Search NASA⌕ Search

SEARCH · Search NASA

Results for “fault tolerant systems”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 595 records · Page 33

The Multi-Mission Earth Entry Vehicle for Sample Return Missions – Past, Present, and Future

The Multi-Mission Earth Entry Vehicle (MMEEV) is an enabling technology developed at NASA’s Langley Research Center (LaRC) over the last two decades for returning samples to Earth across a wide array of space science missions. Currently, the MMEEV is being considered for NASA’s Mars Sample Return (MSR) mission. The original vehicle concept, the Earth Entry Vehicle (EEV), was innovated at LaRC in 1998 as a robust solution to return Mars soil samples to Earth under stringent backward contamination requirements. These backward contamination requirements drove the EEV to have higher reliability than any capsule previously designed for a return-to-Earth sample return mission. The EEV achieved this high reliability by employing a passive (no active systems) vehicle architecture optimized for fault tolerance in a compact, low-mass configuration that is extensible to virtually any sample return mission. The original EEV concept utilized a carbon-carbon primary structure with high-density carbon phenolic thermal protection system. The capsule had a 60-degree sphere-cone forebody and a backshell geometry uniquely tailored to produce aerodynamics that would passively re-orient the vehicle if it entered the atmosphere with an off-nominal attitude. Contrary to every other sample return capsule conceived at the time, the EEV was designed to land without a parachute. The vehicle incorporated an integral energy-absorbing crushable structure that protected the Mars sample for landings on surfaces ranging from soft soil to solid concrete. This paper describes 20 years of technological advancements LaRC has incorporated into the EEV architecture to evolve it from the original, MSR-enabling vehicle, to a true multi-mission capability relevant to any sample return mission. The vehicle’s unique Integrated Composite Stiffener Structure (ICoSS) has been optimized for specific strength - supporting high-G atmospheric entries with steep entry angles that produce precise landing footprints on the ground. The vehicle geometry has been refined through wind tunnel testing and computational fluid dynamics simulations to improve the vehicle’s aerodynamic stability and robustness to off-nominal conditions from hypersonic to subsonic flight. The resulting configuration of the current MMEEV architecture is described, with details provided on its sample carrying capacity and atmospheric entry trajectory capabilities. The upgraded vehicle performance is mapped into current space science objectives, showing how the MMEEV supports future sample return missions and continues to be an enabling technology for NASA’s vision to return samples from Mars.

J M Corliss↗

A Modular Robotic System with Applications to Space Exploration

Modular robotic systems offer potential advantages as versatile, fault-tolerant, cost-effective platforms for space exploration, but a sufficiently mature system is not yet available. We describe the possible applications of such a system, and present prototype hardware intended as a step in the right direction. We also present elements of an automated design and optimization framework aimed at making modular robots easier to design and use, and discuss the results of applying the system to a gait optimization problem. Finally, we discuss the potential near-term applications of modular robotics to terrestrial robotics research.

Hancher, Matthew D.↗

Fault Tolerant Magnetic Bearing for Turbomachinery

NASA Glenn Research Center (GRC) has developed a Fault-Tolerant Magnetic Bearing Suspension rig to enhance the bearing system safety. It successfully demonstrated that using only two active poles out of eight redundant poles from each radial bearing (that is, simply 12 out of 16 poles dead) levitated the rotor and spun it without losing stability and desired position up to the maximum allowable speed of 20,000 rpm. In this paper, it is demonstrated that as far as the summation of force vectors of the attracting poles and rotor weight is zero, a fault-tolerant magnetic bearing system maintained the rotor at the desired position without losing stability even at the maximum rotor speed. A proportional-integral-derivative (PID) controller generated autonomous corrective actions with no operator's input for the fault situations without losing load capacity in terms of rotor position. This paper also deals with a centralized modal controller to better control the dynamic behavior over system modes.

Choi, Benjamin↗

A design approach for ultrareliable real-time systems

A design approach developed over the past few years to formalize redundancy management and validation is described. Redundant elements are partitioned into individual fault-containment regions (FCRs). An FCR is a collection of components that operates correctly regardless of any arbitrary logical or electrical fault outside the region. Conversely, a fault in an FCR cannot cause hardware outside the region to fail. The outputs of all channels are required to agree bit-for-bit under no-fault conditions (exact bitwise consensus). Synchronization, input agreement, and input validity conditions are discussed. The Advanced Information Processing System (AIPS), which is a fault-tolerant distributed architecture based on this approach, is described. A brief overview of recent applications of these systems and current research is presented.

