Search NASA⌕ Search

SEARCH · Search NASA

Results for “Failure Tolerance”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 91 records · Page 5

An out-of-core thermionic-converter system for nuclear space power

Design of the nuclear thermionic space power system, 40 50 70 Kw(e) power range, are given. The design configuration (1) meets the constraints of readily available launch vehicles; (2) allows for off-design operation including startup, shutdown, and possible emergency conditions; (3) provides tolerance of failure by extensive use of modular, redundant elements; (4) incorporates and uses heat pipes in a fashion that reduces the need for extensive in-pile testing of system components; and (5) uses thermionic converters, nuclear fuel elements, and heat transfer devices in a geometrical form adapted from existing incore thermionic system designs. Designs and in some cases performance data for elements and groups of the elements of the system are included. Benefits of the highly modular system approach to reliability, safety, economy of development, and flexibility are discussed.

Breitwieser, R.↗

An out-of-core thermionic-converter system for nuclear space power.

Reexamination of designs of nuclear thermionic space power systems with the converter outside the reactor in the perspective of recent advances in heat-transfer methods, materials, converter performance, and radiation design. The 40- to 70-kW(e) power range is treated. The configuration is found to meet the constraints of readily available launch vehicles. It allows for off-design operation including startup, shutdown, and possible emergency conditions; provides tolerance of failure by extensive use of modular, redundant elements; incorporates and uses heat pipes in a fashion that reduces the need for extensive in-pile testing of system components; and uses thermionic converters, nuclear fuel elements, and heat-transfer devices in a geometrical form adapted from existing incore thermionic system designs.

Breitwieser, R.↗

A self-reorganizing digital flight control system for aircraft

This paper presents a design method for digital self-reorganizing control systems which is optimally tolerant of failures in aircraft sensors. The functions of this system are accomplished with software instead of the popular and costly technique of hardware duplication. The theoretical development, based on M-ary hypothesis testing, results in a bank of M Kalman filters operating in parallel in the failure detection logic. A moving window of the innovations of each Kalman filter drives the detection logic to decide the failure state of the system. The detection logic also selects the optimal state estimate (for control logic) from the bank of Kalman filters. The design process is applied to the design of a self-reorganizing control system for a current configuration of the space shuttle orbiter at Mach 5 and 120,000 feet. The failure detection capabilities of the system are demonstrated using a real-time simulation of the system with noisy sensors.

Montgomery, R. C.↗

An experimental evaluation of software redundancy as a strategy for improving reliability

The strategy of using multiple versions of independently developed software as a means to tolerate residual software design faults is suggested by the success of hardware redundancy for tolerating hardware failures. Although, as generally accepted, the independence of hardware failures resulting from physical wearout can lead to substantial increases in reliability for redundant hardware structures, a similar conclusion is not immediate for software. The degree to which design faults are manifested as independent failures determines the effectiveness of redundancy as a method for improving software reliability. Interest in multi-version software centers on whether it provides an adequate measure of increased reliability to warrant its use in critical applications. The effectiveness of multi-version software is studied by comparing estimates of the failure probabilities of these systems with the failure probabilities of single versions. The estimates are obtained under a model of dependent failures and compared with estimates obtained when failures are assumed to be independent. The experimental results are based on twenty versions of an aerospace application developed and certified by sixty programmers from four universities. Descriptions of the application, development and certification processes, and operational evaluation are given together with an analysis of the twenty versions.

Eckhardt, Dave E., Jr.↗

Reliable broadcast protocols

A number of broadcast protocols that are reliable subject to a variety of ordering and delivery guarantees are considered. Developing applications that are distributed over a number of sites and/or must tolerate the failures of some of them becomes a considerably simpler task when such protocols are available for communication. Without such protocols the kinds of distributed applications that can reasonably be built will have a very limited scope. As the trend towards distribution and decentralization continues, it will not be surprising if reliable broadcast protocols have the same role in distributed operating systems of the future that message passing mechanisms have in the operating systems of today. On the other hand, the problems of engineering such a system remain large. For example, deciding which protocol is the most appropriate to use in a certain situation or how to balance the latency-communication-storage costs is not an easy question.

