SEARCH · Engineering Papers

Results for “Failing Safely”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 217 records · Page 12

All sources NASA NTRS DOE OSTI

NASA NTRS1988

Plume spectrometry for liquid rocket engine health monitoring

An investigation of Space Shuttle Main Engine (SSME) testing failures identified optical events which appeared to be precursors of those failures. A program was therefore undertaken to detect plume trace phenomena characteristic of the engine and to design a monitoring system, responsive to excessive activity in the plume, capable of delivering a warning of an anomalous condition. By sensing the amount of extraneous material entrained in the plume and considering engine history, it may be possible to identify wearing of failing components in time for a safe shutdown and thus prevent a catastrophic event. To investigate the possibilities of safe shutdown and thus prevent a monitor to initiate the shutdown procedure, a large amount of plume data were taken from SSME firings using laboratory instrumentation. Those data were used to design a more specialized instrument dedicated to rocket plume diagnostics. The spectral wavelength range of the baseline data was about 220 nanometers (nm) to 15 micrometer with special attention given to visible and near UV. The data indicates that a satisfactory design will include a polychromator covering the range of 250 nM to 1000 nM, along with a continuous coverage spectrometer, each having a resolution of at least 5A degrees. The concurrent requirements for high resolution and broad coverage are normally at odds with one another in commercial instruments, therefore necessitating the development of special instrumentation. The design of a polychromator is reviewed herein, with a detailed discussion of the continuous coverage spectrometer delayed to a later forum. The program also requires the development of applications software providing detection, variable background discrimination, noise reduction, filtering, and decision making based on varying historical data.

Powers, William T.↗

NASA NTRS2000

A Safety Index and Method for Flightdeck Evaluation

If our goal is to improve safety through machine, interface, and training design, then we must define a metric of flightdeck safety that is usable in the design process. Current measures associated with our notions of "good" pilot performance and ultimate safety of flightdeck performance fail to provide an adequate index of safe flightdeck performance for design evaluation purposes. The goal of this research effort is to devise a safety index and method that allows us to evaluate flightdeck performance holistically and in a naturalistic experiment. This paper uses Reason's model of accident causation (1990) as a basis for measuring safety, and proposes a relational database system and method for 1) defining a safety index of flightdeck performance, and 2) evaluating the "safety" afforded by flightdeck performance for the purpose of design iteration. Methodological considerations, limitations, and benefits are discussed as well as extensions to this work.

Latorella, Kara A.↗

NASA NTRS2006

Case Study: Test Results of a Tool and Method for In-Flight, Adaptive Control System Verification on a NASA F-15 Flight Research Aircraft

Adaptive control technologies that incorporate learning algorithms have been proposed to enable autonomous flight control and to maintain vehicle performance in the face of unknown, changing, or poorly defined operating environments [1-2]. At the present time, however, it is unknown how adaptive algorithms can be routinely verified, validated, and certified for use in safety-critical applications. Rigorous methods for adaptive software verification end validation must be developed to ensure that. the control software functions as required and is highly safe and reliable. A large gap appears to exist between the point at which control system designers feel the verification process is complete, and when FAA certification officials agree it is complete. Certification of adaptive flight control software verification is complicated by the use of learning algorithms (e.g., neural networks) and degrees of system non-determinism. Of course, analytical efforts must be made in the verification process to place guarantees on learning algorithm stability, rate of convergence, and convergence accuracy. However, to satisfy FAA certification requirements, it must be demonstrated that the adaptive flight control system is also able to fail and still allow the aircraft to be flown safely or to land, while at the same time providing a means of crew notification of the (impending) failure. It was for this purpose that the NASA Ames Confidence Tool was developed [3]. This paper presents the Confidence Tool as a means of providing in-flight software assurance monitoring of an adaptive flight control system. The paper will present the data obtained from flight testing the tool on a specially modified F-15 aircraft designed to simulate loss of flight control faces.