Lala, Jaynarayan H.↗

A lightweight, high strength dexterous manipulator for commercial applications

The concept, design, and features are described of a lightweight, high strength, modular robot manipulator being developed for space and commercial applications. The manipulator has seven fully active degrees of freedom and is fully operational in 1 G. Each of the seven joints incorporates a unique drivetrain design which provides zero backlash operation, is insensitive to wear, and is single fault tolerant to motor or servo amplifier failure. Feedback sensors provide position, velocity, torque, and motor winding temperature information at each joint. This sensing system is also designed to be single fault tolerant. The manipulator consists of five modules (not including gripper). These modules join via simple quick-disconnect couplings and self-mating connectors which allow rapid assembly and/or disassembly for reconfiguration, transport, or servicing. The manipulator is a completely enclosed assembly, with no exposed components or wires. Although the initial prototype will not be space qualified, the design is well suited to meeting space requirements. The control system provides dexterous motion by controlling the endpoint location and arm pose simultaneously. Potential applications are discussed.

Marzwell, Neville I.↗

The Use of Efficient Broadcast Protocols in Asynchronous Distributed Systems

Reliable broadcast protocols are important tools in distributed and fault-tolerant programming. They are useful for sharing information and for maintaining replicated data in a distributed system. However, a wide range of such protocols has been proposed. These protocols differ in their fault tolerance and delivery ordering characteristics. There is a tradeoff between the cost of a broadcast protocol and how much ordering it provides. It is, therefore, desirable to employ protocols that support only a low degree of ordering whenever possible. This dissertation presents techniques for deciding how strongly ordered a protocol is necessary to solve a given application problem. It is shown that there are two distinct classes of application problems: problems that can be solved with efficient, asynchronous protocols, and problems that require global ordering. The concept of a linearization function that maps partially ordered sets of events to totally ordered histories is introduced. How to construct an asynchronous implementation that solves a given problem if a linearization function for it can be found is shown. It is proved that in general the question of whether a problem has an asynchronous solution is undecidable. Hence there exists no general algorithm that would automatically construct a suitable linearization function for a given problem. Therefore, an important subclass of problems that have certain commutativity properties are considered. Techniques for constructing asynchronous implementations for this class are presented. These techniques are useful for constructing efficient asynchronous implementations for a broad range of practical problems.

Schmuck, Frank Bernhard↗

All-digital jets are taking off

The functions and advantages of second-generation digital avionics systems are described. These digital systems have increased integration, increased reliability and flexibility, and improved man-machine interface, and they provide increases in the mean time between removal of line-replacable units and fuel savings. Different redundant processors and software are utilized to achieve fault-tolerance performance of flight control systems. The improved landing capabilities, front-panel instruments, sidestick controllers, back-lighted liquid-crystal displays, and fly-by-wire system possible with digital avionics are examined. The applications of digital avionics to military and commercial aircraft are discussed and examples are provided.

Spitzer, C. R.↗

Digital avionics systems - Principles and practices (2nd revised and enlarged edition)

The state of the art in digital avionics systems is surveyed. The general topics addressed include: establishing avionics system requirements; avionics systems essentials in data bases, crew interfaces, and power; fault tolerance, maintainability, and reliability; architectures; packaging and fitting the system into the aircraft; hardware assessment and validation; software design, assessment, and validation; determining the costs of avionics.

Spitzer, Cary R.↗

RAMP: A fault tolerant distributed microcomputer structure for aircraft navigation and control

RAMP consists of distributed sets of parallel computers partioned on the basis of software and packaging constraints. To minimize hardware and software complexity, the processors operate asynchronously. It was shown that through the design of asymptotically stable control laws, data errors due to the asynchronism were minimized. It was further shown that by designing control laws with this property and making minor hardware modifications to the RAMP modules, the system became inherently tolerant to intermittent faults. A laboratory version of RAMP was constructed and is described in the paper along with the experimental results.

Dunn, W. R.↗

Applicative architectures for fault-tolerant multiprocessors

Functional programming frameworks for the design of highly reliable multiprocessor systems are proposed. In contrast to imperative programming environments, a functional environment offers elegant, relatively simple, and efficient solutions to concurrent error detection and recovery problems in multiprocessors. Specific fault tolerance mechanisms for upset exposure, fault containment, secure task assignment, and recovery are developed for a class of applicative multiprocessor architectures. Verification of abstract behavioral characteristics of applicative tasks is used for exposing faults during the execution of tasks. The fault containment mechanism is based on isolation of stack and heap segments of tasks. A protocol for secure task assignment is defined between system components. The architecture permits incremental, distributed, and asynchronous backups of system state. Finally, recovery is accomplished, even in the worst cases, by re-execution of a small number of tasks.

