was well known from Mars Pathfinder, a 0.3% multiplicative power loss per sol, and was considered to be a global constant in normal weather conditions. It turns out it is global. So the solar panels were sized to support all of the driving, instrument and arm operations, communication, and thermal control required for full capability given about 3/4 power from the solar panels. I.e. they were oversized by a third, compared to the power they could deliver with no dust.

(I know someone will then want to ask why there were no mechanisms to remove dust from the panels. There are many answers on this site and other places to that question. Suffice it to say that oversizing the panels by a third was far and away the cheapest and most reliable way to meet the 90-sol lifetime requirement. No money could be spent to go beyond the contractual requirements.)

We can see that even with the expected dust deposition, the rover would not just up and die at 90 sols. Its capability would only start to be reduced below "full". You could keep going for a long time, continuing to reduce the operations until the solar panels got so covered in dust that the rover could no longer communicate or maintain thermal control. Furthermore the power required for full capability was conservatively estimated during the design process, and the rover actually required less than those estimates for "full". As the rover was operated, we got smarter about how to conserve power, and could make each watt-hour drive that much further or send back that much more data.

Still, that 0.3% per sol is relentless. You can't go forever. Before we launched, I predicted that the rovers would each last for at least nine months before succumbing. They would be down to 44% power on the panels, and even more loss due to the seasonal movement of Sun north and so less light on level panels. Other folk on the project thought I was nuts. They were thinking six months, tops. In any case, there was no way they could go indefinitely, even if they were parked on the sides of hills to try to point the panels more at the Sun.

So what happened? How did they keep going after nine months? For years?!

Luck.

Every once in a while, around the same time of the Martian year, the rovers would experience "cleaning events". For terminology, "dust factor" is a percentage of energy delivered by the solar panels compared to when they were shiny and new, taking into account tilt, the latitude of the Sun, and atmospheric opacity. When a cleaning event occurred, the dust factor would jump up suddenly by 10's of percents overnight! This could occur for a few nights, removing the majority of the dust on the panels. Here is a before and after picture of Opportunity from the 2014 cleaning events:

(click, and click again to embiggen)

Each time this happened, the rovers would get a new lease on life. We got cleaning events reliably every Martian year. Until one year we got none for Spirit. Spirit died shortly thereafter.

The other expected life-limiters on the rovers were the brushed DC electric motors, and the lithium-ion battery. In fact, one of the wheel drive motors went out on Spirit, about two Earth years into the mission. Spirit continued to limp along for four more years, dragging that wheel through the dirt. (Once resulting in a scientific discovery found in the trench left behind. In image below, you can see white silica in part of typical Spirit trench dug by stuck wheel.) Due to the failed wheel, Spirit became stuck and could not free itself. Its inability to position on the side of a hill when the Sun moved North again contributed to its loss when the cleaning events didn't return.

Opportunity also lost a motor, but it was a steering motor, and so had less impact on mobility. And Opportunity continued to see cleaning events each Martian year, up until it got hit by the giant global dust storm.

The motors were only tested to three times the 90 sols, simulating the operation and environmental temperature swings. And there were failures in some of the those tests, which resulted in some changes. So it is quite amazing that those motors lasted as long as they did, even with the two failures.

Though we were worried about the lifetime of the batteries in the rovers, they were remarkably reliable through their many years of operations, and lost very little of their capacity.

In general, electronics is not expected to degrade over time, so long as thermal control is maintained. You are only subject to random failures, which can occur. There were some failures in the flash memory on Opportunity, as it got older. Flash memory has a wear out mechanism, though we tend to not notice it since we don't use the same flash memory for a decade. Eventually the operations team gave up on the flash.

Bottom line, Mars cleaned off the solar panels most of the time, but in the end both rovers died because of dust. There were in fact two motor failures, but the rovers were able to keep going. The batteries held up way better than we expected. The electronics I would expect to keep working, though the flash memory failed on one of the rovers.

That's how the rovers lasted so long. Every spacecraft's story is different.

