SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
A total of 48 operational flight instrumentation measurements were identified for use in performance monitoring and fault detection. The Operational Flight Instrumentation List contains all measurements identified for fault detection and annunciation. Some 16 controller data words were identified for use in fault detection and annunciation.
The operational flight instrumentation required for performance monitoring and fault detection are presented. Measurements by the burn through monitors are presented along with manifold and helium source pressures.
The RH-3000 program is developing a rad-hard space qualified 32-bit MIPS R-3000 RISC processor under the Naval Research Lab sponsorship. In addition, under IR&D Harris is developing RHC-3000 for embedded control applications where low cost and radiation tolerance are primary concerns. The development program leverages heavily from commercial development of the MIPS R-3000. The commercial R-3000 has a large installed user base and several foundry partners are currently producing a wide variety of R-3000 derivative products. One of the MIPS derivative products, the LR33000 from LSI Logic, was used as the basis for the design of the RH-3000 chipset. The RH-3000 chipset consists of three core chips and two support chips. The core chips include the CPU, which is the R-3000 integer unit and the FPA/MD chip pair, which performs the R-3010 floating point functions. The two support whips contain all the support functions required for fault tolerance support, real-time support, memory management, timers, and other functions. The Harris development effort had first passed silicon success in June, 1992 with the first rad-hard 32-bit RH-3000 CPU chip. The CPU device is 30 kgates, has a 508 mil by 503 mil die size and is fabricated at Harris Semiconductor on the rad-hard CMOS Silicon on Sapphire (SOS) process. The CPU device successfully passed tesing against 600,000 test vectors derived directly on the LSI/MIPS test suite and has been operational as a single board computer running C code for the past year. In addition, the RH-3000 program has developed the methodology for converting commercially developed designs utilizing logic synthesis techniques based on a combination of VHDK and schematic data bases.
Over the past several years, we have developed techniques to discriminate between fault-prone software modules and those that are not, to estimate a software system's residual fault content, to identify those portions of a software system having the highest estimated number of faults, and to estimate the effects of requirements changes on software quality.
The draft NASA Fault Management (FM) Handbook (2012) states that Fault Management (FM) is a "part of systems engineering", and that it "demands a system-level perspective" (NASAHDBK- 1002, 7). What, exactly, is the relationship between systems engineering and FM? To NASA, systems engineering (SE) is "the art and science of developing an operable system capable of meeting requirements within often opposed constraints" (NASA/SP-2007-6105, 3). Systems engineering starts with the elucidation and development of requirements, which set the goals that the system is to achieve. To achieve these goals, the systems engineer typically defines functions, and the functions in turn are the basis for design trades to determine the best means to perform the functions. System Health Management (SHM), by contrast, defines "the capabilities of a system that preserve the system's ability to function as intended" (Johnson et al., 2011, 3). Fault Management, in turn, is the operational subset of SHM, which detects current or future failures, and takes operational measures to prevent or respond to these failures. Failure, in turn, is the "unacceptable performance of intended function." (Johnson 2011, 605) Thus the relationship of SE to FM is that SE defines the functions and the design to perform those functions to meet system goals and requirements, while FM detects the inability to perform those functions and takes action. SHM and FM are in essence "the dark side" of SE. For every function to be performed (SE), there is the possibility that it is not successfully performed (SHM); FM defines the means to operationally detect and respond to this lack of success. We can also describe this in terms of goals: for every goal to be achieved, there is the possibility that it is not achieved; FM defines the means to operationally detect and respond to this inability to achieve the goal. This brief description of relationships between SE, SHM, and FM provide hints to a modeling approach to provide formal connectivity between the nominal (SE), and off-nominal (SHM and FM) aspects of functions and designs. This paper describes a formal modeling approach to the initial phases of the development process that integrates the nominal and off-nominal perspectives in a model that unites SE goals and functions of with the failure to achieve goals and functions (SHM/FM). This methodology and corresponding model, known as a Goal-Function Tree (GFT), provides a means to represent, decompose, and elaborate system goals and functions in a rigorous manner that connects directly to design through use of state variables that translate natural language requirements and goals into logical-physical state language. The state variable-based approach also provides the means to directly connect FM to the design, by specifying the range in which state variables must be controlled to achieve goals, and conversely, the failures that exist if system behavior go out-of-range. This in turn allows for the systems engineers and SHM/FM engineers to determine which state variables to monitor, and what action(s) to take should the system fail to achieve that goal. In sum, the GFT representation provides a unified approach to early-phase SE and FM development. This representation and methodology has been successfully developed and implemented using Systems Modeling Language (SysML) on the NASA Space Launch System (SLS) Program. It enabled early design trade studies of failure detection coverage to ensure complete detection coverage of all crew-threatening failures. The representation maps directly both to FM algorithm designs, and to failure scenario definitions needed for design analysis and testing. The GFT representation provided the basis for mapping of abort triggers into scenarios, both needed for initial, and successful quantitative analyses of abort effectiveness (detection and response to crew-threatening events).