Jacklin, Stephen A.↗

NASA NTRS1992

Intelsat VI (F-3) reboost mission

As the result of a launch vehicle malfunction, the Intelsat VI(F-3) communications satellite failed to achieve geostationary orbit. The satellite is presently safe in a low-earth orbit pending a NASA Space Shuttle Program (SSP) mission to retrieve it and attach a solid rocket. This paper describes the recovery hardware design and the overall mission efforts undertaken to recover and reboost the satellite.

Virdee, L.↗

NASA NTRS2017

Improving Slip Prediction on Mars Using Thermal Inertia Measurements

Rovers operating on Mars have been delayed, diverted, and trapped by loose granular materials. Vision-based mobility prediction approaches often fail because hazardous sand is difﬁcult to distinguish from safe sand based on surface appearance alone. Unlike surface appearance, the thermal inertia of terrain is directly correlated to the same geophysical properties that control slip. This paper presents a quantitative analysis showing that considering thermal inertia improves rover slip prediction on Mars using in-situ data from the Curiosity rover. Thermal inertia is estimated for each slip measurement in sand using both on-board and orbital instruments. Slip models are learned using a mixture of experts approach where the experts are identiﬁed using thermal inertia. Two-expert models are compared to a single-expert, vision-only model to show that slip predictions are improved by separating high-slip, low thermal inertia sand from low-slip, high thermal inertia sand. These results support the hypothesis that the consideration of thermal inertia improves mobility estimates for rovers on Mars.

Nesnas, Issa A.↗

NASA NTRS2002

Optimal Aircraft Control Upset Recovery With and Without Component Failures

This paper treats the problem of recovering sustainable nondescending (safe) flight in a transport aircraft after one or more of its control effectors fail. Such recovery can be a challenging goal for many transport aircraft currently in the operational fleet for two reasons. First, they have very little redundancy in their means of generating control forces and moments. These aircraft have, as primary control surfaces, a single rudder and pairwise elevators and aileron/spoiler units that provide yaw, pitch, and roll moments with sufficient bandwidth to be used in stabilizing and maneuvering the airframe. Beyond this, throttling the engines can provide additional moments, but on a much slower time scale. Other aerodynamic surfaces, such as leading and trailing edge flaps, are only intended to be placed in a position and left, and are, hence, very slow-moving. Because of this, loss of a primary control surface strongly degrades the controllability of the vehicle, particularly when the failed effector becomes stuck in a non-neutral position where it exerts a disturbance moment that must be countered by the remaining operating effectors. The second challenge in recovering safe flight is that these vehicles are not agile, nor can they tolerate large accelerations. This is of special importance when, at the outset of the recovery maneuver, the aircraft is flying toward the ground, as is frequently the case when there are major control hardware failures. Recovery of safe flight is examined in this paper in the context of trajectory optimization. For a particular transport aircraft, and a failure scenario inspired by an historical air disaster, recovery scenarios are calculated with and without control surface failures, to bring the aircraft to safe flight from the adverse flight condition that it had assumed, apparently as a result of contact with a vortex from a larger aircraft's wake. An effort has been made to represent relevant airframe dynamics, acceleration limits, and actuator limits faithfully, since these contribute to the lack of agility and control power that plays an important role in defining what can be achieved with the vehicle when it is in extremis.

Sparks, Dean W.↗

NASA NTRS2015

Buckling Test Results from the 8-Foot-Diameter Orthogrid-Stiffened Cylinder Test Article TA01

