Search NASA⌕ Search

SEARCH · Search NASA

Results for “fault protection”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 217 records · Page 12
All sourcesNASA NTRSDOE OSTI
NASA NTRS2004

Power Actuation and Switching Module Development

The Deep Space Avionics (DSA) Project is developing a Power Actuation and Switching Module (PASM). This component enables a modular and scalable design approach for power switching applications, which can result in a wide variety of power switching architectures using this simple building block. The PASM is designed to provide most of the necessary power switching functions of spacecraft for various Deep Space missions including future missions to Mars, comets, Jupiter and its moons. It is fabricated using an A SIC process that is tolerant of high radiation. The development includes two application specific integrated circuits (ASICs) and support circuitry all packaged using High Density Interconnect (HDI) technology. It can be operated in series or parallel with other PASMs, It can be used as a high-side or low-side switch and it can drive thruster valves, pyrotechnic devices such as NASA standard initiators, bus shunt resistors, and regular spacecraft component loads. Each PASM contains two independent switches with internal current limiting and over-current trip-off functions to protect the power subsystem from load faults. During turnon and turnoff each switch can limit the rate of current change (di/dt) to a value determined by the user. Threeway majority-voted On/Off commandability and full switch status telemetry (both analog and digital) are built into the module. This paper describes the development process used to design, model, fabricate, and test these compact and versatile power switches. Preliminary test results from prototype HDI PASM hardware are also discussed.

Power Actuation and Switching Module (PASM)↗
NASA NTRS1984

Communications protocols for a fault tolerant, integrated local area network for Space Station applications

The evolutionary growth of the Space Station and the diverse activities onboard are expected to require a hierarchy of integrated,local area networks capable of supporting data, voice and video communications. In addition, fault tolerant network operation is necessary to protect communications between critical systems attached to the net and to relieve the valuable human resources onboard Space Station of day-to-day data system repair tasks. An experimental, local area network is being developed which will serve as a testbed for investigating candidate algorithms and technologies for a fault tolerant, integrated network. The establishment of a set of rules or protocols which govern communications on the net is essential to obtain orderly and reliable operation. A hierarchy of protocols for the experimental network is presented and procedures for data and control communications are described.

Meredith, B. D.↗
NASA NTRS2017

Risk-Significant Adverse Condition Awareness Strengthens Assurance of Fault Management Systems

As spaceflight systems increase in complexity, Fault Management (FM) systems are ranked high in risk-based assessment of software criticality, emphasizing the importance of establishing highly competent domain expertise to provide assurance. Adverse conditions (ACs) and specific vulnerabilities encountered by safety- and mission-critical software systems have been identified through efforts to reduce the risk posture of software-intensive NASA missions. Acknowledgement of potential off-nominal conditions and analysis to determine software system resiliency are important aspects of hazard analysis and FM. A key component of assuring FM is an assessment of how well software addresses susceptibility to failure through consideration of ACs. Focus on significant risk predicted through experienced analysis conducted at the NASA Independent Verification Validation (IVV) Program enables the scoping of effective assurance strategies with regard to overall asset protection of complex spaceflight as well as ground systems. Research efforts sponsored by NASA's Office of Safety and Mission Assurance defined terminology, categorized data fields, and designed a baseline repository that centralizes and compiles a comprehensive listing of ACs and correlated data relevant across many NASA missions. This prototype tool helps projects improve analysis by tracking ACs and allowing queries based on project, mission type, domaincomponent, causal fault, and other key characteristics. Vulnerability in off-nominal situations, architectural design weaknesses, and unexpected or undesirable system behaviors in reaction to faults are curtailed with the awareness of ACs and risk-significant scenarios modeled for analysts through this database. Integration within the Enterprise Architecture at NASA IVV enables interfacing with other tools and datasets, technical support, and accessibility across the Agency. This paper discusses the development of an improved workflow process utilizing this database for adaptive, risk-informed FM assurance that critical software systems will safely and securely protect against faults and respond to ACs in order to achieve successful missions.

