SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Fault-tolerant computer structure called RAMPS (for redundant asynchronous microprocessor system) has simplicity of static redundancy but offers intermittent-fault handling ability of complex, dynamically redundant systems. New structure useful wherever several microprocessors are employed for control - in aircraft, industrial processes, robotics, and automatic machining, for example.
The increasing development of small microprocessor systems has allowed the use of more advanced software in the area of control systems. This paper discusses the development of software for small Space Shuttle Getaway Special Project payloads using payload G285 as a case example. The development process behind a space related software package (as in any software package) is a major factor. The design process for G285 is discussed in some detail along with the general scheme behind data acquisition and thermal environmental control for a space related payload. Additionally, key concepts in a software system concern the implementation of redundant systems, error detection, and error response. All of these factors are discussed.
Formulas for reliability extended to more general cases. Useful in analyses of reliabilities of practical systems and structures, especially of redundant systems of identical components, among which operating loads distributed equally.
Issues related to the reliability of a redundant system with large main memory are addressed. The Fault-Tolerant Processor (FTP) for the Advanced Launch System (ALS) is used as a basis for the presentation. When the system is free of latent faults, the probability of system crash due to multiple channel faults is shown to be insignificant even when voting on the outputs of computing channels is infrequent. Using channel error maskers (CEMs) is shown to improve reliability more effectively than increasing redundancy or the number of channels for applications with long mission times. Even without using a voter, most memory errors can be immediately corrected by those CEMs implemented with conventional coding techniques. In addition to their ability to enhance system reliability, CEMs (with a very low hardware overhead) can be used to dramatically reduce not only the need of memory realignment, but also the time required to realign channel memories in case, albeit rare, such a need arises. Using CEMs, two different schemes were developed to solve the memory realignment problem. In both schemes, most errors are corrected by CEMs, and the remaining errors are masked by a voter.
Issues related to the reliability of a redundant system with large main memory are addressed. In particular, the Fault-Tolerant Processor (FTP) for Advanced Launch System (ALS) is used as a basis for our presentation. When the system is free of latent faults, the probability of system crash due to nearly-coincident channel faults is shown to be insignificant even when the outputs of computing channels are infrequently voted on. In particular, using channel error maskers (CEMs) is shown to improve reliability more effectively than increasing the number of channels for applications with long mission times. Even without using a voter, most memory errors can be immediately corrected by CEMs implemented with conventional coding techniques. In addition to their ability to enhance system reliability, CEMs--with a low hardware overhead--can be used to reduce not only the need of memory realignment, but also the time required to realign channel memories in case, albeit rare, such a need arises. Using CEMs, we have developed two schemes, called Scheme 1 and Scheme 2, to solve the memory realignment problem. In both schemes, most errors are corrected by CEMs, and the remaining errors are masked by a voter.
An approach to implementing a compact, highly reliable and precise Master Time and Frequency subsystem usable in a variety of applications is described. These applications include, among others, Satellite Ground Terminals, Range Timing Stations, Communications Terminals, and Power Station Timing subsystems. All time and frequency output signals are locked to Universal Time via the GPS Satellite system. The system provides for continued output of precise signals in the event of GPS signal interruption from antenna or lead-in breakage or other causes. Cost/performance tradeoffs affecting system accuracy over the short, medium, and long term are discussed. A unique approach to redundant system design provides an architecture with the reliability advantage of triple-redundant majority voting and the cost advantages of dual-redundant elements. The system can be configured to output a variety of precise time and frequency signals and the design can be tailored to output as few, or as many, types and quantities of signals as are required by the application.
A study was performed to evaluate the reliability of Integrated Modular Engine (IME) concepts. Comparisons were made between networked IME systems and non-networked discrete systems using expander cycle configurations. Both redundant and non-redundant systems were analyzed. Binomial approximation and Markov analysis techniques were employed to evaluate total system reliability. In addition, Failure Modes and Effects Analyses (FMEA), Preliminary Hazard Analyses (PHA), and Fault Tree Analysis (FTA) were performed to allow detailed evaluation of the IME concept. A discussion of these system reliability concepts is also presented.
