SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Computer program analyzes the designs of critical systems that will either prove the design is free of single-point failures or detect each member of the population of single-point failures inherent in a system design. This program should find application in the checkout of redundant circuits and digital systems.
This note is being published to improve the visibility of this subject, as we continue to see problems surface in designs, as well as to add additional information to the previously published note for design engineers. The original application note focused on designing systems with no single point failures using Actel Field Programmable Gate Arrays (FPGAs) for critical applications. Included in that note were the basic principles of operation of the Actel FPGA and a discussion of potential single-point failures. The note also discussed the issue of startup transients for that class of device. It is unfortunate that we continue to see some design problems using these devices. This note will focus on the startup properties of certain electronic components, in general, and current Actel FPGAs, in particular. Devices that are "power-on friendly" are currently being developed by Actel, as a variant of the new SX series of FPGAs. In the ideal world, electronic components would behave much differently than they do in the real world, The chain, of course, starts with the power supply. Ideally, the voltage will immediately rise to a stable V(sub cc) level, of course, it does not. Aside from practical design considerations, inrush current limits of certain capacitors must be observed and the power supply's output may be intentionally slew rate limited to prevent a large current spike on the system power bus. In any event, power supply rise time may range from less than I msec to 100 msec or more.
Hazard Analysis, Failure Modes and Effects Analysis (FMEA), the Limited-Life Items List (LLIL), and the Single Point Failure (SPF) List were applied by System Safety and Reliability engineers on NASA's Communications, Navigation, and Networking reConfigurable Testbed (CoNNeCT) Project. The integrated approach involving cross reviews of these reports by System Safety, Reliability, and Design engineers resulted in the mitigation of all identified hazards. The outcome was that the system met all the safety requirements it was required to meet.
Continuity through the circuit breaker in the mechanically closed condition was prevented by a foreign substance on the contact surface onboard Apollo 14. It was concluded that this was the only failure of this type in over 3400 units that were flown, and since no circuit breaker is a single-point failure for crew safety or mission success, no corrective action was taken.
I. Design: a) S/C designed to be largely single fault tolerant; b) Operate in flight demonstrated envelope, with margin; and c) Strict compliance with requirements & flight rules. II. Test: a) Baseline, fault & stress testing using flight system testbeds (H/W & S/W); b) In-flight checkout & demos to remove first time events. III. Failure Analysis: a) Critical event driven fault tree analysis; b) Risk mitigation & development of contingencies. IV) Residual Risks: a) Accepted pre-launch waivers to Single Point Failures; b) Unavoidable risks (e.g. natural disaster). V) Mission Assurance: a) Strict process for characterization of variances (ISAs, PFRs & Waivers; b) Full time Mission Assurance Manager reports to Program Manager: 1) Independent assessment of compliance with institutional standards; 2) Oversight & risk assessment of ISAs, PFRs & Waivers etc.; and 3) Risk Management Process facilitator.
Magnetic suspensions offer several advantages over conventional bearings, arising because of the contactless nature of the load support. In application to spacecraft reaction wheels, the advantages are low drag torque, wearfree, unlubricated, vacuum-compatible operation, and unlimited life. By the provision of redundancy in the control electronics, single-point failures are eliminated. The rational for selection of a passive radial, active axial, dc magnetic suspension is presented, and the relative merits of 3-loop and single-loop magnetic suspensions are discussed. The design of a .678 N-m-sec (.5 ft-lb-sec) reaction wheel using the single loop magnetic suspension was developed; the design compares favorably with current ball bearing wheels in terms of weight and power.
Electric propulsor machines and their associated power electronics have been identified in past studies as low-reliability components in emerging Urban Air Mobility (UAM) Vertical Takeoff and Landing (VTOL) vehicles that raise their predicted catastrophic failure rates. This research effort extends previously presented work investigating the use of fault-tolerant (FT) motor drives in quadrotor aircraft as a promising approach to significantly increase their mean-time-to-failure (MTTF). In particular, fault-tolerant modular motor drives (FT-MMDs) are identified as strong candidates for closing the electric propulsor reliability gap. These FT-MMDs divide a machine drive into multiple redundant modules, each consisting of three phase stator windings and power electronics units, enabling continued machine operation after a module failure. Achieving the highest possible isolation between modules (physical, magnetic, thermal, electrical) is critically important in FT-MMDs to prevent the propagation of any failure between modules. Key additional requirements for achieving the highest possible reliability characteristics with FT-MMDs are high repair rates and aggressive suppression of all single-point failures.
