SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
This slide presentation reviews three failures of software and how the failures contributed to or caused the failure of a launch or payload insertion into orbit. In order to avoid these systematic failures in the future, failure mitigation strategies are suggested for use.
Create an improved method to calculate reliability of a conceptual launch vehicle system prior to fabrication by using historic data of actual root causes of failures. While failures have unique "proximate causes", there are typically a finite amount of common "root causes". Heretofore launch vehicle reliability evaluation typically hardware-centric statistical analyses, while most root causes of failures are been shown to be human-centric. A method based on human-centric root causes can be used to quantify reliability assessments and focus proposed actions to mitigate problems. Existing methods have been optimistic in their projections of launch vehicle reliability compared to actuals. Hypothesis: reliability of a conceptual launch vehicle can be more accurately evaluated based on a rational, probabilistic approach using past failure assessment teams' findings predicated on human-centric causes."Human Reliability Analysis Methods Selection Guidance for NASA"Chandler F.T., et al., NASA HQ/OSMA study group, July 2006. Outside HRA experts from academia, other federal labs, and the private sector. 50 system reliability methods considered, fourteen selected for further study, four finally selected as best suited for human spaceflight. Probabilistic Risk Analysis (PRA) + Human Reliability Analysis (HRA) enabled incorporating effects and probabilities of human errors. While four down-selected methods deemed appropriate for failure assessment, it did not appear that these methods could be concisely applied to perform major system-wide assessment of probability of failure of a conceptual design without becoming unwieldy."Engineering a Safer World", Detailed, comprehensive study external to NASA Leveson N. G., MIT, 2011.Systems-Theoretic Accident Model and Processes (STAMP). All-encompassing accident model based on systems theory analyzed accidents after they occurred and created approaches to prevent occurrence in developing systems not focused on failure prevention per se, but rather reducing hazards by influencing human behavior through use of constraints, hierarchical control structures, and process models to improve system safetySystem Theoretic Process Analysis (STPA) addresses predictive part of problem (a "hazard analysis"). Includes all causal factors identified in STAMP: "...design errors, software flaws, component interaction accidents, cognitively complex human decision-making errors, and social organizational and management factors contributing to accidents" can guide design process rather than require it to exist before-hand did not appear capable of concise application for system-wide assessment of probability of failure of a conceptual design without becoming unwieldy.
Achieving high cycle life rechargeableγ-MnO 2 cathodes in alkaline batteries face many challenges. Chief among these is the inability of theγ-MnO 2 polymorph to retain its structural integrity when cycled to high utilization of its theoretical capacity ∼300 mAh g −1 . In this paper, we investigate the root cause of failure of MnO 2 cathodes under deep cycling in the one-electron discharge range and establish a strong link between capacity fade and the amount of birnessite formed. We uncover the underlying cause of failure by cycling industrial scaleγ-MnO 2 cathodes at various levels of theoretical capacity utilization (100%, 50%, and 30%) and in different KOH concentrations (37, 25, and 10 wt%). To determine materials evolution the cycled cathodes were dissected, characterized and analyzed using SEM, XRD, FIB/SEM, EIS, and XPS. Based on our findings, we propose that one major cause of failure of MnO 2 cathodes stems from the solubility of Mn +3 formed during discharge which effectively results in destruction of theγ-MnO 2 phase and amorphization of the cathode. The results show that the bulk of theγ-MnO 2 phase is preserved only in ∼10 wt% KOH, which indicates the attractive range of KOH concentration for cycling of rechargeableγ-MnO 2 cathodes.
Failure Environment Analysis Tool (FEAT) computer program developed to enable people to see and better understand effects of failures in system. User selects failures from either engineering schematic diagrams or digraph-model graphics, and effects or potential causes of failures highlighted in color on same schematic-diagram or digraph representation. Uses digraph models to answer two questions: What will happen to system if set of failure events occurs? and What are possible causes of set of selected failures? Helps design reviewers understand exactly what redundancies built into system and where there is need to protect weak parts of system or remove them by redesign. Program also useful in operations, where it helps identify causes of failure after they occur. FEAT reduces costs of evaluation of designs, training, and learning how failures propagate through system. Written using Macintosh Programmers Workshop C v3.1. Can be linked with CLIPS 5.0 (MSC-21927, available from COSMIC).
