Search NASA⌕ Search

SEARCH · Search NASA

Results for “Fault Protection Design”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 55 records · Page 3
All sourcesNASA NTRSDOE OSTI
NASA NTRS2013

Soil Moisture Active Passive Mission: Fault Management Design Analyses

As a general trend, the complexities of modern spacecraft are increasing to include more ambitious mission goals with tighter timing requirements and on-board autonomy. As a byproduct, the protective features that monitor the performance of these systems have also increased in scope and complexity. Given cost and schedule pressures, there is an increasing emphasis on understanding the behavior of the system at design time. Formal test-driven verification and validation (V&V) is rarely able to test the significant combinatorics of states, and often finds problems late in the development cycle forcing design changes that can be costly. This paper describes the approach the SMAP Fault Protection team has taken to address some of the above-mentioned issues.

Earth↗
NASA NTRS1990

VIPER project

The VIPER project has so far produced a formal specification of a 32 bit RISC microprocessor, an implementation of that chip in radiation-hard SOS technology, a partial proof of correctness of the implementation which is still being extended, and a large body of supporting software. The time has now come to consider what has been achieved and what directions should be pursued in the future. The most obvious lesson from the VIPER project was the time and effort needed to use formal methods properly. Most of the problems arose in the interfaces between different formalisms, e.g., between the (informal) English description and the HOL spec, between the block-level spec in HOL and the equivalent in ELLA needed by the low-level CAD tools. These interfaces need to be made rigorous or (better) eliminated. VIPER 1A (the latest chip) is designed to operate in pairs, to give protection against breakdowns in service as well as design faults. We have come to regard redundancy and formal design methods as complementary, the one to guard against normal component failures and the other to provide insurance against the risk of the common-cause failures which bedevil reliability predictions. Any future VIPER chips will certainly need improved performance to keep up with increasingly demanding applications. We have a prototype design (not yet specified formally) which includes 32 and 64 bit multiply, instruction pre-fetch, more efficient interface timing, and a new instruction to allow a quick response to peripheral requests. Work is under way to specify this device in MIRANDA, and then to refine the spec into a block-level design by top-down transformations. When the refinement is complete, a relatively simple proof checker should be able to demonstrate its correctness. This paper is presented in viewgraph form.

Kershaw, John↗
NASA NTRS2014

Fault Management Design Strategies

Development of dependable systems relies on the ability of the system to determine and respond to off-nominal system behavior. Specification and development of these fault management capabilities must be done in a structured and principled manner to improve our understanding of these systems, and to make significant gains in dependability (safety, reliability and availability). Prior work has described a fundamental taxonomy and theory of System Health Management (SHM), and of its operational subset, Fault Management (FM). This conceptual foundation provides a basis to develop framework to design and implement FM design strategies that protect mission objectives and account for system design limitations. Selection of an SHM strategy has implications for the functions required to perform the strategy, and it places constraints on the set of possible design solutions. The framework developed in this paper provides a rigorous and principled approach to classifying SHM strategies, as well as methods for determination and implementation of SHM strategies. An illustrative example is used to describe the application of the framework and the resulting benefits to system and FM design and dependability.

systems engineering↗
NASA NTRS1983

Grounding and fault protection of the SMUD PVI array

If large terrestrial photovoltaic (PV) power plants are to provide an economic source of generation, low-cost, reliable and easily maintainable systems must be developed. In addition, if the system is to be a central station powerplant owned and operated by an electric utility, the design must also be consistent with utility specifications and design standards. The particular solutions developed to address these issues, with regard to grounding and fault protection, for the first phase of the Sacramento Municipal Utility District's (SMUD) 100 mw(ac) PV powerplant are presented. This plant, known as PV1, is nominally rated at 1 mw(ac) and is scheduled to be in operation by the spring of 1984.

Rosen, D.↗
NASA NTRS1973

Self-healing fuse development

The mercury-filled self-healing fuses developed for this program afford very good protection from circuit faults with rapid reclosure. Fuse performance and design parameters have been characterized. Life tests indicate a capability of 500 fuse operations. Fuse ratings are 150 v at 5, 15, 25 and 50 circuit A. A series of sample fuses using alumina and beryllia insulation have been furnished to NASA for circuit evaluation.

