Search NASA⌕ Search

SEARCH · Search NASA

Results for “Failure Tolerance”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 127 records · Page 7

Development of the Orion Crew-Service Module Umbilical Retention and Release Mechanism

The Orion CSM umbilical retention and release mechanism supports and protects all of the cross-module commodities between the spacecrafts crew and service modules. These commodities include explosive transfer lines, wiring for power and data, and flexible hoses for ground purge and life support systems. The mechanism employs a single separation interface which is retained with pyrotechnically actuated separation bolts and supports roughly two dozen electrical and fluid connectors. When module separation is commanded, either for nominal on-orbit CONOPS or in the event of an abort, the mechanism must release the separation interface and sever all commodity connections within milliseconds of command receipt. There are a number of unique and novel aspects of the design solution developed by the Orion mechanisms team. The design is highly modular and can easily be adapted to other vehiclesmodules and alternate commodity sets. It will be flight tested during Orions Exploration Flight Test 1 (EFT-1) in 2014, and the Orion team anticipates reuse of the design for all future missions. The design packages fluid, electrical, and ordnance disconnects in a single separation interface. It supports abort separations even in cases where aerodynamic loading prevents the deployment of the umbilical arm. Unlike the Apollo CSM umbilical which was a destructive separation device, the Orion design is resettable and flight units can be tested for separation performance prior to flight.Initial development testing of the mechanisms separation interface resulted in binding failures due to connector misalignments. The separation interface was redesigned with a robust linear guide system, and the connector separation and boom deployment were separated into two discretely sequenced events. These changes addressed the root cause of the binding failure by providing better control of connector alignment. The new design was tuned and validated analytically via Monte Carlo simulation. The analytical validation was followed by a repeat of the initial test suite plus test cases at thermal extremes and test cases with imposed mechanical failures demonstrating fault tolerance. The mechanism was then exposed to the qualification vibration environment. Finally, separation testing was performed at full speed with live ordnance.All tests of the redesigned mechanism resulted in successful separation of the umbilical interface with adequate force margins and timing. The test data showed good agreement with the predictions of the Monte Carlo simulation. The simulation proved invaluable due to the number of variables affecting the separation and the uncertainty associated with each. The simulation allowed for rapid assessment of numerous trades and contingency scenarios, and can be easily reconfigured for varying commodity sets and connector layouts.

Separation↗

Service Life Extension of the ISS Propulsion System Elements

The International Space Station (ISS) is a result of international collaboration in building a sophisticated laboratory of an unprecedented scale in Low Earth Orbit. After a complex assembly sequence spanning over a decade, some of the early modules launched at the beginning of the program would reach the end of their certified lives, while the newer modules were just being commissioned into operation. To maximize the return on global investments in this one-of-a-kind orbiting platform that was initially conceived for a service life until 2016, it is essential for the cutting edge research on ISS to continue as long as the station can be sustained safely in orbit. ISS Program is assessing individual modules in detail to extend the service life of the ISS to 2024, and possibly to 2028. Without life extension, Functional Cargo Block (known by its Russian acronym as FGB) and the Service Module (SM), two of the early modules on the Russian Segment, would reach the end of their certified lives in 2013 and 2015 respectively. Both FGB and SM are critical for the propulsive function of the ISS. This paper describes the approach used for the service life extension of the FGB propulsion system. Also presented is an overview of the system description along with the process adopted for developing the life test plans based on considerations of system failure modes, fault tolerance and safety provisions. Tests and analyses performed, important findings and life estimates are summarized. Based on the life extension data, FGB propulsion system, in general, is considered ready for a service life until 2028.

Kamath, Ulhas↗

Operating Modes and Cooling Capabilities of the Flight ADR for the SXS Instrument on Astro-H

The microcalorimeter array on the Soft X-ray Spectrometer instrument on Astro-H requires cooling to 50 mK, which will be accomplished by a 3-stage adiabatic demagnetization refrigerator (ADR). The ADR is surrounded by a cryogenic system consisting of a superfluid helium tank, a 4.5 K Joule-Thomson (JT) cryocooler, and additional 2-stage Stirling cryocoolers that pre-cool the JT cooler and radiation shields within the cryostat. The unique ADR design allows the instrument to meet all of its science requirements using either the stored cryogen or the JT cryocooler as its heat sink, giving the instrument an unusual degree of tolerance for component failures or degradation in the cryogenic system. The flight detector assembly, ADR and dewar were integrated in early 2014, and have since been extensively characterized and calibrated. At present, the four instruments are being integrated with the spacecraft in preparation for an early 2016 launch. This presentation summarizes the operation and performance of the ADR in all of its operating modes.