The principal objective of the proposed research was to construct a detailed computer model of the NASA Standard Initiator (NSI). The NSI plays a critical role in initiating various pyrotechnic events in the National Space Transportation System and is also used in Shuttle payload applications. Several initiators failed when being tested at very low temperatures (4 to 20 K). During subsequent investigation an unacceptable high failure rate was found even at higher temperatures (100 to 150 K) but the precise cause of failure was not determined. The modelling work was undertaken to investigate reasons for failure and to predict the performance of alternate firing schemes. The work has shown that the most likely cause of failure at low temperature is poor thermal contact between the electrically heated bridgewire and the pyrotechnic charge. This problem may be masked if there is good thermal contact between the bridgewire and the alumina charge cup. The high thermal conductivity of alumina at cryogenic temperatures was overlooked in previous analyses, which assumed that the charge cup acted as a thermal insulator.
Field failures of nichrome thin film resistors have been investigated recently for several pieces of space flight hardware. These failures have involved resistance shifts ranging from a few percent to complete open circuits. Failure analysis and duplication of these failures have revealed that the failures were caused by electrostatic discharge. The failure characteristics and the circuit conditions necessary for failure have been studied for several types of thin film resistors including nichrome and tantalum nitride resistive elements. The effects of latent damage and resistive pattern design will also be discussed.
Modern spacecraft (as well as most other complex mechanisms like aircraft, automobiles, and chemical plants) rely more and more on software, to a point where software failures have caused severe accidents and loss of missions. Software failures during a manned mission can cause loss of life, so there are severe requirements to make the software as safe and reliable as possible. Typically, verification and validation (V&V) has the task of making sure that all software errors are found before the software is deployed and that it always conforms to the requirements. Experience, however, shows that this gold standard of error-free software cannot be reached in practice. Even if the software alone is free of glitches, its interoperation with the hardware (e.g., with sensors or actuators) can cause problems. Unexpected operational conditions or changes in the environment may ultimately cause a software system to fail. Is there a way to surmount this problem? In most modern aircraft and many automobiles, hardware such as central electrical, mechanical, and hydraulic components are monitored by IVHM (Integrated Vehicle Health Management) systems. These systems can recognize, isolate, and identify faults and failures, both those that already occurred as well as imminent ones. With the help of diagnostics and prognostics, appropriate mitigation strategies can be selected (replacement or repair, switch to redundant systems, etc.). In this short paper, we discuss some challenges and promising techniques for software health management (SWHM). In particular, we identify unique challenges for preventing software failure in systems which involve both software and hardware components. We then present our classifications of techniques related to SWHM. These classifications are performed based on dimensions of interest to both developers and users of the techniques, and hopefully provide a map for dealing with software faults and failures.
Computerized fault tree analyses are used to obtain both qualitative and quantitative information about the safety and reliability of an electrical control system that shuts the reactor down when certain safety criteria are exceeded, in the design of a nuclear plant protection system, and in an investigation of a backup emergency system for reactor shutdown. The fault tree yields the modes by which the system failure or accident will occur, the most critical failure or accident causing areas, detailed failure probabilities, and the response of safety or reliability to design modifications and maintenance schemes.
Skylab Earth Resources Experiment Package (EREP) experiments, S191 and S192, required a cold temperature reference for operation of a spectrometer. This cold temperature reference was provided by a subminiature Stirling cycle cooler. However, the failure of the cooler to pass the qualification test made it necessary for additional cooler development, refurbishment, and qualification. A description of the failures and the cause of these failures for each of the coolers is presented. The solutions to the various failure modes are discussed along with problems which arose during the refurbishment program. The rationale and results of various tests are presented. The successful completion of the cryogenic cooler refurbishment program resulted in four of these coolers being flown on Skylab. The system operation during the flight is presented.
