SEARCH · Engineering Papers

Results for “Failing Safely”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 253 records · Page 14

All sources NASA NTRS DOE OSTI

NASA NTRS1999

High Reliability Engine Control Demonstrated for Aircraft Engines

For a dual redundant-control system, which is typical for short-haul aircraft, if a failure is detected in a control sensor, the engine control is transferred to a safety mode and an advisory is issued for immediate maintenance action to replace the failed sensor. The safety mode typically results in severely degraded engine performance. The goal of the High Reliability Engine Control (HREC) program was to demonstrate that the neural-network-based sensor validation technology can safely operate an engine by using the nominal closed-loop control during and after sensor failures. With this technology, engine performance could be maintained, and the sensor could be replaced as a conveniently scheduled maintenance action.

Guo, Ten-Huei↗

NASA NTRS1985

Power-Factor Controllers: How Safe?

Potential safety problems with power-factor controllers (PFC's) evaluated. Based on study of PFCs in use with appliances, report recommends measures to prevent consumers from misapplying these energy saving devices. Device used on such appliances as refrigerators, sewing machines, pumps, hair dryers, and food processors. When misused, they fail to save energy and may cause damage.

Long, K.↗

NASA NTRS1980

Orbiter door closure tools

Safe reentry of the shuttle orbiter requires that the payload bay doors be closed and securely latched. Since a malfunction in the door drive or bulkhead latch systems could make safe reentry impossible, the requirement to provide tools to manually close and secure the doors was implemented. The tools would disconnect a disabled door or latch closure system and close and secure the doors if the normal system failed. The tools required to perform these tasks have evolved into a set that consists of a tubing cutter, a winch, a latching tool, and a bolt extractor. The design, fabrication, and performance tests of each tool are described.

Acres, W. R.↗

NASA NTRS2010

Lunar Surface Operations with Dual Rovers

Lunar Electric Rovers (LER) are currently being developed that are substantially more capable than the Apollo vehicle (LRN ,"). Unlike the LRV, the new LERs provide a pressurized cabin that serves as short-sleeve environment for the crew of two, including sleeping accommodations and other provisions that allow for long tern stays, possibly up to 60 days, on the hear surface, without the need to replenish consumables from some outside source, such as a lander or outpost. As a consequence, significantly larger regions may be explored in the future and traverse distances may be measured in a few hundred kilometers (1, 2). However, crew safety remains an overriding concern, and methods other than "walk back", the major operational constraint of all Apollo traverses, must be implemented to assure -at any time- the safe return of the crew to the lander or outpost. This then causes current Constellation plans to envision long-tern traverses to be conducted with 2 LERs exclusively, each carrying a crew of two: in case one rover fails, the other will rescue the stranded crew and return all 4 astronauts in a single LER to base camp. Recent Desert Research and Technology Studies (DRATS) analog field tests simulated a continuous 14 day traverse (3), covering some 135 km, and included a rescue operation that transferred the crew and diverse consumables from one LER to another these successful tests add substantial realism to the development of long-term, dual rover operations. The simultaneous utilization of 2 LERs is of course totally unlike Apollo and raises interesting issues regarding science productivity and mission operations, the thrust of this note.

Horz, Friedrich↗

NASA NTRSDate not supplied

Comparative Analysis of Thermal Runaway Heat Output as a Function of Trigger Mechanism and Cell Format

High demand for energy storage systems across many fields drives the need for safe and reliable Li-ion batteries. In order to assess the risk of using such batteries in various applications, many types of abuse tests have been developed to push battery cells to their limits and learn how they fail. In this work, internal short circuit (ISC) tests, nail penetration tests, and thermal tests were used to trigger thermal runaway in D-cell, 18650, and 21700 Li-ion cells. High-speed radiography was used to gain insight to the propagation of thermal runaway throughout the cell, while calorimetric and thermal data were recorded in real time. Post-test disassembly of the calorimeter allowed for any mass ejected from the cell to be analyzed and the distribution of mass through the calorimeter to be determined. The impact of cell geometry and trigger mechanism on post-test mass distribution, thermal runaway propagation and internal cell temperature are discussed.

