Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “safe mode”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2

Fault protection techniques in JPL Spacecraft

While every JPL spacecraft requires some unique mission specific fault protection, there are many requirements which are common to all spacecraft configurations. These consist of protecting command and data processing & attitude control computers, protection against communication loss with the spacecraft, ensuring that safe external and internal temperature levels are maintained, and recovery from power overloads. Additionally, most JPL spacecraft are equipped with a general-purpose 'Safe Mode' response algorithm which configures the spacecraft to a lower power state which is safe and predictable so that diagnosis of more complex faults can be addressed by the Operations Team. This paper details the generic application of fault protection techniques which are implemented into most JPL spacecraft designs.

fault protection↗

Protecting Against Faults in JPL Spacecraft

A paper discusses techniques for protecting against faults in spacecraft designed and operated by NASA s Jet Propulsion Laboratory (JPL). The paper addresses, more specifically, fault-protection requirements and techniques common to most JPL spacecraft (in contradistinction to unique, mission specific techniques), standard practices in the implementation of these techniques, and fault-protection software architectures. Common requirements include those to protect onboard command, data-processing, and control computers; protect against loss of Earth/spacecraft radio communication; maintain safe temperatures; and recover from power overloads. The paper describes fault-protection techniques as part of a fault-management strategy that also includes functional redundancy, redundant hardware, and autonomous monitoring of (1) the operational and health statuses of spacecraft components, (2) temperatures inside and outside the spacecraft, and (3) allocation of power. The strategy also provides for preprogrammed automated responses to anomalous conditions. In addition, the software running in almost every JPL spacecraft incorporates a general-purpose "Safe Mode" response algorithm that configures the spacecraft in a lower-power state that is safe and predictable, thereby facilitating diagnosis of more complex faults by a team of human experts on Earth.

Morgan, Paula↗

Guidance, navigation, and control subsystem for the EOS-AM spacecraft

This paper presents the preliminary design of the Guidance, Navigation, and Control (GN&C) subsystem for the EOS-AM spacecraft and specifically focuses on the GN&C Normal Mode design. First, a brief description of the EOS-AM science mission, instruments, and system-level spacecraft design is provided. Next, an overview of the GN&C subsystem functional and performance requirements, hardware, and operating modes is presented. Then, the GN&C Normal Mode attitude determination, attitude control, and navigation systems are detailed. Finally, descriptions of the spacecraft's overall jitter performance and Safe Mode are provided.

Linder, David M.↗

Probabilistic Causal Analysis for System Safety Risk Assessments in Commercial Air Transport

Aviation is one of the critical modes of our national transportation system. As such, it is essential that new technologies be continually developed to ensure that a safe mode of transportation becomes even safer in the future. The NASA Aviation Safety Program (AvSP) is managing the development of new technologies and interventions aimed at reducing the fatal aviation accident rate by a factor of 5 by year 2007 and by a factor of 10 by year 2022. A portfolio assessment is currently being conducted to determine the projected impact that the new technologies and/or interventions may have on reducing aviation safety system risk. This paper reports on advanced risk analytics that combine the use of a human error taxonomy, probabilistic Bayesian Belief Networks, and case-based scenarios to assess a relative risk intensity metric. A sample case is used for illustrative purposes.

Luxhoj, James T.↗

Dawn Safing Approach to Ceres Re-Design

In mid-2014 the Dawn team finalized preparations for the spacecraft’s approach to Ceres. The design was the product of careful planning that began several years in advance, when the spacecraft left Vesta in September 2012. However, a few months prior to the anticipated start of approach, the spacecraft entered a safe mode. While temporary loss of thrust for ion propulsion missions is usually not mission-critical, it still presents many challenges. The safing event occurred at a time when thrusting to match Ceres’ orbital velocity was most effective, which meant the spacecraft must fly past Ceres before capturing into orbit. The new approach geometry changed the team’s strategy for navigating the spacecraft safely into orbit around Ceres with optical data. In this paper we describe the challenges of navigating the Dawn spacecraft into orbit around Ceres, including the safing event and re-design of the approach architecture.

Grebow, Daniel J.↗

Dawn Safing Approach to Ceres Re-Design

In mid-2014 the Dawn team finalized preparations for the spacecraft’s approach to Ceres. The design was the product of careful planning that began several years in advance, when the spacecraft left Vesta in September 2012. However, a few months prior to the anticipated start of approach, the spacecraft entered a safe mode. While temporary loss of thrust for ion propulsion missions is usually not mission-critical, it still presents many challenges. The safing event occurred at a time when thrusting to match Ceres’ orbital velocity was most effective, which meant the spacecraft must fly past Ceres before capturing into orbit. The new approach geometry changed the team’s strategy for navigating the spacecraft safely into orbit around Ceres with optical data. In this paper we describe the challenges of navigating the Dawn spacecraft into orbit around Ceres, including the safing event and re-design of the approach architecture.