Results from the testing of cylinder test article SBKF-P2-CYLTA01 (referred to herein as TA01) are presented. The testing was conducted at the Marshall Space Flight Center (MSFC), November 19‒21, 2008, in support of the Shell Buckling Knockdown Factor (SBKF) Project.i The test was used to verify the performance of a newly constructed buckling test facility at MSFC and to verify the test article design and analysis approach used by the SBKF project researchers. TA01 is an 8-foot-diameter (96-inches), 78.0-inch long, aluminum-lithium (Al-Li), orthogrid-stiffened cylindrical shell similar to those used in current state-of-the-art launch vehicle structures and was designed to exhibit global buckling when subjected to compression loads. Five different load sequences were applied to TA01 during testing and included four sub-critical load sequences, i.e., loading conditions that did not cause buckling or material failure, and one final load sequence to buckling and collapse. The sub-critical load sequences consisted of either uniform axial compression loading or combined axial compression and bending and the final load sequence subjected TA01 to uniform axial compression. Traditional displacement transducers and strain gages were used to monitor the test article response at nearly 300 locations and an advanced digital image correlation system was used to obtain low-speed and high-speed full-field displacement measurements of the outer surface of the test article. Overall, the test facility and test article performed as designed. In particular, the test facility successfully applied all desired load combinations to the test article and was able to test safely into the postbuckling range of loading, and the test article failed by global buckling. In addition, the test results correlated well with initial pretest predictions.

Hilburger, Mark W.↗

NASA NTRS2016

Identification and Reconfigurable Control of Impaired Multi-Rotor Drones

The paper presents an algorithm for control and safe landing of impaired multi-rotor drones when one or more motors fail simultaneously or in any sequence. It includes three main components: an identification block, a reconfigurable control block, and a decisions making block. The identification block monitors each motor load characteristics and the current drawn, based on which the failures are detected. The control block generates the required total thrust and three axis torques for the altitude, horizontal position and/or orientation control of the drone based on the time scale separation and nonlinear dynamic inversion. The horizontal displacement is controlled by modulating the roll and pitch angles. The decision making algorithm maps the total thrust and three torques into the individual motor thrusts based on the information provided by the identification block. The drone continues the mission execution as long as the number of functioning motors provide controllability of it. Otherwise, the controller is switched to the safe mode, which gives up the yaw control, commands a safe landing spot and descent rate while maintaining the horizontal attitude.

Unmanned aerial system↗

NASA NTRS1974

ASTP simulated lightning test report

A simulated lightning test was conducted on the backup spacecraft for the Apollo Soyuz Test Project mission (CSM-119) to determine the susceptibility of the Apollo spacecraft to damage from the indirect effects of lightning. It is demonstrated that induced lightning effects from low-level injected currents can be scaled linearly to those which are obtained in a full threat lightning stroke. Test results indicate that: (1) many of the power and signal critical circuits would fail if subjected to full-threat lightning, (2) pyrotechnic circuits are safe for full-threat lightning, and (3) common-mode voltages exceeded the failure criteria level for all but three of the circuits tested.

Blount, R. L.↗

NASA NTRS2012

Composite Stress Rupture: A New Reliability Model Based on Strength Decay

A model is proposed to estimate reliability for stress rupture of composite overwrap pressure vessels (COPVs) and similar composite structures. This new reliability model is generated by assuming a strength degradation (or decay) over time. The model suggests that most of the strength decay occurs late in life. The strength decay model will be shown to predict a response similar to that predicted by a traditional reliability model for stress rupture based on tests at a single stress level. In addition, the model predicts that even though there is strength decay due to proof loading, a significant overall increase in reliability is gained by eliminating any weak vessels, which would fail early. The model predicts that there should be significant periods of safe life following proof loading, because time is required for the strength to decay from the proof stress level to the subsequent loading level. Suggestions for testing the strength decay reliability model have been made. If the strength decay reliability model predictions are shown through testing to be accurate, COPVs may be designed to carry a higher level of stress than is currently allowed, which will enable the production of lighter structures

Reeder, James R.↗

NASA NTRS2012

Hard and Soft Safety Verifications

The purpose of this paper is to examine the differences between and the effects of hard and soft safety verifications. Initially, the terminology should be defined and clarified. A hard safety verification is datum which demonstrates how a safety control is enacted. An example of this is relief valve testing. A soft safety verification is something which is usually described as nice to have but it is not necessary to prove safe operation. An example of a soft verification is the loss of the Solid Rocket Booster (SRB) casings from Shuttle flight, STS-4. When the main parachutes failed, the casings impacted the water and sank. In the nose cap of the SRBs, video cameras recorded the release of the parachutes to determine safe operation and to provide information for potential anomaly resolution. Generally, examination of the casings and nozzles contributed to understanding of the newly developed boosters and their operation. Safety verification of SRB operation was demonstrated by examination for erosion or wear of the casings and nozzle. Loss of the SRBs and associated data did not delay the launch of the next Shuttle flight.