Fault management↗
NASA NTRS2017

Risk-Significant Adverse Condition Awareness Strengthens Assurance of Fault Management Systems

As spaceflight systems increase in complexity, Fault Management (FM) systems are ranked high in risk-based assessment of software criticality, emphasizing the importance of establishing highly competent domain expertise to provide assurance. Adverse conditions (ACs) and specific vulnerabilities encountered by safety- and mission-critical software systems have been identified through efforts to reduce the risk posture of software-intensive NASA missions. Acknowledgement of potential off-nominal conditions and analysis to determine software system resiliency are important aspects of hazard analysis and FM. A key component of assuring FM is an assessment of how well software addresses susceptibility to failure through consideration of ACs. Focus on significant risk predicted through experienced analysis conducted at the NASA Independent Verification & Validation (IV&V) Program enables the scoping of effective assurance strategies with regard to overall asset protection of complex spaceflight as well as ground systems. Research efforts sponsored by NASAs Office of Safety and Mission Assurance (OSMA) defined terminology, categorized data fields, and designed a baseline repository that centralizes and compiles a comprehensive listing of ACs and correlated data relevant across many NASA missions. This prototype tool helps projects improve analysis by tracking ACs and allowing queries based on project, mission type, domain/component, causal fault, and other key characteristics. Vulnerability in off-nominal situations, architectural design weaknesses, and unexpected or undesirable system behaviors in reaction to faults are curtailed with the awareness of ACs and risk-significant scenarios modeled for analysts through this database. Integration within the Enterprise Architecture at NASA IV&V enables interfacing with other tools and datasets, technical support, and accessibility across the Agency. This paper discusses the development of an improved workflow process utilizing this database for adaptive, risk-informed FM assurance that critical software systems will safely and securely protect against faults and respond to ACs in order to achieve successful missions.

IV&V↗
NASA NTRS1978

Shock Prevention

The electrician pictured is installing a General Electric Ground Fault Interrupter (GFI), a device which provides protection against electrical shock in the home or in industrial facilities. Shocks due to defective wiring in home appliances or other electrical equipment can cause severe burns, even death. As a result, the National Electrical Code now requires GFIs in all new homes constructed. This particular type of GFI employs a sensing element which derives from technology acquired in space projects by SCI Systems, Inc., Huntsville, Alabama, producer of sensors for GE and other manufacturers of GFI equipment. The sensor is based on the company's experience in developing miniaturized circuitry for space telemetry and other spacecraft electrical systems; this experience enabled SCI to package interruptor circuitry in the extremely limited space available and to produce sensory devices at practicable cost. The tiny sensor measures the strength of the electrical current and detects current differentials that indicate a fault in the functioning of an electrical system. The sensing element then triggers a signal to a disconnect mechanism in the GFI, which cuts off the current in the faulty circuit.

Source record↗
NASA NTRS1985

SSME digital control design characteristics

To protect against a latent programming error (software fault) existing in an untried branch combination that would render the space shuttle out of control in a critical flight phase, the Backup Flight System (BFS) was chartered to provide a safety alternative. The BFS is designed to operate in critical flight phases (ascent and descent) by monitoring the activities of the space shuttle flight subsystems that are under control of the primary flight software (PFS) (e.g., navigation, crew interface, propulsion), then, upon manual command by the flightcrew, to assume control of the space shuttle and deliver it to a noncritical flight condition (safe orbit or touchdown). The problems associated with the selection of the PFS/BFS system architecture, the internal BFS architecture, the fault tolerant software mechanisms, and the long term BFS utility are discussed.

Mitchell, W. T.↗
NASA NTRS1991

Nickel-hydrogen LEO cycling at 20 percent - 50 percent DOD

The test setup consists of four major elements: the programmable power supplies and load banks, the data acquisition and control system control computer, and the NiH2 specimen test cells. A simplified block diagram of the test setup is shown. The test setup provides complete battery isolation should a fault occur, and fusing as necessary to protect the battery cells and other equipment. Front panel switches provide for power supply configuration and battery isolation. Front panel meters provide continuous real-time visual monitoring of the voltage and current for each pack of cells. A strip chart recorder provides a hard copy of the voltage and current profiles for each of the packs. The test operates continuously with minimal human interface, except during special tests. The two power supplies are controlled by resistance programming. A bank of resistors and relays was built which can be switched by the control computer to provide control over the charge current to the batteries. The load banks are controlled by the 3497A. The 3497A is equipped with a 0.5 volt programmable power supply which is used to voltage program the load banks. A Hewlett-Packard Vectra 9000 running an HP Basic program is used as the control computer to remotely instruct the 3497A (data acquisition and control) to scan the data channels and retrieve test data. The program then reads, calculates, and stores the data. If an anomaly occurs, the program will disconnect the cells and shut down the test to avoid damage to the cells or equipment.