Grebow, Dan↗

Measuring Crosstalk in MODIS Spectral Bands On-orbit Using the SRCA

Near-identical MODIS instruments launched on-board the Terra and Aqua spacecraft in 1999 and 2002, respectively. Each MODIS instrument has36 spectral bands covering 0.41 to 14.2μm mounted among four focal plane assemblies, along with a series of on-board calibrators (OBCs) used to characterize the instrument performance on-orbit. One such OBC is the Spectro-radiometric Calibration Assembly (SRCA), which is a multi-function calibrator, able to provide calibration sources to measure spatial, spectral, or radiometric properties of the MODIS bands depending on its configuration. The MODIS instrument performance, including measurements of the signal cross-contamination (crosstalk) between bands, was measured on-orbit during early-mission characterization for both instruments. This crosstalk test used the SRCA in its spatial mode while utilizing the thin slit, which is normally used for spectral calibrations. A similar crosstalk test was recently performed for Terra MODIS. Since the Terra safe mode event in 2016, the PVLWIR bands specifically (6.7-9.7μm) have shown increased influence from crosstalk. The process involved in preparing and performing this crosstalk test is included in this work, as well as the findings from the recent and previous SRCA-based crosstalk characterizations.

MODIS↗

Dynamics Questions Associated with the AERCam Sprint Free-Flyer

The International Space Station will require the development of small robotic vehicles for such tasks as external inspection, monitoring of extravehicular activities (EVA's) and station build-up, and providing additional lighting at EVA worksites. The Autonomous EVA Robotic Camera (AERCam) family of free-flyers is currently being developed at NASA Johnson Space Center to perform these functions; the first member of the family is the AERCam Sprint vehicle. Many interesting dynamical questions are associated with the Sprint free-flyer. For instance, the reaction of a vehicle which is nearly spherically symmetric (such as Sprint) to a stuck-on thruster is significantly more complicated than that obtained for an idealized, perfectly spherical, spacecraft model. In particular, the real spacecraft will experience a form of forced nutation, with convergence towards either its major or minor principal axis, depending on both the applied torque and the mass properties of the vehicle. Furthermore, the body-fixed jet force vector may have a significant component along this principal axis, so giving rise to a considerable net linear acceleration of the spacecraft. The large velocity that can result is very important, as it may lead to collision with the nearby Orbiter, and is completely overlooked in the idealized analysis. This report will firstly briefly describe the stuck-on thruster dynamics of the real vehicle, and outline how the small products of inertia of the spacecraft determine the time constants of the motion. Secondly, the dynamical effects of a failed-off jet on the Sprint free-flyer will be described in more detail, and compared with the stuck-on thruster case. This will help to show whether the two malfunctions should be dealt with differently in flight. Finally, the stuck-on thruster detection software (known as the uncommanded motion algorithm) that is proposed to be flown on the Sprint vehicle will be analyzed, and all possible perturbation sources that may tend to give rise to false stuck-on thruster alarms quantified. It will be shown that false alarms can be triggered by discrete events such as a failed-off thruster, a glancing collision with Orbiter structure, or thruster saturation. They can also be triggered by a combination of errors introduced by constantly present sources such as thrust level errors, thruster misalignment, inertial cross-coupling, angular rate sensor noise, and structural vibrations induced by thruster firings. Based on this fact, the original plan to have the spacecraft enter safe mode whenever the uncommanded motion algorithm is triggered does not appear to be advisable. A better approach seems to be to provide the Sprint pilot with a warning whenever uncommanded motion is detected, and then allow the crew to determine whether safing the vehicle is appropriate.

Williams, Trevor↗

CloudSat Anomaly Recovery and Operational Lessons Learned

In April 2011, NASA's pioneering cloud profiling radar satellite, CloudSat, experienced a battery anomaly that placed it into emergency mode and rendered it operations incapable. All initial attempts to recover the spacecraft failed as the resultant power limitations could not support even the lowest power mode. Originally part of a six-satellite constellation known as the "A-Train", CloudSat was unable to stay within its assigned control box, posing a threat to other A-Train satellites. CloudSat needed to exit the constellation, but with the tenuous power profile, conducting maneuvers was very risky. The team was able to execute a complex sequence of operations which recovered control, conducted an orbit lower maneuver, and returned the satellite to safe mode, within one 65 minute sunlit period. During the course of the anomaly recovery, the team developed several bold, innovative operational strategies. Details of the investigation into the root-cause and the multiple approaches to revive CloudSat are examined. Satellite communication and commanding during the anomaly are presented. A radical new system of "Daylight Only Operations" (DO-OP) was developed, which cycles the payload and subsystem components off in tune with earth eclipse entry and exit in order to maintain positive power and thermal profiles. The scientific methodology and operational results behind the graduated testing and ramp-up to DO-OP are analyzed. In November 2011, the CloudSat team successfully restored the vehicle to consistent operational collection of cloud radar data during sunlit portions of the orbit. Lessons learned throughout the six-month return-to-operations recovery effort are discussed and offered for application to other R&D satellites, in the context of on-orbit anomaly resolution efforts.

cloud profiling radar satellite↗

Improvements of On-orbit Characterization of Terra MODIS Short-wave Infrared Spectral Bands Out-of-Band Responses