The objective of this paper is to describe current results from an on-going study of the mechanisms that led to the failure of the TIBB. Experimental and analytical results are presented. Experimental results include load, strain, and deflection data for the TIBB (Technology Integration Box Beam). An analytical investigation was conducted to compliment the experimental investigation and to gain additional insight into the TIBB structural response. Analytical results include strain and deflection results from a global analysis of the TIBB. A local analysis of the failure region is being completed. These analytical results are validated through comparisons with the experimental results from the TIBB tests. The experimental and analytical results from the TIBB tests are used to determine a sequence of events that may have resulted in failure of the TIBB. A potential cause of failure is high stresses in a stiffener runout region. Typical analytical results are presented for a stiffener runout specimen that is being defined to simulate the TIBB failure mechanisms. The results of this study are anticipated to provide better understanding of potential failure mechanisms in composite aircraft structures, to lead to future design improvements, and to identify needed analytical tools for design and analysis.
Composite structures have the potential to be cost-effective, structurally efficient primary aircraft structures. The Advanced Composites Technology (ACT) Program has the goal to develop the technology to exploit this potential for heavily loaded aircraft structures. As part of the ACT Program, Lockheed Aeronautical Systems Company completed the design and fabrication of the Technology Integration Box Beam (TIBB). The TIBB is an advanced composite prototype structure for the center wing section of the C-130 aircraft. Lockheed subjected the TIBB to downbending, upbending, torsion and combined upbending and torsion load conditions to verify the design. The TIBB failed at 83 percent of design ultimate load for the combined upbending and torsion load condition. The objective of this paper is to describe the mechanisms that led to the failure of the TIBB. The results of a comprehensive analytical and experimental study are presented. Analytical results include strain and deflection results from both a global analysis of the TIBB and a local analysis of the failure region. These analytical results are validated by experimental results from the TIBB tests. The analytical and experimental results from the TIBB tests are used to determine a sequence of events that resulted in failure of the TIBB. A potential cause of failure is high stresses in a stiffener runout region. Analytical and experimental results are also presented for a stiffener runout specimen that was used to simulate the TIBB failure mechanisms.
The program goal is to develop a computerized life prediction model capable of identifying present aging progress and predicting end of life for aircraft wiring. A summary is given in viewgraph format of progress made on phase 1 objectives, which were to identify critical aircraft wiring problems; relate most common failures identified to the wire mechanism causing the failure; assess wiring requirments, materials, and stress environment for fighter aircraft; and demonstrate the feasibility of a time-temperature-environment model.
The use of graphite-composites as primary structure is essential for the development of a cost effective single-stage-to-orbit reusable launch vehicle (RLV). A full-scale segment of a graphite-composite intertank was designed and fabricated by an industry team and tested at NASA Langley Research Center as a part of the RLV technology development program. The intertank test component was approximately 3.0 m long by 6.7 m wide and included slightly less than a 90deg section of a cylindrical intertank. The test article was fabricated using graphite-bismaelimide composite material and consisted of a hat-stiffened skin with five ring frames. The stiffeners were secondarily bonded to the panel skin and the ring frames were mechanically attached. The test article was loaded to failure with a uniform compression load applied by 21 individually controlled hydraulic actuators. Resistance strain gages, linear variable differential transformers and video cameras were used to measure and record the test results. A linear f d t e element analysis of the test article and test fixture was performed. The test results verified the structural integrity cf the intertank test article up to the design limit load. However, the test article failed in general skin buckling between the ring frames at a load 1.08 times design limit load. This load was considerably lower than the expected failure load. The cause of premature failure is being investigated. Good correlation of the test and analysis results was obtained for loads up to the design limit load.
The contents include:1) NASA Mission and Organization; 2) Major Mission Failures and Causes; 3) Cultural Changes Resulting from Failures; 3) Safety at NASA Today; 4) Best Safety Practices; 5) Safety Challenges; and 6) Future Commitment.