• Talk about "straight from the horse's mouth"! Feb 18, 2019 at 14:13
• So if the killing factor was power in both of these instances - is there a chance of revival if another 'cleaning event' occurred? Feb 19, 2019 at 2:46
• Very unlikely. Loss of power means loss of thermal control means deep temperature cycles means broken connections due to thermal expansion and contraction. Not to mention a destroyed battery. Even if one did or has come back, we would never know since we’re not trying to communicate with them anymore. Feb 19, 2019 at 3:40

They needed to guarantee that it would operate for its expected duration. Each component has a Mean Time Between Failure (MTBF). The important thing here is that the MTBF is an average. That means that half of the similar components will fail before that time. The MTBF like most statistical measurments follows a bell curve (see below):

In this chart, figure that the horizontal axis measures time and that the MTBF is at the zero position.

The trick is to make the part rugged enough and/or have enough backups (NASA generally goes with the "and" here) that the expected life falls in the -3 range.

That makes it extremely unlikely for the part to fail before its expected life to run out and much more likely to last until a bit after the MTBF.

Every component and group of components is designed this way. That means that anything they build will, in most cases, last much longer than its MTBF.

• This means that the claims that the "expected life" of Opportunity was 90 days are false. Feb 15, 2019 at 3:02
• Time to failure does not necessarily follow a normal ("bell") curve. There are many different models that describe risk of failure over time, with the best choice varying according to the type of component and the expected failure modes. Many of those models are asymmetric, meaning that mean time before failure is not the point by which "half of the similar components will fail" - that would be median time before failure. Feb 15, 2019 at 3:05
• For something like a Mars probe, the designers may want to design it to survive 90 days of bad weather, but have no idea what the Martian weather will actually be like (that's part of why they're sending the probe, after all). Feb 15, 2019 at 3:49
• @GeoffreyBrent: But the core answer remains correct that they want as much of the curve to be on the right side of the "expected life", and thus tend to use parts that will on average last (significantly) longer than the expected life, because NASA can't/won't take a 50% (or even 10%) risk of premature failure. Feb 15, 2019 at 7:35
• The "Mean time between failures" only has meaning for production in the millions (or at least tens of thousands). I still like the answer though Feb 15, 2019 at 8:27

# Although they're up for purchase, the fruits of labor from 58 years of space traveling excellence are not available at Radio Shack.

Is it really that hard to predict how long a device will last?

Yes. Quality control tells you how many cycles something should be able to go through until it is unreliable. The parts you choose to use should be based on their reliability. Your Earth based purchases (aside from planned obsolescence*, economics, and availability), have no such requirements.

I still don't understand how they did that : design a rover that lasted for almost two decades on another planet, and the now +30yo extra-solar probes?

What you're not understanding is that humans know how to build things*, to do whatever/anything you can pay for, for as long as is required. And If you're going to spend a billion dollars to launch a million dollar probe, you buy the expensive gears and put expensive circuits. - I have to buy a new 10 dollar coffee maker about once every two years. Pay me $10k and I'll build you one that you can pass on for the next several generations. How many zeros in your check book? People might have been promoted for having been able to say, "Yeah, I worked on Opportunity." - but not if it had gone dark 12 hours in. At NASA, everyone does everything exactly right and above par, or they might as well have all of stayed in bed. In the early days, most probes didn't survive launch or for very long - but that's why we now know how to make a one year mission probably last ten. Mission critical was the first 90 days. It had to work that long to fulfill it's own statement. Any longer is gravy, but if it died 89 days in, that's mission failure. Guaranteeing something to work for a time period is easy: just run the numbers and apply a good safety factor. But knowing when something will fail can only be gauged with sacrificial test data. Which now we have for Mars rovers, and the Pioneer probes had told us that the Voyagers would be able to handle passing through, e.g., Jupiter's radiation (and now even, past the sun's bow shock). (*) humans know how to build things (to make them break) that shouldn't ever break, to get you buy them repeatedly, or things that don't physically exist like, The White Album. If there's a reverse single word for planned obsolescence, that would be the word for the LOVE that got put into all these probes. How can you love something that much? Pay for it, and pay the right people to do it. They Write the Right Stuff, "The Onboad Shuttle Group" : 260 women and men based in an anonymous office building across the street from the Johnson Space Center in Clear Lake, Texas, southeast of Houston. This software never crashes. It never needs to be re-booted. This software is bug-free. It is perfect, as perfect as human beings have achieved. Consider these stats : the last three versions of the program — each 420,000 lines long-had just one error each. The last 11 versions of this software had a total of 17 errors. Commercial programs of equivalent complexity would have 5,000 errors. The group writes software this good because that’s how good it has to be. Every time it fires up the shuttle, their software is controlling a$4 billion piece of equipment, the lives of a half-dozen astronauts, and the dreams of the nation. Even the smallest error in space can have enormous consequences: the orbiting space shuttle travels at 17,500 miles per hour; a bug that causes a timing problem of just two-thirds of a second puts the space shuttle three miles off course.

