Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Failing Safely”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 181 records · Page 10
All sourcesNASA NTRSDOE OSTI
NASA NTRS1991

Planetary protection issues and future Mars missions

A primary scientific theme for the Space Exploration Initiative (SEI) is the search for life, extant or extinct, on Mars. Because of this, concerns have arisen about Planetary Protection (PP), the prevention of biological cross-contamination between Earth and other planets during solar system exploration missions. A recent workshop assessed the necessity for, and impact of, PP requirements on the unmanned and human missions to Mars comprising the SEI. The following ground-rules were adopted: (1) Information needed for assessing PP issues must be obtained during the unmanned precursor mission phase prior to human landings. (2) Returned Mars samples will be considered biologically hazardous until proven otherwise. (3) Deposition of microbes on Mars and exposure of the crew to martian materials are inevitable when humans land. And (4) Human landings are unlikely until it is demonstrated that there is no harmful effect of martian materials on terrestrial life forms. These ground-rules dictated the development of a conservative PP strategy for precursor missions. Key features of the proposed strategy include: to prevent forward-contamination, all orbiters will follow Mars Observer PP procedures for assembly, trajectory, and lifetime. All landers will follow Viking PP procedures for assembly, microbial load reduction, and bio-shield. And, to prevent back-contamination, all sample return missions will have PP requirements which include fail-safe sample sealing, breaking contact chain with the martian surface, and containment and quarantine analysis in Earth-based laboratory. In addition to deliberating on scientific and technical issues, the workshop made several recommendations for dealing with forward and back-contamination concerns from non-scicntific perspectives.

Devincenzi, D. L.↗
NASA NTRS1994

Call sign intelligibility improvement using a spatial auditory display

A spatial auditory display was designed for separating the multiple communication channels usually heard over one ear to different virtual auditory positions. The single 19 foot rack mount device utilizes digital filtering algorithms to separate up to four communication channels. The filters use four different binaural transfer functions, synthesized from actual outer ear measurements, to impose localization cues on the incoming sound. Hardware design features include 'fail-safe' operation in the case of power loss, and microphone/headset interfaces to the mobile launch communication system in use at KSC. An experiment designed to verify the intelligibility advantage of the display used 130 different call signs taken from the communications protocol used at NASA KSC. A 6 to 7 dB intelligibility advantage was found when multiple channels were spatially displayed, compared to monaural listening. The findings suggest that the use of a spatial auditory display could enhance both occupational and operational safety and efficiency of NASA operations.

Begault, Durand R.↗
NASA NTRS1993

WTEC monograph on instrumentation, control and safety systems of Canadian nuclear facilities

This report updates a 1989-90 survey of advanced instrumentation and controls (I&C) technologies and associated human factors issues in the U.S. and Canadian nuclear industries carried out by a team from Oak Ridge National Laboratory (Carter and Uhrig 1990). The authors found that the most advanced I&C systems are in the Canadian CANDU plants, where the newest plant (Darlington) has digital systems in almost 100 percent of its control systems and in over 70 percent of its plant protection system. Increased emphasis on human factors and cognitive science in modern control rooms has resulted in a reduced workload for the operators and the elimination of many human errors. Automation implemented through digital instrumentation and control is effectively changing the role of the operator to that of a systems manager. The hypothesis that properly introducing digital systems increases safety is supported by the Canadian experience. The performance of these digital systems has been achieved using appropriate quality assurance programs for both hardware and software development. Recent regulatory authority review of the development of safety-critical software has resulted in the creation of isolated software modules with well defined interfaces and more formal structure in the software generation. The ability of digital systems to detect impending failures and initiate a fail-safe action is a significant safety issue that should be of special interest to nuclear utilities and regulatory authorities around the world.