Jones, N. D.↗
NASA NTRS2014

The Curiosity Mars Rover's Fault Protection Engine

The Curiosity Rover, currently operating on Mars, contains flight software onboard to autonomously handle aspects of system fault protection. Over 1000 monitors and 39 responses are present in the flight software. Orchestrating these behaviors is the flight software's fault protection engine. In this paper, we discuss the engine's design, responsibilities, and present some lessons learned for future missions.

flight software↗
NASA NTRS1971

Fault tree applications within the safety program of Idaho Nuclear Corporation

Computerized fault tree analyses are used to obtain both qualitative and quantitative information about the safety and reliability of an electrical control system that shuts the reactor down when certain safety criteria are exceeded, in the design of a nuclear plant protection system, and in an investigation of a backup emergency system for reactor shutdown. The fault tree yields the modes by which the system failure or accident will occur, the most critical failure or accident causing areas, detailed failure probabilities, and the response of safety or reliability to design modifications and maintenance schemes.

W. E. Vesely↗
NASA NTRS1987

Incipient fault detection and power system protection for spaceborne systems

A program was initiated to study the feasibility of using advanced terrestrial power system protection techniques for spacecraft power systems. It was designed to enhance and automate spacecraft power distribution systems in the areas of safety, reliability and maintenance. The proposed power management/distribution system is described as well as security assessment and control, incipient and low current fault detection, and the proposed spaceborne protection system. It is noted that the intelligent remote power controller permits the implementation of digital relaying algorithms with both adaptive and programmable characteristics.

Russell, B. Don↗
NASA NTRS2009

Design and Development of the Solar Dynamics Observatory (SDO) Electrical Power System

The SDO spacecraft was designed to help us understand the Sun's influence on Earth and Near-Earth space by studying the solar atmosphere on small scales of space and time and in many wavelengths simultaneously. It will perform its operations in a geosynchronous orbit of the earth. This paper will present background on the SDO mission, an overview of the design and development activities associated specifically with the SDO electrical power system (EPS), as well as the major driving requirements behind the mission design. The primary coverage of the paper will be devoted to some of the challenges faced during the design and development phase. This will include the challenges associated with development of a compatible CompactPCI (cPCI) interface within the Power System Electronics (PSE) in order to utilize a "common" processor card, implementation of new solid state power controllers (SSPC) for primary load distribution switching and over current protection in the PSE, and the design approach adopted to meet single fault tolerance requirements for all of the SDO EPS functions.

Denney, Keys↗
NASA NTRS2011

CoNNeCT Baseband Processor Module

A document describes the CoNNeCT Baseband Processor Module (BPM) based on an updated processor, memory technology, and field-programmable gate arrays (FPGAs). The BPM was developed from a requirement to provide sufficient computing power and memory storage to conduct experiments for a Software Defined Radio (SDR) to be implemented. The flight SDR uses the AT697 SPARC processor with on-chip data and instruction cache. The non-volatile memory has been increased from a 20-Mbit EEPROM (electrically erasable programmable read only memory) to a 4-Gbit Flash, managed by the RTAX2000 Housekeeper, allowing more programs and FPGA bit-files to be stored. The volatile memory has been increased from a 20-Mbit SRAM (static random access memory) to a 1.25-Gbit SDRAM (synchronous dynamic random access memory), providing additional memory space for more complex operating systems and programs to be executed on the SPARC. All memory is EDAC (error detection and correction) protected, while the SPARC processor implements fault protection via TMR (triple modular redundancy) architecture. Further capability over prior BPM designs includes the addition of a second FPGA to implement features beyond the resources of a single FPGA. Both FPGAs are implemented with Xilinx Virtex-II and are interconnected by a 96-bit bus to facilitate data exchange. Dedicated 1.25- Gbit SDRAMs are wired to each Xilinx FPGA to accommodate high rate data buffering for SDR applications as well as independent SpaceWire interfaces. The RTAX2000 manages scrub and configuration of each Xilinx.