Lowery, John E.↗
NASA NTRS2010

Compact, Reliable EEPROM Controller

A compact, reliable controller for an electrically erasable, programmable read-only memory (EEPROM) has been developed specifically for a space-flight application. The design may be adaptable to other applications in which there are requirements for reliability in general and, in particular, for prevention of inadvertent writing of data in EEPROM cells. Inadvertent writes pose risks of loss of reliability in the original space-flight application and could pose such risks in other applications. Prior EEPROM controllers are large and complex and do not provide all reasonable protections (in many cases, few or no protections) against inadvertent writes. In contrast, the present controller provides several layers of protection against inadvertent writes. The controller also incorporates a write-time monitor, enabling determination of trends in the performance of an EEPROM through all phases of testing. The controller has been designed as an integral subsystem of a system that includes not only the controller and the controlled EEPROM aboard a spacecraft but also computers in a ground control station, relatively simple onboard support circuitry, and an onboard communication subsystem that utilizes the MIL-STD-1553B protocol. (MIL-STD-1553B is a military standard that encompasses a method of communication and electrical-interface requirements for digital electronic subsystems connected to a data bus. MIL-STD- 1553B is commonly used in defense and space applications.) The intent was to both maximize reliability while minimizing the size and complexity of onboard circuitry. In operation, control of the EEPROM is effected via the ground computers, the MIL-STD-1553B communication subsystem, and the onboard support circuitry, all of which, in combination, provide the multiple layers of protection against inadvertent writes. There is no controller software, unlike in many prior EEPROM controllers; software can be a major contributor to unreliability, particularly in fault situations such as the loss of power or brownouts. Protection is also provided by a powermonitoring circuit.

Katz, Richard↗
NASA NTRSDate not supplied

Convergent Aeronautics Solutions (CAS) High Voltage Hybrid Electric Propulsion (HVHEP) Activity

Overview of Convergent Aeronautics Solutions (CAS) High Voltage Hybrid Electric Propulsion (HVHEP) activity. CAS HVHEP activity demonstrated feasibility of variable frequency, variable high voltage power system using doubly fed electric machines (DFM), and provided 90% reduction in power electronic weight for 35 megawatt system. DFM enables multi-phase (9) ac operation, with enhanced control and integrated protection methods for improved safety through minimization of fault energy.

CAS↗
NASA NTRS1971

Fast-acting self-healing metallic fuse.

Description of a fast-acting nonmechanical self-healing mercury fuse capable of protecting a high current circuit or device from overcurrent fault damages. Basically the self-healing fuse consists of two enclosed mercury reservoirs connected by a fine capillary tube filled with mercury that serves as the fusing element. It is pointed out that a better understanding of the energy conversion process involved in the operation of the device could help explore other device configurations (such as a tapering geometry and use of magnetic field to drive the arc into the fuse wall on inductive loads, etc.) and thus extend the range of capabilities for this type of protective device.

Schwartz, F. C.↗
NASA NTRS1974

Design analysis and computer-aided performance evaluation of shuttle orbiter electrical power system. Volume 1: Summary

Studies were conducted to develop appropriate space shuttle electrical power distribution and control (EPDC) subsystem simulation models and to apply the computer simulations to systems analysis of the EPDC. A previously developed software program (SYSTID) was adapted for this purpose. The following objectives were attained: (1) significant enhancement of the SYSTID time domain simulation software, (2) generation of functionally useful shuttle EPDC element models, and (3) illustrative simulation results in the analysis of EPDC performance, under the conditions of fault, current pulse injection due to lightning, and circuit protection sizing and reaction times.