A study was performed to evaluate the reliability of Integrated Modular Engine (IME) concepts. Comparisons were made between networked IME systems and non-networked discrete systems using expander cycle configurations. Both redundant and non-redundant systems were analyzed. Binomial approximation and Markov analysis techniques were employed to evaluate total system reliability. In addition, Failure Modes and Effects Analyses (FMEA), Preliminary Hazard Analyses (PHA), and Fault Tree Analysis (FTA) were performed to allow detailed evaluation of the IME concept. A discussion of these system reliability concepts is also presented.
The invention allows a field-programmable gate array (FPGA) or similar device to be efficiently reconfigured in whole or in part to provide higher capacity, non-redundant operation. The redundant device consists of functional units such as adders or multipliers, configuration memory for the functional units, a programmable routing method, configuration memory for the routing method, and various other features such as block RAM, I/O (random access memory, input/output) capability, dedicated carry logic, etc. The redundant device has three identical sets of functional units and routing resources and majority voters that correct errors. The configuration memory may or may not be redundant, depending on need. For example, SRAM-based FPGAs will need some type of radiation-tolerant configuration memory, or they will need triple-redundant configuration memory. Flash or anti-fuse devices will generally not need redundant configuration memory. Some means of loading and verifying the configuration memory is also required. These are all components of the pre-existing redundant FPGA. This innovation modifies the voter to accept a MODE input, which specifies whether ordinary voting is to occur, or if redundancy is to be split. Generally, additional routing resources will also be required to pass data between sections of the device created by splitting the redundancy. In redundancy mode, the voters produce an output corresponding to the two inputs that agree, in the usual fashion. In the split mode, the voters select just one input and convey this to the output, ignoring the other inputs. In a dual-redundant system (as opposed to triple-redundant), instead of a voter, there is some means to latch or gate a state update only when both inputs agree. In this case, the invention would require modification of the latch or gate so that it would operate normally in redundant mode, and would separately latch or gate the inputs in non-redundant mode.
The International Space Station (ISS) systems are designed based upon having redundant systems with replaceable orbital replacement units (ORUs). These ORUs are designed to be swapped out fairly quickly, but some are very large, and some are made up of many components. When an ORU fails, it is replaced on orbit with a spare; the failed unit is sometimes returned to Earth to be serviced and re-launched. Such a system is not feasible for a 500+ day long-duration mission beyond low Earth orbit. The components that make up these ORUs have mixed reliabilities. Components that make up the most mass-such as computer housings, pump casings, and the silicon board of PCBs-typically are the most reliable. Meanwhile components that tend to fail the earliest-such as seals or gaskets-typically have a small mass. To better understand the problem, my project is to create a parametric model that relates both the mass of ORUs to reliability, as well as the mass of ORU subcomponents to reliability.
The International Space Station's (ISS) Regenerative Environmental Control and Life Support System (ECLSS) was launched in 2008 to continuously recycle urine and crew sweat into drinking water and oxygen using brand new technologies. This functionality was highly important to the ability of the ISS to transition to the long-term goal of 6-crew operations as well as being critical tests for long-term space habitability. Through the initial activation and long-term operations of these systems, important lessons were learned about the importance of system redundancy and operational workarounds that allow Systems Engineers to maintain functionality with limited on-orbit spares. This presentation will share some of these lessons learned including how to balance water through the different systems, store and use water for use in system failures and creating procedures to operate the systems in ways that they were not initially designed to do.
Functional redundancy safeguards for inert gas attitude control thruster systems
Operating procedures for this redundant system are described. A test plan is developed with two objectives. First, performance of the hardware and software delivered is demonstrated. Second, applicability of multiple IMU systems to the space shuttle mission is shown through detailed experiments with FDI algorithms and other multiple IMU software: gyrocompassing, calibration, and navigation. Gimbal flip is examined in light of its possible detrimental effects on FDI and navigation. For Vol. 3, see N74-10296.
