SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Computer program analyzes the designs of critical systems that will either prove the design is free of single-point failures or detect each member of the population of single-point failures inherent in a system design. This program should find application in the checkout of redundant circuits and digital systems.
This note is being published to improve the visibility of this subject, as we continue to see problems surface in designs, as well as to add additional information to the previously published note for design engineers. The original application note focused on designing systems with no single point failures using Actel Field Programmable Gate Arrays (FPGAs) for critical applications. Included in that note were the basic principles of operation of the Actel FPGA and a discussion of potential single-point failures. The note also discussed the issue of startup transients for that class of device. It is unfortunate that we continue to see some design problems using these devices. This note will focus on the startup properties of certain electronic components, in general, and current Actel FPGAs, in particular. Devices that are "power-on friendly" are currently being developed by Actel, as a variant of the new SX series of FPGAs. In the ideal world, electronic components would behave much differently than they do in the real world, The chain, of course, starts with the power supply. Ideally, the voltage will immediately rise to a stable V(sub cc) level, of course, it does not. Aside from practical design considerations, inrush current limits of certain capacitors must be observed and the power supply's output may be intentionally slew rate limited to prevent a large current spike on the system power bus. In any event, power supply rise time may range from less than I msec to 100 msec or more.
The current practices for restoring critical services in the distribution system during a disaster, align with the traditional centralized ideology of distribution systems operations. A central processor evaluates the distribution system after a disruption and attains a restoration plan. However, the centralized operational paradigm is susceptible to single-point failures, requires full situational awareness of the distribution system, and poses scalability challenges for large multifeeder distribution systems. This motivates a distributed decision-making paradigm where multiple agents solve smaller subproblems and jointly coordinate their individual decisions to achieve the global/network-level objective. Toward this goal, we propose a layered architecture for distributed algorithms for resilience and a two-stage distributed algorithm for distribution system restoration. The proposed distributed decision-making framework enables the bottom-up restoration of the distribution system using all available resources, including distributed generation, while only requiring local awareness and limited communications with neighboring connected regions. The proposed framework is robust to single-point failures, enables autonomy using distributed algorithms, and had reduced computational cost compared to centralized optimization solutions.
The high brightness negative ion injector combines multiple individual low-duty-factor H- ion sources (multiplexing) in a manner that allows flexibility in final pulse format and beam duty factor up to CW and increases reliability by eliminating an otherwise single-point failure usually associated with using a single ion source. The multiplexing of multiple beams in new injector system also preserves the beam quality of each individual ion source, eliminating a significant source of beam quality degradation usually associated with combining beams.
Hazard Analysis, Failure Modes and Effects Analysis (FMEA), the Limited-Life Items List (LLIL), and the Single Point Failure (SPF) List were applied by System Safety and Reliability engineers on NASA's Communications, Navigation, and Networking reConfigurable Testbed (CoNNeCT) Project. The integrated approach involving cross reviews of these reports by System Safety, Reliability, and Design engineers resulted in the mitigation of all identified hazards. The outcome was that the system met all the safety requirements it was required to meet.
Continuity through the circuit breaker in the mechanically closed condition was prevented by a foreign substance on the contact surface onboard Apollo 14. It was concluded that this was the only failure of this type in over 3400 units that were flown, and since no circuit breaker is a single-point failure for crew safety or mission success, no corrective action was taken.
I. Design: a) S/C designed to be largely single fault tolerant; b) Operate in flight demonstrated envelope, with margin; and c) Strict compliance with requirements & flight rules. II. Test: a) Baseline, fault & stress testing using flight system testbeds (H/W & S/W); b) In-flight checkout & demos to remove first time events. III. Failure Analysis: a) Critical event driven fault tree analysis; b) Risk mitigation & development of contingencies. IV) Residual Risks: a) Accepted pre-launch waivers to Single Point Failures; b) Unavoidable risks (e.g. natural disaster). V) Mission Assurance: a) Strict process for characterization of variances (ISAs, PFRs & Waivers; b) Full time Mission Assurance Manager reports to Program Manager: 1) Independent assessment of compliance with institutional standards; 2) Oversight & risk assessment of ISAs, PFRs & Waivers etc.; and 3) Risk Management Process facilitator.
Magnetic suspensions offer several advantages over conventional bearings, arising because of the contactless nature of the load support. In application to spacecraft reaction wheels, the advantages are low drag torque, wearfree, unlubricated, vacuum-compatible operation, and unlimited life. By the provision of redundancy in the control electronics, single-point failures are eliminated. The rational for selection of a passive radial, active axial, dc magnetic suspension is presented, and the relative merits of 3-loop and single-loop magnetic suspensions are discussed. The design of a .678 N-m-sec (.5 ft-lb-sec) reaction wheel using the single loop magnetic suspension was developed; the design compares favorably with current ball bearing wheels in terms of weight and power.
