Search NASA⌕ Search

SEARCH · Search NASA

Results for “Failure Tolerance”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 73 records · Page 4

Modernizing NASA’s Space Flight Safety and Mission Success (S&MS) Assurance Framework In Line With Evolving Acquisition Strategies and Systems Engineering Practices

This paper presents the objectives-driven, case-based safety and mission success (S&MS) assurance framework being developed by the NASA Office of Safety and Mission Assurance (OSMA), including its motivations and its implementation via a S&MS Assurance Standard that is under development, supplemented by supporting standards including an S&MS Analysis Management Standard that is also under development. A need to evolve NASA’s S&MS assurance framework has emerged in recent years, resulting from the need to accommodate new acquisition models; the need to accommodate evolving systems engineering (SE) practices; the need to stipulate acceptable levels of S&MS risk; the need for improved integration of S&MS into SE; and the need for clearer risk acceptance accountability. The objectives-driven, case-based S&MS assurance framework proposed here is responsive to that need. Its key features include: • The establishment, by NASA Acquirers, of fundamental S&MS performance objectives that define limits of acceptability for the likelihoods that mission technical objectives will be accomplished and that people, assets, and environments put at risk by the mission will not be adversely affected; • The development and approval of Providers’ S&MS plans for meeting Acquirers’ S&MS performance objectives, including commitments to support Acquirer audit, investigation, and reporting needs; • The development, by Providers, of S&MS assurance cases that argue, supported by evidence, that the Provider has met, or is on track to meeting, the fundamental S&MS objectives; • The evaluation, throughout the program/project life cycle, of Provider S&MS assurance cases as the primary S&MS-related technical basis for Acquirer risk acceptance and the granting to the Provider of authority to proceed through the program/project life cycle. This proposed S&MS assurance framework is notable for its lack of prescription of traditional S&MS requirements and strategies such as defined failure tolerances, margins, or analysis requirements. Instead, Providers are given latitude to propose their own strategies for meeting the fundamental S&MS performance objectives, subject to independent review and Acquirer approval. The result is a framework for S&MS assurance that is at once both rigorous and flexible.

Assurance Case↗

NASA Engineering and Safety Center Technical Bulletin No. 24-01: Material Compatibility of Common Aerospace Metals in MMH/MON-3

The NESC evaluated material compatibility of some common aerospace metals in monomethylhydrazine (MMH) and nitrogen tetroxide (MON-3). Previous work had identified a lack of quantitative compatibility data for nickel alloy 718, 300 series stainless steel, and titanium Ti-6Al-4V in MMH and MON-3 to support the use of zero-failure-tolerant, thin-walled pressure barriers in these propellants. Static (i.e., not flowing) general corrosion and electrochemistry testing was conducted, evaluating varied processing forms and heat treatment of the metals, water content of propellant, and exposure duration. Corrosion-rate data for all tested product forms, fluids, and durations were on the order of 1 x 10 –6 inch per year rather than the previously documented “less than 1 x 10 –3 inch per year”. The majority of the corrosion products were seen in the first 20 days of exposure, with an overall corrosion rate decreasing with time due to the increased divisor (time). It is therefore recommended that corrosion testing be performed at multiple short-term durations to inform the need for longer-duration testing.

Heather K Hickman↗

Fault-tolerant wait-free shared objects

A concurrent system consists of processes and shared objects. Previous research focused on the problem of tolerating process failure. We study the complementary problem of tolerating failures. We divide object failures into two broad classes: responsive and non-responsive. With responsive failures, a faulty object responds to every invocation, but responses may be incorrect. With non-responsive failures, a faulty object may also 'hang' without responding. For each class, we consider crash, and arbitrary types of failures. For each type of failure, we are seeking a universal implementation for fault-tolerant wait-free shared objects. We present (deterministic) implementations for all types of responsive failures, including arbitrary failures. In contrast, we show that even the most benign type of non-responsive failures requires the use of randomization. Of special interest is the problem of implementing fault-tolerant objects using only objects of the same type. We present such fault-tolerant self-implementations for many common object types. Graceful degradation is a desirable property of fault-tolerant implementations: the implemented object never fails more severely than the base objects it is derived from, even if all the base objects fail. For several failure models, we show whether this property can be achieved, and, if so, how. In addition to the above possibility/impossibility results, we also consider the resources complexity of fault-tolerant implementations. In many cases, we present lower bounds and give matching algorithms.

Jayanti, Prasad↗

Implementing fault-tolerant sensors

One aspect of fault tolerance in process control programs is the ability to tolerate sensor failure. A methodology is presented for transforming a process control program that cannot tolerate sensor failures to one that can. Additionally, a hierarchy of failure models is identified.

