Search NASA⌕ Search

SEARCH · Search NASA

Results for “Failure Tolerance”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2
All sourcesNASA NTRSDOE OSTI
NASA NTRS2006

Impact of Solar Array Position on ISS Vehicle Charging

The International Space Station (ISS), because of its large structure and high voltage solar arrays, has a complex plasma interaction with the ionosphere in low Earth orbit (LEO). This interaction of the ISS US Segment photovoltaic (PV) power system with the LEO ionospheric plasma produces floating potentials on conducting elements of the ISS structure relative to the local plasma environment. To control the ISS floating potentials, two Plasma Contactor Units (PCUs) are installed on the Z1 truss. Each PCU discharges accumulated electrons from the Space Station structure, thus reducing the potential difference between the ISS structure and the surrounding charged plasma environment. Operations of the PCUs were intended to keep the ISS floating potential to 40 Volts (Reference 1). Exposed dielectric surfaces overlying conducting structure on the Space Station will collect an opposite charge from the ionosphere as the ISS charges. In theory, when an Extravehicular Activity (EVA) crewmember is tethered to structure via the crew safety tether or when metallic surfaces of the Extravehicular Mobility Unit (EMU) come in contact with conducting metallic surfaces of the ISS, the EMU conducting components, including the perspiration-soaked crewmember inside, can become charged to the Space Station floating potential. The concern is the potential dielectric breakdown of anodized aluminum surfaces on the EMU producing an arc from the EMU to the ambient plasma, or nearby ISS structure. If the EMU arcs, an electrical current of an unknown magnitude and duration may conduct through the EVA crewmember, producing an unacceptable condition. This electrical current may be sufficient to startle or fatally shock the EVA crewmember (Reference 2). Hence, as currently defined by the EVA community, the ISS floating potential for all nominal and contingency EVA worksites and translation paths must have a magnitude less than 40 volts relative to the local ionosphere at all times during EVA. Arcing from the EMU is classified as a catastrophic hazard, which requires two-failure tolerant controls, i.e., three hazard controls. Each PCU is capable of maintaining the ISS floating potential below the requirement during EVA. The two PCUs provide a single failure tolerant control of ISS floating potential. In the event of the failure of one or two PCUs, a combination of solar array shunting and turning the solar arrays into their own wakes will be used to supply control of the plasma hazard (Reference 3). The purpose of this paper is to present on-orbit information that shows that ISS solar array placement with respect to the ISS velocity vector can control solar array plasma charging, and hence, provide an operational control for the plasma hazard. Also, this paper will present on-orbit information that shows that shunting of the ISS solar arrays can control solar array plasma charging, and hence, provide an additional operational control for the plasma hazard.

Alred, John↗
NASA NTRS1990

Making real-time reactive systems reliable

A reactive system is characterized by a control program that interacts with an environment (or controlled program). The control program monitors the environment and reacts to significant events by sending commands to the environment. This structure is quite general. Not only are most embedded real time systems reactive systems, but so are monitoring and debugging systems and distributed application management systems. Since reactive systems are usually long running and may control physical equipment, fault tolerance is vital. The research tries to understand the principal issues of fault tolerance in real time reactive systems and to build tools that allow a programmer to design reliable, real time reactive systems. In order to make real time reactive systems reliable, several issues must be addressed: (1) How can a control program be built to tolerate failures of sensors and actuators. To achieve this, a methodology was developed for transforming a control program that references physical value into one that tolerates sensors that can fail and can return inaccurate values; (2) How can the real time reactive system be built to tolerate failures of the control program. Towards this goal, whether the techniques presented can be extended to real time reactive systems is investigated; and (3) How can the environment be specified in a way that is useful for writing a control program. Towards this goal, whether a system with real time constraints can be expressed as an equivalent system without such constraints is also investigated.