Electric propulsor machines and their associated power electronics have been identified in past studies as low-reliability components in emerging Urban Air Mobility (UAM) Vertical Takeoff and Landing (VTOL) vehicles that raise their predicted catastrophic failure rates. This research effort extends previously presented work investigating the use of fault-tolerant (FT) motor drives in quadrotor aircraft as a promising approach to significantly increase their mean-time-to-failure (MTTF). In particular, fault-tolerant modular motor drives (FT-MMDs) are identified as strong candidates for closing the electric propulsor reliability gap. These FT-MMDs divide a machine drive into multiple redundant modules, each consisting of three phase stator windings and power electronics units, enabling continued machine operation after a module failure. Achieving the highest possible isolation between modules (physical, magnetic, thermal, electrical) is critically important in FT-MMDs to prevent the propagation of any failure between modules. Key additional requirements for achieving the highest possible reliability characteristics with FT-MMDs are high repair rates and aggressive suppression of all single-point failures.
The results of Failure Modes and Effects Analysis (FMEA) conducted for the Wind Turbine Generators are presented. The FMEA was performed for the functional modes of each system, subsystem, or component. The single-point failures were eliminated for most of the systems. The blade system was the only exception. The qualitative probability of a blade separating was estimated at level D-remote. Many changes were made to the hardware as a result of this analysis. The most significant change was the addition of the safety system. Operational experience and need to improve machine availability have resulted in subsequent changes to the various systems which are also reflected in this FMEA.
The results failure modes and effects analysis (FMEA) conducted for wind-turbine generators are presented. The FMEA was performed for the functional modes of each system, subsystem, or component. The single-point failures were eliminated for most of the systems. The blade system was the only exception. The qualitative probability of a blade separating was estimated at level D-remote. Many changes were made to the hardware as a result of this analysis. The most significant change was the addition of the safety system. Operational experience and need to improve machine availability have resulted in subsequent changes to the various systems, which are also reflected in this FMEA.
This paper reports Part I of a two part effort, that is intended to delineate the relationship between reliability and fault tolerant control in a quantitative manner. Reliability analysis of fault-tolerant control systems is performed using Markov models. Reliability properties, peculiar to fault-tolerant control systems are emphasized. As a consequence, coverage of failures through redundancy management can be severely limited. It is shown that in the early life of a syi1ein composed of highly reliable subsystems, the reliability of the overall system is affine with respect to coverage, and inadequate coverage induces dominant single point failures. The utility of some existing software tools for assessing the reliability of fault tolerant control systems is also discussed. Coverage modeling is attempted in Part II in a way that captures its dependence on the control performance and on the diagnostic resolution.
A significant portion of the Low-Level Radio Frequency (LLRF) hardware in Jefferson Lab’s CEBAF is from the original construction of the facility using 1980’s CAMAC technology. Of the fifty-three zones in CEBAF, thirty-six of them are legacy hardware. The age of the legacy system has led to difficulties in maintaining the hardware due to parts going obsolete without suitable drop in replacements. Continued operation of the legacy system is required as the installation of LLRF 3.0 systems is costly and cannot be completed in a short period of time with the available resources. The most pressing failure in the legacy system was a failing buffer card, which is responsible for communication between the EPICs network and individual RF control modules. A new buffer card was designed as a transparent, drop in, replacement so that upgrades are simply a matter of swapping the existing legacy hardware. This buffer card upgrades a single point failure component and promises to extend the operable lifetime of CEBAF’s legacy systems.
Recent successes in NASA planetary science missions has shown that long-lived missions can yield significant science return. These missions, despite their longevity, were not planned to operate beyond their deign life. For example, the Lunar Reconnaissance Orbiter has a design life of 2-3 years, and yet we are entering its 14th year on orbit. Spacecraft longevity in practice has been related to: 1) mission class; 2) did we test it long enough and resolve all the anomalies to be beyond the early failure curve; 3) consumables budgets, and 4) how components are de-signed and tested. Mission class has been perceived as one of the primary ways to drive longevity. But higher mission class is a significant cost and mission driver. Parts selection only from the limited military standard parts and extensive parts qualification adds to development time and cost. Largely redundant (often erroneously interpreted as fully redundant) adds to launch mass and increases testing complexity (which may reduce the amount of testing in the nominal con-figuration). Lower Risk Posture (reflected in a higher mission class) drives significant additional processes and quality assurance analyses. Higher mission class also drives significantly greater sparing and life testing costs. This discussion focuses on whether this is indeed the best way to achieve longevity efficiently or whether there are more efficient ways to achieve longevity. Empirical evidence shows that lower mission classes that implement effective risk reduction and selective redundancy generally results in long life at a lower Spacecraft bus cost. By evaluating redundancy careful-ly, spacecraft cost can be lowered which can enable a more capable payload. Risk of the mission is highly dependent on the complexity of the mission and is only loosely dependent on Class of Mission. High complexity missions can have many single point failures and require the development of new technology, while lower class mission can have lower risk by baselining or incorporating: (selective) redundancy, fault-tolerant design, design for minimum risk, ability to reset, and/or design for graceful degradation. The team met with Goddard Space Flight Center Space Systems Mission Operations leaders to discuss which avionics have proven in flight to be the most reliable and which have had lifetime issues. The paper proposes a list of components to focus on for redundancy for a long-lived lunar mission. Reliability numbers are presented for both single string and dual string missions. The history of life-time performance versus planned mission life according to mission class is presented. A mission with well thought out selective redundancy and effective on the ground test program, can be expected to last well beyond its mission lifetime and provided enhanced return for the community. This approach minimizes project expenditures that do not retire significant risk and allows the project to focus risk mitigation efforts on those risks that will have a significant likelihood of threatening mission success. This is aided by keeping the amount of technology maturation and mission complexity low, while focusing effort on ensuring all component stress-ing parameters well within the bounds of their capabilities.