During EVA (Extravehicular Activity) 23 aboard the ISS (International Space Station) on 07/16/2013 an episode of water in the EMU (Extravehicular Mobility Unit) helmet occurred, necessitating a termination of the EVA (Extravehicular Activity) shortly after it began. The root cause of the failure was determined to be ground-processing short-comings of the ALCLR Ion Beds which led to various levels of contaminants being introduced into the Ion Beds before they left the ground. The Ion Beds were thereafter used to perform on-orbit routine scrubbing operations for the EMU cooling water loop which led to the failure. The root cause investigation identified several areas for improvement of the ALCLR Assembly which have since been initiated. Enhanced washing techniques for the ALCLR Ion Bed have been developed and implemented. On-orbit cooling water conductivity and pH analysis capability to allow the astronauts to monitor proper operation of the ALCLR Ion Bed during scrubbing operation have been investigated and are being incorporated. A simplified means to acquire on-orbit EMU cooling water samples has been designed as well. Finally, an inherently cleaner organic adsorbent to replace the current lignite-based activated carbon, and a non-separable replacement for the separable mixed ion exchange resin have been selected. These efforts are being undertaken to enhance the performance and reduce the risk associated with operations to ensure the long-term health of the EMU cooling water circuit. The intent of this paper is to provide an update of the effort to re-design the ALCLR (Airlock Cooling Loop Recovery) hardware. Last year, this effort was in the early stages of concept development and test which was reported in ICES Paper ICES-2016-221. Those phases are now complete and the final outcomes, as well as plans to build and field the hardware, are being reported on.
The need to improve space mechanism reliability is underscored by a long history of flight failures and anomalies caused by malfunctioning mechanisms on spacecraft and launch vehicles. Some examples of these failures are listed in a table. Because much experience has been gained over the years, many specialized design practices have evolved and many unsatisfactory design approaches have been identified.NASA and the NASA Lewis Research Center conducted a Lessons Learned Study (refs. 1 and 2) and wrote a handbook to document what has been learned in the past. The primary goals of the handbook were to identify desirable and undesirable design practices for space mechanisms and to reduce the number of failures caused by the repetition of past design errors. Another goal was to identify a variety of design approaches for specific applications and to provide the associated considerations and caveats for each approach in an effort to help designers choose the approach most suitable for each application. This technical summary outlines the goals and objectives of the handbook and study as well as the contents of the handbook.
On this twelfth day of the STS-80 mission, the flight crew, Cmdr. Kenneth D. Cockrell, Pilot Kent V. Rominger, Mission Specialists, Tamara E. Jernigan, Thomas D. Jones, and F. Story Musgrave, spend the day discussing the failed hatch with ground controllers. The failure of the hatch to properly open causes the cancellation of the second planned spacewalk by Jernigan and Jones. NASA engineers and managers continue to collect and analyze data on what may be causing the failure. The leading candidate is a misalignment of the hatch against the airlock seal.
Reliability analysis often assumes that a complex system can be kept operating indefinitely with scheduled maintenance and emergency repair using a stock of spare parts, as long as the spare parts are not depleted. This assumption seems justified for well-tested, widely used, long operational systems with a multigenerational history of failure, redesign, and reliability growth. It seems doubtful that newer, relatively untried, high technology space systems can always be repaired. We cannot assume space systems will have a low rate of random failures that can all be repaired with a few identical spares. New untried systems usually have a high initial failure rate, called infant mortality, due to errors in requirements, design, parts, materials, and operations planning. These problems can cause groups of related failures called Common Cause Failures (CCFs). The practical definition of a CCF is any failure mode that cannot be cured using identical redundant systems or spare parts. Systems with CCFs may fail repeatedly for the same reason. Can a life support system be kept operating on the way to Mars using only redundant systems and spare parts? The failure history of International Space Station (ISS) life support systems suggests that CCFs are likely to occur and will probably require design changes rather than being reparable with spare parts.