Space may be really, really big. But there's absolutely no room to effaround.

• NB, a lot of the essential stuff doesn't get built at NASA but at subcontractors and within institutes or consortia that have successfully bid to put instruments on NASA spacecraft. Feb 15, 2019 at 8:14
• “At NASA, everyone does everything exactly right and above par, or they might as well have all of stayed in bed.” I wouldn’t be surprised if this is mostly wrong. When I started work at a large ASIC manufacturer I expected all the design code, verification etc. to be perfect since we are building billions of these devices and a single tapeout can cost millions of US dollars. In reality you’d be surprised how low-quality critical work in this building full of MScs and PHDs can be. Feb 15, 2019 at 11:54
• @Michael - then you're not going to get a job with the company that works for NASA writing spaceship programs, with that attitude: ... "love" (See edit, and how we do things in space ;) Feb 15, 2019 at 17:25

Most space probes don't survive far longer than they were designed for.

Example: Mars missions. 30 failures, 18 successful missions and 8 missions in progress. I count 4 missions (Viking 1 and 2 landers, Spirit and Opportunity) that lasted far longer than their primary mission. So 4/56 is 7% of Mars missions.

There's a bathtub curve at work: if a mission survives launch and orbit insertion/landing, there's a good chance it will fulfill its primary mission (due to the reasons given in other answers). At some point the hardware starts reaching the end of its life, and you get component failures (some of which have redundancy or can be compensated for, like Voyager's camera platform seizing or MER wheel failure, computer failure etc.).

Some types of mission live longer than others:

• stationary landers have a limited amount of science they can do. At some point, science return diminishes and the mission is ended.
• rovers can drive to a new spot, so it makes sense to design them with extended missions in mind
• orbiters run out of stationkeeping fuel eventually
• flyby missions run out of targets (but the few deep-space missions we have, give interesting information on deep space so we keep them powered up as long as we can).

There's some very good answers here on failure modes and statistics, looking at the specific cases of Spirit and Opportunity there is a bit more to it. NASA had just experienced 2 consecutive failures with the Mars Climate Orbiter and Mars Polar Explorer, both of which were caused by errors in development, seen as the result of NASA's "Better, Faster, Cheaper" approach (for more details on that see my answer here).

NASA needed a win to show the US taxpayer, congress and the world they were still in business, so they built 2 probes instead of 1 to double their chances of success and then they worked hard to get the designs right, putting in the best parts and materials they could get. NASA always tries to under-promise and over-deliver, but in this case they were even more conservative than usual when it came to mission duration, 90 days was a target they were reasonably certain to meet if the probes got there.

• " so they built 2 probes instead of 1 to double their chances of success" The math thre isn't quite right. After as, if the probability of one succeeding is 75%, the probability that at least one out of two will succeed is not 150%. Feb 15, 2019 at 22:05
• @Acccumulation Yes, but it's still a common expression (regardless of whether it stems from lack of mathematical knowledge and experience or simple economy). Feb 20, 2019 at 9:56
• @Accumulation and Luaan, this is a great point! I'm sure I would have said "double their chances" too, but in reality the probability that at least one of the two succeeds is: $1-(1-p)^2$, which is $93.75\%$ for $p=75\%$. However, the common expression is approximately correct for events of small probability $1-(1-p)^2 = 2p-p^2$, which is $\approx 2p$ for small $p$. Interesting! Sep 8, 2020 at 19:18

Might be better to see this as: "Why are some estimates of longevity so conservative?".

I think this is clear. They deal with a lot of unknowns. The mars rovers are a great example of this. "How long before dust accumulates?" is a difficult question to answer without having been there. This isn't always the case BTW. Sometimes the limiting factor is something that's very well understood, and I am always surprised by how accurate some of the predictions of failure are.

As a tech guy at work, I'm sometimes faced with with the question "Why didn't it work?". It's sometimes difficult to get people to grasp that things like The Internet requires lots and lots of things to work and, if any of them fail, the whole thing falls apart. I call this a Logistics Chain.

Any space project is going to face lots and lots of failure points. Your missions to Mars have to be (oversimplified list for discussion)

1. Built in a failure-resistant way