Joseph, T. A.↗

The Dangers of Failure Masking in Fault-Tolerant Software: Aspects of a Recent In-Flight Upset Event

On 1 August 2005, a Boeing Company 777-200 aircraft, operating on an international passenger flight from Australia to Malaysia, was involved in a significant upset event while flying on autopilot. The Australian Transport Safety Bureau's investigation into the event discovered that an anomaly existed in the component software hierarchy that allowed inputs from a known faulty accelerometer to be processed by the air data inertial reference unit (ADIRU) and used by the primary flight computer, autopilot and other aircraft systems. This anomaly had existed in original ADIRU software, and had not been detected in the testing and certification process for the unit. This paper describes the software aspects of the incident in detail, and suggests possible implications concerning complex, safety-critical, fault-tolerant software.

Johnson, C. W.↗

NASA Electric Vertical Takeoff and Landing (eVTOL) Aircraft Technology for Public Services – A White Paper

History has shown that our personal life is highly dependent on the technology that people have developed. A strategic scan of the aerospace environment at the beginning of the 21st century strongly suggests that the world might be approaching a new age of airpower—the era of electrified/hybrid aircraft propulsion. Undeniably, starting from the Montgolfier Brothers balloon flight in 1783, to the Wright Brothers piston engine flight in 1903, and the jet engine of the 1960s, or the space age of today, one can say that leaps in propulsion technology have marked the different ages of human flight. The technological advancements, brought at the beginning of 21st century by the revolution in data exchange, computational power, sensors, wireless communication, internet, and autonomy, contributed to the vision of this new age of propulsion we are approaching. Historically, conventional vertical takeoff and landing (VTOL) aircraft have been equipped with propulsion units relying on complex internal combustion machines (turbines, piston engines, for example), and complex mechanical arrangements (gearboxes, shafts, variable pitch propeller). By contrast, electric VTOL aircraft (eVTOL)1 rely on simpler propulsion units (electric motors and in some cases fixed-pitch propellers). This promotes redundancy and improves tolerance to failures, in turn improving safety. The use of simpler electric propulsion units should also allow significant acquisition and operating cost reductions. Whether full-electric (relying solely on batteries) or hybrid-electric (relying on a combination of batteries, fuel-powered engines, and generators.), eVTOLs are also expected to generate less noise and air pollution than conventional aircraft with similar payloads. According to the 2019 Annual Review of IATA (International Air Transport Association) [ref.1], due to an expected increase in air transport traffic by 5% every year and a doubling of air transport passenger numbers to 8.2 billion by 2037 significant challenges are posed to the aviation industry. Furthermore, this report does not factor in the expected demand for short-range (intra-city) air transportation, which is in development and yet to be operational. The increased demand to fly creates a responsibility to expand in a sustainable manner and an endeavor to develop more environmentally-friendly aircraft. eVTOL aircraft, either piloted or autonomous, is gathering considerable interest worldwide. Modern and novel full-electric or hybrid-electric eVTOL configurations enable a new paradigm shift in air transportation as the aviation industry remains committed to its goals of carbon-neutral growth from 2020 onwards and cutting CO2 emissions to half 2005 levels by 2050. While electric power has been used for decades, recent developments in mobile electric/hybrid propulsion coupled with advanced materials and autonomous systems may create the possibility to transition into the next age of air mobility propelled by electric/hybrid VTOL aircraft technology. Although eVTOL aircraft might seem like an incremental improvement or even a counterintuitive regression with regard to past VTOL development, it has in fact the potential to transform air mobility across a wide range of government applications. Previous transformations in aviation generated dramatic leaps in performance, but the cost was commensurate with performance, limiting quantity produced. This next age appears to take a different approach. Performance may not increase, but at this moment technology is poised for future urban mobility that will spawn commercial passenger drone services, that is, autonomous (pilotless) air taxis and thereby add a new dimension to the urban transportation mix of the future [ref. 2]. Advances in electric propulsion, autonomous flight technology, and 5G communication networks will enable this fast new-growing market to become a reality. It is now time to envision the introduction of electric/hybrid eVTOL aircraft for Public Services2. We believe that in the next decades eVTOL aircraft will have the potential to become an essential tool to Public Service agencies around the world in applications such as firefighting, public safety, search and rescue, disaster relief and law enforcement. This