adiabatic demagnetization refrigerator↗

Operating Modes and Cooling Capabilities of the 3-Stage ADR Developed for the Soft-X-Ray Spectrometer Instrument on Astro-H

A 3-stage adiabatic demagnetization refrigerator (ADR) is used on the Soft X-ray Spectrometer instrument on Astro-H to cool a 6x6 array of x-ray microcalorimeters to 50 mK. The ADR is supported by a cryogenic system consisting of a superfluid helium tank, a 4.5 K Joule-Thomson (JT) cryocooler, and additional 2-stage Stirling cryocoolers that pre-cool the JT cooler and cool radiation shields within the cryostat. The ADR is configured so that it can use either the liquid helium or the JT cryocooler as its heat sink, giving the instrument an unusual degree of tolerance for component failures or degradation in the cryogenic system. The flight detector assembly, ADR and dewar were integrated into the flight dewar in early 2014, and have since been extensively characterized and calibrated. This paper summarizes the operation and performance of the ADR in all of its operating modes

x-ray astronomy↗

Complex Dynamics of Air Traffic Flow

Air traffic in the United States has continued to grow at a steady pace since 1980, except for a dip immediately after the tragic events of September 11, 2001. There are different growth scenarios associated both with the magnitude and the composition of the future air traffic. The Terminal Area Forecast (TAF), prepared every year by the FAA, projects the growth of traffic in the United States. Both Boeing and Airbus publish market outlooks for air travel annually. Although predicting the future growth of traffic is difficult, there are two significant trends: heavily congested major airports continue to see an increase in traffic, and the emergence of regional jets and other smaller aircraft with fewer passengers operating directly between non-major airports. The interaction between air traffic demand and the ability of the system to provide the necessary airport and airspace resources can be modeled as a network. The size of the resulting network varies depending on the choice of its nodes. It would be useful to understand the properties of this network to guide future design and development. Many questions, such as the growth of delay with increasing traffic demand and impact of the en route weather on future air traffic, require a systematic understanding of the properties of the air traffic network. There has been a major advance in the understanding of the behavior of networks with a large number of components. Several theories have been advanced about the evolution of large biological and engineering networks by authors in diversified disciplines like physics, mathematics, biology and computer science. Several networks exhibit a scale-free property in the sense that the probabilistic distribution of their nodes as a function of connections decreases slower than an exponential. These networks are characterized by the fact that a small number of components have a disproportionate influence on the performance of the network. Scale-free networks are tolerant to random failure of components, but are vulnerable to selective attack on components. This paper examines two network representations for the baseline air traffic system. A network defined with the 40 major airports as nodes and with standard flight routes as links has a characteristic scale: all nodes have 60 or more links and no node has more than 460 links. Another network is defined with baseline aircraft routing structure exhibits an exponentially truncated scale-free behavior. Its degree ranges from 2 connections to 2900 connections, and 225 nodes have more than 250 connections. Furthermore, those high-degree nodes are homogeneously distributed in the airspace. A consequence of this scale-free behavior is that the random loss of a single node has little impact, but the loss of multiple high-degree nodes (such as occurs during major storms in busy airspace) can adversely impact the system. Two future scenarios of air traffic growth are used to predict the growth of air traffic in the United States. It is shown that a three-times growth in the overall traffic may result in a ten-times impact on the density of traffic in certain parts of the United States.

Scale-free Networks↗

Results of the KRUSTY Nuclear System Test

The Kilowatt Reactor Using Stirling TechnologY (KRUSTY) was a prototypic nuclear-powered test of a 5-kW(thermal) Kilopower space reactor. This paper presents results from the KRUSTY nuclear system test, which operated the power system at various temperatures and power levels for 28 consecutive hours. The testing showed that the system operated as expected and that the reactor is highly tolerant of possible failure conditions and transients. The key feature demonstrated was the ability of the reactor to load-follow the demand of the power conversion system. The thermal power of the test ranged from 1.5 to 5.0 kW(thermal), with a fuel temperature up to 880°C. Each 80-W(electric)–rated Stirling converter produced ~90 W(electric) at a component efficiency of ~35% and an overall system efficiency of ~25%.