Yamamoto, Clifford K↗
NASA NTRS1983

DC wiring system grounding and ground fault protection issues for central station photovoltaic power plants

The DC wiring system for a photovoltaic power plant presents a number of unique challenges to be overcome by the plant designers. There are a number of different configurations that the grounding of the DC wiring system can take, and the choice will affect the number and type of protective devices required to ensure safety of personnel and protection of equipment. The major grounding and fault protection considerations that must be taken into account when selecting the basic overall circuit configuration are summarized. The inherent advantages and disadvantages of each type of circuit grounding (resistance or solid) along with the personnel safety and equipment protection issues for each of these grounding methods are presented.

Simburger, E. J.↗
NASA NTRS2013

Mars Science Laboratory CHIMRA/IC/DRT Flight Software for Sample Acquisition and Processing

The design methodologies of using sequence diagrams, multi-process functional flow diagrams, and hierarchical state machines were successfully applied in designing three MSL (Mars Science Laboratory) flight software modules responsible for handling actuator motions of the CHIMRA (Collection and Handling for In Situ Martian Rock Analysis), IC (Inlet Covers), and DRT (Dust Removal Tool) mechanisms. The methodologies were essential to specify complex interactions with other modules, support concurrent foreground and background motions, and handle various fault protections. Studying task scenarios with multi-process functional flow diagrams yielded great insight to overall design perspectives. Since the three modules require three different levels of background motion support, the methodologies presented in this paper provide an excellent comparison. All three modules are fully operational in flight.

sample processing↗
NASA NTRS1993

On the design of fault-tolerant robotic manipulator systems

Robotic systems are finding increasing use in space applications. Many of these devices are going to be operational on board the Space Station Freedom. Fault tolerance has been deemed necessary because of the criticality of the tasks and the inaccessibility of the systems to maintenance and repair. Design for fault tolerance in manipulator systems is an area within robotics that is without precedence in the literature. In this paper, we will attempt to lay down the foundations for such a technology. Design for fault tolerance demands new and special approaches to design, often at considerable variance from established design practices. These design aspects, together with reliability evaluation and modeling tools, are presented. Mechanical architectures that employ protective redundancies at many levels and have a modular architecture are then studied in detail. Once a mechanical architecture for fault tolerance has been derived, the chronological stages of operational fault tolerance are investigated. Failure detection, isolation, and estimation methods are surveyed, and such methods for robot sensors and actuators are derived. Failure recovery methods are also presented for each of the protective layers of redundancy. Failure recovery tactics often span all of the layers of a control hierarchy. Thus, a unified framework for decision-making and control, which orchestrates both the nominal redundancy management tasks and the failure management tasks, has been derived. The well-developed field of fault-tolerant computers is studied next, and some design principles relevant to the design of fault-tolerant robot controllers are abstracted. Conclusions are drawn, and a road map for the design of fault-tolerant manipulator systems is laid out with recommendations for a 10 DOF arm with dual actuators at each joint.

Tesar, Delbert↗
NASA NTRS2008

Mars Reconnaissance Orbiter In-flight Anomalies and Lessons Learned: An Update

The Mars Reconnaissance Orbiter mission has as its primary objectives: advance our understanding of the current Mars climate, the processes that have formed and modified the surface of the planet and the extent to which water has played a role in surface processes; identify sites of possible aqueous activity indicating environments that may have been or are conducive to biological activity; and thus identify and characterize sites for future landed missions; and provide forward and return relay services for current and future Mars landed assets. MRO's crucial role in the long term strategy for Mars exploration requires a high level of reliability during its 5.4 year mission. This requires an architecture which incorporates extensive redundancy and cross-strapping. Because of the distances and hence light-times involved, the spacecraft itself must be able to utilize this redundancy in responding to time-critical failures. For cases where fault protection is unable to recognize a potentially threatening condition, either due to known limitations or software flaws, intervention by ground operations is required. These aspects of MRO's design were discussed in a previous paper [Ref. 1]. This paper provides an update to the original paper, describing MRO's significant in-flight anomalies over the past year, with lessons learned for redundancy and fault protection architectures and for ground operations.