Sharma, Madhumitra↗

Control system failure monitoring using generalized parity relations

Many applications require that a control system must be tolerant to the failure of its components. This is especially true for large space-based systems that must work unattended and with long periods between maintenance. Fault tolerance can be obtained by detecting the failure of the control system component, determining which component has failed, and reconfiguring the system so that the failed component is isolated from the controller. Component failure detection experiments that were conducted on an experimental space structure, the NASA Langley Mini-Mast are presented. Two methodologies for failure detection and isolation (FDI) exist that do not require the specification of failure modes and are applicable to both actuators and sensors. These methods are known as the Failure Detection Filter and the method of Generalized Parity Relations. The latter method was applied to three different sensor types on the Mini-Mast. Failures were simulated in input-output data that were recorded during operation of the Mini-Mast. Both single and double sensor parity relations were tested and the effect of several design parameters on the performance of these relations is discussed. The detection of actuator failures is also treated. It is shown that in all the cases it is possible to identify the parity relations directly from input-output data. Frequency domain analysis is used to explain the behavior of the parity relations.

Vanschalkwyk, Christiaan Mauritz↗

Fault-tolerant wait-free shared objects

A concurrent system consists of processes and shared objects. Previous research focused on the problem of tolerating process failure. We study the complementary problem of tolerating failures. We divide object failures into two broad classes: responsive and non-responsive. With responsive failures, a faulty object responds to every invocation, but responses may be incorrect. With non-responsive failures, a faulty object may also 'hang' without responding. For each class, we consider crash, and arbitrary types of failures. For each type of failure, we are seeking a universal implementation for fault-tolerant wait-free shared objects. We present (deterministic) implementations for all types of responsive failures, including arbitrary failures. In contrast, we show that even the most benign type of non-responsive failures requires the use of randomization. Of special interest is the problem of implementing fault-tolerant objects using only objects of the same type. We present such fault-tolerant self-implementations for many common object types. Graceful degradation is a desirable property of fault-tolerant implementations: the implemented object never fails more severely than the base objects it is derived from, even if all the base objects fail. For several failure models, we show whether this property can be achieved, and, if so, how. In addition to the above possibility/impossibility results, we also consider the resources complexity of fault-tolerant implementations. In many cases, we present lower bounds and give matching algorithms.

Jayanti, Prasad↗

AC/DC Power Systems with Applications for future Lunar/Mars base and Crew Exploration Vehicle

ABSTRACT The Power Systems branch at JSC faces a number of complex issues as it readies itself for the President's initiative on future space exploration beyond low earth orbit. Some of these preliminary issues - those dealing with electric power generation and distribution on board Mars-bound vehicle and that on Lunar and Martian surface may be summarized as follows: Type of prime mover - Because solar power may not be readily available on parts of the Lunar/Mars surface and also during the long duration flight to Mars, the primary source of power will most likely be nuclear power (Uranium fuel rods) with a secondary source of fuel cell (Hydrogen supply). The electric power generation source - With nuclear power being the main prime mover, the electric power generation source will most likely be an ac generator at a yet to be determined frequency. Thus, a critical issue is whether the generator should generate at constant or variable frequency. This will decide what type of generator to use - whether it is a synchronous machine, an asynchronous induction machine or a switched reluctance machine. The type of power distribution system - the distribution frequency, number of wires (3- wire, 4-wire or higher), and ac/dc hybridization. Building redundancy and fault tolerance in the generation and distribution sub-systems so that the system is safe; provides 100% availability to critical loads; continues to operate even with faulted sub-systems; and requires minimal maintenance. This report descril_es results of a summer faculty fellowship spent in the Power Systems Branch with the specific aim of investigating some of the lessons learned in electric power generation and usage from the terrestrial power systems industry, the aerospace industry as well as NASA's on-going missions so as to recommend novel surface and vehicle-based power systems architectures in support of future space exploration initiatives. A hybrid ac/dc architecture with source side and load side redundancies and including emergency generators on both ac and dc sides is proposed. The generation frequency is 400 Hz mostly because of the technology maturity at this frequency in the aerospace industry. Power will be distributed to several ac load distribution buses through solid state variable speed, constant frequency converters on the ac side. A segmented dc ring bus supplied from ac/dc converters and with the capability of connecting/disconnecting the segments will supply power to multiple de load distribution buses. The system will have the capability of reverse flow from dc to ac side in the case of an extreme emergency on the main ac generation side.

