Search NASA⌕ Search

SEARCH · Search NASA

Results for “Failure Tolerance”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records
All sourcesNASA NTRSDOE OSTI
NASA NTRS2019

Trends in Human Spaceflight: Failure Tolerance, High Reliability and Correlated Failure History

In a half century of human spaceflight, NASA has continuously refined agency safety and reliability requirements in response to mission demands, critical failures, and technology development. Early spacecraft, including Mercury, Gemini and Apollo vehicles, were highly reliant on dissimilar redundancy and demonstrated test margins. Later programs, such as the reusable Space Transportation System (STS) and International Space Station (ISS), introduced probabilistic studies and isolated two-failure tolerance to improve robustness at the expense of added complexity. More recently, the Orion Multi-Program Crew Vehicle (MPCV) program adopted universal single-failure tolerance with two categorical exceptions; Zero-Failure Tolerant (0FT) and Design for Minimum Risk (DFMR) hardware. Failure tolerance variances are defined and managed in accordance with agency human-rating requirements, and require concurrence from program Technical Authorities (TA) as well as the MPCV Safety and Mission Assurance Safety and Engineering Review Panel (MSERP). To understand and reaffirm standards applied to Apollo, Space Shuttle and Orion vehicles, Orion and Deep Space Gateway Safety and Mission Assurance (S&MA) representatives conducted accelerated research to compare unique safety and reliability criteria against ground and flight anomalies, based on information contained in post-mission reports and the Problem Reporting and Corrective Action (PRACA) database. In some cases, high-profile failures and narrow escapes have reinforced decisions to maintain or adapt safety requirements. In others, empirical trends have highlighted the need for vigilance and innovative safety guidelines. Given the inability to achieve absolute compliance with evolving safety and reliability requirements, the team conducted a targeted review of DFMR and 0FT propulsion elements within the framework of changing system design, inspection, materials and process developments to formulate conclusions on technological maturity, failure density, and net changes in safety risk. Based on the aggregate performance of high-reliability and failure-tolerant systems, the authors have attempted to establish best practices and guidelines to inform future program decisions. On a somewhat cautionary note, this study is not intended to direct a universal set of requirements for future missions based on prior lessons learned. Spacecraft safety is a multi-variable problem, and attempts to mitigate past failures will not guarantee future success. However, this assessment offers a retrospective review of policy changes, implementation and effectiveness. In the future, NASA, European Space Agency (ESA) and industry partners may benefit from a more robust correlation between requirements and performance, as space-faring nations work toward more challenging, complex and long-duration commercial and deep-space ventures.

Green, Carrie↗
NASA NTRS1991

Intelligent failure-tolerant control

An overview of failure-tolerant control is presented, beginning with robust control, progressing through parallel and analytical redundancy, and ending with rule-based systems and artificial neural networks. By design or implementation, failure-tolerant control systems are 'intelligent' systems. All failure-tolerant systems require some degrees of robustness to protect against catastrophic failure; failure tolerance often can be improved by adaptivity in decision-making and control, as well as by redundancy in measurement and actuation. Reliability, maintainability, and survivability can be enhanced by failure tolerance, although each objective poses different goals for control system design. Artificial intelligence concepts are helpful for integrating and codifying failure-tolerant control systems, not as alternatives but as adjuncts to conventional design methods.

Stengel, Robert F.↗
NASA NTRS1991

Intelligent failure-tolerant control

An overview of failure-tolerant control is presented, focusing on the control of continuous-time dynamic systems (or plants) whose motions can be represented by integrals of nonlinear ordinary differential equations. Failure tolerance may be called upon to improve system reliability, maintainability, and survivability, and the issues attached to achieving these goals are examined. Robustness, which is required in some degree by all failure-tolerant systems, is discussed. The use of parallel redundancy is examined. Analytical redundancy, the principal functions of which are failure detection, failure identification, and control-system reconfiguration, is also considered. The use of expert systems and neural networks is discussed.