Source record↗
NASA NTRS1990

VIPER project

The VIPER project has so far produced a formal specification of a 32 bit RISC microprocessor, an implementation of that chip in radiation-hard SOS technology, a partial proof of correctness of the implementation which is still being extended, and a large body of supporting software. The time has now come to consider what has been achieved and what directions should be pursued in the future. The most obvious lesson from the VIPER project was the time and effort needed to use formal methods properly. Most of the problems arose in the interfaces between different formalisms, e.g., between the (informal) English description and the HOL spec, between the block-level spec in HOL and the equivalent in ELLA needed by the low-level CAD tools. These interfaces need to be made rigorous or (better) eliminated. VIPER 1A (the latest chip) is designed to operate in pairs, to give protection against breakdowns in service as well as design faults. We have come to regard redundancy and formal design methods as complementary, the one to guard against normal component failures and the other to provide insurance against the risk of the common-cause failures which bedevil reliability predictions. Any future VIPER chips will certainly need improved performance to keep up with increasingly demanding applications. We have a prototype design (not yet specified formally) which includes 32 and 64 bit multiply, instruction pre-fetch, more efficient interface timing, and a new instruction to allow a quick response to peripheral requests. Work is under way to specify this device in MIRANDA, and then to refine the spec into a block-level design by top-down transformations. When the refinement is complete, a relatively simple proof checker should be able to demonstrate its correctness. This paper is presented in viewgraph form.

Kershaw, John↗
NASA NTRS2008

Algorithm-Based Fault Tolerance Integrated with Replication

In a proposed approach to programming and utilization of commercial off-the-shelf computing equipment, a combination of algorithm-based fault tolerance (ABFT) and replication would be utilized to obtain high degrees of fault tolerance without incurring excessive costs. The basic idea of the proposed approach is to integrate ABFT with replication such that the algorithmic portions of computations would be protected by ABFT, and the logical portions by replication. ABFT is an extremely efficient, inexpensive, high-coverage technique for detecting and mitigating faults in computer systems used for algorithmic computations, but does not protect against errors in logical operations surrounding algorithms.

Some, Raphael↗
NASA NTRS2009

Methodologies for Adaptive Flight Envelope Estimation and Protection

This paper reports the latest development of several techniques for adaptive flight envelope estimation and protection system for aircraft under damage upset conditions. Through the integration of advanced fault detection algorithms, real-time system identification of the damage/faulted aircraft and flight envelop estimation, real-time decision support can be executed autonomously for improving damage tolerance and flight recoverability. Particularly, a bank of adaptive nonlinear fault detection and isolation estimators were developed for flight control actuator faults; a real-time system identification method was developed for assessing the dynamics and performance limitation of impaired aircraft; online learning neural networks were used to approximate selected aircraft dynamics which were then inverted to estimate command margins. As off-line training of network weights is not required, the method has the advantage of adapting to varying flight conditions and different vehicle configurations. The key benefit of the envelope estimation and protection system is that it allows the aircraft to fly close to its limit boundary by constantly updating the controller command limits during flight. The developed techniques were demonstrated on NASA s Generic Transport Model (GTM) simulation environments with simulated actuator faults. Simulation results and remarks on future work are presented.