is due to several major factors. • First, with the increasing popularity of small, unmanned aircraft vehicles (UAVs) or drones, many companies today are focusing on the development of passenger UAVs designed to accommodate up to five passengers or equivalent cargo payload. Many such configurations are electric or hybrid-electric designs with VTOL capabilities. Several of these projects have started a flight test program and many more are expected to be in the experimental and development phase in 2020. Such revolutionary vehicles could be in commercial operations by 2030. These eVTOL systems could be ready for selected Public Services missions even sooner. • Second, although these advanced eVTOL vehicles under development still need access to fuel (hybrid) and/or electric charging capability, they can take off and land from almost anywhere. Therefore, such vehicles, both manned and unmanned can be successfully integrated for the critical missions of the Public Services with extra deployment flexibilities. • Third, advancement in electric propulsion systems in the automotive industry together with NASA’s leading efforts in electrification of aircraft propulsion systems, FAA’s ongoing active eVTOL certification programs, and EASA’s proposed framework for the certification of electric/hybrid small category VTOL aircraft in Europe [ref. 3] will help accelerate industry electric propulsion system development and integration. • Finally, eVTOL vehicles could be deployed for Public Services sooner than air taxi or other commercial applications, since Public Services missions may be more easily approved based on specific mission criteria, localized airworthiness authority for public-use aircraft3, and are normally operating under centralized airspace management and control by the theater command. Moreover, public perception and acceptance are generally less of a concern when operations save lives and benefit the wider community. The prioritized introduction of eVTOL aircraft in Public Services is ambitious, but we believe it is achievable in the coming decades if fundamental enablers (people and technologies) are engaged in defining the objectives and needs of these missions. The revolution that is currently taking place in eVTOL aircraft represents an unprecedented opportunity to develop a safer, more affordable, more available and more environmentally friendly future of vertical flight. To ensure that these novel aircraft meet the future expectations of Public Services, it is essential to take a collaborative and multi-disciplinary approach to their development, across engineering disciplines, policy-making, program management, business case development, manufacturing, and flight demonstrations. It should be noted that the term eVTOL (in the near term) used throughout this publication implies aircraft capable of transporting up to 5 persons which may or may not include a pilot if operated fully autonomously, assuming an average of 200 pounds (91 kg) per person or equivalent payload and a range up to 60 miles plus a suitable reserve. Hybrid or hydrogen powered eVTOLs would have greater range. For example, a “3-seat” eVTOL aircraft may only be able to carry two fully equipped firemen, and payload capacity is more relevant when used for the supply mission. Moreover, this paper concentrates on the “last-mile” solutions with a deployment time of no more than 6 hours. Although not specifically discussed in this document, it is understood that the future of Transformative Vertical Flight in general and Public Services, in particular, will also involve smaller UAVs that will undoubtedly play a crucial role in future aerial operations. For example, smaller unmanned aircraft may be used to dispatch medical supplies, portable filtration systems or perform the Search task of future Search and Rescue (SAR) operations. Close collaboration between the aircraft industry, the Civil Aviation Authorities (CAA), e.g., Federal Aviation Administration (FAA), European Aviation Safety Agency (EASA), Transport Canada Civil Aviation (TCCA) and the Department of Defense (DoD) certifiers, will help identify Public Services requirements, define expectations and limit development cost and timescales. Take the US Air Force Agility Prime as an example, the majority of the eVTOL application opportunities and mission elements identified are in line with the NASA TVF WG-4 objectives and use cases. Together, it forms a strong partnership to accelerate the development, certification, and practical deployment for public service missions. The US Air Force Agility Prime has been a collaboration partner on this white paper, and provided valuable input and recommendations. Most of the eVTOL public service mission elements discussed in this paper and additional use cases envisioned by the NASA TVF WG-4 team are shared by the Agility Prime program. The focus and efforts of the Agility Prime in product and system development, industry and government partnership, accelerated certifications as well as early test and deployment are totally in sync with the path forward recommended by this white paper. This kind of collaboration and partnership will help enable the practical use of the eVTOL for public service missions, benefit the eVTOL public acceptance, and accelerate the eVTOL industry revolution.