Marzullo, Keith↗
NASA NTRS2010

Predicting Ares I Reaction Control System Performance by Utilizing Analysis Anchored with Development Test Data

The Ares I launch vehicle is an integral part of NASA s Constellation Program, providing a foundation for a new era of space access. The Ares I is designed to lift the Orion Crew Module and will enable humans to return to the Moon as well as explore Mars.1 The Ares I is comprised of two inline stages: a Space Shuttle-derived five-segment Solid Rocket Booster (SRB) First Stage (FS) and an Upper Stage (US) powered by a Saturn V-derived J-2X engine. A dedicated Roll Control System (RoCS) located on the connecting interstage provides roll control prior to FS separation. Induced yaw and pitch moments are handled by the SRB nozzle vectoring. The FS SRB operates for approximately two minutes after which the US separates from the vehicle and the US Reaction Control System (ReCS) continues to provide reaction control for the remainder of the mission. A representation of the Ares I launch vehicle in the stacked configuration and including the Orion Crew Exploration Vehicle (CEV) is shown in Figure 1. Each Reaction Control System (RCS) design incorporates a Gaseous Helium (GHe) pressurization system combined with a monopropellant Hydrazine (N2H4) propulsion system. Both systems have two diametrically opposed thruster modules. This architecture provides one failure tolerance for function and prevention of catastrophic hazards such as inadvertent thruster firing, bulk propellant leakage, and over-pressurization. The pressurization system on the RoCS includes two ambient pressure-referenced regulators on parallel strings in order to attain the required system level single Fault Tolerant (FT) design for function while the ReCS utilizes a blow-down approach. A single burst disk and relief valve assembly is also included on the RoCS to ensure single failure tolerance for must-not-occur catastrophic hazards. The Reaction Control Systems are designed to support simultaneously firing multiple thrusters as required

Stein, William B.↗
NASA NTRS1992

Spacecraft dynamics characterization and control system failure detection, volume 1

The work under this grant has been directed to two aspects of the control of flexible spacecraft: (1) the modeling of deployed or erected structures including nonlinear joint characteristics; and (2) the detection and isolation of failures of the components of control systems for large space structures. The motivation for the first of these research tasks is the fact that very large assemblies in space will have to be built or deployed in situ. A likely scenario is, in fact, a combination of these wherein modules which are folded for transportation into orbit are erected to their final configuration and then jointed with other such erected modules to form the full assembly. Any such erectable modules will have joints. It remains to be seen whether or not joints designed for operational assemblies will have nonlinear properties, but it seems prudent to develop a methodology for dealing with that possibility. The motivation for the second of these research tasks is the fact that we foresee large assemblies in space which will require active control to damp vibrations and/or hold a desired shape. Lightweight structures will be very flexible, with many elastic modes having very low frequencies. In order to control these modes well, the control system will likely require many sensors and many actuators, probably distributed over much of the structure. The combination of a large number of control system components with long operational periods virtually guarantees that these systems will suffer control system component failures during operation. The control system must be designed to tolerate failures of some sensors and actuators, and still be able to continue to perform its function.

Source record↗
NASA NTRS2015

Reliability on ISS Talk Outline

1. Overview of ISS 2. Space Environment and it effects a. Radiation b. Microgravity 3. How we ensure reliability a. Requirements b. Component Selection i. Note: I plan to stay away from talk about Rad Hardened components and talk about why we use older processors because they are less susceptible to SEUs. c. Testing d. Redundancy / Failure Tolerance e. Sparing strategies 4. Operational Examples a. Multiple MDM Failures on 6A due to hard drive failure In general, my plan is to only talk about data that is currently available via normal internet sources to ensure that I stay away from any topics that would be Export Controlled, ITAR, or NDA‐controlled. The operational example has been well‐reported on in the media and those are the details that I plan to cover. Additionally I am not planning on using any slides or showing any photos during the talk.