This paper deals with analytic redundancy management of systems that have appreciable structural dynamics and require active control. The class of systems considered is large, lightweight spacecraft that have large numbers of distributed sensors and actuators. Both preliminary design and on-line operations are studied. For the preliminary design we deal with the placement of the sensor and actuator components on a highly flexible spacecraft. For on-line operation an analytic redundancy management system based on examination of the residuals of a Kalman filter is considered. A large, flexible grid made of overlapping aluminum bars is used to experimentally evaluate this analytic redundancy management system. Results of the experimental evaluation are included in the paper.
Equations are derived which enable one to calculate the system reliability for parallel or triple modular redundant systems with standby spares. Software error detection is introduced into the TMR/Spares system configuration in order to utilize fully all of the units. An indication of the sensitivity of the system reliability to an increase in the number of spares, partitioning, switching, variations in the powered and unpowered failures rates, and time is presented. A comparison of the parallel and the TMR/Spares system configurations, under similar conditions, is given.
The Life Support Flight Program is evaluating regenerative technologies, including those that utilize higher plants, as a means to reduce resupply over long duration space missions. Constructed to assist in the evaluation process is the CELSS Test Facility Engineering Development Unit (CTF-EDU) an environmentally closed (less than 1% mass and thermal leakage) technology test bed. This ground based fully functional prototype is currently configured to support crop growth, utilizing the power, volume and mass resources allocated for two space station racks. Sub-system technologies were selected considering their impact on available resources, their ability to minimize integration issues, and their degree of modularity. Gas specific mass handling is a key sub-system technology for both biological and physical/chemical life support technologies. The CTF-EDU requires such a system to accommodate non-linear oxygen production from crops, by enabling the control system to change and sustain partial pressure set points in the growth volume. Electrochemical cells are one of the technologies that were examined for oxygen handling in the CTF-EDU. They have been additionally considered to meet other regenerative life support functions, such as oxygen generation, the production of potable water from composite waste streams, and for having the potential to integrate life support functions with those of propulsion and energy storage. An oxygen removal system based on an electrochemical cell was chosen for the EDU due to it's low power, volume and mass requirements (10W, 0.000027 cu m, 4.5 kg) and because of the minimal number of integration considerations. Unlike it's competitors, the system doesn't require post treatments of its byproducts, or heat and power intensive regenerations, that also mandate system redundancy or cycling. The EDUs oxygen removal system only requires two resources, which are already essential to controlled plant growth: electricity and water. Additionally, the amount of oxygen that is removed from the EDU is directly proportional to the cell input current via Faraday's constant, potentially allowing for a mol/electron measurement of photosynthetic rate. The currently operative oxygen removal system has maintained reduced oxygen set points within the EDU, and preparation is underway to verify of the accuracy of electrochemical measurement of oxygen production and hence, photosynthesis. This paper examines the working principles of the electrochemical cell, outlines the overall design of the oxygen removal system and its integration with other EDU subsystems, and summarizes test results obtained over crop growth cycles in the CTF-EDU.
CARE 3 (Computer-Aided Reliability Estimation, version three) is a computer program designed to help estimate the reliability of complex, redundant systems. Although the program can model a wide variety of redundant structures, it was developed specifically for fault-tolerant avionics systems--systems distinguished by the need for extremely reliable performance since a system failure could well result in the loss of human life. It substantially generalizes the class of redundant configurations that could be accommodated, and includes a coverage model to determine the various coverage probabilities as a function of the applicable fault recovery mechanisms (detection delay, diagnostic scheduling interval, isolation and recovery delay, etc.). CARE 3 further generalizes the class of system structures that can be modeled and greatly expands the coverage model to take into account such effects as intermittent and transient faults, latent faults, error propagation, etc.
The paper reviews developments in failure detection and isolation techniques applicable to gimballed and strapdown systems. It examines basic redundancy management goals of improved reliability, performance and logistic costs, and explores mechanizations available for both input and output data handling. The meaning of redundant system reliability in terms of available coverage, system MTBF, and mission time is presented and the practical hardware performance limitations of failure detection and isolation techniques are explored. Simulation results are presented illustrating implementation coverages attainable considering IMU performance models and mission detection threshold requirements. The implications of a complete GN&C redundancy management method on inertial techniques are also explored.