Lithium-ion battery; thermal runaway; calorimetry;↗

NASA NTRS1985

Structural and mechanical design challenges of space shuttle solid rocket boosters separation and recovery subsystems

The design of the space shuttle solid rocket booster (SRB) subsystems for reuse posed some unique and challenging design considerations. The separation of the SRBs from the cluster (orbiter and external tank) at 150,000 ft when the orbiter engines are running at full thrust meant the two SRBs had to have positive separation forces pushing them away. At the same instant, the large attachments that had reacted launch loads of 7.5 million pounds thrust had to be servered. These design considerations dictated the design requirements for the pyrotechnics and separation rocket motors. The recovery and reuse of the two SRBs meant they had to be safely lowered to the ocean, remain afloat, and be owed back to shore. In general, both the pyrotechnic and recovery subsystems have met or exceeded design requirements. In twelve vehicles, there has only been one instance where the pyrotechnic system has failed to function properly.

Woodis, W. R.↗

NASA NTRS1996

Flight Test of a Propulsion-Based Emergency Control System on the MD-11 Airplane with Emphasis on the Lateral Axis

A large, civilian, multi-engine transport MD-11 airplane control system was recently modified to perform as an emergency backup controller using engine thrust only. The emergency backup system, referred to as the propulsion-controlled aircraft (PCA) system, would be used if a major primary flight control system fails. To allow for longitudinal and lateral-directional control, the PCA system requires at least two engines and is implemented through software modifications. A flight-test program was conducted to evaluate the PCA system high-altitude flying characteristics and to demonstrate its capacity to perform safe landings. The cruise flight conditions, several low approaches and one landing without any aerodynamic flight control surface movement, were demonstrated. This paper presents results that show satisfactory performance of the PCA system in the longitudinal axis. Test results indicate that the lateral-directional axis of the system performed well at high attitude but was sluggish and prone to thermal upsets during landing approaches. Flight-test experiences and test techniques are also discussed with emphasis on the lateral-directional axis because of the difficulties encountered in flight test.

Burken, John J.↗

NASA NTRS2014

Applying Flammability Limit Probabilities and the Normoxic Upward Limiting Pressure Concept to NASA STD-6001 Test 1

Repeated Test 1 extinction tests near the upward flammability limit are expected to follow a Poisson process trend. This Poisson process trend suggests that rather than define a ULOI and MOC (which requires two limits to be determined), it might be better to define a single upward limit as being where 1/e (where e (approx. equal to 2.7183) is the characteristic time of the normalized Poisson process) of the materials burn, or, rounding, where approximately 1/3 of the samples fail the test (and burn). Recognizing that spacecraft atmospheres will not bound the entire oxygen-pressure parameter space, but actually lie along the normoxic atmosphere control band, we can focus the materials flammability testing along this normoxic band. A Normoxic Upward Limiting Pressure (NULP) is defined that determines the minimum safe total pressure for a material within the constant partial pressure control band. Then, increasing this pressure limit by a factor of safety, we can define the material as being safe to use at the NULP + SF (where SF is on the order of 10 kilopascal, based on existing flammability data). It is recommended that the thickest material to be tested with the current Test 1 igniter should be 3 mm thick (1/8 inches) to avoid the problem of differentiating between an ignition limit and a true flammability limit.

flammability↗

NASA NTRS2006

Ka-Band Wide-Bandgap Solid-State Power Amplifier: Prototype Combiner Spurious Mode Suppression and Power Constraints