Misiora, Mike↗
NASA NTRS2015

Electrical Pressurization Concept for the Orion MPCV European Service Module Propulsion System

The paper presents the design of the pressurization system of the European Service Module (ESM) of the Orion Multi-Purpose Crew Vehicle (MPCV). Being part of the propulsion subsystem, an electrical pressurization concept is implemented to condition propellants according to the engine needs via a bang-bang regulation system. Separate pressurization for the oxidizer and the fuel tank permits mixture ratio adjustments and prevents vapor mixing of the two hypergolic propellants during nominal operation. In case of loss of pressurization capability of a single side, the system can be converted into a common pressurization system. The regulation concept is based on evaluation of a set of tank pressure sensors and according activation of regulation valves, based on a single-failure tolerant weighting of three pressure signals. While regulation is performed on ESM level, commanding of regulation parameters as well as failure detection, isolation and recovery is performed from within the Crew Module, developed by Lockheed Martin Space System Company. The overall design and development maturity presented is post Preliminary Design Review (PDR) and reflects the current status of the MPCV ESM pressurization system.

Helium↗
NASA NTRS1985

Experimental Development of a Failure Detection Scheme for Large Space Structures

Large flexible spacecraft may require control systems consisting of large numbers of sensors and actuators. To assure a viable mission, the control system should tolerate failures of some of the control components. Hence, it is desirable to automate the process of failure detection, identification, and control system reconfiguration (FDI&R). Some of the opportunities to accommodate failure in the spacecraft design are reviewed. Some methods for FDI&R are presented in overview, and the method chosen for experimental testing is described. Finally, the experimental activities leading to the validation of the technique are presented.

Montgomery, R. C.↗
NASA NTRS2010

Potential Lunar In-Situ Resource Utilization Experiments and Mission Scenarios

The extraction and use of resources on the Moon, known as In-Situ Resource Utilization (ISRU), can potentially reduce the cost and risk of human lunar exploration while also increasing science achieved. By not having to bring all of the shielding and mission consumables from Earth and being able to make products on the Moon, missions may require less mass to accomplish the same objectives, carry more science equipment, go to more sites of exploration, and/or provide options to recover from failures not possible with delivery of spares and consumables from Earth alone. The concept of lunar ISRU has been considered and studied for decades, and scientists and engineers were theorizing and even testing concepts for how to extract oxygen from lunar soil even before the Apollo 11 mission to the Moon. There are four main areas where ISRU can significantly impact how human missions to the Moon will be performed: mission consumable production, civil engineering and construction, energy production, storage, and transfer, and manufacturing and repair. The area that has the greatest impact on mission mass, hardware design and selection, and mission architecture is mission consumable production, in particular, the ability to make propellants, life support consumables, and fuel cell reagents. Mission consumable production allows for refueling and reuse of spacecraft, increasing power production and storage, and increased capabilities and failure tolerance for crew life support. The other three areas allow for decreased mission risk due to radiation and plume damage, alternative power systems, and failure recover capabilities while also enabling infrastructure growth over Earth delivered assets. However, while lunar ISRU has significant potential for mass, cost, and risk reduction for human lunar missions, it has never been demonstrated before in space. To demonstrate that ISRU can meet mission needs and to increase confidence in incorporating ISRU capabilities into mission architectures, terrestrial laboratory and analog field testing along with robotic precursor missions are required. A stepwise approach with international collaboration is recommended. The first step is to understand the resources available through orbital and surface exploration missions. Resources of particular interest are hydrogen, hydroxyl, water, and other polar volatile resources recently measured by Chandrayaan, Lunar Reconnaissance Orbiter (LRO), and the Lunar Crater Observation and Sensing Satellite (LCROSS). The second step is to demonstrate critical aspects of ISRU systems to prove ISRU is feasible under lunar environmental and resource conditions (ex. subscale oxygen extraction from regolith). The third step is to perform integrated missions with ISRU and other connected systems, such as power, consumable storage, surface mobility, and life support at a relevant mission scale to demonstrate ISRU capabilities as well as the critical interfaces with other exploration systems. If possible, the mission should demonstrate the use of ISRU products (ex. in a rocket engine or fuel cell). This dress rehearsal mission would be the final step before full implementation of ISRU into human missions, and may be performed during human lunar exploration activities. This stepwise approach is the most conservative approach, and may only be possible with international cooperation due to the limited number of robotic missions each nation/space agency can perform within their budget.