Tang, Liang↗
NASA NTRS2010

Integral Battery Power Limiting Circuit for Intrinsically Safe Applications

A circuit topology has been designed to guarantee the output of intrinsically safe power for the operation of electrical devices in a hazardous environment. This design uses a MOSFET (metal oxide semiconductor field-effect transistor) as a switch to connect and disconnect power to a load. A test current is provided through a separate path to the load for monitoring by a comparator against a preset threshold level. The circuit is configured so that the test current will detect a fault in the load and open the switch before the main current can respond. The main current passes through the switch and then an inductor. When a fault occurs in the load, the current through the inductor cannot change immediately, but the voltage drops immediately to safe levels. The comparator detects this drop and opens the switch before the current in the inductor has a chance to respond. This circuit protects both the current and voltage from exceeding safe levels. Typically, this type of protection is accomplished by a fuse or a circuit breaker, but in order for a fuse or a circuit breaker to blow or trip, the current must exceed the safe levels momentarily, which may be just enough time to ignite anything in a hazardous environment. To prevent this from happening, a fuse is typically current-limited by the addition of the resistor to keep the current within safe levels while the fuse reacts. The use of a resistor is acceptable for non-battery applications where the wasted energy and voltage drop across the resistor can be tolerated. The use of the switch and inductor minimizes the wasted energy. For example, a circuit runs from a 3.6-V battery that must be current-limited to 200 mA. If the circuit normally draws 10 mA, then an 18-ohm resistor would drop 180 mV during normal operation, while a typical switch (0.02 ohm) and inductor (0.97 ohm) would only drop 9.9 mV. From a power standpoint, the current-limiting resistor protection circuit wastes about 18 times more power than the switch and the inductor configuration. In the fault condition, both the resistor and the inductor react immediately. The resistor reacts by allowing more current to flow and dropping the voltage. Initially, the inductor reacts by dropping the voltage, and then by not allowing the current to change. When the comparator detects the drop in voltage, it opens the switch, thus preventing any further current flow. The inductor alone is not sufficient protection, because after the voltage drop has settled, the inductor would then allow the current to change, in this example, the current would be 3.7 A. In the fault condition, the resistor is flowing 200 mA until the fuse blows (anywhere from 1 ms to 100 s), while the switch and inductor combination is flowing about 2 A test current while monitoring for the fault to be corrected. Finally, as an additional safety feature, the circuit can be configured to hold the switch opened until both the load and source are disconnected.

Burns, Bradley M.↗
NASA NTRS1996

RAID Unbound: Storage Fault Tolerance in a Distributed Environment

Mirroring, data replication, backup, and more recently, redundant arrays of independent disks (RAID) are all technologies used to protect and ensure access to critical company data. A new set of problems has arisen as data becomes more and more geographically distributed. Each of the technologies listed above provides important benefits; but each has failed to adapt fully to the realities of distributed computing. The key to data high availability and protection is to take the technologies' strengths and 'virtualize' them across a distributed network. RAID and mirroring offer high data availability, which data replication and backup provide strong data protection. If we take these concepts at a very granular level (defining user, record, block, file, or directory types) and them liberate them from the physical subsystems with which they have traditionally been associated, we have the opportunity to create a highly scalable network wide storage fault tolerance. The network becomes the virtual storage space in which the traditional concepts of data high availability and protection are implemented without their corresponding physical constraints.

Ritchie, Brian↗
NASA NTRS1993

On the design of fault-tolerant robotic manipulator systems

Robotic systems are finding increasing use in space applications. Many of these devices are going to be operational on board the Space Station Freedom. Fault tolerance has been deemed necessary because of the criticality of the tasks and the inaccessibility of the systems to maintenance and repair. Design for fault tolerance in manipulator systems is an area within robotics that is without precedence in the literature. In this paper, we will attempt to lay down the foundations for such a technology. Design for fault tolerance demands new and special approaches to design, often at considerable variance from established design practices. These design aspects, together with reliability evaluation and modeling tools, are presented. Mechanical architectures that employ protective redundancies at many levels and have a modular architecture are then studied in detail. Once a mechanical architecture for fault tolerance has been derived, the chronological stages of operational fault tolerance are investigated. Failure detection, isolation, and estimation methods are surveyed, and such methods for robot sensors and actuators are derived. Failure recovery methods are also presented for each of the protective layers of redundancy. Failure recovery tactics often span all of the layers of a control hierarchy. Thus, a unified framework for decision-making and control, which orchestrates both the nominal redundancy management tasks and the failure management tasks, has been derived. The well-developed field of fault-tolerant computers is studied next, and some design principles relevant to the design of fault-tolerant robot controllers are abstracted. Conclusions are drawn, and a road map for the design of fault-tolerant manipulator systems is laid out with recommendations for a 10 DOF arm with dual actuators at each joint.

Tesar, Delbert↗
NASA NTRS1971

Fault tree applications within the safety program of Idaho Nuclear Corporation

Computerized fault tree analyses are used to obtain both qualitative and quantitative information about the safety and reliability of an electrical control system that shuts the reactor down when certain safety criteria are exceeded, in the design of a nuclear plant protection system, and in an investigation of a backup emergency system for reactor shutdown. The fault tree yields the modes by which the system failure or accident will occur, the most critical failure or accident causing areas, detailed failure probabilities, and the response of safety or reliability to design modifications and maintenance schemes.

W. E. Vesely↗