Chowdhury, Badrul H.↗

Fault tolerant testbed evaluation, phase 1

In recent years, avionics systems development costs have become the driving factor in the development of space systems, military aircraft, and commercial aircraft. A method of reducing avionics development costs is to utilize state-of-the-art software application generator (autocode) tools and methods. The recent maturity of application generator technology has the potential to dramatically reduce development costs by eliminating software development steps that have historically introduced errors and the need for re-work. Application generator tools have been demonstrated to be an effective method for autocoding non-redundant, relatively low-rate input/output (I/O) applications on the Space Station Freedom (SSF) program; however, they have not been demonstrated for fault tolerant, high-rate I/O, flight critical environments. This contract will evaluate the use of application generators in these harsh environments. Using Boeing's quad-redundant avionics system controller as the target system, Space Shuttle Guidance, Navigation, and Control (GN&C) software will be autocoded, tested, and evaluated in the Johnson (Space Center) Avionics Engineering Laboratory (JAEL). The response of the autocoded system will be shown to match the response of the existing Shuttle General Purpose Computers (GPC's), thereby demonstrating the viability of using autocode techniques in the development of future avionics systems.

Caluori, V., Jr.↗

Virtually-synchronous communication based on a weak failure suspector

Failure detectors (or, more accurately Failure Suspectors (FS)) appear to be a fundamental service upon which to build fault-tolerant, distributed applications. This paper shows that a FS with very weak semantics (i.e., that delivers failure and recovery information in no specific order) suffices to implement virtually-synchronous communication (VSC) in an asynchronous system subject to process crash failures and network partitions. The VSC paradigm is particularly useful in asynchronous systems and greatly simplifies building fault-tolerant applications that mask failures by replicating processes. We suggest a three-component architecture to implement virtually-synchronous communication: (1) at the lowest level, the FS component; (2) on top of it, a component (2a) that defines new views; and (3) a component (2b) that reliably multicasts messages within a view. The issues covered in this paper also lead to a better understanding of the various membership service semantics proposed in recent literature.

Schiper, Andre↗

Fault tolerant programmable digital attitude control electronics study

The attitude control electronics mechanization study to develop a fault tolerant autonomous concept for a three axis system is reported. Programmable digital electronics are compared to general purpose digital computers. The requirements, constraints, and tradeoffs are discussed. It is concluded that: (1) general fault tolerance can be achieved relatively economically, (2) recovery times of less than one second can be obtained, (3) the number of faulty behavior patterns must be limited, and (4) adjoined processes are the best indicators of faulty operation.

Sorensen, A. A.↗

A Convex Approach to Fault Tolerant Control

The design of control laws for dynamic systems with the potential for actuator failures is considered in this work. The use of Linear Matrix Inequalities allows more freedom in controller design criteria than typically available with robust control. This work proposes an extension of fault-scheduled control design techniques that can find a fixed controller with provable performance over a set of plants. Through convexity of the objective function, performance bounds on this set of plants implies performance bounds on a range of systems defined by a convex hull. This is used to incorporate performance bounds for a variety of soft and hard failures into the control design problem.

Maghami, Peiman G.↗

Attitude Control System Design for the Solar Dynamics Observatory

The Solar Dynamics Observatory mission, part of the Living With a Star program, will place a geosynchronous satellite in orbit to observe the Sun and relay data to a dedicated ground station at all times. SDO remains Sun- pointing throughout most of its mission for the instruments to take measurements of the Sun. The SDO attitude control system is a single-fault tolerant design. Its fully redundant attitude sensor complement includes 16 coarse Sun sensors, a digital Sun sensor, 3 two-axis inertial reference units, 2 star trackers, and 4 guide telescopes. Attitude actuation is performed using 4 reaction wheels and 8 thrusters, and a single main engine nominally provides velocity-change thrust. The attitude control software has five nominal control modes-3 wheel-based modes and 2 thruster-based modes. A wheel-based Safehold running in the attitude control electronics box improves the robustness of the system as a whole. All six modes are designed on the same basic proportional-integral-derivative attitude error structure, with more robust modes setting their integral gains to zero. The paper details the mode designs and their uses.

Starin, Scott R.↗