Marzullo, Keith↗

A fault tolerant approach to state estimation and failure detection in nonlinear systems

The design problem considered in the present investigation involves a nonlinear discrete time stochastic system where replicated sensors provide redundant observations of inputs and outputs of the system, compensate for sensor 'normal operating' bias levels, and generate reliable estimates for the plant states in the presence of possible sensor failures. The resulting fault tolerant design should utilize inherent analytical redundancy and be capable of detecting many different types and levels of sensor failures. In addition, it should have minimal complexity. In connection with these goals, a sensor fault tolerant system design methodology is developed. The performance of the considered approach to an application is discussed, taking into account the design of a sensor fault tolerant system using analytic redundancy for the Terminal Configured Vehicle research aircraft in a microwave landing system environment.

Lancraft, R. E.↗

Closed-Loop Evaluation of an Integrated Failure Identification and Fault Tolerant Control System for a Transport Aircraft

Formal robustness analysis of aircraft control upset prevention and recovery systems could play an important role in their validation and ultimate certification. Such systems developed for failure detection, identification, and reconfiguration, as well as upset recovery, need to be evaluated over broad regions of the flight envelope or under extreme flight conditions, and should include various sources of uncertainty. To apply formal robustness analysis, formulation of linear fractional transformation (LFT) models of complex parameter-dependent systems is required, which represent system uncertainty due to parameter uncertainty and actuator faults. This paper describes a detailed LFT model formulation procedure from the nonlinear model of a transport aircraft by using a preliminary LFT modeling software tool developed at the NASA Langley Research Center, which utilizes a matrix-based computational approach. The closed-loop system is evaluated over the entire flight envelope based on the generated LFT model which can cover nonlinear dynamics. The robustness analysis results of the closed-loop fault tolerant control system of a transport aircraft are presented. A reliable flight envelope (safe flight regime) is also calculated from the robust performance analysis results, over which the closed-loop system can achieve the desired performance of command tracking and failure detection.

Shin, Jong-Yeob↗

Reliability bounds for fault-tolerant systems with competing responses to component failures

Bounds are established on the probability of system failure for fault-tolerant systems of the type used, for example, in aviation control. Event series leading to system failure are assumed to follow a semi-Markov model in which the potential sojourn times associated with component failures have exponential distributions and those associated with system responses have distributions with unspecified form. A product form of the bounds is derived by using a model that provides for multiple competing system responses to component failures.

Lee, L. D.↗

Reliability bounds for fault-tolerant systems with competing responses to component failures

Bounds are established on the probability of system failure for fault-tolerant systems of the type used, for example, in aviation control. Event series leading to system failure are assumed to follow a semi-Markov model in which the potential sojourn times associated with component failures have exponential distributions and those associated with system responses have distributions with unspecified form. A product form of the bounds is derived by using a model that provides for multiple competing system responses to component failures.

Lee, L. D.↗

Fault-tolerant system considerations for a redundant strapdown inertial measurement unit

The development and evaluation of a fault-tolerant system for the Redundant Strapdown Inertial Measurement Unit (RSDIMU) being developed and evaluated by the NASA Langley Research Center was continued. The RSDIMU consists of four two-degree-of-freedom gyros and accelerometers mounted on the faces of a semi-octahedron which can be separated into two halves for damage protection. Compensated and uncompensated fault-tolerant system failure decision algorithms were compared. An algorithm to compensate for sensor noise effects in the fault-tolerant system thresholds was evaluated via simulation. The effects of sensor location and magnitude of the vehicle structural modes on system performance were assessed. A threshold generation algorithm, which incorporates noise compensation and filtered parity equation residuals for structural mode compensation, was evaluated. The effects of the fault-tolerant system on navigational accuracy were also considered. A sensor error parametric study was performed in an attempt to improve the soft failure detection capability without obtaining false alarms. Also examined was an FDI system strategy based on the pairwise comparison of sensor measurements. This strategy has the specific advantage of, in many instances, successfully detecting and isolating up to two simultaneously occurring failures.