Wetherholt, Jon↗

NASA NTRS1995

Modeling of collision induced absorption spectra of CO2-CO2 pairs for planetary atmosphere of Venus

The objective of the proposal was to model the rototranslational and rotovibrational collision induced absorption spectral bands of importance for the radiative transfer analysis of the atmosphere of Venus. Our main task has involved CO2 pairs. The approach is not straightforward: whereas computational techniques to compute CIA spectra of small linear molecules exist, and were successfully applied to molecules like H2 or N2, they fail when applied to large molecules like CO2. For small molecules one can safely assume that the interaction potential is isotropic. The same approximation does not work for CO2, and when employed, it gives an incorrect band shape and only 50 percent of the CIA intensity.

Borysow, Aleksandra↗

NASA NTRS1995

Design, analysis and control of large transports so that control of engine thrust can be used as a back-up of the primary flight controls

A propulsion controlled aircraft (PCA) system has been developed at NASA Dryden Flight Research Center at Edwards Air Force Base, California, to provide safe, emergency landing capability should the primary flight control system of the aircraft fail. As a result of the successful PCA work being done at NASA Dryden, this project investigated the possibility of incorporating the PCA system as a backup flight control system in the design of a large, ultra-high capacity megatransport in such a way that flight path control using only the engines is not only possible, but meets MIL-Spec Level 1 or Level 2 handling quality requirements. An 800 passenger megatransport aircraft was designed and programmed into the NASA Dryden simulator. Many different analysis methods were used to evaluate the flying qualities of the megatransport while using engine thrust for flight path control, including: (1) Bode and root locus plot analysis to evaluate the frequency and damping ratio response of the megatransport; (2) analysis of actual simulator strip chart recordings to evaluate the time history response of the megatransport; and (3) analysis of Cooper-Harper pilot ratings by two NaSA test pilots.

Roskam, Jan↗

NASA NTRS2005

Hubble Space Telescope Magnetometer and Two-Gyro Control Law Design, Implementation, and On-Orbit Performance

For f i h years, the science mission of the Hubble Space Telescope (HST) required using at least three of six rate gyros for attitude control. In the past, HST has mitigated gyro hardware failures by replacement of the failed units through Space Shuttle Servicing Missions. Following the tragic loss of Space Shuttle Columbia on STS-107, the desire to have a safe haven for astronauts during missions has resulted in the cancellation of all planned maxu14 missions to HST. While a robotic servicing mission is being currently being planned, controlling with alternate sensors to replace failed gyros can extend the HST Science mission until the robotic mission can be performed and extend science at HST s end of life. A two-gym control law has been designed and implemented using magnetometers (Magnetic Sensing System - MSS), fixed head star trackers (FHSTs), and Fine Guidance Sensors (FGSs) to control vehicle rate about the missing gyro axis. The three aforementioned sensors are used in succession to reduce HST boresight jitter to less than 7 milli-arcseconds rms and attitude error to less than 10 milli-arcseconds prior to science imaging. The MSS and 2-Gyro (M2G) control law is used for large angle maneuvers and attitude control during earth occultation of FHSTs and FGSs. The Tracker and 2-Gyro (T2G) control law dampens M2G rates and corrects the majority of attitude error in preparation for guide star acquisition with the FGSs. The Fine Guidance Sensor and 2-Gyro (F2G) control law d a m p T2G rates and controls HST attitude during science imaging. This paper describes the M2G control law. Details of M2G algorithms are presented, including computation of the HST 3-axis attitude error estimate, design of the M2G control law, SISO hear stability analyses, and restrictions on operations to maintain the h d t h and safety requirement of a 10degree maximum attitude error. Results of simulations performed in HSTSIM, a high-fidelity non-linear time domain simulation, are presented to predict HST on-orbit performance in attitude hold and maneuver modes. Simulation results are compared to on-orbit data from M2G flight tests performed in November and December 2004 and February 2005. Flight telemetry, using a currently available third gyro, shows that HST attitude error with the new M2G control law is maintained below the 10-degree requirement, and attitude errors are under 2 degrees for 95% of the time.