The draft NASA Fault Management (FM) Handbook (2012) states that Fault Management (FM) is a "part of systems engineering", and that it "demands a system-level perspective" (NASAHDBK- 1002, 7). What, exactly, is the relationship between systems engineering and FM? To NASA, systems engineering (SE) is "the art and science of developing an operable system capable of meeting requirements within often opposed constraints" (NASA/SP-2007-6105, 3). Systems engineering starts with the elucidation and development of requirements, which set the goals that the system is to achieve. To achieve these goals, the systems engineer typically defines functions, and the functions in turn are the basis for design trades to determine the best means to perform the functions. System Health Management (SHM), by contrast, defines "the capabilities of a system that preserve the system's ability to function as intended" (Johnson et al., 2011, 3). Fault Management, in turn, is the operational subset of SHM, which detects current or future failures, and takes operational measures to prevent or respond to these failures. Failure, in turn, is the "unacceptable performance of intended function." (Johnson 2011, 605) Thus the relationship of SE to FM is that SE defines the functions and the design to perform those functions to meet system goals and requirements, while FM detects the inability to perform those functions and takes action. SHM and FM are in essence "the dark side" of SE. For every function to be performed (SE), there is the possibility that it is not successfully performed (SHM); FM defines the means to operationally detect and respond to this lack of success. We can also describe this in terms of goals: for every goal to be achieved, there is the possibility that it is not achieved; FM defines the means to operationally detect and respond to this inability to achieve the goal. This brief description of relationships between SE, SHM, and FM provide hints to a modeling approach to provide formal connectivity between the nominal (SE), and off-nominal (SHM and FM) aspects of functions and designs. This paper describes a formal modeling approach to the initial phases of the development process that integrates the nominal and off-nominal perspectives in a model that unites SE goals and functions of with the failure to achieve goals and functions (SHM/FM).
The function of Transit Habitat (TH) Reaction Control System (RCS) propulsion is to provide free-flying spacecraft capabilities and to augment Gateway stack control when docked on Gateway. The requirements of multiple propellant replenishments and extensive life operation have significant impacts on selection of the propulsion system concept and components for the RCS. The intent of this document is to provide insight into the government-reference conceptual design of a propulsion system for TH element. A pressure-fed hypergolic bi-propellant system is the assumed propulsion approach for the RCS. Its architectural concept is being traded within the NASA Moon to Mars architecture. A pressure-regulated system is examined. The propellants under consideration are Monomethyl Hydrazine (MMH) and Mixed Oxides of Nitrogen with 3% Nitric Oxide (MON3). A peer review was conducted to assess the flow schematic design and propulsion component selection, compliant with a set of assumed requirements. Redundant components to satisfy one-fault tolerance for function and two-fault tolerance against catastrophic events are incorporated in the propulsion concept design. Instrumentation laid out on the schematic would be used to gather data to monitor the health of the propulsion system and to support quantity gauging of the propulsion system fluids. Venting propellant ullage gas overboard during the refilling operations poses a significant concern to the external surfaces of the TH. A liquid/gas separator would be required to eliminate, or at least reduce, the amount of liquid propellant expelled in the vent gas mixture. The technology readiness level of the phase separator for the TH must be advanced. Metal diaphragm and non-positive-expulsion PMD propellant tank systems were traded against each other, with the PMD architecture being selected. A blowdown concept is also considered for the TH RCS propulsion. Its fluid schematic is derived from the pressure-regulated schematic with removal of assemblies involving the helium pressurization and ullage venting. Its system wet mass is 10% heavier than the pressure-regulated due to thruster performance loss and larger propellant tanks. There is no firm constraint on the propulsion system mass at this phase of the design. The blowdown concept can offer reduction in component count and operation, that would lead to a more reliable propulsion system. The blowdown concept would also benefit avionics, thermal, power, and structures on the TH. Assessing these benefits will be carried as a future work. Drawbacks of thrust and minimum impulse bit (MIB) variations due to the blowdown operation would be acceptable to Guidance, Navigation, and Control (GNC). Although the blowdown concept has been selected as a current baseline, further evaluation of the concept will be the subject of future work to ensure that the blowdown propulsion operation is appropriate for the HT RCS propulsion. This document also highlights key trade studies and design decisions, including pros and cons of the selected concept. Other appropriate options for components are pointed out for future assessments. Additional background information and documents for further review are referenced in this report.
Two algorithms were developed to demonstrate the implementation of autonomous functions in an existing spacecraft power system. The functions selected for autonomous operation include a typical performance monitoring function, battery state of charge, and a fault detection and response function represented by a battery state of charge below a preselected limit. The constraints imposed by the existing power system configuration are the available data in the telemetry stream and the existing commands and command structure. The areas requiring future development are the degree of battery characterization, the effects of hardware/software faults, and the verification of faults.