Motyka, P.↗

Adaptive Control Allocation for Powered Descent Vehicles

The following work details a study into real-time failure adaptive control allocation method for powered descent vehicle systems. The motivation for this work is to enable future human and robotic missions utilizing a powered descent system to tolerate engine failures in flight without the loss of crew or assets. This study is conducted using a six degree-of-freedom trajectory simulation of a PDV (Powered Descent Vehicle) experiencing either a loss of thrust or an engine stuck full on failure scenario. Sequential least squares in the frequency domain is used on-board to process inertial measurement unit (IMU) data and generate an estimate of the PDV plant model, which is then fed to the guidance and control system. Data used by the sequential least squares method is generated from an in-flight maneuver. The work herein focuses on determining a maneuver that is least impactful to the PDV trajectory and enables a suitable plant model estimate. A 1.5-second-long maneuver with an amplitude of 5 percent throttle is determined to provide suitable data for the sequential least squares method to estimate a plant model. A PDV implementing this method can adapt to a single engine failure and continue to reach its touchdown conditions.

Green, Justin S.↗

Masking failures of multidimensional sensors (extended abstract)

When a computer monitors a physical process, the computer uses sensors to determine the values of the physical variables that represent the state of the process. A sensor can sometimes fail, however, and in the worst case report a value completely unrelated to the true physical value. The work described is motivated by a methodology for transforming a process control program that can not tolerate sensor failure into one that can. In this methodology, a reliable abstract sensor is created by combining information from several real sensors that measure the same physical value. To be useful, an abstract sensor must deliver reasonably accurate information at reasonable computational cost. Sensors are considered that deliver multidimensional values (e.g., location or velocity in three dimensions, or both temperature and pressure). Geometric techniques are used to derive upper bounds on abstract sensor accuracy and to develop efficient algorithms for implementing abstract sensors.

Chew, Paul↗

An out-of-core thermionic-converter system for nuclear space power

Design of the nuclear thermionic space power system, 40 50 70 Kw(e) power range, are given. The design configuration (1) meets the constraints of readily available launch vehicles; (2) allows for off-design operation including startup, shutdown, and possible emergency conditions; (3) provides tolerance of failure by extensive use of modular, redundant elements; (4) incorporates and uses heat pipes in a fashion that reduces the need for extensive in-pile testing of system components; and (5) uses thermionic converters, nuclear fuel elements, and heat transfer devices in a geometrical form adapted from existing incore thermionic system designs. Designs and in some cases performance data for elements and groups of the elements of the system are included. Benefits of the highly modular system approach to reliability, safety, economy of development, and flexibility are discussed.

Breitwieser, R.↗

An out-of-core thermionic-converter system for nuclear space power.

Reexamination of designs of nuclear thermionic space power systems with the converter outside the reactor in the perspective of recent advances in heat-transfer methods, materials, converter performance, and radiation design. The 40- to 70-kW(e) power range is treated. The configuration is found to meet the constraints of readily available launch vehicles. It allows for off-design operation including startup, shutdown, and possible emergency conditions; provides tolerance of failure by extensive use of modular, redundant elements; incorporates and uses heat pipes in a fashion that reduces the need for extensive in-pile testing of system components; and uses thermionic converters, nuclear fuel elements, and heat-transfer devices in a geometrical form adapted from existing incore thermionic system designs.

Breitwieser, R.↗

A self-reorganizing digital flight control system for aircraft

This paper presents a design method for digital self-reorganizing control systems which is optimally tolerant of failures in aircraft sensors. The functions of this system are accomplished with software instead of the popular and costly technique of hardware duplication. The theoretical development, based on M-ary hypothesis testing, results in a bank of M Kalman filters operating in parallel in the failure detection logic. A moving window of the innovations of each Kalman filter drives the detection logic to decide the failure state of the system. The detection logic also selects the optimal state estimate (for control logic) from the bank of Kalman filters. The design process is applied to the design of a self-reorganizing control system for a current configuration of the space shuttle orbiter at Mach 5 and 120,000 feet. The failure detection capabilities of the system are demonstrated using a real-time simulation of the system with noisy sensors.

Montgomery, R. C.↗

An experimental evaluation of software redundancy as a strategy for improving reliability

The strategy of using multiple versions of independently developed software as a means to tolerate residual software design faults is suggested by the success of hardware redundancy for tolerating hardware failures. Although, as generally accepted, the independence of hardware failures resulting from physical wearout can lead to substantial increases in reliability for redundant hardware structures, a similar conclusion is not immediate for software. The degree to which design faults are manifested as independent failures determines the effectiveness of redundancy as a method for improving software reliability. Interest in multi-version software centers on whether it provides an adequate measure of increased reliability to warrant its use in critical applications. The effectiveness of multi-version software is studied by comparing estimates of the failure probabilities of these systems with the failure probabilities of single versions. The estimates are obtained under a model of dependent failures and compared with estimates obtained when failures are assumed to be independent. The experimental results are based on twenty versions of an aerospace application developed and certified by sixty programmers from four universities. Descriptions of the application, development and certification processes, and operational evaluation are given together with an analysis of the twenty versions.

