Lessons learned from systems engineering on the James Webb Space Telescope

Abstract. The James Webb Space Telescope is NASA’s flagship mission and successor to the highly successful Hubble Space Telescope. It is an infrared observatory featuring a cryogenic 6.6 m aperture, deployable optical telescope element with a payload of four science instruments assembled into an integrated science instrument module that provide imagery and spectroscopy in the near infrared band between 0.6 and 5  μm and in the mid-infrared band between 5 and 28  μm. JWST was successfully launched on December 25, 2021, aboard an Ariane 5 launch vehicle. All 50 major deployments were successfully completed by January 8, 2022. The observatory performed all mid-course correction maneuvers and achieved its operational mission orbit around the Sun-Earth second Lagrange Point. All commissioning and calibration activities have been completed and JWST has begun its science mission. Its present performance meets or out-performs all requirements. Launching over 20 years after its mission concept review, the JWST Observatory is a first and only of its kind of facility. This program faced many unique challenges that were not only technical in nature but also organizational and managerial. We describe the challenges faced by the JWST systems engineering team, the way the team addressed them, and make recommendations for focus areas of future flagship missions, which will likely face similar challenges. It will not explicitly address the cost challenges of the mission. We first describe the mission and its over-arching challenges. We then describe the tailoring of systems engineering processes and methods used to address these challenges and effectiveness. The events, tasks, issues, and their resolutions and the resulting specific lessons learned from the project are discussed with the over-arching recommendations for future flagship missions that derive from these lessons.


Introduction: The Mission and the Challenges
The James Webb Space Telescope (JWST) mission was conceived in 1989 1 as a successor to the Hubble Space Telescope (HST) to investigate the early universe with a goal to detect "first light objects," to study the evolution of galaxies from first light to the present day, and to study star birth and the evolution of solar systems in our own galaxy.Later, since the system design of JWST was assessed to be capable of observing exoplanets without an impact to the hardware's design, a fifth science objective was added to include investigations of some of the roughly 5000 currently known exoplanets.
These science objectives required a 6-m class infrared optical telescope element (OTE) and science instrument payload cooled to cryogenic temperatures of 55 K or less.The science mission calls for imagery and spectroscopy in the near-infrared (NIR) band from 0.6 to 5 μm, and in the mid-infrared (MIR) band from 5 to 28 μm.Four science instruments (SIs) were selected; the near-infrared camera (NIRCam) from the University of Arizona, the near-infrared spectrometer from the European Space Agency, the mid-infrared instrument (MIRI) from the European Consortium (EC), and the Jet Propulsion Laboratory and the fine guidance sensor (FGS)/near infrared imaging slitless spectrometer (NIRISS) from the Canadian Space Agency (CSA).The OTE and spacecraft element (SCE), which provide the traditional subsystems; command and data handling (C&DH); electrical power subsystem (EPS); telecommunication subsystem (COMM); attitude control subsystem (ACS); propulsion subsystem; and thermal control subsystem (TCS) were provided by Northrop Grumman (NG) and their subcontractor Ball Aerospace.A hierarchal diagram of the JWST system is shown in Fig. 1.
The JWST observatory was designed to operate at the Earth-Sun second Lagrange (L2) point for a minimum science mission life of 5 years and a goal of 10 years.Arianespace's Ariane 5 Launch Vehicle was selected to launch the observatory and insert it into a direct inject trajectory to a 180-day orbital period around the L2 point.Since the deployed configuration of the observatory far exceeded the volume of the Ariane 5 fairing as well as any other available launcher fairing, the observatory was folded for launch and underwent a complex series of deployments on its way out to the L2 point.The Observatory is summarized in Fig. 2.
Science and mission operations are conducted from the Space Telescope Science Institute (STScI).Low data rate S-Band command and telemetry and high data rate Ka-Band science communications with the observatory are provided by the NASA deep space network (DSN).The JWST mission is graphically summarized in Fig. 3.
JWST passed NASA's Mission Confirmation Review (MCR) in 1996, but this review predates the current project lifecycle review process. 2 The first contract awards to develop designs occurred in 1998, which began the formulation phase.Implementation of the JWST project began with the NASA review, key decision point C (KDP C), and the mission preliminary design review (PDR) in 2008 and continues now into science operations, phase E. The phases of the JWST project are shown in Fig. 4, along with the dates of major reviews.
The Observatory, shown with the launcher in Fig. 5, was successfully launched aboard its Ariane 5 heavy-lift launcher on December 25, 2021, and completed all 50 complex deployments by January 8, 2022.It was inserted into its L2 orbit via a second mid-course correction thruster burn on January 24, 2022.
All commissioning and calibration activities were completed on schedule and the first Early Release Observations were released to the public on July 12, 2022.The Observatory has Fig. 1 JWST system hierarchy.
been operating since, executing its "cycle 1" science programs at performance levels better than requirements.In particular, the optical performance of the Observatory is roughly twice as good as required. 3The Observatory was required to be diffraction limited at a wavelength of 2 μm and is currently diffraction limited below 1.0 μm at the "designed to" NIRCam field points.
The Observatory is truly a "first of its kind," as illustrated by a comparison to its NASA predecessor flagship, the Hubble Space Telescope.This comparison is shown in Fig. 6.This figure indicates some of the significant challenge areas that confronted the engineering team.The challenge of meeting science requirements was complicated by the limited margin resulting from the mass and volume capacity of launchers available at the time of the formulation of JWST.Although the JWST project experienced issues with funding, the programmatic lessons learned are not explicitly address in this paper.The cost challenges of the mission can be found in, "Breaking the Cost Curve: Applying Lessons Learned from the James Webb Space Telescope Development" by Feinberg et.al. (SPIE 10698.2018) for lessons learned applicable to this area. 41 Size, Stability, and Cryogenic Temperatures Radiometric sensitivity drove the primary mirror of JWST to have an aperture >6 m in diameter.The radiometric sensitivity and MIR straylight requirements require low detector noise levels and low thermal emissions from the telescope's fore-optics.Operational temperatures for the fore-optics must be below 55 K, and for the NIR SIs, which use HgCdTe detectors, must be below 45 K.The MIRI, using an arsenic-doped silicon (Si:As) detector, must be cooled to 6 K. Given the mass and size of the 6.6 m diameter primary mirror, the only option that yielded an observatory of a large enough size for the science objectives with a low enough mass and volume for available launch systems was a design with a passively cooled OTE and NIR SIs.This was accomplished by giving them good views to cold space and insulating them from solar  illumination via a sunshield.To effectively shadow the OTE over the science-specified field-ofregard (FOR), 5 the sunshield must be approximately 15 m wide by 21 m long, about the size of a tennis court.NIR detectors are passively cooled using cold space radiators, and the MIRI detector is actively cooled using a dedicated cryocooler.Such large-scale passive cooling requires a highly effective insulating sunshield, very detailed design, analysis, and characterization of all parasitic heat paths, and sufficient cryogenic radiator margin to cover their uncertainties.The stability of the NIR point spread functions (PSF) is specified in terms of an encircled energy (EE) stability over time periods of 24 h and 14 days.Given the technical and program constraints, including the lack of mass and volume margins, we decided to address this requirement without using more complex active control systems.Therefore, the observatory was designed to provide structural-thermal stability as it slewed through its various attitudes in the FOR.This presented challenges not only for the design but also for the tests and analyses necessary to verify the level of stability.

Mass Constraints
Early estimates of the mass of the observatory showed that margins against the lift capability of the available launchers for direct injection transfer trajectories would be tight.Since mass is the "currency" used by spacecraft engineers to solve problems, this constraint is coupled to many of the other design challenges.Low mass margins often result in a more integrated architecture, where interface influences are not independent across functional interfaces.Traditional methods of dynamic, thermal, and electrical isolations between elements and interfaces had to be balanced against their cost in mass.Such coupling results in the need for more detailed integrated analyses to compute performance since modifications to one subsystem could have significant impacts on others.The overall complexity of the system meant the integrated models had a large number of nodes and integrated modeling cycles took many months.

Size: Deployment Challenge
An Observatory of this scale could not fit into the volume of any of the largest available launcher fairings, all of which had diameters of about 5 m.This forced folding the observatory for launch and unfolding it on-orbit in a series of complex deployments.Several deployable components, such as the sunshield, were very tight on volume clearances, which further constrained their designs and led to more complex deployments.Such deployments have inherent reliability risks since they necessarily involve many mechanisms that are potential single point failures (SPF).In many of these deployments, JWST relied on Ensign-Bickford Aerospace & Defense Company (EBAD) non-explosive actuator (NEA), to provide a low-shock method of releasing items from a launch-locked condition prior to being deployed into a flight condition.These devices and verification of these single use items are discussed later in this paper.In addition, deployments of items such as a flexible "non-deterministic" sunshield membranes and cables pose risks of unintentional snagging and tearing and must be carefully managed and controlled during all stages of the deployment.Furthermore, the testing of such large deployments requires very complicated ground support equipment (GSE) to provide effective gravity off-loading during all the configurations of the observatory experienced during all steps of the deployment.

Performance Verification
Its size, mass, and range of temperatures (approximately 280 to 400 K on the hot side of the sunshield, 55 K or less on the cold side) make any flight performance tests of the fully assembled observatory impractical.This challenge was realized very early in the mission formulation. 6The verification of on-orbit performance requirements must therefore ultimately rely upon analytical integrated models of the observatory, assembled from element or subsystem models that are correlated or validated by tests at these lower levels of assembly for metrics, such as cryogenic margin, optical stability, straylight, and pointing performance.This approach must carefully allocate performance margin for interface interactions between these parts, which are not correlated or validated by these individual tests.In addition, the performance degradation due to workmanship must be estimated and covered with acceptable margin allocations or bounded by Observatory level workmanship tests.This effort elevates the importance of the integrated systems model and analysis over and above that of its traditional role as only tools for trade studies and design evaluation.

Systems Engineering Methods
As with any new and unique space mission, many systems engineering processes are tailored to meet the challenges.This section describes this tailoring and its effectiveness for addressing these challenges.The resource challenges of JWST, mass in particular, led to an architecture that is often described as "highly integrated" to mean that the interfaces between subsystems and key assemblies are often not simple and/or "clean."For instance, some functionality that would normally be in one subsystem is instead in another subsystem that provided it with less mass penalty even though it was a more complex design.An example of one subsystem interacting with another subsystem is where a thermal interface between the two subsystems is not a uniform temperature.The result is that the interface definition requirements must include gradient accommodations in temperature or in dimensional changes with temperature.In a highly interacting system, a change to one subsystem or assembly can typically have significant effects on the performance of others.Such architectures are best served by systems engineering processes that are tailored to manage trade studies at the system level.

Systems Engineering Organization
A systems engineering team (SET) is typically organized in hierarchically, structured along product lines to streamline financial reporting.Therefore, it usually parallels the organization of the work break down structure, which has obvious advantages since work authority must follow the funding.This, however, can lead to a phenomenon called "stove-piping" that can be detrimental to the development of a highly integrated architecture.Individual teams tend to focus only on optimizing their products rather than optimizing the performance of the system.Many of the complex and challenging problems for JWST required working groups that contained the relevant subject matter experts from the individual product teams, as shown in Fig. 7, to work in unison outside the traditional product boundaries for their solution.
There were over 20 permanent working groups formed as part of the JWST SET and several ad hoc groups to address the various systems problems that arose.Among the permanent working groups were the mechanical, electrical, line of sight (LOS), deployment, software, thermal, jitter, contamination control, electromagnetic interference/electromagnetic compatibly (EMI/EMC), optical and electrical power.
A working group approach yielded key benefits in the solution and management of mass and thermal margins as described in the following sections.
The use of working groups is common in the NASA systems engineering process, but it may not be familiar to companies that typically build systems for Department of Defense (DOD) customers, as the DOD prefers more compartmentalization.For NASA-contractor partnerships, it is important that the significant contractor participation in such groups be properly planned in their initial manpower estimates.