The results of Failure Modes and Effects Analysis (FMEA) conducted for the Wind Turbine Generators are presented. The FMEA was performed for the functional modes of each system, subsystem, or component. The single-point failures were eliminated for most of the systems. The blade system was the only exception. The qualitative probability of a blade separating was estimated at level D-remote. Many changes were made to the hardware as a result of this analysis. The most significant change was the addition of the safety system. Operational experience and need to improve machine availability have resulted in subsequent changes to the various systems which are also reflected in this FMEA.
The results failure modes and effects analysis (FMEA) conducted for wind-turbine generators are presented. The FMEA was performed for the functional modes of each system, subsystem, or component. The single-point failures were eliminated for most of the systems. The blade system was the only exception. The qualitative probability of a blade separating was estimated at level D-remote. Many changes were made to the hardware as a result of this analysis. The most significant change was the addition of the safety system. Operational experience and need to improve machine availability have resulted in subsequent changes to the various systems, which are also reflected in this FMEA.
This paper reports Part I of a two part effort, that is intended to delineate the relationship between reliability and fault tolerant control in a quantitative manner. Reliability analysis of fault-tolerant control systems is performed using Markov models. Reliability properties, peculiar to fault-tolerant control systems are emphasized. As a consequence, coverage of failures through redundancy management can be severely limited. It is shown that in the early life of a syi1ein composed of highly reliable subsystems, the reliability of the overall system is affine with respect to coverage, and inadequate coverage induces dominant single point failures. The utility of some existing software tools for assessing the reliability of fault tolerant control systems is also discussed. Coverage modeling is attempted in Part II in a way that captures its dependence on the control performance and on the diagnostic resolution.
Recent successes in NASA planetary science missions has shown that long-lived missions can yield significant science return. These missions, despite their longevity, were not planned to operate beyond their deign life. For example, the Lunar Reconnaissance Orbiter has a design life of 2-3 years, and yet we are entering its 14th year on orbit. Spacecraft longevity in practice has been related to: 1) mission class; 2) did we test it long enough and resolve all the anomalies to be beyond the early failure curve; 3) consumables budgets, and 4) how components are de-signed and tested. Mission class has been perceived as one of the primary ways to drive longevity. But higher mission class is a significant cost and mission driver. Parts selection only from the limited military standard parts and extensive parts qualification adds to development time and cost. Largely redundant (often erroneously interpreted as fully redundant) adds to launch mass and increases testing complexity (which may reduce the amount of testing in the nominal con-figuration). Lower Risk Posture (reflected in a higher mission class) drives significant additional processes and quality assurance analyses. Higher mission class also drives significantly greater sparing and life testing costs. This discussion focuses on whether this is indeed the best way to achieve longevity efficiently or whether there are more efficient ways to achieve longevity. Empirical evidence shows that lower mission classes that implement effective risk reduction and selective redundancy generally results in long life at a lower Spacecraft bus cost. By evaluating redundancy careful-ly, spacecraft cost can be lowered which can enable a more capable payload. Risk of the mission is highly dependent on the complexity of the mission and is only loosely dependent on Class of Mission. High complexity missions can have many single point failures and require the development of new technology, while lower class mission can have lower risk by baselining or incorporating: (selective) redundancy, fault-tolerant design, design for minimum risk, ability to reset, and/or design for graceful degradation. The team met with Goddard Space Flight Center Space Systems Mission Operations leaders to discuss which avionics have proven in flight to be the most reliable and which have had lifetime issues. The paper proposes a list of components to focus on for redundancy for a long-lived lunar mission. Reliability numbers are presented for both single string and dual string missions. The history of life-time performance versus planned mission life according to mission class is presented. A mission with well thought out selective redundancy and effective on the ground test program, can be expected to last well beyond its mission lifetime and provided enhanced return for the community. This approach minimizes project expenditures that do not retire significant risk and allows the project to focus risk mitigation efforts on those risks that will have a significant likelihood of threatening mission success. This is aided by keeping the amount of technology maturation and mission complexity low, while focusing effort on ensuring all component stress-ing parameters well within the bounds of their capabilities.
In current spacecraft design, a trend can be observed to achieve greater fault tolerance through the application of on-board software dedicated to detecting and isolating failures. Whether fault tolerance through software can meet the desired objectives depends on very careful consideration and control of the system in which the software is imbedded. The considered investigation has the objective to provide some of the insight needed for the required analysis of the system. A description is given of the techniques which have been developed in this connection during the development of the Voyager spacecraft. The Voyager Galileo Attitude and Articulation Control Subsystem (AACS) fault tolerant design is discussed to emphasize basic lessons learned from this experience. The central driver of hardware redundancy implementation on Voyager was known as the 'single point failure criterion'.