Stengel, Robert F.↗
NASA NTRS1997

Free-Swinging Failure Tolerance for Robotic Manipulators

Under this GSRP fellowship, software-based failure-tolerance techniques were developed for robotic manipulators. The focus was on failures characterized by the loss of actuator torque at a joint, called free-swinging failures. The research results spanned many aspects of the free-swinging failure-tolerance problem, from preparing for an expected failure to discovery of postfailure capabilities to establishing efficient methods to realize those capabilities. Developed algorithms were verified using computer-based dynamic simulations, and these were further verified using hardware experiments at Johnson Space Center.

English, James↗
NASA NTRS1997

Free-Swinging Failure Tolerance for Robotic Manipulators

Under this GSRP fellowship, software-based failure-tolerance techniques were developed for robotic manipulators. The focus was on failures characterized by the loss of actuator torque at a joint, called free-swinging failures. The research results spanned many aspects of the free-swinging failure-tolerance problem, from preparing for an expected failure to discovery of postfailure capabilities to establishing efficient methods to realize those capabilities. Developed algorithms were verified using computer-based dynamic simulations, and these were further verified using hardware experiments at Johnson Space Center.

English, James↗
NASA NTRS1990

Tolerating failures of continuous-valued sensors

One aspect of fault tolerance in process control programs is the ability to tolerate sensor failure. A methodology for transforming a process control program that cannot tolerate sensor failures onto one that can is presented. Issues addressed include modifying specifications in order to accommodate uncertainty in sensor values and averaging sensor values in a fault tolerant manner. In addition, a hierarchy of sensor failure models is identified, and both the attainable accuracy and the run-time complexity of sensor averaging with respect to this hierarchy is discussed.

Marzullo, Keith↗
NASA NTRS1984

Inherent Problems in Designing Two-Failure Tolerant Electromechanical Actuators

An electromechanical ac-powered rotary actuated four-bar linkage system for rotating the Shuttle/Centaur deployment adapter is described. The essential features of the deployment adapter rotation system (DARS) are increased reliability for mission success and maximum practical hazard control for safety. The requirements, concept development, hardware configuration, quality assurance provisions, and techniques used to meet two-fault tolerance requirements are highlighted. The rationale used to achieve a degree of safety equivalent of that of two-failure tolerance is presented. Conditions that make this approach acceptable, including single failure point components with regard to redundancy versus credibility of failure modes, are also discussed.

Hornyak, S.↗
NASA NTRS1977

Electrical power requirements analysis. Single failure tolerant entry

The results of an analysis of the orbiter electrical power system for the case of a single failure tolerant (SFT) entry are presented. The analysis was performed using the shuttle electrical power system analysis computer program. It was performed to permit assessment of the capability of the orbiter systems to support the proposed entry configuration and to provide the data necessary to identify potential constraints and limitations. Three contingency modes have been identified which would require an SFT entry. This analysis addresses an SFT entry resulting from the loss of two fuel cell powerplants, while on orbit. The results of the analysis indicate that, even under near optimum conditions, the fuel cell power demand will exceed the tested operating capacity of 16 kw, and that various electrical components may experience voltages below 24 VDC.

Pipher, M. D.↗
NASA NTRS1994

Failure tolerant operation of kinematically redundant manipulators

Redundant manipulators may compensate for failed joints with their additional degrees of freedom. In this paper such a manipulator is considered fault tolerant if it can guarantee completion of a task after any one of its joints has failed. This fault tolerance of kinematically redundant manipulators is insured here. Methods to analyze the manipulator's work space find regions inherently suitable for critical tasks because of their high level of failure tolerance. Constraints are then placed on the manipulator's range of motion to guarantee completion of a task.

Lewis, Christopher L.↗
NASA NTRS1971

A three-failure-tolerant computer system.

Two basic factors influence the design of highly reliable computer systems: the amount of failures required to be tol erated and the reliability or MTBF required. A computer system designed to tolerate any three single failures in a fail-operational-fail-operational-fail-safe manner for a real-time control application is presented. The design approach uses adaptive majority voting in both hardware and software with a four-level redundant system. Various methods of performing the adaptive majority voting functions were evaluated with the selected approach using a special module termed a voter-comparator switch (VCS). The VCS module allows the computer system to be operated in a variety of redundant modes, depending on the failure tolerance required at any particular time.