Trade Study Methods
Trade studies and their methods are well documented and are common to the systems engineering discipline.The method of performing trade studies used by the JWST SET was a tailored from requirements and guidance from NASA Standard NPR 7123.1D 7that was tailored to meet the needs of the project and its diverse set of partners.Beyond the unique partnerships, there were two factors that complicated JWST trades: (1) the highly integrated nature of the JWST architecture, and (2) the fact that many of the initial trade studies were conducted concurrently.
These complications were addressed with a centralized systems engineering organization that had the final approval for most technical trade studies.A flow of this methodology is shown in Fig. 8. Segment, element, and lower-level trades are formulated by the responsible organizations and reviewed by the SET for their compatibility with overall system goals.Then, the SET ensures that all stakeholders are identified for their inputs into the trade.It is up to the SET to determine if data critical to systems performance assessments that should be produced as part of this trade.When complete, trade results are reviewed and assessed by the SET to determine their impact to overall systems performance.Finally, the SET updates the system baseline documentation as required.
The first, and perhaps most important, feature of this methodology is for systems engineering to control the systems baseline, the technical description of the functions, resource allocations and their best estimates, performance estimates, element and subsystem designs, and their interfaces.At any moment, the baseline may not be optimal or even adequate, but it should be selfconsistent in all its defined interfaces and subsystem interactions.Trade studies are defined to improve or correct deficiencies in this baseline and are reviewed by the systems team for technical and schedule risks and for cost-growth avoidance.Trade plans are formulated and reviewed to make sure that trade options are coordinated with other on-going trades and ascertain whether any options are inconsistent with the options of these other trades.Using the system baseline, the systems team identifies all the potential stakeholders and ensures they are members or reviewers of the trades study.
Finally, the systems team reviews the resulting assessments from the trade study team.These results should be organized as an assessment and rating of the various options.For a highly integrated architecture, it should be the system team that makes the final decision, based on the systems level performance assessments or presents this trade to a board of system level program management, mission assurance, and systems engineering for programmatic and risk-based trades.This can most easily be illustrated in the various trades to address the mass margin recovery. 8For example, there were many subsystem options that minimized the mass of the subsystem within their requirements but that used options that were less than desirable for the system perspective.One such option was the elimination of one reaction wheel assembly (RWA).Eliminating one RWA would to bring the attitude control system under its mass allocation, but this option was highly undesirable from an Observatory system-level perspective due to the reduction of redundancy of a limited life and critical component.
Since the system engineering team coordinates and reviews these trade studies, it is the responsibility of that team to track the various concurrent trade studies and make sure the relationships between their options are well understood.Figure 9 illustrates one of the diagrams used by systems engineering to depict the relationships between various concurrent trades and the narrowing down of the various trade spaces.It also depicts the order in which trade decisions needed to flow, some with nested decisions.In this figure, the green boxes indicate the solution preferred by the subsystem team performing the trade, but the yellow indicates the selected option.The difference was choosing between a trade outcome that benefited the subsystem vs the trade outcome that benefited the overall element or observatory.Often, these trades involved risk-based factors.In the flow, the last trade was made in light of all the preceding trades and decisions.
This top-managed approach to the decision analysis process was used in these trade studies and helped to evaluate each trade option for technical, cost, and schedule issues; alternatives; and various uncertainties related to each option.It afforded the JWST management team the opportunity to minimize technical risk, schedule risk, and avoid cost growth while satisfying the uncountable intangible factors that crossed every decision.These included federal budget funding profiles, mission assurance factors (i.e., part reliability/manufacturability), schedule aggressiveness, international partnership constraints, staffing, and allocation of expertise.

Integrated Modeling
Performance predictions of the JWST observatory relied on a set of coordinated analytical models and methods, referred to as integrated modeling.Figure 10 shows the various inputs to system of models and the interfaces between the models and the outputs.The specifics of these modeling processes are contained in Refs.9 to 18.
An integrated modeling working group under the mission systems engineering organization was responsible for the management of this process.Individual product teams delivered their respective models, such as the OTE thermal, structural, and optical models, and those models were integrated into the various observatory models by the various discipline working groups, such as the optical, thermal, and mechanical working groups.The integrated modeling working group that oversaw this work developed model guidelines and interface documents for these individual models.
The overall process of assembling the various models and running the model cycle took between 3 and 6 months.Therefore, the running of the full integrated modeling process, as depicted in Fig. 10, was organized in discrete cycles, in much the same way as conventional couple loads cycles are run.During the JWST implementation phase, twelve full integrated modeling cycles were executed.A typical cycle process is depicted in Fig. 11, which shows the modeling cycles performed in preparation for the system definition review (SDR).
A typical cycle involves the definition of the specific goals of the cycles, which, in the early phases of JWST development, usually involved the performance assessments to support the trade studies being conducted.Specific systems configurations were defined, being combinations of the various trade options as recommended by the individual trade study teams.In addition, the scenarios for the cycle would be defined.An example of such a scenario would be the case of computing the wavefront error (WFE) change for the optical system between a two observatory attitudes, which produced distinct thermal conditions across the observatory.The system models were assembled and debugged according to the guidelines established by the modeling working group.The systems models were then "frozen," and the full analysis run.In parallel with these Fig. 10 The JWST integrated modeling process.
efforts, the various design teams would be defining alternate designs that, in conjunction with the results of this cycle, would form the plans and objectives for subsequent cycles.
The integrated modeling working group also defined the requirements for the tests that would ultimately be used to validate the final system models used for the final verification of system performance.Many requirements where specified as "on-orbit performance" meaning the performance had to be calculated for on-orbit conditions if those conditions could not be simulated on the ground, which was often the case.For example, JWST Observatory level optical alignment and WFE were not able to be measured and compared directly to requirements in a ground test because the on-orbit thermal and gravity environment could not be adequately simulated in ground test.The performance requirements that needed to be verified by an analysis were identified by the SET and methods to validate the models through ground test were developed.Dedicated engineering peer reviews were conducted with independent subject matter experts to review these validation plans.Further information on the modeling and validation of those models can be found in Refs.19 and 20.

Technical Performance Metrics and Margin Management
The definition of specific technical performance metrics (TPMs) to monitor the health and performance of the system as it is developed is standard systems engineering practice for NASA.For JWST, there were thirty-four such TPMs that were defined and tracked over the development life cycle, as shown in Fig. 12, which shows not only the final pre-launch predictions of the metrics but also the post-launch, on-orbit measurements as presented at the post launch assessment review.
The selection of these TPMs was derived from the primary objectives of the mission.The guidelines for managing many of the mission design or performance margins over the lifecycle reviews did not fall into standard definitions from Goddard standards 21 or aerospace system engineering standards, such as those from American Institute of Aeronautics and Astronautics (AIAA). 22In these documents, mass, power, radio frequency (RF) link, and propellant have well established guidelines for margin, developed over hundreds of missions.These documents do not provide clear metrics that apply to the cryogenic heat rejection margin that should be carried on a 3-metric ton passively cooled cryogenic system, or NIR and MIR stray light into an instrument's optical system or LOS stability.The SET had to develop guidelines for these metrics to use on JWST.These margins were developed by considering the uncertainties of the key parameters, uncertainties for the fidelity of the as-modeled physics, uncertainties for the deviation of the actual as-built hardware due to workmanship, and uncertainties from the verification and model validation tests.
An example of the formulation of the cryogenic margin for the NIRCam radiator is shown in Fig. 13, which also shows how this margin changed once thermal models were validated by tests.Similar budgets were generated to define stray light margin, LOS, and thermal drift stability.
Performance margins had to be large enough at any given time to accommodate the uncertainties with enough left over for the unknown-unknown errors that always crop up in any space mission.Metrics that had margin to accommodate this were rated as "green."Metrics that had margin over the required performance but not enough to cover all the uncertainties were rated "yellow" and those that had negative margin relative to the requirements were rated "red."This process was successful as, at the time of launch, all performance margins were acceptable and rated at "green."The on-orbit performance seen to date on JWST cannot fully confirm that all parameters are successfully achieved as many of the requirements were include lifetime effects on materials and coatings and are not fully known until the specified full-performance lifetime of five years.

Design and Management of a Non-Standard Verification Program
Because the JWST was inherently untestable as an integrated observatory, its verification involved a very complex interplay between tests that would validate element or subsystem analytical models, and the final analyses using observatory models integrated from these lower models.The highest levels at which these validation tests were conducted were split along temperature lines.The OTIS (the cryogenic "super-element" assembly of the OTE and ISIM) was tested at cryogenic temperatures at the NASA's Johnson Space Center (JSC) "Chamber A" facility, and the SCE (spacecraft bus + sunshield) was tested at more typical "sun-facing" temperatures at Northrop Grumman's test facility, as shown in Fig. 14.The formulation of this program involved considerable effort, and future flagship observatory programs will need to understand the complexities to adequately plan for the effort of developing a non-standard verification program to ensure that system risk is minimized by verification in the appropriate environment and test-validated models.As part of such a program, very strict attention must be paid to the integration and configuration management of the observatory analytical models to make sure that they always conform to the configuration of the "as-built" hardware.
The verification program must also consider that analytical models do not model many of the assembly workmanship errors associated with the final observatory integration.For JWST, these were addressed as   Many of the observatory tests fell into the category of the latter.The observatory level sinevibe test was one such example.The OTIS and SCE sine-vibration tests independently qualified the assembled element for dynamics loads that would be experienced during launch.In addition, measured accelerations of structures during these tests were used to validate the structural models of each system element.The observatory sine vibe test established that the workmanship of the observatory level integration was within acceptable bounds.
Portions of the OTIS cryogenic test also checked both detail design features and workmanship of the OTE to ISIM integration.Tests were specifically designed to verify that the structure supporting the telescope primary mirror segments was stable and predictable in the integrated system.In this testing, influence was seen from shrinkage of a "soft-structure" stray light shielding.This was the Kapton film used to block light paths from passing from behind the telescope into the optical train.This film was connected to the stiff carbon-tube structure supporting the mirror actuators and flexures, but tension in the thin film could be seen in the WFE of the system.It was discovered that the drawings and integration procedures for this soft-structure needs considerable design and integration process review to ensure slight workmanship level features do not impact the system's performance.Since this issue was found late, during final cryogenic optical testing, slack had to be added to avoid a significant WFE instability with changing temperature of the blanket material in space at operating temperature.Also, the final optical tests during the OTIS cryo-vacuum test also uncovered the criticality of thermal strain in the cryogenic harness from the ISIM Electronics Compartment (IEC) to the primary mirror backplane.This harness strain causes stress and consequent unintended strain in the backplane resulting in a cyclic instability due to heaters cycling on and off in the IEC.After the JSC test, strain into the structure was reduced by allowing the service loop in the harness to have maximum compliance to minimize this cyclic effect, but it did not eliminate it entirely.This residual strain induced by the harnesses and seen when the heaters cycle results in a small instability that is now the limiting performance driver for exoplanet transit science, so any effort to reduce harness cable strain proved to be worthwhile.Cabling, similar to soft structure, needs additional attention during design and integration to avoid imparting stress and strain into highly sensitive structures supporting optical systems.

Failure Modes and Effects Analyses and Workmanship Risks
Due to its complex deployments, JWST had many SPF items for a Class-A NASA flagship observatory.A total of 344 SPF items were identified, 295 associated with deployments, and the majority of these in the sunshield.Reliability engineering and systems engineering therefore devoted considerable attention to failure modes and effects analyses (FMEA) of these SPFs. 23his was particularly true of the many release mechanisms and the NEA devices that were incorporated into them, such as the membrane release devices (MRDs) for the sunshield.Following a test anomaly of the 1/8" NEA used to restrain the sunshield for launch, an extensive FMEA was conducted that revealed many previously unknown failure modes of these devices.Many of these modes involved the way in which the two redundant fuse wires that release the device reacted.A detailed understanding of the failure modes led to a minor change of the fuse configuration for the JWST 1/8" NEAs as well as the changes to its assembly procedures and mandatory inspection points.
These FMEAs were also conducted for the other NEA designs used for JWST and revealed that most of these failure modes lie in the final assembly and installation of many of these release mechanisms.To mitigate the risks from these failure modes, the project conducted a "process FMEA" of the assembly of these NEAs.The results of this effort resulted in new tools and assembly machines that removed the variabilities that previously existed in the "by-hand" assembly process, replacing them with the more deterministic methods with controlled tolerances.This was particularly the case with the winding of the restraining wire of the ¾" NEA, used in the launch release mechanisms that held the 3000 kg OTE and ISIM to the spacecraft during launch.
The results of the FMEA also led to the incorporation of the review of video and photographic records of the final installation of these devices into the observatory.Details of these mitigations is provided in Ref. 23.

JWST Systems Engineering History
This section documents the history of the system engineering events, tasks, and issues from system pre-formulation, through formulation, implementation, and commissioning, to show how the various methods described in Sec. 2 were leveraged.This section also describes the specific lessons learned from these experiences.

Life Cycle Timeline
An overall description of the history of the JWST from its inception to current science operations is described in Ref. 24.This section augments that description with the key systems engineering events and activities that took place over the JWST life cycle.Figure 4, back in Sec. 1, illustrates the top-level timeline of this life cycle, which generally followed a standard sequence of activities and reviews for a NASA Flagship Mission during formulation and implementation phases.There were, however, some deviations from this that deserve some description.
Maturation of the new technologies that were required for this mission, culminated in a technology non-advocate review (T-NAR) that was held in January 2007.This review was to assess that all critical technologies were at a technical readiness level (TRL) of six or higher.A TRL-6 means there has been a successful demonstration of a system, subsystem model, or prototype of the technology in a relevant environment.This T-NAR reviewed the readiness of the 10 technologies shown in Fig. 15.All technologies but the heat switch technology were eventually flown on JWST.The heat switch did not fly because it was later found not to be required by the design.The T-NAR was an invention of the JWST program.Normally per NASA policy, a technology readiness assessment is part of the non-advocate review (NAR) that is held in close conjunction with mission PDR.Replanning in 2006 shifted mission PDR and NAR to March 2008, but the JWST project had committed to reaching TRL-6 for its enabling technologies by January 2007.Therefore, the T-NAR was conceived as a separate review consisting only of the technology assessment portion of the NAR to afford a proper and timely assessment of technology maturity.Beyond the typical technology assessment criteria, the approach to critical enabling telescope technologies was particularly stringent and included detailed whitepapers and independent reviews by the telescope product integrity team (PIT), a group of international experts in telescopes and optics that included the former chairs of the University of Arizona Optical Sciences Center and the University of Rochester Institute of Optics.Because of this early and rigorous approach, the flight telescope development had no technological issues, and the use of the independent review team was considered by JWST management as a value-added review process.
Second, due to funding profile constraints, the project deferred development of the spacecraft bus and consequently delayed the bus critical design review (CDR).The bus development was considered low risk relative to the other observatory elements, and so a delay in its development would be acceptable.However, for system risk reduction, the project concluded that a CDR of the mission-level system should remain on schedule to provide time for any corrections from the review board to long lead elements, such as the OTE or integrated science instrument module (ISIM), thus putting the bus CDR out of sequence after the mission CDR.To address this conundrum with the mission-level system CDR, a "regression-type" systems level review, termed the systems look-back review (SLR), was conducted after the spacecraft bus CDR to ensure that the system impacts from actions of this review were properly incorporated.
The formulation phase, which began at the official start of the JWST project and ended with PDR, included approximately seventy trade studies, spanning all segments (ground, flight, and launcher) of the system.Conducting many trades during the formulation phase is expected from a system engineer's perspective, but there continued to be a large number of trades occurring during the subsequent implementation phase and, most notably, trade studies continued after the SLR.These trades were undertaken to address problems, many of which were discovered between PDR and SLR.In retrospect, this late discovery of problems should have been expected for an observatory as radically unique as JWST.Most of these later trades addressed issues in the following areas, many of which align with the challenges that were listed in Sec. 1 and were anticipated early in the project: 1. Low mass margins 2. Low cryogenic radiator margins 3. Low stray light margins 4. Testing methods (test methods and facilities) 5. Venting 6. Deployment and mechanism reliability 7. Behavior of soft structure The three areas where the risk was unforeseen at the start of JWST were the low stray light margins, venting, and the behavior of soft structure (membranes, blankets, etc.).The number of "late" trade studies and their relatively large scope is an indicator of the complexity of JWST and of deficiencies inherent in the standard engineering process to provide detail on the more driving issues early.The saying the "devil is in the details" became highly apparent on JWST.As mentioned previously, the standard engineering processes assumed that subsystem designs and performance were largely independent at their interfaces.The details of these dependencies were where the difficulty came.
The observatory was launched on December 25, 2021, which started the 6-month long commissioning process.This is shown in Fig. 16.Although there were anomalies experienced during commissioning, they were not unusual even by "ordinary" mission standards and the process was much smoother than anticipated.All critical operations were successfully completed, and the observatory started conducting cycle 1 science operations after the release of its early release observations on July 12, 2022.To date, the observatory performance has met or is better than all of its requirements.