Uhrig, Robert E.↗
NASA NTRS1994

A rose by any other name: Certification seen as process rather than content

Green (1990) believes that the two main factors safeguarding flying from human error are both related to certification and regulation. First is the increasingly proceduralized nature of flying whereby as much as possible is reduced to a rule-based activity. Second is the emphasis placed upon training and competency checking of aircrew in simulators and in the air, both generally and for all particular types of aircraft flown. This leaves, believes Green, other human factors that are relatively unaddressed as yet and which can give rise to human reliability problems. These include: hardware factors and especially pilot/co-pilot relationships; and system factors including fatigue and cost/safety trade-offs. He also, importantly, identifies problems with the integration of the 'electronic crew member' following increased automation. Human reliability failures with artificial intelligence and automation, due to over-reliance on the system fail-safe mechanisms, or to operator under- confidence in the integrity or self-regulating capacity of the system, or to out-of-loop effects, are widely accepted as being due to deficiencies in plant design, planning, management and maintenance more than to 'operator error' - Reason's (1990) latent error or organization pathogens argument. Reliability failures in complex systems are well enough documented to give cause for concern and at least promote a debate on the merits of a full certification program. The purpose of this short paper is to seek out and explore what is valuable in certification, at the least to show that the benefits outweigh the disadvantages and at best to identify positive outcomes perhaps not obtainable in other ways. On both sides of the debate on certification there is general agreement on the need for a better human factors perspective and effort in complex aviation systems design. What is at issue is how this is to be promoted. It is incumbent upon opponents of certification to say how else such promotion be enabled. This is an exploratory and philosophical review, not a focused and specific one, and it will draw upon much that is not firmly in the domain of complex aviation systems.

Wilson, John R.↗
NASA NTRS1980

Design and Analysis of a Stiffened Composite Fuselage Panel

A stiffened composite panel has been designed that is representative of the fuselage structure of existing wide bodied aircraft. The panel is a minimum weight design, based on the current level of technology and realistic loads and criteria. Several different stiffener configurations were investigated in the optimization process. The final configuration is an all graphite epoxy J-stiffened design in which the skin between adjacent stiffeners is permitted to buckle under design loads. Fail-safe concepts typically employed in metallic fuselage structure have been incorporated in the design. A conservative approach has been used with regard to structural details such as skin frame and stringer frame attachments and other areas where sufficient design data was not available.

Dickson, J. N.↗
NASA NTRS1996

Thermal Control Subsystem Design for the Avionics of a Space Station Payload

A case study of the thermal control subsystem development for a space based payload is presented from the concept stage through preliminary design. This payload, the Space Acceleration Measurement System 2 (SAMS-2), will measure the acceleration environment at select locations within the International Space Station. Its thermal control subsystem must maintain component temperatures within an acceptable range over a 10 year life span, while restricting accessible surfaces to touch temperature limits and insuring fail safe conditions in the event of loss of cooling. In addition to these primary design objectives, system level requirements and constraints are imposed on the payload, many of which are driven by multidisciplinary issues. Blending these issues into the overall system design required concurrent design sessions with the project team, iterative conceptual design layouts, thermal analysis and modeling, and hardware testing. Multiple tradeoff studies were also performed to investigate the many options which surfaced during the development cycle.

Moran, Matthew E.↗
NASA NTRS1998

Optical Closed-Loop Propulsion Control System Development

The overall objective of this program was to design and fabricate the components required for optical closed-loop control of a F404-400 turbofan engine, by building on the experience of the NASA Fiber Optic Control System Integration (FOCSI) program. Evaluating the performance of fiber optic technology at the component and system levels will result in helping to validate its use on aircraft engines. This report includes descriptions of three test plans. The EOI Acceptance Test is designed to demonstrate satisfactory functionality of the EOI, primarily fail-safe throughput of the F404 sensor signals in the normal mode, and validation, switching, and output of the five analog sensor signals as generated from validated optical sensor inputs, in the optical mode. The EOI System Test is designed to demonstrate acceptable F404 ECU functionality as interfaced with the EOI, making use of a production ECU test stand. The Optical Control Engine Test Request describes planned hardware installation, optical signal calibrations, data system coordination, test procedures, and data signal comparisons for an engine test demonstration of the optical closed-loop control.

Poppel, Gary L.↗
NASA NTRS1999

Space Shuttle Main Engine: Advanced Health Monitoring System

The main gola of the Space Shuttle Main Engine (SSME) Advanced Health Management system is to improve flight safety. To this end the new SSME has robust new components to improve the operating margen and operability. The features of the current SSME health monitoring system, include automated checkouts, closed loop redundant control system, catastropic failure mitigation, fail operational/ fail-safe algorithms, and post flight data and inspection trend analysis. The features of the advanced health monitoring system include: a real time vibration monitor system, a linear engine model, and an optical plume anomaly detection system. Since vibration is a fundamental measure of SSME turbopump health, it stands to reason that monitoring the vibration, will give some idea of the health of the turbopumps. However, how is it possible to avoid shutdown, when it is not necessary. A sensor algorithm has been developed which has been exposed to over 400 test cases in order to evaluate the logic. The optical plume anomaly detection (OPAD) has been developed to be a sensitive monitor of engine wear, erosion, and breakage.