Johnny T. Doo↗

Design and Fabrication of the Langley Aerodrome No. 8 - Distributed Electric Propulsion VTOL Testbed

The Langley Aerodrome No. 8 (LA-8) is a distributed electric propulsion, vertical takeoff and landing (VTOL) aircraft that is being used for wind tunnel testing and free flight testing at the NASA Langley Research Center. The intent of the LA-8 project is to provide a low-cost, modular test bed for technologies in the area of Advanced Air Mobility which includes electric urban and short regional flight. The methods used on the LA-8 provide a rapid means to verify aerodynamic, acoustic, and flight dynamics analysis of new electric VTOL and short takeoff and landing (STOL) designs. In addition, the flight vehicle will be used to help develop test processes for FAA flight vehicle airworthiness certification and for the development of robust flight control algorithms that are tolerant of failures. A new approach is being used on test vehicle design that makes extensive use of 3-D printing. Although materials used in 3-D printing have less strength than traditional materials used for NASA’s wind tunnel and flight models, strategic placement of load-carrying structures allows the aircraft to meet structural criteria while also enabling easy changes to be made in the vehicle design, such as the outer mold line. Modularity of the vehicle’s main components allows rapid changes to the vehicle configuration for comparative evaluation of alternate designs. Finally, a description is given of detailed inertia measurements of the flight vehicle using compound pendulum swing methods.

Urban air mobility↗

Quality Issues in Propulsion

Propulsion system quality is defined in this paper as having high reliability, that is, quality is a high probability of within-tolerance performance or operation. Since failures are out-of-tolerance performance, the probability of failures and their occurrence is the difference between high and low quality systems. Failures can be described at 3 levels: the system failure (which is the detectable end of a failure), the failure mode (which is the failure process), and the failure cause (which is the start). Failure causes can be evaluated & classified by type. The results of typing flight history failures shows that most failures are in unrecognized modes and result from human error or noise, i.e. failures are when engineers learn how things really work. Although the study based on US launch vehicles, a sampling of failures from other countries indicates the finding has broad application. The parameters of the design of a propulsion system are not single valued, but have dispersions associated with the manufacturing of parts. Many tests are needed to find failures, if the dispersions are large relative to tolerances, which could contribute to the large number of failures in unrecognized modes.

McCarty, John P.↗

Control system failure monitoring using generalized parity relations

Many applications require that a control system must be tolerant to the failure of its components. This is especially true for large space-based systems that must work unattended and with long periods between maintenance. Fault tolerance can be obtained by detecting the failure of the control system component, determining which component has failed, and reconfiguring the system so that the failed component is isolated from the controller. Component failure detection experiments that were conducted on an experimental space structure, the NASA Langley Mini-Mast are presented. Two methodologies for failure detection and isolation (FDI) exist that do not require the specification of failure modes and are applicable to both actuators and sensors. These methods are known as the Failure Detection Filter and the method of Generalized Parity Relations. The latter method was applied to three different sensor types on the Mini-Mast. Failures were simulated in input-output data that were recorded during operation of the Mini-Mast. Both single and double sensor parity relations were tested and the effect of several design parameters on the performance of these relations is discussed. The detection of actuator failures is also treated. It is shown that in all the cases it is possible to identify the parity relations directly from input-output data. Frequency domain analysis is used to explain the behavior of the parity relations.

Vanschalkwyk, Christiaan Mauritz↗

Nonlinear and progressive failure aspects of transport composite fuselage damage tolerance

The purpose is to provide an end-user's perspective on the state of the art in life prediction and failure analysis by focusing on subsonic transport fuselage issues being addressed in the NASA/Boeing Advanced Technology Composite Aircraft Structure (ATCAS) contract and a related task-order contract. First, some discrepancies between the ATCAS tension-fracture test database and classical prediction methods is discussed, followed by an overview of material modeling work aimed at explaining some of these discrepancies. Finally, analysis efforts associated with a pressure-box test fixture are addressed, as an illustration of modeling complexities required to model and interpret tests.