Architecture Trade Studies
Unlike many of the previous space-based astronomical observatories, JWST did not have similar predecessor missions to leverage and therefore pre-formulation started from an essentially blank sheet of paper.The CDR-level JWST architecture was a result of many important trade studies that had been conducted in the years leading up the system CDR in April of 2010.Forty-four trades were conducted from MCR through CDR.Eleven more were conducted from CDR through SLR.A hierarchical list of the major trade studies is shown in Fig. 17.
Many of the initial trades were obviously needed, such as the trades to define the mission orbit, the sunshield configuration, the OTE optical materials and structural design, and its interfaces to the ISIM.What is not obvious is some of the complex interactions between many of the trade options.Because of the mass and volume limitations as well as the many complications due to the cryogenic nature of the observatory, many of these trades were highly coupled.This highly coupled nature required special attention on the part of systems engineering as did the fact that many of these highly coupled trades were being conducted concurrently.As hardware designs matured and model fidelity improved across all JWST subsystems, it was necessary to revisit several trade studies.These studies, initially conducted based on early models, had to be repeated due to the discovery of key performance margins being too low.This was particularly true of the ISIM radiator trades to determine the area and configuration of the radiators that passively cool the science instrument detectors.This trade was also coupled to the ISIM electronics compartment (IEC) trade that concluded that focal plane electronics, which were designed to operate at room temperatures, were best located on the cold side of the observatory to reduce electronic noise levels and provide an OTE-ISIM configuration more conducive to verification by a single cryogenic test.The accommodation of room-temperature electronics on the cold side of the observatory was no small matter.Parasitic heat leaks are notorious risks for cryogenic systems, and one consisting of more than 3000 kg of hardware that relies on passive radiative cooling must have sufficient cooling margin to address these risks.
The eleven trades conducted between CDR and SLR touched all subsystems of the observatory and were entitled:

OTIS test configuration refinements
Transportation changes All of the system trades resulted in an evolution of the JWST observatory from its initial "Strawman Yardstick Design" used to establish the feasibility of the initial requirements, to the configuration ultimately presented at the SLR.This evolution is shown in Fig. 18.
In addition, there were trades performed in reaction to growing systems costs.Among these were the Science Assessment Team 25 trades, which considered how relaxation to science requirements could mitigate growing cost risks.These trades resulted in the relaxation of certain image quality requirements such as the diffraction limited image quality from 1 to 2 μm, the PSF ellipticity requirements, and PSF stability.
Finally, there were a series of trades to define the verification program, and, in fact, the test configuration had several major iterations of architecture.As described in Sec. 1, JWST verification could never be based solely on test, but rather needed a complex combination of tests and analyses.Following lessons learned from HST, significant attention was levied on the optical tests that would prove this design was flight worthy.The complexity of these tests was due to the sheer size of the observatory and the reality that the optics would only align correctly at cryogenic temperatures.Therefore, trades not only had to consider the specific optical tests and the equipment necessary to conduct them but also the thermal vacuum facilities that could accommodate these tests.
Two very large thermal vacuum test facilities were considered, both of which would require significant modifications to accommodate these cryogenic tests.The first was the Plum Brook Thermal Vacuum Facility, now known as the Armstrong Test Facility, at the NASA Glenn Research Center in Sandusky, Ohio, and the second was the chamber A facility at the NASA JSC in Houston, Texas.The study team selected the JSC chamber A facility because it best met the test capability criteria, accommodation, cleanliness, and even access to the facility from an airport capable of accommodating the C5 Galaxy Transport Aircraft and the JWST transport container, aka "space telescope transporter for air, road, and sea" known as STTARS.But even after this selection, there were considerable trades performed to define the final test configuration of the OTIS.In the end, the study team selected a test configuration that suspended the JWST OTIS from the ceiling of the chamber pressure vessel itself in a "cup-up" configuration, meaning that the primary mirror was pointing upward.The optical test equipment used a center of curvature interferometer to prove the segmented primary mirror could be properly phased, along with a series of tests using three auto-collimating optical flat mirrors with sources at the Cassegrain focus the OTE to prove the overall prescription of the optical train was correct.A photogrammetry system 26 was used to verify key alignments, fiber-fed sources were used at the Cassegrain focus looking both up and down, and phase retrieval algorithms used in the wavefront sensing and control were employed in "pass and a half" and "half-pass" end-toend optical tests. 27

Trades During Integration and Test
The Observatory Integration and Test (I&T) Program for JWST, shown in Fig. 19, consisted of parallel efforts the I&T of the OTE and ISIM (i.e., OTIS), I&T for the spacecraft bus and sunshield (i.e., the SCE), and the Observatory.This I&T period saw a tail-off of the more traditional trade studies, but systems engineering efforts continued to address issues that surfaced during this period.Trades were performed to address the following issues:  In addition to the trades needed to resolve these I&T issues, there were also two system/ observatory level trades that were conducted late in the I&T phase.These were: 1. Venting of the launcher during assent to mitigate rapid depressurization at fairing jettison.2. Investigation of proximity avoidance between the JWST and the Ariane upper stage following its disposal maneuver.
In addition, there was also an effort on the part Ariane to solve issues it had with the dynamics of the fairing jettison, which had grounded the launcher for approximately 8 months.

Design Issues
In the context of this paper, an issue will be defined as an unforeseen problem, one that surfaced as the design progressed.There were two categories of such issues.The first described in this section are those that surfaced during the design phase of the observatory, and second, described in the next section, are those that surfaced during the I&T phase.Many of the design issues were highly coupled, particularly with mass.

Mass design issues
The estimated mass of the observatory went through the typical episodic increases as the design matured, usually at or right before key system level reviews.However, shortly after the early Mission Confirmation Review, the mass margin plunged precipitously, and, for the rest of the program, mass margin was low. Figure 20 shows the mass margin evolution for the project, with the left graph showing the early evolution where margin dove from an estimate above 50% to an estimate lower than 25%.The graph on the right of the figure shows the evolution from SDR through I&T.These graphs show that once the more detailed project engineering started the mass issues became evident, and the project was challenged for the duration as measured by well-established normal margins at each milestone review set by NASA and the AIAA.One of the more significant drops in margin occurred between CDR and SLR when a thermal issue surfaced, as described in Sec.3.4.2.
There were multiple system level mass-reduction efforts over the development life of the program, all associated with the major design reviews (systems design review, preliminary design review, CDR, and the systems look-back review).The mass recovery efforts and their associated issues involved: Fig. 20 JWST mass margin evolution during the project.
1. Detailed re-estimates of the mass, often referred to as "pencil sharpening" to make sure they were correct and to understand in detail the error bars or uncertainty factors that were applied.2. Similar re-evaluations of the launch vehicle capability and whether there were trade options to increase this capability.3. Architecture level mass-reduction trades.4. Component level mass-reduction trades that usually involved light-weighting components by altering materials or eliminating unnecessary structure.
An example of item 3 above, an "architecture level mass-reduction" trade, is the trade that evaluated the use of a helium dewar against the use of a cryocooler to actively cool the MIRI detector.The selected cryocooler offered a systems level mass savings of over 200 kg while maintaining the capability to cool the MIRI detectors for the life of the mission (not to mention affording safety and I&T advantages as well).A second example is a serendipitous architectural decision for mass margin centered around the first mid-course correction (MCC-1) maneuver.To avoid engineering and contamination issues, no thrusters were on the cold side of the observatory, so JWST did not have the capability to thrust toward the sun.Therefore, the Ariane 5 launcher was required to "aim low" to cover a 3-sigma over-burn launch dispersion to insure only burns away from the sun would be required after separation from the launcher.The MCC-1 maneuver performed by the observatory would make up the energy difference, and in doing so realized a staging efficiency, thus yielding a net mass savings.

Thermal design issues
Radiative passive cooling of the approximately 3000 kg OTIS was the only practical option, and parasitic heat leaks are notorious risks for even moderately ambitious space borne systems.Therefore, the SET paid very special attention to making sure that the observatory had an adequate area of cryogenic radiators to cover these parasitic heats loads as well as the efficiently uncertainty.At JWST's launch, the thermal uncertainty would remain large as the verification program never thermally tested the observatory in its fully integrated state.The actual parts of the thermal verification program had the cryogenic side of the observatory tested in the chamber A facility of JSC, the spacecraft bus and stowed sunshield tested in the NG M4 thermal vacuum facility, and the insulating performance of the sunshield computed from thermal models that were validated from tests of one-third scale engineering test unit of the sunshield.Since the region between the spacecraft bus and the OTE, called the "core" region, was an extremely thermally complex region with multiple thermal interfaces, a full-scale engineering model of the core region was tested.The analytical models for these portions of the observatory were validated by these tests and then integrated into an observatory model used to verify that the OTIS would reach its required cryogenic temperatures on-orbit.Aside from the intrinsic uncertainties, such models do not model the possible workmanship errors.Any heat leaks resulting from these errors would represent a threat against the final performance and these were addressed by carrying additional radiator margin.
The SET allocated requirements for the cryogenic margin necessary to cover this piecewise verification and formulated a "burn-down" plan for lowering this margin as more test data were accumulated to lower the uncertainties.The SET tracked this margin carefully over the course of the development as well all the thermal liens and threats against it.As with the mass margin, the decline of the cryogenic margin was episodic, showing decreases as detailed engineering proved that potential threats were in fact highly likely or certain.There were multiple recovery efforts to increase the cryogenic margin to desired levels.
The last of these efforts occurred between the CDR and SLR.Deficiency in cryogenic margin was evident at the CDR and was the source of a significant concern.Following CDR, the margins continued to decrease, and the worst-case margin exhibited by the FGS radiator was estimated to be negative.Figure 21 shows the cryogenic margin evolution during this period.The solution to this was the addition of considerable radiator area on the top of the ISIM enclosure.This additional radiator area was only accommodated by using a deployed assembly, the aft deployed ISIM radiator (ADIR), shown in Fig. 22.This solution came not only with another complex deployable but also with a significant mass cost, as also shown in Fig. 22.In addition, as part of this thermal design update, cryogenic margin requirements and calculation methodologies were updated and margins on heat loads were segregated from the margin on needed passive cooling capability.The radiator changes, in combination with the updated requirements and margin calculation methodology, proved to be very robust to the natural margin degradation experienced during I&T.