Koczela, L. J.↗
NASA NTRS2024

Failure-Tolerant Avionics for Crewed Space Systems Recommended Best Practices

This paper provides an overview of some of the major steps needed to mature and justify the design of an avionics system for crewed spacecraft. It is organized as a collection of artifacts or pieces of evidence that NASA needs to assess the system at design reviews, including a functional failure modes and effects analysis (FFMEA), fault containment region (FCR) definitions, the failure hypothesis, and reliability analysis. This paper is intended as a reference for designers working on NASA crewed spaceflight projects, reliability engineers responsible for avionics system assessments, and program managers wanting to understand what evidence is required at design reviews to ensure crew safety and mission success.

Avionics↗
NASA NTRS1990

32-Bit-Wide Memory Tolerates Failures

Electronic memory system of 32-bit words corrects bit errors caused by some common type of failures - even failure of entire 4-bit-wide random-access-memory (RAM) chip. Detects failure of two such chips, so user warned that ouput of memory may contain errors. Includes eight 4-bit-wide DRAM's configured so each bit of each DRAM assigned to different one of four parallel 8-bit words. Each DRAM contributes only 1 bit to each 8-bit word.

Buskirk, Glenn A.↗
NASA NTRS2016

Flat H Frangible Joint Evolution

Space vehicle staging and separation events require pyrotechnic devices. They are single-use mechanisms that cannot be tested, nor can failure-tolerant performance be demonstrated in actual flight articles prior to flight use. This necessitates the implementation of a robust design and test approach coupled with a fully redundant, failure-tolerant explosive mechanism to ensure that the system functions even in the event of a single failure. Historically, NASA has followed the single failure-tolerant (SFT) design philosophy for all human-rated spacecraft, including the Space Shuttle Program. Following the end of this program, aerospace companies proposed building the next generation human-rated vehicles with off-the-shelf, non-redundant, zero-failure-tolerant (ZFT) separation systems. Currently, spacecraft and launch vehicle providers for both the Orion and Commercial Crew Programs (CCPs) plan to deviate from the heritage safety approach and NASA's SFT human rating requirements. Both programs' partners have base-lined ZFT frangible joints for vehicle staging and fairing separation. These joints are commercially available from pyrotechnic vendors. Non-human-rated missions have flown them numerous times. The joints are relatively easy to integrate structurally within the spacecraft. In addition, the separation event is debris free, and the resultant pyro shock is lower than that of other design solutions. It is, however, a serious deficiency to lack failure tolerance. When used for critical applications on human-rated vehicles, a single failure could potentially lead to loss of crew (LOC) or loss of mission (LOM)). The Engineering and Safety & Mission Assurance directorates within the NASA Johnson Space Center took action to address this safety issue by initiating a project to develop a fully redundant, SFT frangible joint design, known as the Flat H. Critical to the ability to retrofit on launch vehicles being developed, the SFT mechanisms must fit within the same three-dimensional envelope as current designs as well as meet structural loads requirements. There is increased mass associated with the redundant design, and the goal is to minimize the weight impact as much as possible. These requirements presented significant challenges, both technically and financially; these challenges will be explored in this paper. Perhaps greater than the technical issues confronted during this design process, were the financial considerations. These were a significant part of the story of this design and development plan. Insufficient financial and labor resources were formidable barriers to completing this project. Nevertheless, JSC personnel successfully conducted several test series at JSC with very useful results. The many lessons learned drove design improvements, performance efficiency, and increased functional reliability. This paper examines the significant technical and financial challenges that these requirements posed to the project team. It discusses the evolution of the SFT frangible joint design, including optimization, testing, and successful partnering of the Johnson Space Center (JSC) engineering and JSC safety organizations, to enhance the flight safety margin for America's next generation of human-rated space vehicles.

Diegelman, Thomas E.↗
NASA NTRS1986

Electromechanical Turboprop-Pitch-Control Mechanism

Propeller-control system autonomous and tolerant of failure. Mounting electrical-power module and conditioning/control systems inboard rotating propeller hub eliminates failure-prone slipring devices and creates autonomous, failure-tolerant propeller-control system. Modular component design facilitates on-the-wing maintenance. System highly adaptive to various sizes and gearbox configurations. Features and capabilities described unmatched by any comparable PCM now in existence. These capabilities needed by large, fuel-efficient, commuter turboprop aircraft now being developed by aircraft industry.