Wirzburger, John H.↗

NASA NTRS1992

Fault tolerant capabilities of the Cosmic Background Explorer attitude control system

The Cosmic Background Explorer (COBE), which was launched November 18, 1989 from Vandenberg Air Force Base aboard a Delta rocket, has been classified by the scientific community as a major success with regards to the field of cosmology theory. Despite a number of anomalies which have occurred during the mission, the attitude control system (ACS) has performed remarkably well. This is due in large part to the fault tolerant capabilities that were designed into the ACS. A unique triaxial control system orientated in the spacecraft's transverse plane provides the ACS the ability to safely survive various sensor and actuator failures. Features that help to achieve this fail-operational system include component cross-strapping and autonomous control electronics switching. This design philosophy was of utmost importance because of the constraint placed upon the ACS to keep the spinning observatory and its cryogen-cooled science instruments pointing away from the sun. Even though the liquid helium was depleted within the expected twelve months from launch, it is still very much desirable to avoid any thermal disturbances upon the remaining functional instruments.

Placanica, Samuel J.↗

NASA NTRS2006

Evolution of the Hubble Space Telescope Safing Systems

The Hubble Space Telescope (HST) was launched on April 24 1990, with an expected lifespan of 15 years. Central to the spacecraft design was the concept of a series of on-orbit shuttle servicing missions permitting astronauts to replace failed equipment, update the scientific instruments and keep the HST at the forefront of astronomical discoveries. One key to the success of the Hubble mission has been the robust Safing systems designed to monitor the performance of the observatory and to react to keep the spacecraft safe in the event of equipment anomaly. The spacecraft Safing System consists of a range of software tests in the primary flight computer that evaluate the performance of mission critical hardware, safe modes that are activated when the primary control mode is deemed inadequate for protecting the vehicle, and special actions that the computer can take to autonomously reconfigure critical hardware. The HST Safing System was structured to autonomously detect electrical power system, data management system, and pointing control system malfunctions and to configure the vehicle to ensure safe operation without ground intervention for up to 72 hours. There is also a dedicated safe mode computer that constantly monitors a keep-alive signal from the primary computer. If this signal stops, the safe mode computer shuts down the primary computer and takes over control of the vehicle, putting it into a safe, low-power configuration. The HST Safing system has continued to evolve as equipment has aged, as new hardware has been installed on the vehicle, and as the operation modes have matured during the mission. Along with the continual refinement of the limits used in the safing tests, several new tests have been added to the monitoring system, and new safe modes have been added to the flight software. This paper will focus on the evolution of the HST Safing System and Safing tests, and the importance of this evolution to prolonging the science operations of the telescope.

Pepe, Joyce↗

NASA NTRS2016

Modifying a Commercial Centrifuge to Reduce Electromagnetic Interference and Evaluating Functionality of Ultrasound Equipment