Stray light design issues
From the beginning, it was difficult to meet the stray light performance for JWST using NASA's traditionally recommended margin factors of 5 to 10 times lower than required for stray light levels predicted by analyses.The primary sources for stray light, and therefore the primary threats and liens to be addressed by these margins, were different in the NIR and MIR wavelengths.
NIR stray light levels are dominated by scattering of starlight from contaminants on the optical surface and from "sneak paths" of light from the sky through the system to the detectors.Figure 23 illustrates two such sneak paths, called the truant path and the rogue path.The truant path is one where light coming from the sky in the aft direction passes over the perimeter of the primary mirror and scatters off the secondary mirror, entering the optical train.The second, called the rogue path, is a direct path of light from the sky over the secondary mirror into the aft optics subsystem's Cassegrain aperture and directly impinging the pick-off mirror region of the instruments.
MIR stray light levels are dominated by observatory thermal emissions, as heat from observatory components with a clear view to the optics were the primary sources of MIR stray light.Much of the MIR stray light recovery was achieved as a result of the trade studies performed to resolve a baseline design with lower thermal margin, which generally lowered temperatures of primary MIR sources to acceptable levels.The MIR path into the optical train is also shown in Fig. 23.
Stray light control was achieved by three general methods: 1. Control of the temperature of key observatory surfaces to limit thermal emission in the MIR wavelengths; 2. Contamination control to limit stray light scattering off the optical surfaces; 3. Shielding of key stray light sources or paths from the optical elements.
A key lesson learned in the area of stray light was the critical importance of setting interfaces properly early on to avoid design issues and integrated modeling difficulties.This can be seen in the on-orbit anomaly section on stray light, Sec.3.7.4.The prime example was a rogue path design issue that resulted from the telescope development and instrument development teams not working to the same prescription.Once the observatory contractor was selected, it was discovered that the NIRCam and observatory contractor team had different assumptions for the telescope design including the speed of the optical system.The observatory contractor team changed their design to accommodate NIRCam, which had already been started.Eventually, it was determined that the design change had opened a rogue path where light from the sky can enter along the side of the secondary and directly strike instrument pickoff mirrors.Once determined, changing the prescription would have been a major change so, instead, with copious analysis, the team used aperture stops and pupil stops to address it.The new complexity was mostly successful, but the rogue path aspect of the interface did not get sufficiently flowed for analytical verification purposes, which ultimately led to definition of some bright-star keep-out zones during on-orbit characterization and stray light model validation during commissioning.If the interface between the telescope and instruments had been better coordinated and properly specified from the start, these efforts and mitigations would not have been needed.See  In other areas, shielding of the various sources and light paths was achieved by stops in the optical trains of the instruments and by use of various "soft-structure" membranes, such as single-layer Kapton sheets use for stray light control, at the observatory level.For NIR truant path, a soft-structure membrane called the "frill" was incorporated around the perimeter of the primary mirror, as shown in Fig. 24.For the rogue path, optical masks in the aft optics subsystem were used to provide the blockage.Specifically, the outer edge of the fine steering mirror pupil stop helped to mitigate truant path.
MIR straylight was controlled by two notable shields.The first shields blocked the thermal emissions from the hotter core area of the observatory, emanating from between the bottom of the OTE and the top of the spacecraft, from impinging of the secondary mirror and scattering into the optical paths and this was called the "Bib" for its appearance.During the final stages of detailed design, it was realized that a portion of the Bib itself was heating to temperatures that could present a stray light.So, another, "outer" Bib was added that occulted the hotter regions of the inner Bib.The second shields were constructed of thermal blankets placed on the top and bottoms of the sunshield spreader bars to prevent their thermal emissions from impinging on the secondary mirror or primary mirror.Thermal conductive paths along these spreader bars heat the tips of these spreader bars, which, if unblocked, present an MIR stray light source.These covers were nicknamed the "epaulets" and are shown in Fig. 24 for the mid-boom spreader bars.Similar epaulets are also included on the forward spreader bars.
There were several modifications to these designs that were made relatively late in the design phase and even during I&T.Late changes to thermal multi-layer insulation (MLI) blankets softstructure, such as these, are common late in I&T.But these soft-structures can interact with precision optics and or deployed interfaces, and any late design changes can have important consequences that can be missed after all other detailed analysis has been already completed.Many of these consequences were identified as issues during the I&T phase.
As part of the stray light control, the JWST contamination control program established cleanliness allocations for particulates and molecular for all optical elements and kept careful track the accumulations during all phases of the I&T program.Particular attention was given to the primary and secondary mirrors (PM, SM), as they were exposed during much of the I&T program due to handling safety concerns with managing a cover.The PM was allocated a total life percent area coverage (PAC) of 1.5% for particulates and the SM was allocated 0.5% PAC.The project leveraged opportunities to perform cleanings of the PM and SM throughout the I&T program and, as a result, the PAC was well below the maximum allowed by the requirements at launch. 28

Thermal distortion
JWST is passively thermally stable where the as-designed thermal time constant was approximately 6 days with a requirement to update the primary mirror alignments no more frequently than every fourteen days.The approach to analyzing thermal stability of the as-designed hardware, two steady state conditions were considered.These were the worst case hot and worst cold conditions after allowing time for stabilization.The magnitude of the wavefront change after worst-case cold condition to worse-case hot condition was allocated from the optical system error budget to be approximately 50 nm root-mean square (RMS) of WFE.The overall stability in the primary optical train's wavefront was then sub-allocated to multiple contributors by low, mid, and high spatial frequency. 29The main contribution to wavefront instability is the primary mirror segment assembly, which includes the mirror substrate, hexapod, and radius of curvature systems with actuators, delta frame assembly, and the flexures and athermalization systems.The backplane itself is also a major contributor, driven by the coefficient of thermal expansion over the 30 to 55 K operating range of the tubes and due to the less than 100 mK thermal drifts from pointing the telescope within the field of regard affecting the joints and interfaces.In addition, the wing segments of the primary mirror have hinges and latches that are also part of the overall telescope's stability budget.The predicted change, without model uncertainty, was approximately 18 nm RMS.This value was measured on-orbit and was very close to this model prediction.The on-orbit measured thermally stability performance is described in Ref. 29 and was measured to be approximately 18 nm with a time constant of 1.5 to 2 days.In comparison, the preflight prediction from integrated modeling was 14.6 nm with a time constant of 5 to 6 days predicted at observatory beginning of life, versus requirements of 54 nm rms.This is summarized in Table 1.
Note that cryogenic bonds were highly complex and difficult to model, and every joint type required special analysis and test validation.In addition, integrated modeling cycles of the backplane were very time consuming due to the nodal density and complexity.The cryogenic passive stability mitigation efforts interacted with the lack of mass margin and at one point in time the entire program had to work to save mass and the backplane had to simplify joint interfaces, which required redesigns.In addition, gravity distortion of the lightweight structures had to be carefully understood as did structural margins for launch.

Jitter design issues
Jitter refers to high frequency vibration, outside the control bandwidth of the observatory fine guidance control, which disturbs the LOS of the OTE during an observation.Based on the design constraints defined by two requirements, (the overall image quality requirement at an overall WFE of less than 150 nm, and the requirement to be refraction limited at a wavelength of 2 μm) the SET allocated an overall jitter requirement of no more than 0.007 arcsec (69 nm rms WFE equivalent).To achieve this, isolation devices were incorporated between the OTE and the spacecraft bus.These devices isolated the OTE from the two major vibration sources in the spacecraft -the RWAs and the cryocooler compressors for MIRI.Such isolation schemes must avoid vibration transmission paths that can transmit vibrations, and these shunt paths can hide until the final detailed deployed dynamics models of the observatory.During the development of the observatory, many of these paths were identified as more detailed dynamic models of the observatory were developed.
The detailed models of the spacecraft were the pacing item for performing jitter analysis.As cited earlier, the detailed design of the spacecraft was delayed due to funding constraints prior to the CDR.It was therefore between the Observatory-level CDR and the SLR that many of these detailed vibration transmission paths were identified.One path involved the propagation of harmonics of the 30.5 Hz drive frequency of the pulse tube cryocooler.These vibrations were analyzed to travel through the heat pipes connecting the compressor to its radiators on the spacecraft bus, thus shunting past the compressor vibration isolators, through the bus structure, through the deployed tower assembly and into the OTE.Because this vibration transmission path was found late in the design phase, changes to hardware were highly undesirable, and in the end, it was found that tuning of the cooler compressor speed on orbit could be performed to avoid the predicted LOS response.It was fortunate that the MIRI cooler had the thermal lift margin to allow such tuning based on optimizing vibration performance over thermal efficiency.This is another example of how thermal margin was expended to address a late system design issue.

Deployment design issues
The deployments of the JWST observatory were always recognized as a major challenge, and a separate paper is necessary to fully cover all the issues encountered in their design and implementation. 30The unique design of the sunshield offered most of these design challenges, which can be broadly characterized as follows: 1. Membrane management: Designing the proper constraints and inhibits to make sure the tennis-court size sunshield does not drift into areas that damage them or impede deployment actions during all stages of the sunshield deployment.The design of such constraints necessarily involved a large number of release mechanisms, and there were numerous trades to minimize this number that eventually concluded with 107 MRDs. 2. Cable/slack management: The deployment and tensioning of the five layers of the sunshield was accomplished with spooler motors and cables.The management of the cables through all stages of the deployment was a challenge.There were numerous design iterations to make sure that the cables and their slack during various stages of the deployments were controlled and constrained to preclude snagging.3. Mechanism design: Aside from the architecture studies that determined the number and location of the release devices, the design of the mechanisms themselves took several iterations, ranging from concepts that used individual strings and through holes in the folded membranes to contain them to the final concept that used rigid pins.These concepts were also challenged by tight clearances between the stowed observatory and the Ariane fairing.4. Folding and stowage constraints: The successful deployment of the sunshield has been rightfully likened to that of a parachute; its ultimate success or failure is determined by the quality of its final folding and packing.The processes for folding were practiced extensively on the integrated validation article (IVA) and several iterations were conducted to flush out the many important nuances.But even after that, the quality of the final stowage demanded extra vigilance and attention to detail on the part of deployment systems engineering and quality assurance.
Deployment mechanism design was also an issue for other elements of the observatory, which relied on a total of 178 release mechanisms for its deployments (including those of the sunshield).Each of these release mechanisms contained SPF modes, meaning they were all SPF items as documented and reported by NASA standards.Most of these release devices contained various versions of the EBAD NEA, a device known for its low output shock.These devices come in a variety of sizes, but they all function similarly.They are designed to carry a tensile preload until commanded to release.The preload is applied through a release rod held in place by two separable spool halves, which are, in turn, held together by tight winding of restraining wire.The restraint wire is held in place by redundant electrical fuse wires; actuation of either circuit allows release.Upon firing of the fuse wires, the restraint wire unwinds allowing the spool halves to separate releasing the release rod and the associated preload.
For the most part, the devices were found to perform as expected.However, the largest of the NEA designs used for JWST, the ¾" NEA, named for the size of release rod, which were used to hold the OTIS to the top of the spacecraft bus for launch were found to have issues.These four devices shown in Fig. 25 were in the primary launch load path of the observatory and because of this required very high preload levels.The levels were within the specifications for the devices, but in test firings the output shock of the devices exceeded their required levels.An extensive investigation was conducted that resulted in design modifications and a re-qualification program.In addition to the design modifications, changes were made to the fabrication techniques to make them more repeatable, and therefore more reliable.

Launch and ascent thermal design issues
A major thermal issue that took over 10 years to fully resolve was Observatory temperatures during launch and specifically temperatures on the stowed telescope.During initial launcher compatibility studies, the lack of a re-startable upper stage on the Ariane 5 was cause for concern regarding the thermal and solar exposure the telescope.Without a re-startable upper stage, the launch would have to occur early in the local morning, thus subjecting the telescope to direct sun after fairing jettison.Without thorough knowledge of the Ariane 5's capabilities at the time, it was thought that a traditional launch's thermal management maneuvers of the launcher's upper stage would moderate temperatures.
Subsequent meetings with Arianespace provided updated trajectory and roll characteristics and thermal analyses prior to PDR indicated that critical temperatures on the telescope's cryogenic backplane were exceeding the survival limits of the composite's epoxy system of 50°C.The epoxy in the backplane structure softens when it is warmed to temperatures above 50°C.This softening may not cause a structural failure, but the loads experienced during the time of the elevated temperature may distort the structure, which may result in a deformed structure upon cooling, which can induce stresses into the mirrors.This can cause misalignments and WFE.Subsequent structural and thermal studies investigated the benefit of higher temperature limits that would result from post-curing the backplane during assembly by raising its temperature in a very controlled and mechanically supported manner.Although it could have potentially solved the launch and ascent thermal issue, post curing the backplane was not pursued due to cost, schedule, and complexity concerns.
Prior to CDR, and due to continued predicted temperature violations on the telescope backplane, the traditional thermal management maneuvers were abandoned.In its place, a partial roll, or back and forth rocking motion of the launch upper stage, was proposed.This approach kept the sun on one side of the telescope and better constrained temperature violations to specific areas.After Arianespace agreed to the new proposed profile, a lengthy and multi-year thermal analysis investigated sensitivities to launch date, launch time of day, and roll profile errors.In parallel, a series of tests were conducted on composite samples where distortion was measured versus temperature and structural load.In addition, pre-launch cooling of the telescope structure to below 12°C was implemented and would provide additional margin to the 50°C limit.The combination of the unique roll profile, robust thermal analyses, structural testing, and prelaunch cooling, all resulted in the observatory arriving safely on-orbit.

Engineering Units and System Test Beds
Because of JWST's unique design, the use of full-scale and/or high-fidelity test beds and engineering units was critical to the development processes.ETU's and test beds were used to develop the flight hardware design as well as to develop and practice the tests that would be performed on the fight hardware.Many of these tests, such as the OTIS cryogenic test, were as challenging as testing the flight hardware itself.Figure 26 illustrates some of the key ETU's or testbeds used by the project.Each testbed is described below.