Singer, Chirs↗
NASA NTRS2000

MSC/NASTRAN Stress Analysis of Complete Models Subjected to Random and Quasi-Static Loads

Space payloads, such as those which fly on the Space Shuttle in Spacelab, are designed to withstand dynamic loads which consist of combined acoustic random loads and quasi-static acceleration loads. Methods for computing the payload stresses due to these loads are well known and appear in texts and NASA documents, but typically involve approximations such as the Miles' equation, as well as possible adjustments based on "modal participation factors." Alternatively, an existing capability in MSC/NASTRAN may be used to output exact root mean square [rms] stresses due to the random loads for any specified elements in the Finite Element Model. However, it is time consuming to use this methodology to obtain the rms stresses for the complete structural model and then combine them with the quasi-static loading induced stresses. Special processing was developed as described here to perform the stress analysis of all elements in the model using existing MSC/NASTRAN and MSC/PATRAN and UNIX utilities. Fail-safe and buckling analyses applications are also described.

Hampton, Roy W.↗
NASA NTRS1999

Publication Bias ( The "File-Drawer Problem") in Scientific Inference

Publication bias arises whenever the probability that a study is published depends on the statistical significance of its results. This bias, often called the file-drawer effect since the unpublished results are imagined to be tucked away in researchers' file cabinets, is potentially a severe impediment to combining the statistical results of studies collected from the literature. With almost any reasonable quantitative model for publication bias, only a small number of studies lost in the file-drawer will produce a significant bias. This result contradicts the well known Fail Safe File Drawer (FSFD) method for setting limits on the potential harm of publication bias, widely used in social, medical and psychic research. This method incorrectly treats the file drawer as unbiased, and almost always miss-estimates the seriousness of publication bias. A large body of not only psychic research, but medical and social science studies, has mistakenly relied on this method to validate claimed discoveries. Statistical combination can be trusted only if it is known with certainty that all studies that have been carried out are included. Such certainty is virtually impossible to achieve in literature surveys.

Scargle, Jeffrey D.↗
NASA NTRS2000

Closed End Launch Tube (CELT)

As an alternative to magnetic propulsion for launch assist, the authors propose a pneumatic launch assist system. Using off the shelf components, coupled with familiar steel and concrete construction, a launch assist system can be brought from the initial feasibility stage, through a flight capable 5000 kg. demonstrator to a deployed full size launch assist system in 10 years. The final system would be capable of accelerating a 450,000 kg. vehicle to 270 meters per second. The CELT system uses commercially available compressors and valves to build a fail-safe system in less than half the time of a full Mag-Lev (magnetic levitation) system, and at a small fraction of the development cost. The resulting system could be ready in time to support some Gen 2 (generation 2) vehicles, as well as the proposed Gen 3 vehicle.

Lueck, Dale E.↗
NASA NTRS2001

Flight Computer Processing Avionics for Space Station Microgravity Experiments: A Risk Assessment of Commercial Off-the-Shelf Utilization