Sanders, Gerald B.↗
NASA NTRS1981

Design and verification of a multiple fault tolerant control system for STS applications using computer simulation

General Dynamics/Convair is under NASA contract to integrate the Centaur upper stage into the space transportation system for future planetary missions. This requires that control of all safety critical functions be two-failure tolerant. The control system developed consists of five asynchronous computers, each contributing at their outputs to a 3-out-of-5 voting plane. Subsystem control is based on an end function redundancy management scheme. Analysis of multiple component failures and worst-case time-phase asynchrony among the computers is performed by a real-time computer simulation. The simulation emulates the hardware and subsystem interfaces, wire by wire, providing assessibility to any component for the insertion of preprogrammed failures. Observability is provided via a graphics system and diagnostic software. The simulation provides an engineering tool where the integrity of control system hardware and imbedded software can be demonstrated.

Szatkowski, G. P.↗
NASA NTRS1981

Real-time computer simulation/emulation for verification of multi-fault-tolerant control of Centaur-in-Shuttle

NASA has contracted with General Dynamics to design and develop an advanced Centaur liquid upper stage for support of the Galileo and Solar Polar interplanetary missions in 1985-86. The control of the Centaur while it resides in the Shuttle cargo bay must meet the STS safety requirements to be dual failure tolerant in all mission critical functions. The demonstration of the integrity of this control system in the event of multiple component failures and worst-case time-phase asynchroniety among the system's computers is performed by a real-time computer simulation. The simulation emulates the control hardware, subsystem interfaces, and imbedded software processes, wire-by-wire, to provide accessibility for fault insertion. Observability is provided via graphics and diagnostic software. Verification is the product of Monte Carlo simulation analysis.

Szatkowski, G. P.↗
NASA NTRS1981

Defect design of insulation systems for photovoltaic modules

A defect-design approach to sizing electrical insulation systems for terrestrial photovoltaic modules is presented. It consists of gathering voltage-breakdown statistics on various thicknesses of candidate insulation films where, for a designated voltage, module failure probabilities for enumerated thickness and number-of-layer film combinations are calculated. Cost analysis then selects the most economical insulation system. A manufacturing yield problem is solved to exemplify the technique. Results for unaged Mylar suggest using fewer layers of thicker films. Defect design incorporates effects of flaws in optimal insulation system selection, and obviates choosing a tolerable failure rate, since the optimization process accomplishes that. Exposure to weathering and voltage stress reduces the voltage-withstanding capability of module insulation films. Defect design, applied to aged polyester films, promises to yield reliable, cost-optimal insulation systems.

Mon, G. R.↗
NASA NTRSDate not supplied

Trends in Human Spaceflight: Analysis of Observed Propulsion Failure Modes Following NASA’s Artemis I Mission

In 2022, NASA’s Artemis program returned the agency to lunar space, propelled by the Orion European Service Module (ESM). Through rigorous ground test campaigns for Artemis I and II and the collection and transmission of operational data during the Artemis I flight, the Safety and Mission Assurance (S&MA) team created and maintained a robust database of component nonconformances. This study analyzes in-flight and ground processing findings on the Artemis ESM propulsion subsystem to track reliability and safety metrics, as well as comparing the data to that of previous human spaceflight programs, Apollo and Space Shuttle. In drawing a comparison to the Artemis I flight, recommendations can be made for the Artemis II crewed mission to ensure best practices for flight safety, including redundancy and failure tolerance in the system. The results reinforce a need for robust safety standards and caution against the complacency of a single successful test flight.

human spaceflight safety↗
NASA NTRSDate not supplied

Trends in Human Spaceflight: Analysis of Observed Propulsion Failure Modes Following NASA’s Artemis I Mission