David I. Poston↗

Considerations for Software Fault Prevention and Tolerance

Mission or safety-critical spaceflight systems should be developed to both reduce the likelihood of software faults pre-flight and to detect/mitigate the effects of software errors should they occur in-flight. New data is available that categorizes software errors from significant historic spaceflight software incidents with implications and considerations to better develop and design software to both minimize and tolerate these most likely software failures.

Avionics↗

A fault-tolerant intelligent robotic control system

This paper describes the concept, design, and features of a fault-tolerant intelligent robotic control system being developed for space and commercial applications that require high dependability. The comprehensive strategy integrates system level hardware/software fault tolerance with task level handling of uncertainties and unexpected events for robotic control. The underlying architecture for system level fault tolerance is the distributed recovery block which protects against application software, system software, hardware, and network failures. Task level fault tolerance provisions are implemented in a knowledge-based system which utilizes advanced automation techniques such as rule-based and model-based reasoning to monitor, diagnose, and recover from unexpected events. The two level design provides tolerance of two or more faults occurring serially at any level of command, control, sensing, or actuation. The potential benefits of such a fault tolerant robotic control system include: (1) a minimized potential for damage to humans, the work site, and the robot itself; (2) continuous operation with a minimum of uncommanded motion in the presence of failures; and (3) more reliable autonomous operation providing increased efficiency in the execution of robotic tasks and decreased demand on human operators for controlling and monitoring the robotic servicing routines.

Marzwell, Neville I.↗

Eigenstructure Assignment for Fault Tolerant Flight Control Design

In recent years, fault tolerant flight control systems have gained an increased interest for high performance military aircraft as well as civil aircraft. Fault tolerant control systems can be described as either active or passive. An active fault tolerant control system has to either reconfigure or adapt the controller in response to a failure. One approach is to reconfigure the controller based upon detection and identification of the failure. Another approach is to use direct adaptive control to adjust the controller without explicitly identifying the failure. In contrast, a passive fault tolerant control system uses a fixed controller which achieves acceptable performance for a presumed set of failures. We have obtained a passive fault tolerant flight control law for the F/A-18 aircraft which achieves acceptable handling qualities for a class of control surface failures. The class of failures includes the symmetric failure of any one control surface being stuck at its trim value. A comparison was made of an eigenstructure assignment gain designed for the unfailed aircraft with a fault tolerant multiobjective optimization gain. We have shown that time responses for the unfailed aircraft using the eigenstructure assignment gain and the fault tolerant gain are identical. Furthermore, the fault tolerant gain achieves MIL-F-8785C specifications for all failure conditions.

Sobel, Kenneth↗

Reinitialization issues in fault tolerant systems

This paper is concerned with the reinitialization of fault tolerant systems in which detection and isolation (FDI) techniques are used, on-line, to identify and compensate for system failures. Specifically, it will focus on FDI techniques which utilize analytic redundancy, arising from a knowledge of the plant dynamics, by analyzing the residuals of a no-fail filter designed on the assumption of no failures. In these types of fault tolerant systems, system failures have to propagate through the no-fail filter dynamics in order to get detected. Therefore, the no-fail filter must be reinitialized after the isolation of a failure so that the accumulated effects of the failure are removed. In this paper, various approaches to this reinitialization problem will be discussed.