NASA/Marshall Space Flight Center (MSFC) is continually looking for ways to reduce the costs and schedule and minimize the technical risks during the development of microgravity programs. One of the more prominent ways to minimize the cost and schedule is to use off-the-shelf hardware (OTS). However, the use of OTS often increases the risk. This paper addresses relevant factors considered during the selection and utilization of commercial off-the-shelf (COTS) flight computer processing equipment for the control of space station microgravity experiments. The paper will also discuss how to minimize the technical risks when using COTS processing hardware. Two microgravity experiments for which the COTS processing equipment is being evaluated for are the Equiaxed Dendritic Solidification Experiment (EDSE) and the Self-diffusion in Liquid Elements (SDLE) experiment. Since MSFC is the lead center for Microgravity research, EDSE and SDLE processor selection will be closely watched by other experiments that are being designed to meet payload carrier requirements. This includes the payload carriers planned for the International Space Station (ISS). The purpose of EDSE is to continue to investigate microstructural evolution of, and thermal interactions between multiple dendrites growing under diffusion controlled conditions. The purpose of SDLE is to determine accurate self-diffusivity data as a function of temperature for liquid elements selected as representative of class-like structures. In 1999 MSFC initiated a Center Director's Discretionary Fund (CDDF) effort to investigate and determine the optimal commercial data bus architecture that could lead to faster, better, and lower cost data acquisition systems for the control of microgravity experiments. As part of this effort various commercial data acquisition systems were acquired and evaluated. This included equipment with various form factors, (3U, 6U, others) and equipment that utilized various bus structures, (VME, PC104, STD bus). This evaluation of hardware was performed in conjunction with a trade study that considered over twenty (20) different factors relevant to the selection of an optimum design approach. These factors included; safety, sizing and timing, radiation hardness and single event upset, power consumption, heat dissipation, size and volume, expected service life, maintainability, heritage, operating systems, requirements for software reuse, availability of compatible interface boards, relative cost, schedule, reliability, EMI/EMC factors, "hot swap" capability, standards for conduction cooling, I/O capabilities, unique carrier requirements and operating system considerations. The approach to evaluate Safety as part of this study included a review of the Preliminary Hazard Analysis (PHA) for each of the experiment designs and a determination of how each hazard could be addressed and eliminated when different processors were selected. This included evaluating various design approaches and trade-offs between fault tolerant designs and fail-safe designs in accordance with NSTS 1700.7B. This will include the results of radiation testing where available. Various operating systems, such as VxWorks, Linux, QNX, and Embedded NT are evaluated and the advantages and disadvantages of their utilization are also addressed. Design implementation strategies for the various operating systems are considered and discussed. This paper presents the results and recommendations from this trade study. Preliminary conclusions from this study are that safety concerns from lack or radiation testing on COTS equipment can be addressed by additional testing and design considerations, the PC104 bus provided adequate I/O for the SDLE and EDSE microgravity experiments, and PC104 bus components offered significant advantages over VME and cPCI for weight and space reductions.

Estes, Howard↗
NASA NTRS2001

Consideration of Moving Tooth Load in Gear Crack Propagation Predictions

Robust gear designs consider not only crack initiation, but crack propagation trajectories for a fail-safe design. In actual gear operation, the magnitude as well as the position of the force changes as the gear rotates through the mesh. A study to determine the effect of moving gear tooth load on crack propagation predictions was performed. Two-dimensional analysis of an involute spur gear and three-dimensional analysis of a spiral-bevel pinion gear using the finite element method and boundary element method were studied and compared to experiments. A modified theory for predicting gear crack propagation paths based on the criteria of Erdogan and Sih was investigated. Crack simulation based on calculated stress intensity factors and mixed mode crack angle prediction techniques using a simple static analysis in which the tooth load was located at the highest point of single tooth contact was validated. For three-dimensional analysis, however, the analysis was valid only as long as the crack did not approach the contact region on the tooth.

Lewicki, David G.↗
NASA NTRS1997

Surface Movement Incidents Reported to the NASA Aviation Safety Reporting System

Increasing numbers of aircraft are operating on the surface of airports throughout the world. Airport operations are forecast to grow by more that 50%, by the year 2005. Airport surface movement traffic would therefore be expected to become increasingly congested. Safety of these surface operations will become a focus as airport capacity planning efforts proceed toward the future. Several past events highlight the prevailing risks experienced while moving aircraft during ground operations on runways, taxiways, and other areas at terminal, gates, and ramps. The 1994 St. Louis accident between a taxiing Cessna crossing an active runway and colliding with a landing MD-80 emphasizes the importance of a fail-safe system for airport operations. The following study explores reports of incidents occurring on an airport surface that did not escalate to an accident event. The Aviation Safety Reporting System has collected data on surface movement incidents since 1976. This study sampled the reporting data from June, 1993 through June, 1994. The coding of the data was accomplished in several categories. The categories include location of airport, phase of ground operation, weather /lighting conditions, ground conflicts, flight crew characteristics, human factor considerations, and airport environment. These comparisons and distributions of variables contributing to surface movement incidents can be invaluable to future airport planning, accident prevention efforts, and system-wide improvements.