Hardware-system test beds
The backplane stability test article (BSTA) was a full ETU of a portion of the primary mirror backplane structure that was used to characterize the cryogenic stability of the structural members and joints.It was also used to characterize the cryogenic damping properties of the structure for line-of-sight stability predictions.
The ¾" NEA verification test unit was a high-fidelity ETU of the modified NEA device used to release the OTE from the spacecraft without imparting output shock.This unit was used to qualify a modified design of the unit.Manufacturing issues were found with the device, 30 and this issue is discussed in Sec.3.4.6.
The test bed telescope (TBT) was a 1:6 subscale replica of the segmented telescope that was used to practice and develop the on-orbit alignment and phasing procedures.The testbed had all the degrees of freedom of the flight telescope with flight-like actuators.The testbed was used to determine the error budget of all wavefront sensing and control algorithms and that budget was then traceable to all flight algorithm requirements.
The pathfinder telescope was a full-scale model of the center section of the telescope with two primary mirror segments (both spares) and a flight spare secondary mirror.This pathfinder telescope was used to practice and validate the test procedures and verify the test equipment for the flight OTIS cryogenic optical tests in the modified JSC Chamber A facility.Three separate tests were performed with the pathfinder.The first test focused on the optical GSE, the second test added the flight aft optics system and cryogenic optical fiber fed sources, and the third test removed the flight aft optics system and demonstrated the thermal test aspects of the test with additional thermal simulators for the mirror segments.
The observatory Core test program consisted of full-scale cryogenic tests of the region of the observatory between the OTE and the top of the spacecraft bus.This was a highly complex thermal region of the observatory and one that needed extra care in the validation of thermal models.This Core test was conducted twice, the first time with an early development model with the goal of proving that this complex region, which contains the IEC, could be adequately modeled and the needed cryogenic temperatures could be achieved.A second test, known as Core 2, was a high-fidelity ETU of the final design and was a key part of the overall thermal verification program.
Existing thermal vacuum chambers were not large enough to accommodate testing of the full-scale sunshield.Therefore, a one-third scale sunshield model was thermally tested to validate the sunshield thermal model.
The sunshield IVA was a full-scale model of the sunshield used to demonstrate the sunshield deployment process and to investigate and practice various folding methods.Much like a parachute, the folding methods for the sunshield were critical to its final success, and this IVA enabled rehearsing of the folding process without adding extra wear and tear from handling to the flight unit.As discussed further in Sec.3.4.6, the rehearsal of the sunshield folding could have been taken a step further.If it had involved some of the methods required in on the actual flight unit, such as use of manlifts and measures to work near delicate and contamination sensitive hardware, the during of the folding effort would have been realized sooner.
The end-to-end cryo-cooler test was an effective tool to validate the MIRI cryo-cooler performance model.The flight cryo-cooler subsystem is distributed over the entire span of the observatory (compressors in the spacecraft bus, cold heads in the ISIM, and coolant lines that traversed the "core" region between the two) so an end-to-end test of the actual flight cooler after integration into the observatory in flight conditions was not possible.The end-to-end test used flight-spare cooler and a prototype of MIRI that was adapted by the European MIRI team to make sure it would react thermally in the same manner as the fight instrument in the flight environment.The test confirmed that the refrigeration system can successfully cool down MIRI and keep it cold.The end-to-end cooler test also provided an opportunity to fine-tune the operational parameters of MIRI in a simulated environment and to verify overall system performance.

Electronics and software-system test beds
JWST also relied heavily on electrical and software test beds for the design, validation, and verification at various levels of the systems.This section describes the key test beds used for development, verification, and on-orbit troubleshooting.
Software telemetry simulators (STS): The STS runs the spacecraft and ISIM flight software and was used by the spacecraft and ISIM teams for software development and testing.This system is the quickest of the systems to set up and run for syntax checks on flight products.It is completely software-based and does not require the operator to reside in a test lab to run the simulator.An example of a flight product that was validated on an STS is the formal certification and performance of the deployment system software, including all "negative paths" except for a few paths that required special subsystem flight software loads.Negative software system testing uses invalid input data, or undesired system behaviors, to check for unexpected system errors.
The JWST project used a series of rack-mount simulators called the JWST Certification Labs (JLABs).See the photo of a rack-mounted JLAB system in Fig. 27.The JLABs provided a both a ground system simulator and a spacecraft simulator.They also optionally provided an ISIM simulator.During the peak of hardware and software development, the JWST project maintained 38 JLABs of different fidelity levels spread across the United States, Canada, and Europe.
The most basic of the JLABs were called the Science Instrument Development Units, and these were delivered to the four instrument providers and several other subsystem labs for flight software and development of the operational script subsystem.
The science instrument test set (SITS) replicated the JWST ground based interface, spacecraft, and ICDH commands and was used during instrument level integration and test (I&T).Early testing of flight software with flight-like operational systems demonstrated the interactions with ICDH command processing, which reduced risk by identifying command and telemetry interfaces to the ISIM interface with the instrument flight hardware and flight electronics.The SITS was also used for post-shipment checkout of the instrument engineering test units and instrument flight units.
The JLAB systems, their flight-like interface, the JLAB system management, and the configuration control of the flight and non-flight database that supported the JLAB systems were critical to success at the final Observatory level integration of JWST.The planning, installation, maintenance, and effective use of these systems took considerable resources from all the JWST project, partners, and contactors, yet resulted in the success of the Observatory level test campaign, and, more importantly, the successful and on-time in-flight commissioning of the Observatory.A system schematic of a typical JLAB is shown in Fig. 27.
The JWST Project continues to use JLABs with high-fidelity fine guidance subsystem simulators for testing of updates to software and operational scripts.The simulator includes a suite of instrument simulators called the instrument electronics simulator (IES), which substitute for the flight instruments now that the JLABs are not connected to the flight instruments.
The observatory test bed (OTB) is a high-fidelity electrical and software Observatory simulator.It is located at the JWST Mission Operations Center (MOC) at Space Telescope Science Institute (STScI).Besides a spacecraft and ISIM simulator, it includes a vehicle dynamic simulator (VDS), some primary and redundant flight-like hardware, a high-fidelity FGS simulator, and simulators for all the science instruments.This system connects with much of the flight operations system (FOS) located at the MOC.With the VDS and the FGS simulator, the OTB allows the full interaction with the spacecraft flight software, attitude control system, fine guiding system, on-board script subsystem, including functions such as slews, settling of slews, momentum unloads, high gain antenna pointing, and closed loop guidance engagement.Simulation includes solar torque, light-time delay, contact playback, and very realistic science observation plan execution.
However, even this system has limitations, and upgrades or improvements are nearly continuously in work.One of the biggest non-flight like features of the OTB is timing.OTB timing has been optimized but cannot be not fully flight-like due to the simulated systems and nonflight-like components.In addition, timing conflicts can be random in nature and the OTB is not designed for streamlined iterative testing to find corner-case timing conflicts.
The engineering model test bed (EMTB) is another high-fidelity electrical and software Observatory simulator, which is located at Northrop Grumman's Space Park facility.This system is remotely accessible to FOS, which served as a method to dry run pre-flight ground tests in which the FOS was used to command the actual flight Observatory.In addition, this system was used for deployment product validation and deployment electronics unit (DEU) software validation as it includes an engineering model of the DEU.
The early commissioning activities and configurations were run on this simulator and testing of functions that could not be performed on the STS.
The EMTB also includes an engineering model of the actuator deployment unit, which controls the actuators on the JWST mirror segments.Although extensive testing of these actuators was performed at the test bed telescope, the EMTB put the ADU commanding into a flight-like system.Also, the EMTB includes capabilities to run special tests for deployments with load simulators.
From early software tests to extensive validation and testing of line-of-sight software components and Observatory fault management algorithms, the EMTB has been critical in verifying many of the systems that cannot be sufficiently end-to-end tested in flight-like conditions on the flight Observatory.
Finally, a unique tool was developed for JWST visualization during the on-orbit commissioning called the observatory visualization tool.This tool graphically showed the observatory as it deployed, based on flight telemetry from various on-board sensors.This allowed the operations team deploying the telescope to visualize and readily communicate the flight configuration.

Sine vibe test issues
The purpose of the OTIS sine vibration test was to qualify the OTIS hardware for the low frequency dynamics launch load environment from the Ariane 5 rocket, provide data for the finite element model verification, and to verify the minimum launch frequency requirement.The test levels were based on the observatory sine vibration launch load provided by the Ariane 5 user's manual and this load, when transferred to the OTIS hardware, applied an acceleration up to 2 g from 5 to 100 Hz in all three axes.It was critical that the hardware experience the load required to pass the flight environment without greatly over-testing any part of the structure.Therefore, notching of the input test signal was allowed to prevent unrealistic launch inputs but it was a challenge for the input to stay above the sine vibration minimum floor levels provided by Arianespace.
The OTIS hardware consisted of several mechanisms used to deploy the mirror wings and secondary mirror.The mechanisms were qualified through separate random vibration tests, however, they were expected to chatter during low frequency sine vibration.This chattering showed high frequency responses in the test data and made it difficult to control the test to limit structural responses to the mirrors.Therefore, high frequency time history data were reviewed during the test to understand the structural loading on the mirrors and its deployment latches.An anomaly occurred early in testing that showed a high frequency response throughout the hardware due to one of the primary mirror wing mechanical restraints overcoming its preload during the test.While an investigation indicated no hardware damage was found, test limits that were previously set for strength of the hardware were modified to accommodate limits from the preload in the mechanical restraints.
Another lesson learned during the OTIS sine vibration test was the room temperature damping coefficient of the composite mirror backplane structure.The mirror backplane structure was primarily designed to minimize mirror motion due to its cryogenic operational temperatures.Composite material was selected to meet this primary design requirement.However, damping of this composite hardware at room temperature, similar to the launch temperatures, was shown to be lower damping than predicted, which then resulted in higher sine vibration test responses for the aft optics assembly and the secondary mirror support structure.Following the OTIS mechanical testing, dampers were installed for these components.The performance of the dampers was then verified during Observatory-level mechanical testing.These dampers worked as designed.The mirror components were then shown to appropriately respond within design loads and within Arianespace's required minimum test levels in sine vibration.However, this was a very late change to and had the project had to be confident that the dampers installed at this late stage were the right solution.
In addition to lessons learned that were pertinent to OTIS specific hardware, there were lessons learned from the sine-vibration test configuration.It was shown that determining the test instrumentation and its routing ahead of performing the test was critical to the success of controlling the responses throughout the hardware.The OTIS test instrumentation, which consisted of interface force gages and six hundred response accelerometers, began its design 2 years ahead of testing because it was a very complex ground instrumentation set up.Three things that made it complex included: 1. the need to obtain proper accessibility to critical components, 2. the need to design acceptable mounting methods that would survive launch and cryogenic temperatures if the instrumentation was required to fly, and 3. the need to obtain and checkout the instrumentation with mass simulators prior to using it for the flight hardware test.
Starting the instrumentation design early greatly contributed to the efficiency of running the OTIS sine vibration test.

Cryogenic test wavefront error instability issues
The OTIS cryogenic tests, conducted in the modified JSC Chamber A Facility, were perhaps the largest and most complex cryogenic tests ever conducted.The design of the optical and thermal GSE as well as the cleaning of the chamber itself to accommodate optical testing was extremely demanding.The OTIS testing took roughly 100 days, which included lengthy controlled cooldown and warm-up periods to avoid contamination on critical surfaces.
Overall, the test went smoothly and as planned, even though the test was conducted through Hurricane Harvey, which hit JSC and the surrounding communities very hard.During OTIS thermal vacuum testing, there were several performance issues that were encountered.The critical issue was unforeseen optical instabilities during the final EE stability tests.One instability was a change in WFE with a time period of minutes, which was correlated to the duty cycles of the IEC heaters.Analysis of the instability showed that there were unaccounted for stress paths between the IEC and the OTE from GSE that varied as heaters cycled.Once accounted for, the bulk of the instability was explained, but there was residual instability that could persist in orbit due to these heaters imparting strain through the harnessing between the IEC and surrounding structure.The residual instability of the WFE and EE was within allocations but was nonetheless unexpected to be identifiable in the telescope WFE once operating on orbit.The residual instabilities due to the heater cycling signature was reduced by defining a narrower bandwidth for the control heaters.An on-orbit commissioning test of this OTIS-level characterization of this instability showed that on-orbit errors are well within acceptable limits. 29,31he second instability was identified with the stresses from the differential thermal contractions between the OTE frill and the primary mirror backplane structure.Post-test inspections showed sections of the frill did not have the proper amount of slack so that it imparted stress on the PM structure as it cooled down.The backplane had a much larger thermal time constant than the soft-structure frill, due to its large mass.Additions were made to the sections of the frill to increase the slack to its mounting points at room temperatures, but since the OTIS cryogenic test was not to be repeated, the consequence of these corrections was not tested and carried a certain risk, which was reviewed and deemed to be acceptably low.As with the IEC heater instability, these measurements informed the commissioning tests and showed that this instability is well within acceptable limits. 29,31Ultimately, stability tests in-orbit showed the fixes for these issues worked almost exactly as expected, a key reason for the outstanding stability of the observatory.

Avionics boxes issues late in integration and test
During the spacecraft and observatory level tests four significant avionics boxes failed and required replacement and repair.The nature of the failures themselves was due to electrical part failures and or workmanship issues.Table 2 lists and describes the failures.
It is not uncommon for such failures; in fact, such electrical performance tests are intended to find such issues, and operating hours are required to make sure infant mortality issues reveal themselves and get discovered.The systems level issues and the lessons to be learned are more toward the advantages of box accessibility.This was particularly evident with the failures of the TWTA and CTP.The spacecraft bus was designed to have removable equipment panels to provide late access to the boxes, but the removal and replacement of these was still a very demanding process that involved relatively tight space as shown in Fig. 28.