Caglayan, A. K.↗

Gateway Autonomy for Enabling Deep Space Exploration

The Gateway spacecraft is an important stepping-stone to exploration of the solar system, integrating commercial and international partners into a tightly coupled system, enabling cislunar activities, and implementing key technologies for missions to Mars. Autonomy is a capability area necessary to handle long communication outages where intervention from Earth is impossible, to prepare to operate with long communication delays that will be common in interplanetary travel, and to make spaceflight more affordable and accessible by reducing sustaining operations costs. The Gateway Concept of Operations states that one of Gateway’s goals is to “focus on infrastructure and systems that will allow autonomous operations aboard the Gateway with robotics, automated systems, advanced communications, and distributed computing.” Gateway’s Vehicle Systems Manager (VSM) and associated Autonomous Spacecraft Management Architecture (ASMA) are key products towards delivering autonomous capability. The primary functions of the control architecture are Mission Management and Timeline Execution, Resource Management, Fault Management, and Vehicle Control and Operation (VCO). In each of these areas, there is an initial level of capability to be delivered at launch, with plans to continue development and grow to greater capability. The initial deployment of VSM will focus on maintaining vehicle safety by focusing on full fault management capabilities and deploying only enough resource and timeline planning functionality to support that. The final deployment of VSM will add significant planning and control optimization functionality to support nominal operations for up to 21 days without ground support, even accommodating fault and failure conditions. While the VSM is the vehicle-level representation of autonomous reasoning, distributed automation is essential to provide the right scope and abstraction of information to process. Module and system support of automation and simplicity of interfaces are two important design paradigms that Gateway is focusing on to garner a systems approach to autonomy. Distribution of reasoning can increase complexity, so Gateway is also taking a strict hierarchical approach to information flow and decision making. VSM is not the only capability necessary to achieve an autonomous spacecraft. Robotics support for maintenance of the spacecraft will be essential to provide continued vehicle functionality even when crew is not present. Technical and programmatic challenges exist when implementing autonomous robotics operations. These challenges include sufficient network flexibility to support data transfer to the rest of the vehicle to coordinate module-to-module robotic walk-offs and finding the proper interfaces to allow sufficient dexterity. Communication system upgrades planned for Gateway include Delay Tolerant Networking to best utilize the complex network of relays that will be part of mature cislunar operations. Distributed computing and management will provide failure tolerance, robustness, and growth of capabilities while still allowing significant reuse of heritage software on heritage systems as well as reuse of common applications across a spacecraft to minimize new development, but this requires adherence to key standards and interfaces. The Gateway program has demonstrated significant progress towards these capabilities and has identified challenges other spacecraft developers should be aware of from the start.

Molly Anderson↗

Gateway Autonomy for Enabling Deep Space Exploration

The Gateway spacecraft is an important stepping-stone to exploration of the solar system, integrating commercial and international partners into a tightly coupled system, enabling cislunar activities, and implementing key technologies for missions to Mars. Autonomy is a capability area necessary to handle long communication outages where intervention from Earth is impossible, to prepare to operate with long communication delays that will be common in interplanetary travel, and to make spaceflight more affordable and accessible by reducing sustaining operations costs. The Gateway Concept of Operations states that one of Gateway’s goals is to “focus on infrastructure and systems that will allow autonomous operations aboard the Gateway with robotics, automated systems, advanced communications, and distributed computing.” Gateway’s Vehicle Systems Manager (VSM) and associated Autonomous Spacecraft Management Architecture (ASMA) are key products towards delivering autonomous capability. The primary functions of the control architecture are Mission Management and Timeline Execution, Resource Management, Fault Management, and Vehicle Control and Operation (VCO). In each of these areas, there is an initial level of capability to be delivered at launch, with plans to continue development and grow to greater capability. The initial deployment of VSM will focus on maintaining vehicle safety by focusing on full fault management capabilities and deploying only enough resource and timeline planning functionality to support that. The final deployment of VSM will add significant planning and control optimization functionality to support nominal operations for up to 21 days without ground support, even accommodating fault and failure conditions. While the VSM is the vehicle-level representation of autonomous reasoning, distributed automation is essential to provide the right scope and abstraction of information to process. Module and system support of automation and simplicity of interfaces are two important design paradigms that Gateway is focusing on to garner a systems approach to autonomy. Distribution of reasoning can increase complexity, so Gateway is also taking a strict hierarchical approach to information flow and decision making. VSM is not the only capability necessary to achieve an autonomous spacecraft. Robotics support for maintenance of the spacecraft will be essential to provide continued vehicle functionality even when crew is not present. Technical and programmatic challenges exist when implementing autonomous robotics operations. These challenges include sufficient network flexibility to support data transfer to the rest of the vehicle to coordinate module-to-module robotic walk-offs and finding the proper interfaces to allow sufficient dexterity. Communication system upgrades planned for Gateway include Delay Tolerant Networking to best utilize the complex network of relays that will be part of mature cislunar operations. Distributed computing and management will provide failure tolerance, robustness, and growth of capabilities while still allowing significant reuse of heritage software on heritage systems as well as reuse of common applications across a spacecraft to minimize new development, but this requires adherence to key standards and interfaces. The Gateway program has demonstrated significant progress towards these capabilities and has identified challenges other spacecraft developers should be aware of from the start.