Walker, Tom↗

On the implementation and use of Ada on fault-tolerant distributed systems

Due to a lack of distribution semantics and failure semantics, Ada was found to be inadequte for programming distributed systems in which process failure has to be tolerated. It is shown, however, that it is possible to define adequate distribution and failure semantics for Ada so that the language can be used to program fault-tolerant distributed systems. It is noted that although the new semantics require no additions or changes to Ada's syntax, an extensive support system is necessary to implement them.

Knight, John C.↗

A Voyager attitude control perspective on fault tolerant systems

In current spacecraft design, a trend can be observed to achieve greater fault tolerance through the application of on-board software dedicated to detecting and isolating failures. Whether fault tolerance through software can meet the desired objectives depends on very careful consideration and control of the system in which the software is imbedded. The considered investigation has the objective to provide some of the insight needed for the required analysis of the system. A description is given of the techniques which have been developed in this connection during the development of the Voyager spacecraft. The Voyager Galileo Attitude and Articulation Control Subsystem (AACS) fault tolerant design is discussed to emphasize basic lessons learned from this experience. The central driver of hardware redundancy implementation on Voyager was known as the 'single point failure criterion'.

Rasmussen, R. D.↗

On the design of fault-tolerant robotic manipulator systems

Robotic systems are finding increasing use in space applications. Many of these devices are going to be operational on board the Space Station Freedom. Fault tolerance has been deemed necessary because of the criticality of the tasks and the inaccessibility of the systems to maintenance and repair. Design for fault tolerance in manipulator systems is an area within robotics that is without precedence in the literature. In this paper, we will attempt to lay down the foundations for such a technology. Design for fault tolerance demands new and special approaches to design, often at considerable variance from established design practices. These design aspects, together with reliability evaluation and modeling tools, are presented. Mechanical architectures that employ protective redundancies at many levels and have a modular architecture are then studied in detail. Once a mechanical architecture for fault tolerance has been derived, the chronological stages of operational fault tolerance are investigated. Failure detection, isolation, and estimation methods are surveyed, and such methods for robot sensors and actuators are derived. Failure recovery methods are also presented for each of the protective layers of redundancy. Failure recovery tactics often span all of the layers of a control hierarchy. Thus, a unified framework for decision-making and control, which orchestrates both the nominal redundancy management tasks and the failure management tasks, has been derived. The well-developed field of fault-tolerant computers is studied next, and some design principles relevant to the design of fault-tolerant robot controllers are abstracted. Conclusions are drawn, and a road map for the design of fault-tolerant manipulator systems is laid out with recommendations for a 10 DOF arm with dual actuators at each joint.

Tesar, Delbert↗

Catastrophic Fault Recovery with Self-Reconfigurable Chips

Mission critical systems typically employ multi-string redundancy to cope with possible hardware failure. Such systems are only as fault tolerant as there are many redundant strings. Once a particular critical component exhausts its redundant spares, the multi-string architecture cannot tolerate any further hardware failure. This paper aims at addressing such catastrophic faults through the use of 'Self-Reconfigurable Chips' as a last resort effort to 'repair' a faulty critical component.

fault tolerance↗

Catastrophic fault recovery with self-reconfigurable chips

Mission critical systems typically employ multi-string redundancy to cope with possible hardware failure. Such systems are only as fault tolerant as there are many redundant strings. Once a particular critical component exhausts its redundant spares, the multi-string architecture cannot tolerate any further hardware failure. This paper aims at addressing such catastrophic faults through the use of "Self-Reconfigurable Chips" as a last resort effort to "repair" a faulty critical component.

Chau, Savio N.↗

An approximation formula for a class of fault-tolerant computers

An approximation formula is derived for the probability of failure for fault-tolerant process-control computers. These computers use redundancy and reconfiguration to achieve high reliability. Finite-state Markov models capture the dynamic behavior of component failure and system recovery, and the approximation formula permits an estimation of system reliability by an easy examination of the model.

White, A. L.↗