Results of prototype hardware activities related to a 120-W, 32-GHz (Ka-band) solid-state power amplifier (SSPA) architecture study are presented. Spurious mode suppression and the power-handling capability of a prototype 24-way radial combiner and a prototype 2-way septum binary combiner were investigated. Experimental data indicate that a commercial absorptive filter, designed to pass the circular TE01 mode, effectively suppressed the higher-order modes generated by a narrowband, flower-petal-type mode transducer. However, the same filter was not effective in suppressing higher-order modes generated by the broadband Marie mode transducer that is used in the prototype waveguide radial combiner. Should greater filtering be required by a particular SSPA application, a broadband mode filter that can suppress specifically those higher-order modes that are generated by the Marie transducer will need to be developed. A back-to-back configuration of the prototype radial combiner was tested with drive power up to approximately 50 W. No anomalous behavior was observed. Power measurements of the septum combiner indicate that up to 10-W radio frequency (RF) can be dissipated in the integrated resistive element before a permanent performance shift is observed. Thus, a given adder (a single-stage, 2-way combiner) can safely combine two 20-W sources, and the adder will not be damaged in the event of a source failure. This result is used to calculate the maximum source power that can be safely combined as a function of the number of sources combined and the number of source failures allowed in a multi-stage combiner. The analysis shows that SSPA power >140 W can be generated by power combining 16 sources producing 10 W each. In this configuration, up to three sources could fail with the guarantee that the combiner would not be damaged. Finally, a modified prototype septum combiner design was verified. The improved design reduced the assembly time from over 2 hours to about 15 minutes per adder.

Khan, P.↗

NASA NTRS2019

Towards Resilient Autonomous Navigation of Drones

Robots and particularly drones are especially useful in exploring extreme environments that pose hazards to humans. To ensure safe operations in these situations, usually perceptually degraded and without good GNSS, it is critical to have a reliable and robust state estimation solution. The main body of literature in robot state estimation focuses on developing complex algorithms favoring accuracy. Typically, these approaches rely on a strong underlying assumption: the main estimation engine will not fail during operation. In contrast, we propose an architecture that pursues robustness in state estimation by considering redundancy and heterogeneity in both sensing and estimation algorithms. The architecture is designed to expect and detect failures and adapt the behavior of the system to ensure safety. To this end, we present HeRO (Heterogeneous Redundant Odometry): a stack of estimation algorithms running in parallel supervised by a resiliency logic. This logic carries out three main functions: a) perform confidence tests both in data quality and algorithm health; b) re-initialize those algorithms that might be malfunctioning; c) generate a smooth state estimate by multiplexing the inputs based on their quality. The state and quality estimates are used by the guidance and control modules to adapt the mobility behaviors of the system. The validation and utility of the approach are shown with real experiments on a ying robot for the use case of autonomous exploration of subterranean environments, with particular results from the STIX event of the DARPA Subterranean Challenge.

Agha-mohammadi, Ali-akbar↗

NASA NTRS1991

Digging in the coronal graveyard - A Rosat observation of the red giant Arcturus

A deep exposure of the bright star Arcturus (Alpha Bootis: K1 III) with the Roentgensatellit (Rosat) failed to detect soft X-ray emission from the archetype 'noncoronal' red giant. The 3-sigma upper limit in the energy band 0.1-2.4 keV corresponds to an X-ray luminosity of less than 3 x 10 to the 25th erg/s, equivalent to a coronal surface flux density of less than 0.0001 solar. The nondetection safely eliminates coronal irradiation as a possible mechanism to produce the highly variable He I 10830 feature and emphasizes the sharp decline in solarlike coronal activity that accompanies the evolution of low-mass single stars away from the main sequence. While the most conspicuous object in the Rosat field of view was not visible in X-rays, at least one fainter star is among the about 60 sources recorded: the Sigma Sct variable CN Boo, an A8 giant in the UMa Stream.

Ayres, Thomas R.↗

NASA NTRS2019

Maneuver design overview of the 2018 InSight Mars lander mission

Launched on May 5, 2018, the Interior Exploration using Seismic Investigations, Geodesy, and Heat Transport (InSight) spacecraft landed safely on Mars on November 26, 2018. To deliver the lander accurately to the landing site, six trajectory correction maneuvers (TCMs) were planned along the reference trajectory from Earth launch to Mars entry. For the last two TCMs, there were two corresponding contingency TCMs planned that could be executed in the event that the corresponding nominal one failed. There were also twenty pre-designed menu TCMs available for execution at the time of the last contingency TCM, about 8 hours before the Mars entry, descent, and landing. This navigation paper overviews the maneuver design of each TCM, as well as how each one actually performed during operations.