Connell, Linda J.↗
NASA NTRS2002

The IRAC Shutter Mechanism: Residual Magnetism and the Rotary Solenoid

The Infrared Array Camera (IRAC) Shutter mechanism was originally presented in the paper, 'A Low Power Cryogenic Shutter Mechanism for Use on Infrared Imagers' at the 34th Aerospace Mechanisms Symposium, May 2000. At that time, the shutter was believed to be performing flawlessly and there was every indication it would continue to do so. In early spring of 2001, the calibration shutter, a rotary solenoid designed to be fail-safe open, remained in a closed state with no power to the electromagnetic coils. The ensuing investigation, subsequent testing, proposed remedy, and lessons learned are the focus of this paper.

Schwinger, Scott↗
NASA NTRS2002

Vibration Reduction of Helicopter Blade Using Variable Dampers: A Feasibility Study

In the report, the investigation of controlling helicopter-blade lead-lag vibration is described. Current practice of adding passive damping may be improved to handle large dynamic range of the blade with several peaks of vibration resonance. To minimize extra-large damping forces that may damage the control system of blade, passive dampers should have relatively small damping coefficients, which in turn limit the effectiveness. By providing variable damping, a much larger damping coefficient to suppress the vibration can be realized. If the damping force reaches the maximum allowed threshold, the damper will be automatically switched into the mode with smaller damping coefficient to maintain near-constant damping force. Furthermore, the proposed control system will also have a fail-safe feature to guarantee the basic performation of a typical passive damper. The proposed control strategy to avoid resonant regions in the frequency domain is to generate variable damping force in combination with the supporting stiffness to manipulate the restoring force and conservative energy of the controlled blade system. Two control algorithms are developed and verified by a prototype variable damper, a digital controller and corresponding algorithms. Primary experiments show good potentials for the proposed variable damper: about 66% and 82% reductions in displacement at 1/3 length and the root of the blade respectively.

Lee, George C.↗
NASA NTRS1976

Safer Liquid Natural Gas

After the disaster of Staten Island in 1973 where 40 people were killed repairing a liquid natural gas storage tank, the New York Fire Commissioner requested NASA's help in drawing up a comprehensive plan to cover the design, construction, and operation of liquid natural gas facilities. Two programs are underway. The first transfers comprehensive risk management techniques and procedures which take the form of an instruction document that includes determining liquid-gas risks through engineering analysis and tests, controlling these risks by setting up redundant fail safe techniques, and establishing criteria calling for decisions that eliminate or accept certain risks. The second program prepares a liquid gas safety manual (the first of its kind).

Source record↗
NASA NTRS2002

Flight Evaluation of the Army/NASA Variable Stability Fly-by-Wire Rotorcraft Aircrew Systems Concept Airborne Laboratory (RASCAL) JUH-60A

NASA Ames Research Center and the U.S. Army Aeroflight dynamics Directorate (AFDD) have performed initial flight evaluations of the Research Flight Control System (RFCS) integrated into the Army/NASA Rotorcraft Aircrew Systems Concepts Airborne Laboratory (RASCAL) JUH-GOA. The highly modified JUH-GOA Black Hawk helicopter is a full authority, high bandwidth, variable stability, in-flight simulator designed to support development of advanced flight control, sensor, and integrated display and control technologies in a fail safe environment. Preparation for flight test required an extensive hazard analysis and ground testing to ensure proper system operation. A hardware in the loop development facility was utilized to evaluate control law stability following software changes, assess servo hardover upset conditions during manual and monitor disengagements and provide pilot familiarization of test techniques and software changes prior to flight. First engagement of the RFCS was conducted on 31 Aug 2001. RFCS transfer system operation, envelope expansion and a limited rate monitor evaluation have been completed with low bandwidth and model following control laws. The presentation will discuss the following - System overview including aircraft modifications and integrated development facilities used with the RASCAL facility. - Preliminary hazard identification and mitigation prior to flight test. - Ground testing used to qualify the RFCS transfer system and verify fault monitor operation. - Flight test results of low-bandwidth and model following control law evaluations including maneuver agility, control limitations, fault monitor reliability, and recovery from manual and monitor disengagement. - Lessons learned including test techniques using a passive three-axis sidearm controller, the value of the development facility in reducing risk and crew coordination issues related to the operation of a full authority, variable stability platform. - Future research and modifications planned for the RASCAL aircraft.

Dave Arterburn↗