In 2022, NASA’s Artemis program returned the agency to lunar space, propelled by the Orion European Service Module (ESM). Through rigorous ground test campaigns for Artemis I and II and the collection and transmission of operational data during the Artemis I flight, the Safety and Mission Assurance (S&MA) team created and maintained a robust database of component nonconformances. This study analyzes in-flight and ground processing findings on the Artemis ESM propulsion subsystem to track reliability and safety metrics, as well as comparing the data to that of previous human spaceflight programs, Apollo and Space Shuttle. In drawing a comparison to the Artemis I flight, recommendations can be made for the Artemis II crewed mission to ensure best practices for flight safety, including redundancy and failure tolerance in the system. The results reinforce a need for robust safety standards and caution against the complacency of a single successful test flight.

human spaceflight safety↗
NASA NTRS1986

Failure-accommodating control of large flexible spacecraft

This paper considers the problem of designing failure-accommodating controllers for large flexible spacecraft when there are sector-type nonlinearities in the loops. It is proved that an LQG-type controller can be made failure tolerant by inserting appropriate gains in the actuator paths and state estimator residual paths. For the state feedback case, when the actuators are saturating type, it is proved that there exists a finite region of attraction, which is invariant in the presence of these gains. Another class of controllers, which employs collocated sensors and actuators is presented, and is shown to have excellent failure-accommodation properties in addition to its robustness properties.

Joshi, S. M.↗
NASA NTRS2016

Flat H Redundant Frangible Joint Development

Orion and Commercial Crew Program (CCP) Partners have chosen to use frangible joints for certain separation events. The joints currently available are zero failure tolerant and will be used in mission safety applications. The goal is to further develop a NASA designed redundant frangible joint that will lower flight risk and increase reliability. FY16 testing revealed a successful design in subscale straight test specimens that gained efficiency and supports Orion load requirements. Approach / Innovation A design constraint is that the redundant joint must fit within the current Orion architecture, without the need for additional vehicle modification. This limitation required a design that changed the orientation of the expanding tube assemblies (XTAs), by rotating them 90deg from the standard joint configuration. The change is not trivial and affects the fracture mechanism and structural load paths. To address these changes, the design incorporates cantilevered arms on the break plate. The shock transmission and expansion of the XTA applies force to these arms and creates a prying motion to push the plate walls outward to the point of structural failure at the notched section. The 2014 test design revealed that parts could slip during functioning wasting valuable energy needed to separate the structure with only a single XTA functioning. Dual XTA functioning fully separated the assembly showing a discrepancy can be backed up with redundancy. Work on other fully redundant systems outside NASA is limited to a few patents that have not been subjected to functionality testing Design changes to prevent unwanted slippage (with ICA funding in 2015) showed success with a single XTA. The main goal for FY 2016 was to send the new Flat H RFJ to WSTF where single XTA test failures occurred back in 2014. The plan was to gain efficiency in this design by separating the Flat H RFJ with thicker ligaments with dimensions baselined in 2014. Other modifications included geometry changes to better disperse loads paths and to minimize air gaps. The design additionally added more structural strength to enhance the structural limits in static loads testing. The design also implemented a smoother load line through the assembly. Results / Knowledge Gained The new Flat H RFJ successfully fractured at WSTF with thicker ligaments and lower cord size. Where failure to separate occurred earlier, there is now excessive energy available for structural separation. The new challenge to provide some structural support to prevent secondary fracturing of the break plate remains to be completed. This future work is being funded by the JSC Engineering Directorate in 2017 to elevate the TRL on curved Flat H RFJs that configure with the Orion Service Panel Separation. Additional funding from JSC Engineering will provide new design testing to avoid secondary fracturing.

Brown, Chris↗
NASA NTRS1974

Adaptive voting computer system

A computer system is reported that uses adaptive voting to tolerate failures and operates in a fail-operational, fail-safe manner. Each of four computers is individually connected to one of four external input/output (I/O) busses which interface with external subsystems. Each computer is connected to receive input data and commands from the other three computers and to furnish output data commands to the other three computers. An adaptive control apparatus including a voter-comparator-switch (VCS) is provided for each computer to receive signals from each of the computers and permits adaptive voting among the computers to permit the fail-operational, fail-safe operation.

Koczela, L. J.↗