The Jet Propulsion Laboratory has started the development of a Pulse Width Modulator Application Specific Integrated Circuit (PWMA). This development is leveraging the previous development of the Switch Control ASIC (SCA). The purpose of the development is to provide the control for a selected range of power converter topologies and to meet the stringent environmental requirements of deep space missions. The PWMA will include several power control functions that are not normally included on the off-the-shelf components available today. One key functional requirement is the ability to implement an N + K redundant power converter with the ability to control the charging of a battery. Other applications will be the typical point of load isolated and non-isolated power converters. The purpose the development is not only to provide a much needed flight part, but also to accelerate the engineering process by using a standard cell library from previous ASIC developments. Under previous developments with Boeing and Lockheed Martin, JPL has produced three ASICs. Each ASIC has been implemented by using an analog standard cell library. One such development was the SCA, which is design to provide a floating power switch control. The functional verification of this ASIC has been completed and the cells used have been targeted for the new development of the PWMA. The primary function of the PWMA is to provide the control function of a point of load power converter. The design is an isolated 60 W converter with a 33 V output. In architecting the design, several functions were left up to the power converter design in order to make the ASIC more generic. The ASIC can be used for several power converter topologies and power levels. Some additional features have been added to the ASIC to provide the interfaces for multi-phase topologies and battery control functions. An N+K fault tolerant strategy has been implemented in order to provide the battery control functions. The PWMA has been developed to provide an ASIC with several functions not normally available in the off the shelf controllers. These functions have been added to enable the power converter designers to achieve fault tolerant designs and battery control functions.
The spectral distribution function is introduced to characterize the process leading to faults in rotating machinery. It is shown to be a more robust indicator than conventional power spectral density estimates, but requires only slightly more computational effort. The method is illustrated with examples from seeded gearbox transmission faults and an analytical model of a defective bearing. Procedures are suggested for implementation in realistic environments.
The main goal of this project is to fulfill the need of a controller upgrade for the Cavity Environmental Control System (CECS) on the NASA SOFIA aircraft. The preceding controller had multiple disadvantages including operating in an unpressurized region, incomplete functionality implementation, limited fault and status monitoring capability, and reduced maintainability and reliability. The new controller will go through the NASA design process to fulfill all the requirements of CECS operation including complete functionality of all devices currently installed on the aircraft, added devices to improve fault and health monitoring, and overall improvement in maintainability and reliability.
In order to support manned spaceflight safety requirements, the Space Launch System (SLS) has defined program-level requirements for key systems to ensure successful operation under single fault conditions. The SLS program has also levied requirements relating to the capability of the Inertial Navigation System to detect a second fault. This detection functionality is required in order to feed abort analysis and ensure crew safety. Increases in navigation state error due to sensor faults in a purely inertial system can drive the vehicle outside of its operational as-designed environmental and performance envelope. As this performance outside of first fault detections is defined and controlled at the vehicle level, it allows for the use of system level margins to increase probability of mission success on the operational edges of the design. A top-down approach is utilized to assess vehicle sensitivity to second sensor faults. A wide range of failure scenarios in terms of both fault magnitude and time is used for assessment. The approach also utilizes a schedule to change fault detection thresholds autonomously. These individual values are optimized along a nominal trajectory in order to maximize probability of mission success in terms of system-level insertion requirements while minimizing the probability of false positives. This paper will describe an approach integrating Genetic Algorithms and Monte Carlo analysis to tune the threshold parameters to maximize vehicle resilience to second fault events over an ascent mission profile. The analysis approach and performance assessment and verification will be presented to demonstrate the applicability of this approach to second fault detection optimization to maximize mission probability of success through taking advantage of existing margin.
Automated aircraft control has traditionally been divided into distinct "functions" that are implemented separately (e.g., autopilot, autothrottle, flight management); each function has its own fault-tolerant computer system, and dependencies among different functions are generally limited to the exchange of sensor and control data. A by-product of this "federated" architecture is that faults are strongly contained within the computer system of the function where they occur and cannot readily propagate to affect the operation of other functions. More modern avionics architectures contemplate supporting multiple functions on a single, shared, fault-tolerant computer system where natural fault containment boundaries are less sharply defined. Partitioning uses appropriate hardware and software mechanisms to restore strong fault containment to such integrated architectures. This report examines the requirements for partitioning, mechanisms for their realization, and issues in providing assurance for partitioning. Because partitioning shares some concerns with computer security, security models are reviewed and compared with the concerns of partitioning.