In current spacecraft design, a trend can be observed to achieve greater fault tolerance through the application of on-board software dedicated to detecting and isolating failures. Whether fault tolerance through software can meet the desired objectives depends on very careful consideration and control of the system in which the software is imbedded. The considered investigation has the objective to provide some of the insight needed for the required analysis of the system. A description is given of the techniques which have been developed in this connection during the development of the Voyager spacecraft. The Voyager Galileo Attitude and Articulation Control Subsystem (AACS) fault tolerant design is discussed to emphasize basic lessons learned from this experience. The central driver of hardware redundancy implementation on Voyager was known as the 'single point failure criterion'.
Although rigorous pre-emptive measures are taken to preclude failures and anomalous conditions from occurring in JPL spacecraft missions prior to launch, unforeseeable problems can still surface after liftoff. In the case of the Cassini/Huygens Mission-to-Saturn spacecraft, several problems were observed post-launch: 1) immediately after takeoff, the collected engineering/science data stored on the Solid State Recorders (SSR) contained a significantly higher number of corrupted bits than was expected (considerably over spec) due to human error in the memory mapping of these devices, 2) numerous Solid State Power Switches (SSPS) sporadically tripped off throughout the mission due to cosmic ray bombardment from the unique space environment, and 3) false assumptions in the pressure regulator design in combination with missing heritage test data led to inaccurate design conclusions, causing the issuance of two waivers for the regulator to close properly (a potentially mission catastrophic single-point failure which occurred 24 days after launch) - amongst other problems. For Cassini, some of these anomalies led to arduous work-arounds or required continuous monitoring of telemetry variables by the ground-based Spacecraft Operations Flight Support (SOFS) team in order to detect and fix fault occurrences as they happened. Fortunately, sufficient funding and schedule margin allowed several Fault Protection (FP) solutions to be implemented into post-launch Flight Software (FSW) uploads to help resolve these issues autonomously, reducing SOFS ground support efforts while improving anomaly recovery time in order to preserve maximum science capture. This paper details the FP applications used to resolve the above issues as well as to optimize solutions for several other problems experienced by the Cassini spacecraft during its fight, in order to enhance the spacecraft's overall mission success throughout the 18 years of its 20 year expedition to and within the Saturnian system.
The reliable operation of islanded microgrids increasingly depends on secondary controls that restore voltage and frequency to nominal values and ensure accurate active and reactive power sharing. Centralized secondary control architectures achieve high accuracy through global coordination at the cost of single-point failures and limited scalability compared with decentralized/distributed approaches. But a critical gap remains in addressing the interoperability and vendor-agnostic operation of secondary controls in real-world microgrids where heterogeneous diesel generator(s) and grid-forming (GFM) inverter(s) from multiple manufacturers always coexist. Practical and vendor-agnostic interoperability guidelines for the secondary control architecture of microgrids with multiple GFM units have not yet been developed; therefore, this paper proposes an interoperable and vendor-agnostic secondary control framework that operates seamlessly across GFM units from different vendors without relying on proprietary controls and protocols, hardware, or lock-ins. The framework leverages existing communication infrastructures (e.g., Modbus TCP/IP) to enable cost-effective deployment while addressing practical challenges, such as packet loss and quantization errors. Mitigation strategies-including data averaging, situational event-triggered control, and finite-iteration execution-are introduced to enhance reliability under real-world conditions. A generalized modeling and design framework is also presented, supported by robustness analysis to demonstrate independence from vendor-specific implementations. The proposed framework is validated through a large-scale hardware demonstration using a 3-$\phi$, 480-V, 60-Hz, 713-kVA laboratory hardware microgrid involving a heterogeneous diesel generator and multiple GFM inverters, showcasing its effectiveness in achieving stable voltage and frequency restoration and accurate power sharing under practical constraints. The results highlight the framework's potential as a scalable and practical solution for next-generation microgrids requiring openness, standard framework, and interoperability.
Here, this study develops a multiagent deep reinforcement learning (MADRL)-enabled framework for the decentralized cooperative control of a novel dual-branch (DB) damping controller for both low-frequency oscillation (LFO) and ultralow-frequency oscillation (ULFO). It has two branches, each of which consists of a proportional resonance (PR) and a second-order polynomial that is designed to handle target oscillation modes. To improve the robustness of the controller to system uncertainties, MADRL is developed, where multiagents are centrally trained to obtain the coordinated adaptive control policy while being executed in a decentralized manner to provide the optimal parameter setting for each controller with only local states. Comparisons with the IEEE 10-machine 39-bus system demonstrate that the proposed method achieves better robustness to uncertainties, lower communication delay, and single-point failure, as well as damping control performances for both LFO and ULFO.