Steinetz, B. M.↗
NASA NTRS1993

Tutorial: Performance and reliability in redundant disk arrays

A disk array is a collection of physically small magnetic disks that is packaged as a single unit but operates in parallel. Disk arrays capitalize on the availability of small-diameter disks from a price-competitive market to provide the cost, volume, and capacity of current disk systems but many times their performance. Unfortunately, relative to current disk systems, the larger number of components in disk arrays leads to higher rates of failure. To tolerate failures, redundant disk arrays devote a fraction of their capacity to an encoding of their information. This redundant information enables the contents of a failed disk to be recovered from the contents of non-failed disks. The simplest and least expensive encoding for this redundancy, known as N+1 parity is highlighted. In addition to compensating for the higher failure rates of disk arrays, redundancy allows highly reliable secondary storage systems to be built much more cost-effectively than is now achieved in conventional duplicated disks. Disk arrays that combine redundancy with the parallelism of many small-diameter disks are often called Redundant Arrays of Inexpensive Disks (RAID). This combination promises improvements to both the performance and the reliability of secondary storage. For example, IBM's premier disk product, the IBM 3390, is compared to a redundant disk array constructed of 84 IBM 0661 3 1/2-inch disks. The redundant disk array has comparable or superior values for each of the metrics given and appears likely to cost less. In the first section of this tutorial, I explain how disk arrays exploit the emergence of high performance, small magnetic disks to provide cost-effective disk parallelism that combats the access and transfer gap problems. The flexibility of disk-array configurations benefits manufacturer and consumer alike. In contrast, I describe in this tutorial's second half how parallelism, achieved through increasing numbers of components, causes overall failure rates to rise. Redundant disk arrays overcome this threat to data reliability by ensuring that data remains available during and after component failures.

Gibson, Garth A.↗
NASA NTRS2013

Design Safety Used in NASA's Human-rated Primary Lithium Batteries

Single cell tests were benign for external short, inadvertent charge and overdischarge into reversal up to 4.5 A. At lower current loads cells die (may be due to excessive dendrite formation) benignly. String level external short circuits lead to an unbalanced overdischarge, with one cell going into reversal. The result is catastrophic violent venting. Unbalanced string overdischarges at different currents causes catastrophic violent venting also. Heat-to-vent is very dramatic displaying violent venting Simulated internal short is also catastrophic and displays violent venting. Battery is not UL-rated; hence does not have dual-fault tolerance or tolerance to inherent cell tolerance to failures Battery Design for NASA JSC's human-rated application for use on ISS was changed to include two bypass diodes per cell to provide for two-failure tolerance to overdischarge into reversal (and external short) hazards.

Jeevarajan, J.↗
NASA NTRS1995

Autonomous control system reconfiguration for spacecraft with non-redundant actuators

The Small Satellite Technology Initiative (SSTI) 'CLARK' spacecraft is required to be single-failure tolerant, i.e., no failure of any single component or subsystem shall result in complete mission loss. Fault tolerance is usually achieved by implementing redundant subsystems. Fault tolerant systems are therefore heavier and cost more to build and launch than non-redundent, non fault-tolerant spacecraft. The SSTI CLARK satellite Attitude Determination and Control System (ADACS) achieves single-fault tolerance without redundancy. The attitude determination system system uses a Kalman Filter which is inherently robust to loss of any single attitude sensor. The attitude control system uses three orthogonal reaction wheels for attitude control and three magnetic dipoles for momentum control. The nominal six-actuator control system functions by projecting the attitude correction torque onto the reaction wheels while a slower momentum management outer loop removes the excess momentum in the direction normal to the local B field. The actuators are not redundant so the nominal control law cannot be implemented in the event of a loss of a single actuator (dipole or reaction wheel). The spacecraft dynamical state (attitude, angular rate, and momentum) is controllable from any five-element subset of the six actuators. With loss of an actuator the instantaneous control authority may not span R(3) but the controllability gramian integral(limits between t,0) Phi(t, tau)B(tau )B(prime)(tau) Phi(prime)(t, tau)d tau retains full rank. Upon detection of an actuator failure the control torque is decomposed onto the remaining active axes. The attitude control torque is effected and the over-orbit momentum is controlled. The resulting control system performance approaches that of the nominal system.

Grossman, Walter↗