Soft structure risk of billowing during launch
As described earlier, changes to soft structure on JWST were more consequential than on previous spacecraft and had to be carefully considered.The shape, position, and imparted stresses from these members had much tighter tolerances than on previous spacecraft where soft structure MLI can usually be cut and tailored in the final stages of I&T without concern.Aside from the changes to the primary mirror frill and bib that was already described, other "soft structure" issues were identified late in the I&T program.Most late soft-structure changes were associated with venting behavior during launch and ascent.Soft-structure issues involving deployments are covered in Sec.3.6.5.
The most significant of the venting issues came as result of late breaking data from other launchers that showed the residual atmospheric pressure within the launcher's fairing at or near the time of fairing jettison was not as low as thought.Data obtained in late 2016 indicated pressures could be higher than 2 milli-Bars, which raised concerns for the loads that would be imparted to the stowed sunshield membranes from billowing from the rapid depressurization at fairing jettison.This billowing exerts loads not only on the membranes but also on the pins of the MRDs that holds them down.Damage to these pins could result in a failure to release, and thus represented a significant risk to the mission.
Ariane was informed of this concern and agreed to fly US-provided pressure sensors with high enough precision for accurate measurements of these low residual pressures.These sensors showed pressures as high as 0.58 milli-Bars existed just prior to fairing jettison.
In conjunction with Arianespace, the project kicked-off a three-pronged effort to address this risk that consisted of: 1.A development program on the part of Ariane to modify their fairing vent system to lower residual pressures at fairing jettison.2. Analysis on the part of systems engineering to refine venting analysis to generate more accurate load estimates for the membrane and MRDs.3. Analysis and tests of the membranes and MRDs to establish their actual capabilities.
Arianespace was successful in improving their venting efficiency via modification of the vent valves, systems engineering passed revised requirements to NG to establish the residual atmosphere at fairing jettison, and NG was successful in qualifying their sunshield hardware  The data from the JWST launch showed that the pressure was under the revised pressure requirement and no discernable damage was incurred to any sunshield membrane from the launch depressurization.
Other than depressurization at fairing jettison, the more conventional venting issues associated soft structure was realized early, and design practices were instituted to address them.But as the design matured, and the as-built blanket geometry was examined closely, it became clear that details of the blanket tie downs did not correlate with those that were modeled to adequate level of detail.As late as May 2021, modifications had to be made to the blanket tie downs on the sunshield's unitized pallet structures (UPS's) to make sure they conformed with load predicts made by updated venting models.This change is an example of late changes where changes to the tie-downs of the UPS blankets were necessary because of deviations from the configuration in the venting models.

Deployment, membrane snags
A full-scale engineering model of the sunshield, called the integrated validation assembly, was used for development and practice of sunshield deployments, as shown in Fig. 26.Even with this high-fidelity engineering model, there were still unexpected issues discovered during the deployment tests of the flight sunshield and OTE on the ground.For the sunshield, there were two major deployment issues that surfaced: (1) a significant snag of one of the membrane tensioning subsystem (MTS) cables and (2) an anomaly in the firing of the redundant firing circuit of a 1/8" NEAs in one of the 107 MRDs.
The MTS snag incident occurred during the first deployment test of the flight sunshield in November 2017.During the tensioning of the sunshield layer 1, a spring clip (a curled piece of Kapton) used to control the position of a tensioning cable, held in place longer than expected and negator springs in the path of this cable reached their full stroke.When the clip finally let go, there was a sudden generation of cable slack, which looped around and snagged around the negator spring housing of a neighboring cable.Such a snag on orbit would have been a severe failure for the sunshield deployment.Design modifications were implemented in the form of snag guards in the cables near these negator springs and resizing of the Kapton clips to adjust their release strength.These late changes were simple in nature but since they occurred late in the I&T flow, their actual implementation was challenging.In addition to these changes, the sunshield engineering team conducted audits of the slack management of all the tensioning cables and made changes to their routing.The second anomaly involved the second deployment test of the flight sunshield.This test was after the sine vibration and thermal-vacuum tests of the system.The 1/8" NEA, which are used to release the 107 MRDs, were fired only on their redundant firing circuits.One of the NEAs failed to release, as shown in Fig. 29.When fired on the primary firing circuit, the NEA did release, and so this was not characterized as a failure since both circuits are fired on orbit.This was nonetheless an important anomaly that triggered an extensive investigation of all the failure modes of these devices, which were considered to have flight heritage.
Since these NEAs are used in 107 MRDs all of which are SPF Items, it was important to maximize their reliability.The investigation surfaced several previously unknown failure modes, which resulted in minor design changes to the NEA device itself and the implementation of revised assembly and inspection methods.

Integration and testing anomalies and reporting
Documenting and managing anomalies was a significant effort particularly during the observatory integration and test phase when final deployments and stowing and inspections occurred.The Northrop Grumman mission assurance processes for Anomaly Review Boards (ARB) and Failure Review Boards were used and the Northrop Grumman Mission Assurance Manager oversaw this entire effort.A standing board was formed that reviewed and approved every ARB and FRB activity.This formal board included key technical leads from Northrop Grumman and the NASA mission assurance manager, deputy project manager for technical, and the observatory I&T chief engineer.In addition, the lead mission system engineer, ISIM system engineer, and I&T chief engineer (formerly telescope manager) reported to the Goddard Engineering leadership monthly and the lead MSE had ultimate technical authority and reported to the NASA chief engineer.

Commissioning Anomalies
The JWST project was significantly affected by the COVID-19 Global Pandemic through much of 2020.This, among other factors already described, led to a slow down after the completion of the Observatory elements late in the JWST integration and test phase and prior to their final Observatory assembly and testing.The JWST team took this period of remote work as an opportunity to improve documentation, do in-depth reviews, and rehearse the anomaly response processes and procedures.This time was extremely valuable as demonstrated by the successful commissioning campaign and early release science results.
The JWST anomaly response process was designed to integrate and coordinate among all the teams and subsystems.This includes all three space agencies, their contractors, and all teams from the ground system.An Anomaly Management Board (AMB) was developed, which is much different from a traditional NASA ARB to include all parties and led by the JWST Project Manager.The AMB was designed to be available 24 hours a day, seven days a week throughout commissioning.Soon after an anomaly was identified, this board would meet, often with little notice, to understand the nature of an anomaly and to hear what, if any, immediate actions were taken by the autonomous fault management system or from the ground by the flight operations team.The JWST process empowered this team to be the sole body for making decision on how to proceed with Observatory operations.This board would decide if further critical operations were warranted, approve processes for collection of investigation data and form a cross-functional tiger team to perform initial investigations and assessments.The investigation team, also known as the Anomaly Response Team (ART), would report back to the board to recommend actions on a near and longer-term path forward.With each cycle of the review, the AMB would review health and safety and approve all actions proposed by the investigation team before they were taken on the flight system.
When a larger, more in-depth, and typically off-line investigation into a root cause or longterm best approach for operations was needed, the AMB would charter an ARB.This board would be formed with experts from on and off the project to study a fault, failure or feature in-depth and report back to the AMB with a recommended course of action or analysis of root cause, or any other item that was delineated in the ARB Charter.
This multi-faceted and highly integrated approach to anomaly management worked extremely well to keep a very large team working, communicating, and functioning together.Below are select specific issues encountered during the JWST commissioning campaign that contribute to overall JWST lessons learned.
During commissioning, JWST tracked and reported on every data point that was out of expected values and worked to track down the cause and best resolution of each item.In addition, the JWST fault management processes are very conservative and designed to put the hardware into a safe configuration every time an unexpected condition is encountered by the on-board, autonomous software.This approach led to several instants of putting the observatory into a safe mode during commissioning.There has been a total of six on-board autonomous Observatory-level fault responses that put the Observatory into safe mode, none of which have resulted in performance degradation or significant risk to the observatory health and safety.Many times the safe mode response was due to an unexpected configuration between the instruments and the spacecraft.Commissioning anomalies encountered that were not due to simple configuration or software time-out conditions are described below and summarized in Table 3.

Fine sun sensor glint and fault management
Very early in commissioning, the Observatory entered safe mode, and followed a nominal fault management response where the autonomous software algorithms swap many of the systems to redundant hardware and electronics.The reason for entering safe mode was determined, corrected and on recovery of the primary-side configuration, the JWST Fine Sun Sensor (FSS) located a signal other than the sun while performing a start-up scan of the FSS detector.This "fake sun" was realized by the on-console team and quickly addressed, but an investigation was made into the possible "fake sun" root cause and mitigation to this as an FSS failure mode.This investigation could not conclusively identify the source, but slewing the Observatory to a different sun vector, where it is thought that a glint with a complex path was eliminated or diminished, allowed the FSS to find and track the true sun.For long term mitigation of this issue reoccurring, or to mitigate it happening on the redundant FSS, prime and redundant FSS's are now always left powered.This allows them to continuously track on the same sun.Frequent checks of the values from the two units are made to ensure that they are both finding the same sun vector.
The lesson learned from this experience extends beyond the failure mode of the FSS and looks at the overlap of the fault management and the hot/cold unit spare philosophy.JWST fault management simplified responses as much as possible to ensure that any possible fault was addressed by the initial response.This means that the algorithm responded as though any fault  The result of the optimization yielded highly stable and repeatable pointing system with very low image jitter 3.7.6

Micrometeoroids
A single hit to the C3 mirror produced higher damage than was expected for an individual hit over a 5-year life To minimize the likelihood of future large hits like the one on C3, a micrometeoroid avoidance zone has been adopted that reduces telescope pointing in the orbital direction, called the ram direction, where the orbital velocity increases the relative velocity with the micrometeoroid and thereby increases its damage

DSN availability
Oversubscription and low efficiency led to JWST pausing the collection of science data A review team was formed to make recommendations for near-and long-term strategies to address the issues for JWST, DSN, and for future SMD missions using DSN assets was the result of the worst possible condition that could cause that fault and it did not require two pieces of telemetry to initiate that full response.Although the JWST fault management responses were extremely well reviewed, a significant reduction in risk during a fault management response, or recovery, was achieved by a small change to the hot/cold spare state of the FSS.Anytime a fault management response, and therefore the recovery, requires a significant number of systems to be powered up on the primary/redundant side, risk is added to the initial fault management response as well as to the recovery.

Solar array performance in early commissioning
A lesson learned was also realized on thermal modeling.Through the years of design and analysis on JWST, the configuration of "model runs" had to be carefully chosen as they informed and entire modeling cycle where one analysis result fed into others.It was not possible to perform all possible conditions due to the length and cost of modeling different parameters in the complex integrated modeling environment.It is typical to take the worst-case operating extremes to do these models, so for thermal this often winds up as a "worst-case cold" model and a "worst-case hot" model.Add to this the large number of configurations that JWST would go through during deployments and the number of cases, many of which represent transient states, expand considerably.
Even though it was a large number of unique configurations, analyses were done to assess the health and safety of the Observatory while in prolonged partially deployed configurations.These special studies were conducted to confirm that anomalies could be investigated and resolved without the constraint and pressure of time limits.Of specific concern in these partially deployed configurations were excessive momentum build up, off nominal and structurally stressing cool down temperatures, and water ice migration to cooling optics.Although a product of these analyses, solar array temperatures in these partially deployed configuration were never evaluated for their impact on array power output.Although there was no actual thermal concern with the array in the mid-deployment configurations, the assumptions for calibration of the regulators on the solar array assumed a different thermal state than was seen in flight in this time frame.The operations team identified sub-optimal performance in the solar array indicated by a small current being pulled from the battery.Once the issue was identified and a final thermal state of the solar array was achieved, the regulators were calibrated, and all solar array operation has been nominal.

Deployment indicator switches
Launch-locked, stowed, and deployed items on JWST have telemetry to indicate the state of the subsystem.Some states have a two-condition telemetry point, meaning that an item is either locked or unlocked or stowed or unstowed.In particular, deployed items have multiple telemetry points to designate its current state.Such telemetry may indicate, a locked, unlocked, and deployed state as well as telemetry indicating how many motor steps have been executed.In ground testing, these deployments and the telemetry that indicated the success of those deployments, were tested, trended, and rehearsed.However, testing in the cleanroom, under Earth's gravity and at room temperature, cannot always fully check out the on-orbit range of conditions.This was seen on-orbit where some of the "deployed" indictor switches did not indicate that hardware had properly or fully deployed.When this occurred, the team fully analyzed the data from the Observatory and ran a parallel case on the full-size sunshield model.From these ground model tests, it was determined that there was good rationale to believe the on-orbit deployment was successful despite the anomalous telemetry condition.For example, the sunshield's membrane covers were successfully deployed, but, due to on-orbit conditions that were not simulated on the ground, the sensors did not properly indicate a status of "deployed."