The Project Management and Engineering Branch (SF4) supports the Human Health and Performance Directorate (HH&P) and is responsible for developing and supporting human systems hardware for the International Space Station (ISS). When a principal investigator's (PI) medical research project on the ISS is accepted, SF4 develops the necessary hardware and software to transport to the ISS. The two projects I primarily worked on were the centrifuge and ultrasound projects. Centrifuge: One concern with spacecraft such as the ISS is electromagnetic interference (EMI) from onboard equipment, typically from radio waves (frequencies of ~3 kHz to ~300 GHz), which can negatively affect nearby circuitry. Standard commercial centrifuges produce EMI above safety limits, so my task was to help reduce EMI production from this equipment. Two centrifuges were tested: one unmodified as a control and one modified. To reduce EMI below safety limits, one centrifuge was modified to become a Faraday shield, in which significant electrical contact was made between all regions of the centrifuge housing. This included removing non-conductive paint, applying conductive fabric to the lid and foam sealer, adding a 10,000 μF decoupling capacitor across the power supply, and adding copper adhesive-mount gaskets to the housing interior. EMI testing of both centrifuges was performed in the EMI/EMC Control Test and Measurement Facility. EMI for both centrifuges was below safety limits for frequencies between 10 MHz and 15 GHz (pass); however, between 14 kHz and 10 MHz, EMI for the unmodified centrifuge exceeded safety limits (fail) as expected. Alternatively, for the modified centrifuge with the Faraday shield, EMI was below the safely limit of 55 dBμV/m for electromagnetic frequencies between 14 kHz and 10 MHz. This result indicates our modifications were successful. The successful EMI test allowed us to communicate with the vendor what modifications they needed to make to their commercial unit to meet our specifications and to understand what needs to be done in lab to the new centrifuge. Our modifications will provide a standard for readying centrifuges for future missions. Once the new modified centrifuge arrives by the vendor, it will need to undergo EMI testing again for validation. The centrifuge is also in the process of compatibility testing with a custom stowage drawer, which is an ongoing project in SF4. Both of these items will be payloads on future missions to the ISS for various research purposes. Ultrasound: ISS currently has an onboard ultrasound (Ultrasound 2 system) for research and medical purposes. Every piece of medical flight hardware has an equivalent ground-unit so instrumentation can be routinely evaluated and transported to the ISS if necessary. The ground-unit ultrasound equipment must be evaluated every six months using a task performance sheet (TPS). A TPS is a document, written by the appropriate scientists and engineers, which describes how to run equipment and is written in such a way that astronauts with unspecialized training can follow the tasks. I was responsible for performing six TPSs on a combination of three ultrasounds and two video power converters (VPCs). Performing a TPS involves checking out and computationally documenting each piece of equipment removed from storage locations, setting up hardware and software, performing tasks to verify functionality, returning equipment, and logging items back into the computerized system. My work revealed all ground-unit ultrasounds were functioning properly. Because of proper function, a discrepancy report (DR) did not have to be opened. The TPS was then passed along to the Quality Engineering (QE) for review and ultimately given to Quality Assurance (QA). Other projects: In addition to my main projects, I participated in other tasks including troubleshooting an EEG headband, volunteering for an ultrasound training research study, and conformal coating printed circuit boards. My internship at SF4 has helped me understand how space systems hardware development for the ISS fits into NASA's mission and vision.

Greening, Gage J.↗

NASA NTRSDate not supplied

Metal Additive Manufacturing for Rocket Engines: Successes and Failures

NASA has been developing additive manufacturing (AM) for various technical and programmatic advantages for complex rocket engine and aerospace components. This maturation has focused on various AM processes, new alloys, characterizing material properties, developing standards, producing demonstrator parts, and integrating AM hardware in liquid rocket engines through test-fail-fix cycles, as well as application and dissemination of lessons learned of the AM lifecycle. The importance of proper AM processing was made evident in the failure of a Laser Powder Bed Fusion (L-PBF) copper-alloy combustion chamber during a hot-fire test due to a degraded material quality. The hot-fire test aimed to demonstrate high duty cycle under a risk-tolerant development project, where consequences of component failure would be minimal. However, the unintentional component failure emphasized the necessity of robust material characterization and rigorous process control procedures for the safe use of AM components in critical applications. This presentation provides an overview of the development failure, a discussion on the evaluation of the failed chamber and supplemental chambers produced at the same time, a representative material samples that included intentional build witness lines, and a summary of the key results and recommendations from the evaluations. NASA continues to approach AM processes and designs with a level of risk and acceptance of failures that is appropriate for the project objectives, with the overall goal of safe implementation of AM technology and transferring AM technology into commercial space applications. This presentation with provide critical awareness to the community lessons learned on proper implementation of AM.

L-PBF↗