Wallace, Mark↗

NASA NTRS1999

Results from the First Two Flights of the Static Computer Memory Integrity Testing Experiment

This paper details the scientific objectives, experiment design, data collection method, and post flight analysis following the first two flights of the Static Computer Memory Integrity Testing (SCMIT) experiment. SCMIT is designed to detect soft-event upsets in passive magnetic memory. A soft-event upset is a change in the logic state of active or passive forms of magnetic memory, commonly referred to as a "Bitflip". In its mildest form a soft-event upset can cause software exceptions, unexpected events, start spacecraft safeing (ending data collection) or corrupted fault protection and error recovery capabilities. In it's most severe form loss of mission or spacecraft can occur. Analysis after the first flight (in 1991 during STS-40) identified possible soft-event upsets to 25% of the experiment detectors. Post flight analysis after the second flight (in 1997 on STS-87) failed to find any evidence of soft-event upsets. The SCMIT experiment is currently scheduled for a third flight in December 1999 on STS-101.

Hancock, Thomas M., III↗

NASA NTRS2011

Measurement of CPAS Main Parachute Rate of Descent

The Crew Exploration Vehicle Parachute Assembly System (CPAS) is being designed to land the Orion Crew Module (CM) at a safe rate of descent at splashdown. Flight test performance must be measured to a high degree of accuracy to ensure this requirement is met with the most efficient design possible. Although the design includes three CPAS Main parachutes, the requirement is that the system must not exceed 33 ft/s under two Main parachutes, should one of the Main parachutes fail. Therefore, several tests were conducted with clusters of two Mains. All of the steady-state rate of descent data are normalized to standard sea level conditions and checked against the limit. As the Orion design gains weight, the system is approaching this limit to within measurement precision. Parachute "breathing," cluster interactions, and atmospheric anomalies can cause the rate of descent to vary widely and lead to challenges in characterizing parachute terminal performance. An early test had contradictory rate of descent results from optical trajectory and Differential Global Positioning Systems (DGPS). A thorough analysis of the data sources and error propagation was conducted to determine the uncertainty in the trajectory. It was discovered that the Time Space Position Information (TSPI) from the optical tracking provided accurate position data. However, the velocity from TPSI must be computed via numerical differentiation, which is prone to large error. DGPS obtains position through pseudo-range calculations from multiple satellites and velocity through Doppler shift of the carrier frequency. Because the velocity from DGPS is a direct measurement, it is more accurate than TSPI velocity. To remedy the situation, a commercial off-the-shelf product that combines GPS and an Inertial Measurement Unit (IMU) was purchased to significantly improve rate of descent measurements. This had the added benefit of solving GPS dropouts during aircraft extraction. Statistical probability distributions for CPAS Main parachute rate of descent and drag coefficient were computed and plotted. Using test data, a terminal rate of descent at splashdown can be estimated as a function of canopy loading.

Ray, Eric S.↗

NASA NTRS1998

Framework for Small-Scale Experiments in Software Engineering: Guidance and Control Software Project: Software Engineering Case Study

Software is becoming increasingly significant in today's critical avionics systems. To achieve safe, reliable software, government regulatory agencies such as the Federal Aviation Administration (FAA) and the Department of Defense mandate the use of certain software development methods. However, little scientific evidence exists to show a correlation between software development methods and product quality. Given this lack of evidence, a series of experiments has been conducted to understand why and how software fails. The Guidance and Control Software (GCS) project is the latest in this series. The GCS project is a case study of the Requirements and Technical Concepts for Aviation RTCA/DO-178B guidelines, Software Considerations in Airborne Systems and Equipment Certification. All civil transport airframe and equipment vendors are expected to comply with these guidelines in building systems to be certified by the FAA for use in commercial aircraft. For the case study, two implementations of a guidance and control application were developed to comply with the DO-178B guidelines for Level A (critical) software. The development included the requirements, design, coding, verification, configuration management, and quality assurance processes. This paper discusses the details of the GCS project and presents the results of the case study.