A laboratory testbed facility which was constructed at NASA LeRC for the development of an Intelligent Control System (ICS) for reusable rocket engines is described. The framework of the ICS consists of a hierarchy of various control and diagnostic functions. The traditional high speed, closed-loop controller resides at the lowest level of the ICS hierarchy. Above this level resides the diagnostic functions which identify engine faults. The ICS top level consists of the coordination function which manages the interaction between an expert system and a traditional control system. The purpose of the testbed is to demonstrate the feasibility of the OCS concept by implementing the ICS as the primary controller in a simulation of the Space Shuttle Main Engine (SSME). The functions of the ICS which are implemented in the testbed are as follows: an SSME dynamic simulation with selected fault mode models, a reconfigurable controller, a neural network for sensor validation, a model-based failure detection algorithm, a rule based failure detection algorithm, a diagnostic expert system, an intelligent coordinator, and a user interface which provides a graphical representation of the event occurring within the testbed. The diverse nature of the ICS has led to the development of a distributed architecture consisting of specialized hardware and software for the implementation of the various functions. This testbed is made up of five different computer systems. These individual computers are discussed along with the schemes used to implement the various ICS components. The communication between computers and the timing and synchronization between components are also addressed.
A Sensor Data Qualification (SDQ) function has been developed that allows the onboard flight computers on NASA s launch vehicles to determine the validity of sensor data to ensure that critical safety and operational decisions are not based on faulty sensor data. This SDQ function includes a novel noise series fault detection algorithm for qualification of the output data from LO2 and LH2 low-level liquid sensors. These sensors are positioned in a launch vehicle s propellant tanks in order to detect propellant depletion during a rocket engine s boost operating phase. This detection capability can prevent the catastrophic situation where the engine operates without propellant. The output from each LO2 and LH2 low-level liquid sensor is a discrete valued signal that is expected to be in either of two states, depending on whether the sensor is immersed (wet) or exposed (dry). Conventional methods for sensor data qualification, such as threshold limit checking, are not effective for this type of signal due to its discrete binary-state nature. To address this data qualification challenge, a noise computation and evaluation method, also known as a noise fault detector, was developed to detect unreasonable statistical characteristics in the discrete data stream. The method operates on a time series of discrete data observations over a moving window of data points and performs a continuous examination of the resulting observation stream to identify the presence of anomalous characteristics. If the method determines the existence of anomalous results, the data from the sensor is disqualified for use by other monitoring or control functions.
Concepts for software to implement real time aircraft control systems on a centralized digital computer were discussed. A fault tolerant software structure employing functionally redundant routines with concurrent error detection was proposed for critical control functions involving safety of flight and landing. A degraded recovery block concept was devised to allow collocation of critical and noncritical software modules within the same control structure. The additional computer resources required to implement the proposed software structure for a representative set of aircraft control functions were discussed. It was estimated that approximately 30 percent more memory space is required to implement the total set of control functions. A reliability model for the fault tolerant software was described and parametric estimates of failure rate were made.
Three-dimensional finite element modeling techniques are used to synthesize geodetic and seismological results for 1979 Imperial Valley earthquake. The strategy pursued consists of two principal steps. In the first step, the seismologically-derived coseismic fault slip is taken as a function of position in the fault plane and is applied directly to the three-dimensional dislocation model. In the second step, a physical model of stresses and constitutive parameters is perturbed so as to reproduce the observed fault slip. Hence, the principal features of the coseismic slip pattern are explained by a stress-driven fault model in which: (1) a spatially unresolved asperity is found equivalent to a stress drop of 18 MPa averaged over an area of 15 sq km, and (2) driving stress is essentially absent on the fault segment overlapping the 1940 earthquake rupture zone.
For over two decades, NASA Glenn Research Center (GRC) has been supporting the development of Radioisotope Power Systems (RPS). NASA desires higher conversion efficiency RPS options that are reliable and robust with long life design. Dynamic conversion, such as Stirling offer the potential for higher conversion efficiencies than current RPS but have yet to be demonstrated in a flight application. GRC developed a non-nuclear representation of a RPS consisting of a pair of Advanced Stirling Convertors (ASC), a Dual Convertor Controller (DCC), and associated support equipment. The DCC was designed by the Johns Hopkins University/Applied Physics Laboratory (JHU/APL) to actively control a pair of ASCs. Based on lessons learned, three generations of DCCs were developed over the past decade. After each generation of the DCC was completed, tests were performed to verify functionality. These tests include acceptance testing, fault testing, characterization testing, and testing with the Radioisotope Power System Systems Integration Laboratory (RSIL). Acceptance testing verifies that the DCC can control a pair of ASCs to produce full convertor power output. The fault testing verifies that the DCC can maintain control of the ASCs during either internal or external faults. Characterization testing verifies the functionality of the DCC over a range of bus voltage values. RSIL provides insight into the electrical interactions between a representative radioisotope power generator, its associated control schemes, and realistic electric system loads. The DCC design, development, lessons learned, test results, and future work are presented in this paper.