Eckhardt, Dave E., Jr.↗

Reliable broadcast protocols

A number of broadcast protocols that are reliable subject to a variety of ordering and delivery guarantees are considered. Developing applications that are distributed over a number of sites and/or must tolerate the failures of some of them becomes a considerably simpler task when such protocols are available for communication. Without such protocols the kinds of distributed applications that can reasonably be built will have a very limited scope. As the trend towards distribution and decentralization continues, it will not be surprising if reliable broadcast protocols have the same role in distributed operating systems of the future that message passing mechanisms have in the operating systems of today. On the other hand, the problems of engineering such a system remain large. For example, deciding which protocol is the most appropriate to use in a certain situation or how to balance the latency-communication-storage costs is not an easy question.

Joseph, T. A.↗

The Dangers of Failure Masking in Fault-Tolerant Software: Aspects of a Recent In-Flight Upset Event

On 1 August 2005, a Boeing Company 777-200 aircraft, operating on an international passenger flight from Australia to Malaysia, was involved in a significant upset event while flying on autopilot. The Australian Transport Safety Bureau's investigation into the event discovered that an anomaly existed in the component software hierarchy that allowed inputs from a known faulty accelerometer to be processed by the air data inertial reference unit (ADIRU) and used by the primary flight computer, autopilot and other aircraft systems. This anomaly had existed in original ADIRU software, and had not been detected in the testing and certification process for the unit. This paper describes the software aspects of the incident in detail, and suggests possible implications concerning complex, safety-critical, fault-tolerant software.

Johnson, C. W.↗

NASA Electric Vertical Takeoff and Landing (eVTOL) Aircraft Technology for Public Services – A White Paper