Hayhurst, Kelly J.↗

NASA NTRS2002

Minimum Control Requirements for Advanced Life Support Systems

Advanced control technologies are not necessary for the safe, reliable and continuous operation of Advanced Life Support (ALS) systems. ALS systems can and are adequately controlled by simple, reliable, low-level methodologies and algorithms. The automation provided by advanced control technologies is claimed to decrease system mass and necessary crew time by reducing buffer size and minimizing crew involvement. In truth, these approaches increase control system complexity without clearly demonstrating an increase in reliability across the ALS system. Unless these systems are as reliable as the hardware they control, there is no savings to be had. A baseline ALS system is presented with the minimal control system required for its continuous safe reliable operation. This baseline control system uses simple algorithms and scheduling methodologies and relies on human intervention only in the event of failure of the redundant backup equipment. This ALS system architecture is designed for reliable operation, with minimal components and minimal control system complexity. The fundamental design precept followed is "If it isn't there, it can't fail".

Boulange, Richard↗

NASA NTRS2009

An Indirect Adaptive Control Scheme in the Presence of Actuator and Sensor Failures

The problem of controlling a system in the presence of unknown actuator and sensor faults is addressed. The system is assumed to have groups of actuators, and groups of sensors, with each group consisting of multiple redundant similar actuators or sensors. The types of actuator faults considered consist of unknown actuators stuck in unknown positions, as well as reduced actuator effectiveness. The sensor faults considered include unknown biases and outages. The approach employed for fault detection and estimation consists of a bank of Kalman filters based on multiple models, and subsequent control reconfiguration to mitigate the effect of biases caused by failed components as well as to obtain stability and satisfactory performance using the remaining actuators and sensors. Conditions for fault identifiability are presented, and the adaptive scheme is applied to an aircraft flight control example in the presence of actuator failures. Simulation results demonstrate that the method can rapidly and accurately detect faults and estimate the fault values, thus enabling safe operation and acceptable performance in spite of failures.

Sun, Joy Z.↗

NASA NTRS2012

Tools Ensure Reliability of Critical Software

In November 2006, after attempting to make a routine maneuver, NASA's Mars Global Surveyor (MGS) reported unexpected errors. The onboard software switched to backup resources, and a 2-day lapse in communication took place between the spacecraft and Earth. When a signal was finally received, it indicated that MGS had entered safe mode, a state of restricted activity in which the computer awaits instructions from Earth. After more than 9 years of successful operation gathering data and snapping pictures of Mars to characterize the planet's land and weather communication between MGS and Earth suddenly stopped. Months later, a report from NASA's internal review board found the spacecraft's battery failed due to an unfortunate sequence of events. Updates to the spacecraft's software, which had taken place months earlier, were written to the wrong memory address in the spacecraft's computer. In short, the mission ended because of a software defect. Over the last decade, spacecraft have become increasingly reliant on software to carry out mission operations. In fact, the next mission to Mars, the Mars Science Laboratory, will rely on more software than all earlier missions to Mars combined. According to Gerard Holzmann, manager at the Laboratory for Reliable Software (LaRS) at NASA's Jet Propulsion Laboratory (JPL), even the fault protection systems on a spacecraft are mostly software-based. For reasons like these, well-functioning software is critical for NASA. In the same year as the failure of MGS, Holzmann presented a new approach to critical software development to help reduce risk and provide consistency. He proposed The Power of 10: Rules for Developing Safety-Critical Code, which is a small set of rules that can easily be remembered, clearly relate to risk, and allow compliance to be verified. The reaction at JPL was positive, and developers in the private sector embraced Holzmann's ideas.

Source record↗