Stray light in commissioning images
During commissioning, a deficiency in how the stray light model efforts were divided between an effort in the Observatory level model and the instrument level models was found.On such a large Observatory, built by distributed organizations, and where much of the system was designed in parallel, managing design changes in interfaces in the modeling cycles was a challenge and this resulted in a stray light path into the instruments after a design change in the optical prescription of the telescope was made.The changes to mitigate this path were analyzed using the Observatory stray light model.This showed that the stray light path from the telescope did not enter the entrance pupil of the instruments.However, light did enter the ISIM interior and did impact non-optical surfaces of the structure and instruments.The observatory level model used for stray light analysis only included the optical trains of the instrument and not any of the structure of the instruments.The number of surfaces that full geometry models of the instruments would add to the observatory level model would make the observatory level model unwieldy.The instrument teams were asked to take look from their instruments out to the newly proposed geometry in the aft-optics of the telescope and determine, with alignment uncertainties, if the geometry change fully mitigated the issue.What was missed in the inward-outward approach is the low-angle scatter from light impinging on non-optical surfaces that entered through the observatory's stray light path.In the infrared, even surfaces coated with low emissivity black treatments can still reflect a significant percentage of the photons.
This was first found by the NIRCam team in commissioning images and an extensive investigation lead to the discovery that bright sources located in a narrow field relative to the Observatory stray light path could scatter off instrument baffles and interior surfaces of optical mounts onto the NIRCam detector.There was also a possible path that entered the Observatory's stray light path only after scattering off a blanket on the telescope's structure.Although these multiple-scatter paths transmit a very low percentage of the energy from the sky to the detector, a bright source with JWST's highly sensitive detectors still made the level of the scattered light noticeable.For NIRCam, these features moved with the location of bright sources on the sky and extensive work has been performed to characterize these for calibration purposes.Observation planning can largely avoid placing bright stars in the susceptible regions relative to the NIRCam field.Details can be found in the JWST on-line user documentation. 32eatures were also found within the NIRISS instrument during commissioning and correlated with a low-angle scatter off non-optical structures in the instrument from the stray light path through the telescope.The feature specific to this path has been called the "light-saber" due to its appearance.Further information on the NIRISS stray light features can be found at in the JWST on-line user documentation. 33

Line-of-sight performance
As mentioned in a prior lesson learned, the effective use of the delays during Observatory level integration and test yielded positive results in several places.A clear positive result was the enhanced simulation capability at the operations center for testing the interactions between the attitude control system, the FGS, and the onboard script subsystem that dealt with the line-of-sight management of the telescope.This enhanced simulator fidelity led to several improvements in the various software and operating scripts to correct for timing or configuration-related potential faults, which were found and corrected prior to launch.During commissioning, additional work could be rapidly conducted on this system to verify operations and correct issues.Because of the issues that were found and resolved early with this enhanced simulator, the line-of-sight closed loop control system, which could not be tested end-to-end on the flight hardware on the ground, worked extremely well.This system was performing well from the point in commissioning where it was critically needed to continue with telescope alignment and its success led directly to the excellent and timely release of JWST's first images to the public on July 12, 2022.

Micrometeoroids
The open-architecture of the JWST optics, which is working well from all aspects of the design, was expected to be degraded slowly by micrometeoroid damage.Early design decisions on this architecture were based on the best models of the time on the size, frequency, and speed of micrometeoroids moving through the JWST L2 orbit.Experimental damage testing was carried out on mirror samples to ensure that the mirrors would survive the expected flux of micrometeoroids.The testing on the ground cannot fully simulate the velocities in space and the modeling methods that existed when this was assessed were limited.JWST is actually able to sense micrometeoroids both using pupil images and wavefront sensing (measurable in wavefront) in ways that are more sensitive than has ever been performed.Results to date indicate the number and distribution of micrometeors is consistent with the expected environment for the JWST orbit, but one incident on the C3 mirror created higher damage than was expected for an individual hit over a 5-year life.The most likely explanation for the unexpected nature of damage of this particular micrometeoroid impact is the limitation in being able to model the damage at the early phase of the program combined with the sensitivity of location on mirror and the statistical nature of very high energy micrometeoroids.To minimize the likelihood of future large hits like the one on C3, a micrometeoroid avoidance zone 34 has been adopted that reduces telescope pointing in the orbital direction, called the ram direction, where the orbital velocity increases the relative velocity with the micrometeoroid and thereby increases its damage.With this and the significant optical margins, the telescope optical WFE and performance is expected to meet requirements for decades. 31

Deep space network availability
The last lesson learned from JWST commissioning extended into the first months of JWST Cycle 1 science as the launch and mission of Artemis 1 overlapped and used the same ground station network as JWST.The overlap in subscription of this asset and low efficiency in the downlinks on this asset due to a variety of compatibility issues resulted in JWST science having to pause to wait for the data to be off-loaded from the flight recorder.The space communications service provided by the DSN is managed by NASA's Space Communications and Navigation program (SCaN), which serves as the program office for all of NASA's space communications activities.A joint study was initiated between SCaN and NASA's science mission directorate (SMD) to understand the issues encountered by JWST and to make recommendations for near-and longterm strategies to address the found issues for JWST, DSN, and for future SMD missions using DSN assets. 35he DSN consists of three facilities spaced equidistant from each other-∼120 deg apart in longitude-around the world.These sites are at Goldstone, near Barstow, California; near Madrid, Spain; and near Canberra, Australia.The strategic placement of these sites permits virtually constant communication with spacecraft as Earth rotates.
The study team was co-chaired by JWST and Space Communications and Navigation leadership and consisted of a team of subject matter experts representing different areas of interest.The issues were found to fall into at least one of two major themes.They were either due to a lack of true understanding of the needs, assumptions, or requirement of either side during the mission planning phase or they could be attributed to the DSN's ongoing challenge to balance limited supply of assets while there was a growing mission demand.
The report detailed the issues identified and laid out recommendation for JWST and DSN to make both near-and long-term improvements to the current situation.Many of the longer-term improvements are geared toward future missions and, specifically, planning around the Artemis use of the system as it is a critical manned mission likely to directly overlap with JWST science data throughput.

Recommendations or Future Missions
7][38] This section presents these recommendations.

Bigger Launchers
JWST maximized the Observatory size that would fit into the largest available faring at the time it was designed.Mass margin and stowed volume clearance to the launcher fairing were among the primary challenges to JWST design.Later in development and during I&T, JWST was constantly challenged by limited mass margin, and this complicated all major trades, including the problems associated with cryogenic design.
The next generation of launchers (Space-X Starship, Blue Origin New Glenn, and NASA/ Boeing SLS) offers considerable increases in mass and volume capability.Mass to orbit capability possible with the bigger launchers, up to 100,000 kg to low-Earth orbit (LEO), provides sufficient mass capability to enable large mass margins on an Observatory larger than JWST.The projected volumes of these fairings can accommodate observatories with apertures between 6 and 9 m using the JWST segmented architecture with winged deployment approach for the primary mirror.Significant leaps in mass to orbit capability (such as up to 100,000 kg to low earth orbit) enables large mass margins early in the program, which can be used not only for simplifying design initially but also for resolving issues and optimizing trades over time.Much is still not known about the performance of these future launchers, including cleanliness that is critical for UV performance, venting that is key for deployable components with large surface areas and trapped air volume, vibroacoustic levels, actual useable fairing volumes (including in length), and many other details that could even evolve with subsequent generations.Nonetheless, observatory architectures that can fit in any-and-all three of the known next generation of large rockets would minimize risk and programmatic volatility even as these rocket designs mature and evolve.

Evolution versus Revolution
The JWST telescope experience is that "the devil is in the details" and many of these details are refined between PDR and CDR.Finding design issues and conducting trades that result in cross-interface architecture changes can be costly to a program.
The JWST segmented aperture architecture offers a flexible developmental head start for large aperture space telescopes (>6 m diameter).This includes how to measure and perform metrology of mirror segments, how to mount them, and how to align them-critical attributes that have all already been learned and demonstrated on JWST.Similarly, the telescope deployment methods of a "winged" primary mirror are demonstrated to work on orbit, is well understood, and is low risk.Extensive ground development work and on-orbit experience exists for wavefront sensing, alignment, and control of a segmented mirror; it is well understood and has been demonstrated through commissioning.Finally, the segmented design has proven verification and testing methods.
The JWST architecture offers many advantages as a starting point for future large observatories.Its on-orbit performance is known, and this performance to-date has exceeded all requirements.Its passive optical stability characteristics are within striking distance of general class science needs and those that require active wavefront management.The segmented architecture, along with the wing deployment approach, is flexible for aperture size and launch vehicle faring size, allowing various configurations of Starship, New Glenn, and SLS.Having a significant head-start on the primary mirror technologies will reduce the number of new "devil in the detail" trades that can be encountered late in the design phase.

Servicing
Although, in its final design, JWST was not designed for serviceability, many attempts were made to make portions of JWST, especially the instruments, as modular as possible for ease of ground assembly and test.Serviceability of future large astrophysics observatories will be an enabling part of the evolution from JWST.Significant heritage exists from the successful Hubble servicing, and new robotic servicing technology and techniques are under development with demonstrated capability on the horizon.There are key enablers and considerations that can be used as design principals early on that can be value added without adding excessive cost and schedule burden to accommodate a yet un-architected serviceability.
The main method to enable serviceability is a modular design with common design choices and interfaces.This not only has the benefit of enabling serviceability, but it can greatly improve the efficiency of design, analysis, and ground integration of the components or subassemblies.Reuse of complex models, ground test equipment, and handling GSE can reduce the schedule to build the next generation of subsystems and instruments.This was seen in the early days of Webb, where the instrument development was often in parallel or in front of the overall observatory design.Accommodating interface changes once long-lead items are in final design or manufacturing has rippling impacts on cost, schedule, and even performance.A planned service and instrument upgrade could soften the need for long lead instrument procurements as it would put the Observatory architecture and performance as the top tier requirement of the initial build and launch.
In addition, JWST has an entire system of fit-check units, test units, and simulators that were developed over the years to support the parallel development of the subsystems and to support the flight system with ground test and troubleshooting capabilities.The vast majority of this equipment had suffered in fidelity as the years of budget woes plagued JWST.Now much of this hardware and software have no future value to the JWST mission or to other projects as the equipment was customized to perform only one function for one custom set of hardware.A goal of the first-generation support systems, both hardware and software, would be to serve again in the build and test of the later generation of serviced subsystem or to become a part of a ground-based verification platform for the later generations of hardware.

Performance Margins
The importance of ample performance margins for new missions cannot be over stressed.Novel systems architectures are full of new uncertainties and unanticipated subsystem interactions that will usually surface only during the most detailed design phases.This was clearly the case for JWST cryogenic margins, which were challenged by the parasitic load sources.In addition, the jitter sneak paths from the cooler compressors to the telescope were found during the detailed design phase.The thermal lift margins of the cooler were one of chief enablers for on-orbit cooler tuning to address this issue.
Another area where margins proved to be advantageous to JWST was the strength margins that existed in the MRD mechanisms to address the unanticipated loads from the rapid depressurization at fairing jettison.It should also be noted that, the uncertainty of the actual capability of these mechanisms caused schedule delays for additional testing late in the project.To avoid such situations in future projects, it is strongly recommended that new mechanism or structural designs be tested to failure to provide certain knowledge of their actual capability, and thus the actual margins present in the design.
Another key challenge in general was coupled-loads analyses often led to cases where there was initially determined to be negative margins on factor of safety.Subsequent, more detailed analyses often showed that there was not a hardware issue.However, these efforts were costly in time and resources.To avoid this situation, if adequate mass exists, minimum margins of safety (not just factors of safety) should be required of the design as smart design principles across the board.
The estimation of the performance margins required to reliably address uncertainties against mission objectives should be determined as early as possible.Such determinations will require early architecture work to define and characterize the behaviors of system interfaces.Such early architecture studies should be performed as early as possible, and in parallel with the early technology development efforts.JWST expended considerable effort in upfront technology development, and reaped the fruit of this effort but could have developed architecture earlier as the delay in details of this did lead to technical problems.Such studies require well defined and funded tasks upfront to define the architecture in enough detail to find the risks areas.Evolution of a previously known and successful architecture such as JWST can be highly advantageous for just this purpose.
Finally, the scenarios performed by systems modeling need to be carefully considered and should include nominal cases without conservative modeling uncertainty factors applied.It is a common practice for product organizations to deliver their models with hidden conservative factors and/or assumption applied.These bounding case models can often hide existing margins and can also have the detrimental effect of being "case inconsistent" with other model deliveries.The hidden conservative assumptions in one model may not be consistent with the assumptions in other models.This can have the effect of either producing system model predictions that are too conservative or potentially having a systems model in which the individual assumptions cancel each other, producing a prediction not as conservative as thought.To yield the best and most informed estimates of system margin, all model deliveries should include at least a nominal version without hidden conservative factors to be used at the system level for case consistent predictions of margins.
Nominal case consistent model runs can also be extremely valuable for the operations to set expectations of what a nominal behavior is expected, and even more importantly, what offnominal behavior looks like.This was particularly evident during JWST early operations where solar array output power appeared to be low but should have been easily anticipated given the actual temperature gradients that would appear across the five deployed panels.

Importance of Full Scale or High-Fidelity Test Beds
The JWST verification and validation program could not have been fully implemented on flight hardware.Many of the key performance requirements in the JWST program are verified by analysis with models validated by test.In some cases, multiple methods and/or duplication of testing may be implemented for risk mitigation or cross-checking purposes.The goal is to minimize the risk associated with on-orbit performance via an affordable, comprehensive verification program.To that effect, hardware models and analytical models were key to the success of JWST.To ensure that the analytical models were validated, they first modeled the test and were correlated to the test results.Then, the parameters from the test model could be used in flight models for verification.In many instances of this process, two independent teams would build, correlate, and analyze model using different tools and different approaches.This reliance on this process for a full verification method necessitated the use of test beds to verify these analytical models.In addition, these test beds and simulators were able to be built early, as part of an ETU program, and then later updated to be flight-like in key areas.Future observatories will need to plan these test beds and ETU programs into the verification program early and work with management to ensure that their importance to the overall verification program is understood such that they are not descoped or otherwise cut from the early program priorities.In addition, the facilities and staffing to accommodate these test beds will need to be part of the early planning of the program such that they are not underfunded.