History has shown that our personal life is highly dependent on the technology that people have developed. A strategic scan of the aerospace environment at the beginning of the 21st century strongly suggests that the world might be approaching a new age of airpower—the era of electrified/hybrid aircraft propulsion. Undeniably, starting from the Montgolfier Brothers balloon flight in 1783, to the Wright Brothers piston engine flight in 1903, and the jet engine of the 1960s, or the space age of today, one can say that leaps in propulsion technology have marked the different ages of human flight. The technological advancements, brought at the beginning of 21st century by the revolution in data exchange, computational power, sensors, wireless communication, internet, and autonomy, contributed to the vision of this new age of propulsion we are approaching. Historically, conventional vertical takeoff and landing (VTOL) aircraft have been equipped with propulsion units relying on complex internal combustion machines (turbines, piston engines, for example), and complex mechanical arrangements (gearboxes, shafts, variable pitch propeller). By contrast, electric VTOL aircraft (eVTOL)1 rely on simpler propulsion units (electric motors and in some cases fixed-pitch propellers). This promotes redundancy and improves tolerance to failures, in turn improving safety. The use of simpler electric propulsion units should also allow significant acquisition and operating cost reductions. Whether full-electric (relying solely on batteries) or hybrid-electric (relying on a combination of batteries, fuel-powered engines, and generators.), eVTOLs are also expected to generate less noise and air pollution than conventional aircraft with similar payloads. According to the 2019 Annual Review of IATA (International Air Transport Association) [ref.1], due to an expected increase in air transport traffic by 5% every year and a doubling of air transport passenger numbers to 8.2 billion by 2037 significant challenges are posed to the aviation industry. Furthermore, this report does not factor in the expected demand for short-range (intra-city) air transportation, which is in development and yet to be operational. The increased demand to fly creates a responsibility to expand in a sustainable manner and an endeavor to develop more environmentally-friendly aircraft. eVTOL aircraft, either piloted or autonomous, is gathering considerable interest worldwide. Modern and novel full-electric or hybrid-electric eVTOL configurations enable a new paradigm shift in air transportation as the aviation industry remains committed to its goals of carbon-neutral growth from 2020 onwards and cutting CO2 emissions to half 2005 levels by 2050. While electric power has been used for decades, recent developments in mobile electric/hybrid propulsion coupled with advanced materials and autonomous systems may create the possibility to transition into the next age of air mobility propelled by electric/hybrid VTOL aircraft technology. Although eVTOL aircraft might seem like an incremental improvement or even a counterintuitive regression with regard to past VTOL development, it has in fact the potential to transform air mobility across a wide range of government applications. Previous transformations in aviation generated dramatic leaps in performance, but the cost was commensurate with performance, limiting quantity produced. This next age appears to take a different approach. Performance may not increase, but at this moment technology is poised for future urban mobility that will spawn commercial passenger drone services, that is, autonomous (pilotless) air taxis and thereby add a new dimension to the urban transportation mix of the future [ref. 2]. Advances in electric propulsion, autonomous flight technology, and 5G communication networks will enable this fast new-growing market to become a reality. It is now time to envision the introduction of electric/hybrid eVTOL aircraft for Public Services2. We believe that in the next decades eVTOL aircraft will have the potential to become an essential tool to Public Service agencies around the world in applications such as firefighting, public safety, search and rescue, disaster relief and law enforcement. This is due to several major factors. • First, with the increasing popularity of small, unmanned aircraft vehicles (UAVs) or drones, many companies today are focusing on the development of passenger UAVs designed to accommodate up to five passengers or equivalent cargo payload. Many such configurations are electric or hybrid-electric designs with VTOL capabilities. Several of these projects have started a flight test program and many more are expected to be in the experimental and development phase in 2020. Such revolutionary vehicles could be in commercial operations by 2030. These eVTOL systems could be ready for selected Public Services missions even sooner. • Second, although these advanced eVTOL vehicles under development still need access to fuel (hybrid) and/or electric charging capability, they can take off and land from almost anywhere. Therefore, such vehicles, both manned and unmanned can be successfully integrated for the critical missions of the Public Services with extra deployment flexibilities. • Third, advancement in electric propulsion systems in the automotive industry together with NASA’s leading efforts in electrification of aircraft propulsion systems, FAA’s ongoing active eVTOL certification programs, and EASA’s proposed framework for the certification of electric/hybrid small category VTOL aircraft in Europe [ref. 3] will help accelerate industry electric propulsion system development and integration. • Finally, eVTOL vehicles could be deployed for Public Services sooner than air taxi or other commercial applications, since Public Services missions may be more easily approved based on specific mission criteria, localized airworthiness authority for public-use aircraft3, and are normally operating under centralized airspace management and control by the theater command. Moreover, public perception and acceptance are generally less of a concern when operations save lives and benefit the wider community. The prioritized introduction of eVTOL aircraft in Public Services is ambitious, but we believe it is achievable in the coming decades if fundamental enablers (people and technologies) are engaged in defining the objectives and needs of these missions. The revolution that is currently taking place in eVTOL aircraft represents an unprecedented opportunity to develop a safer, more affordable, more available and more environmentally friendly future of vertical flight. To ensure that these novel aircraft meet the future expectations of Public Services, it is essential to take a collaborative and multi-disciplinary approach to their development, across engineering disciplines, policy-making, program management, business case development, manufacturing, and flight demonstrations. It should be noted that the term eVTOL (in the near term) used throughout this publication implies aircraft capable of transporting up to 5 persons which may or may not include a pilot if operated fully autonomously, assuming an average of 200 pounds (91 kg) per person or equivalent payload and a range up to 60 miles plus a suitable reserve. Hybrid or hydrogen powered eVTOLs would have greater range. For example, a “3-seat” eVTOL aircraft may only be able to carry two fully equipped firemen, and payload capacity is more relevant when used for the supply mission. Moreover, this paper concentrates on the “last-mile” solutions with a deployment time of no more than 6 hours. Although not specifically discussed in this document, it is understood that the future of Transformative Vertical Flight in general and Public Services, in particular, will also involve smaller UAVs that will undoubtedly play a crucial role in future aerial operations. For example, smaller unmanned aircraft may be used to dispatch medical supplies, portable filtration systems or perform the Search task of future Search and Rescue (SAR) operations. Close collaboration between the aircraft industry, the Civil Aviation Authorities (CAA), e.g., Federal Aviation Administration (FAA), European Aviation Safety Agency (EASA), Transport Canada Civil Aviation (TCCA) and the Department of Defense (DoD) certifiers, will help identify Public Services requirements, define expectations and limit development cost and timescales. Take the US Air Force Agility Prime as an example, the majority of the eVTOL application opportunities and mission elements identified are in line with the NASA TVF WG-4 objectives and use cases. Together, it forms a strong partnership to accelerate the development, certification, and practical deployment for public service missions. The US Air Force Agility Prime has been a collaboration partner on this white paper, and provided valuable input and recommendations. Most of the eVTOL public service mission elements discussed in this paper and additional use cases envisioned by the NASA TVF WG-4 team are shared by the Agility Prime program. The focus and efforts of the Agility Prime in product and system development, industry and government partnership, accelerated certifications as well as early test and deployment are totally in sync with the path forward recommended by this white paper. This kind of collaboration and partnership will help enable the practical use of the eVTOL for public service missions, benefit the eVTOL public acceptance, and accelerate the eVTOL industry revolution.

Johnny T. Doo↗