Although rigorous pre-emptive measures are taken to preclude failures and anomalous conditions from occurring in JPL spacecraft missions prior to launch, unforeseeable problems can still surface after liftoff. In the case of the Cassini/Huygens Mission-to-Saturn spacecraft, several problems were observed post-launch: 1) immediately after takeoff, the collected engineering/science data stored on the Solid State Recorders (SSR) contained a significantly higher number of corrupted bits than was expected (considerably over spec) due to human error in the memory mapping of these devices, 2) numerous Solid State Power Switches (SSPS) sporadically tripped off throughout the mission due to cosmic ray bombardment from the unique space environment, and 3) false assumptions in the pressure regulator design in combination with missing heritage test data led to inaccurate design conclusions, causing the issuance of two waivers for the regulator to close properly (a potentially mission catastrophic single-point failure which occurred 24 days after launch) - amongst other problems. For Cassini, some of these anomalies led to arduous work-arounds or required continuous monitoring of telemetry variables by the ground-based Spacecraft Operations Flight Support (SOFS) team in order to detect and fix fault occurrences as they happened. Fortunately, sufficient funding and schedule margin allowed several Fault Protection (FP) solutions to be implemented into post-launch Flight Software (FSW) uploads to help resolve these issues autonomously, reducing SOFS ground support efforts while improving anomaly recovery time in order to preserve maximum science capture. This paper details the FP applications used to resolve the above issues as well as to optimize solutions for several other problems experienced by the Cassini spacecraft during its fight, in order to enhance the spacecraft's overall mission success throughout the 18 years of its 20 year expedition to and within the Saturnian system.
A description is presented of the propulsion and propellant systems of the Centaur D-1T, an improved version of the Centaur high energy upper state. The primary change to the propulsion system to provide three-burn capability was the addition of radiation shielding to the propellant duct. The redundant valves and feed paths were added to the H202 supply and reaction control system to increase system tolerance to the most probable causes of failure. Other changes were made to enhance mission capability of the Centaur, and represent an increase in inherent reliability of the vehicle through reduction of single failure points and by substitution of more reliable components.
The development of an acid electrolyte fuel cell was investigated to provide a cost effective electrical power system for the space shuttle orbiter. Previous investigation showed the life capability of the fuel cell was improved by proper prehumidification of the reactant gases. Breadboard models were developed which incorporate reactant prehumidification and have a life duration time of 2000 hours. Fuel cell performance was found to be invariant with cell life, and reactant consumption was unchanged from start to end of life. Satisfactory start and stop procedures are demonstrated along with scale-up capabilities for the number of cells in a stack, and for cell active areas. Safety design features, which operate to isolate the affected module from the remainder of the system, to eliminate single point failure modes from affecting the entire electrical power system are included.
Modifications are described which have been introduced to the Centaur high-energy upper stage (which is being integrated with the Titan IIIC booster) to improve mission flexibility and reliability, and to provide three-burn synchronous orbit capability. The addition of a sidewall radiation shield significantly reduces heat transfer to the liquid hydrogen tank. This radiation field, in conjunction with a newly developed computer controlled propellant tank venting and pressurization system, permits the use of improved techniques for propellant management during orbital coast. Some minor changes in the propulsion and propellant systems which were necessary to adapt these systems for synchronous orbit trajectories are described, together with the redundancy incorporated to reduce the number of single failure points.-
A family of heat pipe reactors design concepts has been developed to provide heat to a variety of electrical conversion systems. Three power plants are described that span the power range 1-500 kWe and operate in the temperature range 1200-1700 K. The reactors are fast, compact, heat-pipe cooled, high-temperature nuclear reactors fueled with fully enriched refractory fuels, UC-ZrC or UO2. Each fuel element is cooled by an axially located molybdenum heat pipe containing either sodium or lithium vapor. Virtues of the reactor designs are the avoidance of single-point failure mechanisms, the relatively high operating temperature, and the expected long lifetimes of the fuel element components.
The Pioneer Venus Orbiter and the Multiprobe spacecraft propulsion subsystems and their performance are presented. Monopropellant hydrazine subsystems on each spacecraft provided the capability to spin up the spacecraft after separation and perform all spin rate, velocity, and attitude changes required by the control subsystem to satisfy mission objectives. The propulsion subsystem provides thrust on demand by supplying anhydrous hydrazine from the propellant tanks through manifolds, filters and valves to the thrust chamber assemblies where the hydrazine is catalytically decomposed and expanded in a conical nozzle. The subsystems consist of seven 1 lbf thrusters for the Orbiter and six 1 lbf thrusters for the multiprobe which are isolated by two latch valves from the two propellant tanks so that two redundant thruster clusters are provided to ensure mission completion in the event of a single point failure. The propellant feed system is of all-welded construction to minimize weight and leakage and titanium is used as the primary material of construction. The multiprobe burned up on entering the Venus atmosphere with enough propellant left for the mission and the Orbiter was inserted into Venus orbit with enough propellant remaining for more than 2 earth years of orbital operations.