Molly Anderson↗

Fault tolerant control laws

A systematic procedure for the synthesis of fault tolerant control laws to actuator failure has been presented. Two design methods were used to synthesize fault tolerant controllers: the conventional LQ design method and a direct feedback controller design method SANDY. The latter method is used primarily to streamline the full-state Q feedback design into a practical implementable output feedback controller structure. To achieve robustness to control actuator failure, the redundant surfaces are properly balanced according to their control effectiveness. A simple gain schedule based on the landing gear up/down logic involving only three gains was developed to handle three design flight conditions: Mach .25 and Mach .60 at 5000 ft and Mach .90 at 20,000 ft. The fault tolerant control law developed in this study provides good stability augmentation and performance for the relaxed static stability aircraft. The augmented aircraft responses are found to be invariant to the presence of a failure. Furthermore, single-loop stability margins of +6 dB in gain and +30 deg in phase were achieved along with -40 dB/decade rolloff at high frequency.

Ly, U. L.↗

Solid Rocket Booster Large Main and Drogue Parachute Reliability Analysis

The parachutes on the Space Transportation System (STS) Solid Rocket Booster (SRB) are the means for decelerating the SRB and allowing it to impact the water at a nominal vertical velocity of 75 feet per second. Each SRB has one pilot, one drogue, and three main parachutes. About four minutes after SRB separation, the SRB nose cap is jettisoned, deploying the pilot parachute. The pilot chute then deploys the drogue parachute. The drogue chute provides initial deceleration and proper SRB orientation prior to frustum separation. At frustum separation, the drogue pulls the frustum from the SRB and allows the main parachutes that are mounted in the frustum to unpack and inflate. These chutes are retrieved, inspected, cleaned, repaired as needed, and returned to the flight inventory and reused. Over the course of the Shuttle Program, several improvements have been introduced to the SRB main parachutes. A major change was the replacement of the small (115 ft. diameter) main parachutes with the larger (136 ft. diameter) main parachutes. Other modifications were made to the main parachutes, main parachute support structure, and SRB frustum to eliminate failure mechanisms, improve damage tolerance, and improve deployment and inflation characteristics. This reliability analysis is limited to the examination of the SRB Large Main Parachute (LMP) and drogue parachute failure history to assess the reliability of these chutes. From the inventory analysis, 68 Large Main Parachutes were used in 651 deployments, and 7 chute failures occurred in the 651 deployments. Logistic regression was used to analyze the LMP failure history, and it showed that reliability growth has occurred over the period of use resulting in a current chute reliability of R = .9983. This result was then used to determine the reliability of the 3 LMPs on the SRB, when all must function. There are 29 drogue parachutes that were used in 244 deployments, and no in-flight failures have occurred. Since there are no observed drogue chute failures, Jeffreys Prior was used to calculate a reliability of R =.998. Based on these results, it is concluded that the LMP and drogue parachutes on the Shuttle SRB are suited to their mission and changes made over their life have improved the reliability of the parachute.

Clifford, Courtenay B.↗

Fault tolerant navigation in a Microwave Landing System environment

This paper describes the failure detection and isolation performance of a sensor fault tolerant system for the NASA Terminal Configured Vehicle (TCV) research aircraft in a Microwave Landing System (MLS) environment. The objective of the fault tolerant system is to detect failures in navigation-aid instruments and on-board sensors and to provide reliable estimates for the aircraft states in the possible presence of these sensor malfunctions. Analytic redundancy, which exists between the various sensor outputs due to the aircraft point mass equations of motion, is used to identify sensor failures. State estimates are used by an automatic guidance and control system to land the aircraft along a prescribed path.

Caglayan, A. K.↗

Probabilistic inspection strategies for minimizing service failures

The INSIM computer program is described which simulates the 'limited fatigue life' environment in which aircraft structures generally operate. The use of INSIM to develop inspection strategies which aim to minimize service failures is demonstrated. Damage-tolerance methodology, inspection thresholds and customized inspections are simulated using the probability of failure as the driving parameter.

Brot, Abraham↗

Reconfigurable tree architectures using subtree oriented fault tolerance

An approach to the design of reconfigurable tree architecture is presented in which spare processors are allocated at the leaves. The approach is unique in that spares are associated with subtrees and sharing of spares between these subtrees can occur. The Subtree Oriented Fault Tolerance (SOFT) approach is more reliable than previous approaches capable of tolerating link and switch failures for both single chip and multichip tree implementations while reducing redundancy in terms of both spare processors and links. VLSI layout is 0(n) for binary trees and is directly extensible to N-ary trees and fault tolerance through performance degradation.

Lowrie, Matthew B.↗