Mars Reconnaissance Orbiter↗
NASA NTRS1988

Expert system structures for fault detection in spaceborne power systems

This paper presents an architecture for an expert system structure suitable for use with power system fault detection algorithms. The system described is not for the purpose of reacting to faults which have occurred, but rather for the purpose of performing on-line diagnostics and parameter evaluation to determine potential or incipient fault conditions. The system is also designed to detect high impedance or arcing faults which cannot be detected by conventional protection devices. This system is part of an overall monitoring computer hierarchy which would provide a full evaluation of the status of the power system and react to both incipient and catastrophic faults. An approximate hardware structure is suggested and software requirements are discussed. Modifications to CLIPS software, to capitalize on features offered by expert systems, are presented. It is suggested that such a system would have significant advantages over existing protection philosophy.

Watson, Karan↗
NASA NTRS2005

Use of Field Programmable Gate Array Technology in Future Space Avionics

Fulfilling NASA's new vision for space exploration requires the development of sustainable, flexible and fault tolerant spacecraft control systems. The traditional development paradigm consists of the purchase or fabrication of hardware boards with fixed processor and/or Digital Signal Processing (DSP) components interconnected via a standardized bus system. This is followed by the purchase and/or development of software. This paradigm has several disadvantages for the development of systems to support NASA's new vision. Building a system to be fault tolerant increases the complexity and decreases the performance of included software. Standard bus design and conventional implementation produces natural bottlenecks. Configuring hardware components in systems containing common processors and DSPs is difficult initially and expensive or impossible to change later. The existence of Hardware Description Languages (HDLs), the recent increase in performance, density and radiation tolerance of Field Programmable Gate Arrays (FPGAs), and Intellectual Property (IP) Cores provides the technology for reprogrammable Systems on a Chip (SOC). This technology supports a paradigm better suited for NASA's vision. Hardware and software production are melded for more effective development; they can both evolve together over time. Designers incorporating this technology into future avionics can benefit from its flexibility. Systems can be designed with improved fault isolation and tolerance using hardware instead of software. Also, these designs can be protected from obsolescence problems where maintenance is compromised via component and vendor availability.To investigate the flexibility of this technology, the core of the Central Processing Unit and Input/Output Processor of the Space Shuttle AP101S Computer were prototyped in Verilog HDL and synthesized into an Altera Stratix FPGA.

Ferguson, Roscoe C.↗
NASA NTRS1991

High-power converters for space applications

Phase 1 was a concept definition effort to extend space-type dc/dc converter technology to the megawatt level with a weight of less than 0.1 kg/kW (220 lb./MW). Two system designs were evaluated in Phase 1. Each design operates from a 5 kV stacked fuel cell source and provides a voltage step-up to 100 kV at 10 A for charging capacitors (100 pps at a duty cycle of 17 min on, 17 min off). Both designs use an MCT-based, full-bridge inverter, gaseous hydrogen cooling, and crowbar fault protection. The GE-CRD system uses an advanced high-voltage transformer/rectifier filter is series with a resonant tank circuit, driven by an inverter operating at 20 to 50 kHz. Output voltage is controlled through frequency and phase shift control. Fast transient response and stability is ensured via optimal control. Super-resonant operation employing MCTs provides the advantages of lossless snubbing, no turn-on switching loss, use of medium-speed diodes, and intrinsic current limiting under load-fault conditions. Estimated weight of the GE-CRD system is 88 kg (1.5 cu ft.). Efficiency of 94.4 percent and total system loss is 55.711 kW operating at 1 MW load power. The Maxwell system is based on a resonance transformer approach using a cascade of five LC resonant sections at 100 kHz. The 5 kV bus is converted to a square wave, stepped-up to a 100 kV sine wave by the LC sections, rectified, and filtered. Output voltage is controlled with a special series regulator circuit. Estimated weight of the Maxwell system is 83.8 kg (4.0 cu ft.). Efficiency is 87.2 percent and total system loss is 146.411 kW operating at 1 MW load power.

Park, J. N.↗