Failure Modes and Effects Analysis and Inspections
When an observatory design necessitates points where a single failure results in full or probable mission loss, those design features must be given full attention management, system engineering, and mission assurance early.Those subsystems should have scrutinized FMEA, even for hardware that is considered "heritage" because it has been used on other flight systems.As part of that analysis, a process-related FMEA should also be performed for all hardware that could be sensitive to workmanship failures.This is particularly true for hardware that cannot be tested fully in its final configuration.The NEA devices are the best example of this on JWST, as once the fuse wire was triggered, the device was spent.Therefore, the assembly could be tested for overall functionality, but the actual release device was new in each instance.Also, the folding and unfolding of the sunshield is a prime example in which small details of workmanship are quite significant and can change the outcome of each-and-every deployment.Only enough review of the process to work through and reduce the possible deviations can lower this risk.
To that end, inspection points are important.These inspection points serve to have a second set of eyes on the hardware as well as stopping to document that point, with photographs and other documentation that might apply to that inspection point.Although this process is often thought of as obtrusive, other applications, such as major surgery in hospitals, employ the same method of a second, verifying, review of critical steps before proceeding on.

Telescope Barrels
The open architecture of the JWST primary and secondary optics was reviewed and analyzed early on for micrometeoroid damage.As JWST is now providing trending data on the damage imparted on the primary mirror by what is known at the sporadic flux of micrometeoroids orbiting the sun, the value of a barrel that shields the primary optic from such damage is desired for missions that are particularly sensitive to WFE or scatter.In addition to micro-meteor protection, a telescope barrel will also be necessary as a contamination mitigation for on-orbit servicing spacecraft, particularly for UV and visible telescopes that are subject to degradation from photopolymerization.As replacing mirrors on a multi-decade mission is likely beyond the scope of servicing for the next observatory, a barrel or baffle to shield the primary and secondary optics will be warranted.Note that future far infrared missions may be able to tolerate the effects of micrometeoroids and could be an open design.

On-Orbit Cameras
Finally, the JWST project investigated the addition of cameras on or near the Observatory early in the JWST development but incorporating them was ultimately rejected.First of all, JWST is large and underwent many configuration changes during deployment and had many specific locations of importance to deployment.Using cameras on the observatory would have required either multiple narrow-field cameras, adding significant complexity, or a few wide-field cameras that would yield little in the way of helpful detailed information.Wiring harnesses for cameras would have had to cross some articulating deployment interfaces and add more mechanical and thermal leak paths, presenting a particular challenge for cameras located on the cold side of JWST.Then, there was the issue of illumination.JWST is very shiny, so visible cameras on the Sun-facing side would be subject to extreme glare and contrast issues, whereas ones on the dark, cold, shaded, space-facing side would need added lighting.Although infrared or thermal-imaging cameras on the cold side may have obviated the need for some illumination, they would still have presented, the same harnessing disadvantages.Furthermore, cameras on the cold side would have to work at very cold "cryogenic" temperatures, either requiring "ordinary" ones to be encapsulated or insulated so they would work and not fracture in extreme cold or developing special-purpose cryogenic-compatible cameras just for deployment surveillance.In addition, there was no method to connect the cameras to the data system to effectively download the images without major architectural changes even during formulation.And of course, JWST had a very challenging and ever-present mass constraint.Notwithstanding these challenges, some camera schemes were mocked-up and tested on full-scale mockups of JWST hardware, and it was determined that deployment surveillance cameras installed on JWST would be add risk, not reduce it.Regardless, JWST's built-in sense of "touch," e.g., switches and various mechanical, electrical, and temperature sensors, as well as indirect sensing, such as temperatures and rate sensing gyros, provided much more useful and definitive information than surveillance cameras likely could.Late in development, well into I&T, the opportunity arose to consider CubeSats with cameras "formation flying" with JWST, but it was also considered too risky for the technology of CubeSats in the L2 orbit at the time.Moreover, there was no mass, power, or volume for such hardware in the JWST launch faring.However, technology has progressed significantly since this study was performed and the next Observatory could architect in such a machine vision system early, integrating it with the data and communication systems and even incorporating this system into the verification program.Architecting the camera systems from the very beginning affords the designers the ability to consider ways of effectively using that feedback system in the deployment system's fault identification and recover plans.Finally, the benefits of a camera system on JWST would have extended well past the deployment phase of the mission.Information on health and quality of the sunshield or information useful to a possible refueling/servicing mission on JWST could have been gained.The public involvement and excitement generated by such imagery should also not be left unstated.Had this been in the original concept of JWST and had it been afforded the needed resources, it would have been a very valuable subsystem.Therefore, one lesson learned from the JWST project is that the inclusion of vision system should be included in the baseline architecture trade space of future flagship missions.

Mechanism Testing
Much of the methodology for life and performance testing of mechanism for NASA is based on experience with lower earth and geo-synchronous orbit satellites.These methods do not easily translate into a long-duration mission at L2, with stable thermal environments but other unique conditions, such as cryogenic and critical deployment mechanisms.These mechanisms cannot be evaluated by the lower earth and geo-synchronous standards and new standards could now be evolved from the JWST experience.To this end, the actual failure mechanism of designs must be understood.Testing or stressing the life qualification mechanism to failure informs the team as to at least one likely failure mode of that system.It also allows for true margins to be understood and properly modeled.Examples of this can be found in the deployment system for JWST as well as in the instrument suite, where temperature cycling of the hardware was performed due to conditions experienced during the ground test campaign, not due to on-orbit thermal conditions.

Summary
The JWST on-orbit performance meets or exceeds all mission and science requirements.This was accomplished by a dedicated team with all aspects of programmatic and technical involvement.Risks were identified and a diverse team worked to understand and mitigate risks where possible.To build an Observatory that is a leap forward in technology and capability from all that existed before is possible.The lessons that were learned during this process can help guide and enable the next leap forward in space science.
1. Mass and volume can help simplify the design by allowing subsystems to maintain performance independence.Carrying large margins from the beginning will be used to solve problems as they arise.Large rockets will aid in providing mass and volume capability.
Compatibility with all the generation of large rockets currently being developed would be prudent for future great observatories.2. Verification of an observatory that is too large or complex to be end-to-end tested on the ground will have major driving requirements verified by analysis.This analysis needs to be supported by engineering units and test beds and the plans for these items must be part of the baseline.More reliance on active controls can simplify modeling and verification but itself needs a testbed and demonstration strategy.3. System engineering processes were used in every phase of the program, from initial concepts to commissioning.Developing a strong systems team that is integrated across discipline and organizations is crucial.Comprehensive mission system engineering needs to start at the very beginning even during science assessments, technology road-mapping, and international collaboration definition phases to assure good interfaces, robust verification, and proper architecting.4. TPMs and the margins held at each project lifecycle review will be customized for a oneof-a-kind observatory.Evolution of the JWST design will provide a baseline and rationale of target margins for the next observatory.Future programs should strive for ample margins to enable the requisite flexibility to optimally manage challenges during development.5. Integrated modeling is required for a complex design with system-level interactions between hardware.The team and processes to implement a successful modeling effort along-side a design and test program takes considerable planning and clear process control.6. Mechanism requirements need to be identified or developed to support the environment and use of those mechanisms over the life of the next flagship observatory.7. Failure assessments of critical items, such as single faults that can result in mission loss, require complete assessments of the hardware and workmanship driven processes.Inspection points are critical to the verify and document the workmanship.8. Serviceability and features that support serviceability, such as camera systems, should be considered early as part of the baseline design definition as a separate subsystem, which can then be included in various architectural and performance trades.

Disclosures
The authors declare that the research was conducted in the absence of any commercial or financial relationships that could be construed as a potential conflict of interest.
Michael Menzel is the NASA mission systems engineer for the James Webb Space Telescope (JWST) at the Goddard Space Flight Center in Greenbelt, Maryland.He has held this position since he joined NASA in June 2004.His involvement with the James Webb Project extends back to 1998 when he became the chief systems engineer for Lockheed Martin's Pre-Phase A studies for the then Next Generation Space Telescope and later for Lockheed's Phase A JWST contract.In 2001, he joined the Northrop Grumman James Webb systems engineering team.
Keith Parrish was the observatory and commissioning manager for the JWST.He also led the development of Webb's cryogenic thermal architecture and thermal test and verification program.He is currently the deputy project manager for the GOES-R series of geostationary weather satellites.He received his BS degree in aerospace engineering from the University of Maryland at College Park and his MS degree in mechanical systems engineering from the George Washington University in Washington, D.C.
Lee Feinberg has been the JWST telescope manager and optics lead at NASA's Goddard Space Flight Center in Greenbelt, Maryland, since 2002, where he had a leading role in the optics technology development, telescope design, integration, and test and commissioning of the telescope.Prior to that he was the assistant chief for technology in the Instrument Systems and Technology Division at Goddard.He is a fellow of the Society of Photo-Optical Instrumentation Engineers (SPIE) and a NASA Goddard Space Flight Center Senior Fellow.
Paul Geithner is a retired NASA civil servant and current employee of Heliospace Corporation.Most recently, He was the deputy project manager-technical for the JWST and previously served as observatory manager, program executive, instrument systems manager, and mission systems engineer.He also worked on the optical correction for and upgrades to the Hubble Space Telescope.He received his BSEE degree from Virginia Tech and his MBA degree from the University of Virginia.

Fig. 4
Fig. 4 The JWST systems engineering life cycle timeline.*JWST began formulation prior to the current definition of NASA's KDP A.

Fig. 5
Fig. 5 (a) The JWST Observatory prior to its final folding for launch and (b) the JWST Launch aboard the Ariane 5 Launcher on December 25, 2021.

Fig. 11
Fig. 11 Integrated modeling cycles between the system requirements review and SDR.

Fig. 14
Fig. 14 JWST verification by analysis and test.

1 .
Performance margins large enough to bound the resulting degradations that could result as determined by Monte-Carlo analyses or by characterization from testbed or engineering test unit (ETU) tests.2. The incorporation of workmanship tests of the assembled flight hardware to bound the magnitude of such workmanship errors.

Fig. 15
Fig. 15 JWST technologies reviewed during its T-NAR in January of 2007.

Fig. 18
Fig.18Evolution of the JWST observatory from a concept.

Fig. 21
Fig. 21 Decrease of cryogenic radiator margin with mass margin.

Fig. 22
Fig. 22 Changes to the ISIM cryogenic radiators to address the CDR margin deficiency.

Sec. 3
.7.4 for further details on the stray light investigation and mitigations developed during commissioning.

Fig. 25
Fig. 25 Location of the OTIS to spacecraft launch release devices with ¾" NEA.

Fig. 26
Fig. 26 Key JWST engineering test units and hardware test beds.

Fig. 27
Fig. 27 Schematic and photograph of a nominal JLAB.
failure (February 2019) During functional testing just prior to SCE thermal vac tests TWTA-1 unexpectedly powered off Manufacturer determined the failure was caused by a parts failure in the TWTA electrical power conditioner TWTA manufacturer (TESAT) reviewed data and recommended removal A replacement TWTA was assembled, installed into the spacecraft March 2020 by partial removal of the -J2 equipment panel CTP-2 failure (February 2019) Subsequent to −12 dB Z -axis sine vibe, during initial SC power on, CTP-2 did not power ON as expected Manufacturer determined the failure was caused by a transformer parts failure in the CTP During functional testing just prior to SCE thermal vac tests CTP-2 unexpectedly powered off An engineering model of the CTP was upgraded to flight qualification (CTP-3) and used as a flight replacement CTP manufacturer (Northrop Grumman) reviewed data and recommended removal The replacement unit was installed into the spacecraft March 2020 by partial removal of the -J2 equipment panel S-band transponder-1 failure (January 2021) Following observatory level sine vibe tests S-band transponder-1 receiver looped continuously in a watchdog reset condition during power up attempt Root cause was identified as a bad solder joint in a coax connector due to deficient workmanship and inspection Joint was repaired and all joints inspected and upgraded as needed Transponder-1 was removed for repair by the manufacturer (TASI) Unit was re-integrated into the spacecraft and observatory regression testing was conducted.Unit re-installation did not require spacecraft removal due to accessibility S-band transponder-2 failure (January 2021) Following observatory level sine vibe tests S-band transponder-2 transmitter output was 6 dB lower than expected Root cause was identified as a bad weld joint in a coax connector due to deficient workmanship and inspection Joint was repaired and all joints inspected and upgraded as needed Transponder-2 was removed for repair by the manufacturer (TASI) Unit was re-integrated into the spacecraft and observatory regression testing was conducted.Unit re-installation did not require spacecraft removal due to accessibility to these new requirements.The entire exercise took approximately 2 years.The exercise used data from five Ariane flights prior to JWST, with modified vent valves on the last two launches.

Fig. 28
Fig. 28 Re-installation operations of the TWTA and CTP.
fault management Faulty reading on the redundant FSS Issue investigated and changes made to operations to reduce risk of reoccurrence 3.7.2Solar array performance in early commissioning Temperatures of a partially deployed configuration impacted on array power output The power consumption of the observatory was minimized until the sunshield deployment was complete, resulting in the final thermal state of the solar array 3.7.3Deployment indicator switches Some sunshield deployment indicator switches did not indicate that the sunshield had fully deployed Sunshield's membrane covers were successfully deployed, but, due to on-orbit conditions that were not simulated on the ground, the sensors did not properly indicate a status of "deployed" 3.7.4Stray light in commissioning images A late design change in the telescope resulted in low-angle scatter from light impinging on non-optical surfaces entering the instruments' optical systems Developed calibrations and bright object avoidance zones to maximize the quality of the images.The resulting light contamination is well below requirement levels, but efforts maximized the science return 3.7.5 Line-of-sight performance Minor improvements in tuning of FGS, the fine steering mirror, and the star trackers to optimize performance

Table 1
Comparison of WFE: requirement, prediction, and measurement.

Table 2
Avionics box failures during the spacecraft and observatory I&T program.

Table 3
Summary of commissioning anomalies.