The short-wave infrared (SWIR) bands (5-7, 26) of Terra MODIS, which are co-located with the mid-wav e infrared (MWIR) bands (20-25) on the short and mid-wave infrared (SMIR) Focal Plane Assembly (FPA),have a known issue related to 5.3 μm out-of-band (OOB) thermal leak and electronic crosstalk that was identified prelaunch. As a result, a crosstalk correction algorithm was designed and implemented in the MODIS Level 1B (L1B) calibration. Shortly after the Terra launch, extensive efforts were under taken to help characterize and mitigate the impact due to the OOB response and crosstalk on the SWIR on-orbit calibration and, consequently, the associated L1Bdata products. In addition, special night time day mode (NTDM) operations have been regularly scheduled to derive the crosstalk correction coefficients. Since MODIS does not have a spectral band centered at 5.3 μm, its band 28 (7.325 μm) was chosen as the surrogate sending band to simulate the OOB radiances at 5.3 μm. This was largely based on the measurements from the MODIS Airborne Simulator (MAS) spectrometer field campaigns in the early months after the Terra launch. In the case of Aqua MODIS, the magnitude of the SWIR crosstalk was much smaller and band 25 (4.52 μm) was found to be more effective as the sending band for the crosstalk correction. In recent years, the Terra MODIS photovoltaic (PV) long-wave infrared (LWIR) bands (27-30)electronic crosstalk has increased considerably, especially after the spacecraft safe-mode event occurred in February2016. This accentuated degradation in the PV LWIR performance has also impacted the performance of the SWIR crosstalk correction and thus its calibration and data quality. In this paper, we examine the use of band 25 as the sending band for the Terra MODIS SWIR crosstalk correction and compare its performance with that based on band 28 as the sending band. Results indicate an improvement of on-orbit gain stability for the SWIR calibration and reduced detector to detector and sub-frame to sub-frame striping in the calibrated L1B imagery, especially during the period when the PV LWIR electronic crosstalk has become more severe. This approach has been implemented in the forward production of Terra MODIS Collection 6 and Collection 6.1,starting from July 2019, and is planned to be used for the future reprocessing of MODIS L1B and to help improve the mission-long reflectance calibration and trending stability of the SWIR bands.

MODIS, Terra, Aqua, MODIS, SWIR, calibration, out-↗

Twenty Years of Terra MODIS Spatial Performance Using the Spectro-Radiometric Calibration Assembly

The Moderate Resolution Imaging Spectroradiometer (MODIS) instrument on-board the NASA’s Earth Observing System Terra satellite has continued successful Earth-sensing operations for over 20 years. To aid in its mission in providing calibrated science data to the worldwide user community, the MODIS instrument is equipped with several on-board calibrators designed to measure changes in the instrument response over time. One such calibrator is the Spectro-Radiometric Calibration Assembly (SRCA), which can provide a source signal for radiometric, spectral, or spatial characterization. When commanded into its spatial calibration mode, the SRCA is able to produce light across the MODIS band spectral range (0.412μm to 14.2μm) at a variety of signal levels thanks to several internal halogen lamps, an IR glow bar, and a neutral density filter. This signal, used in combination with commanded sub-sample measurements of the MODIS detectors, provides a basis for determining changes in the spatial performance of the MODIS spectral bands. This work summarizes the spatial calibration process using the SRCA and presents 20 years of Terra MODIS spatial performance characterized through co-registration between MODIS bands, detectors, and focal plane assemblies. Results from pre-launch testing using the Integration and Alignment Collimator and the SRCA are incorporated in the history of the Terra MODIS mission-long spatial performance. We also note modifications to the spatial characterization methodology brought on by changes to the SRCA’s operational configuration and changes to the MODIS spectral band performance, particularly after the recovery from the safe-mode event in February 2016. Results are compared against the MODIS design specifications.

MODIS↗

Single Event Transients in Linear Integrated Circuits

On November 5, 2001, a processor reset occurred on board the Microwave Anisotropy Probe (MAP), a NASA mission to measure the anisotropy of the microwave radiation left over from the Big Bang. The reset caused the spacecraft to enter a safehold mode from which it took several days to recover. Were that to happen regularly, the entire mission would be compromised, so it was important to find the cause of the reset and, if possible, to mitigate it. NASA assembled a team of engineers that included experts in radiation effects to tackle the problem. The first clue was the observation that the processor reset occurred during a solar event characterized by large increases in the proton and heavy ion fluxes emitted by the sun. To the radiation effects engineers on the team, this strongly suggested that particle radiation might be the culprit, particularly when it was discovered that the reset circuit contained three voltage comparators (LM139). Previous testing revealed that large voltage transients, or glitches appeared at the output of the LM139 when it was exposed to a beam of heavy ions [NI96]. The function of the reset circuit was to monitor the supply voltage and to issue a reset command to the processor should the voltage fall below a reference of 2.5 V [PO02]. Eventually, the team of engineers concluded that ionizing particle radiation from the solar event produced a negative voltage transient on the output of one of the LM139s sufficiently large to reset the processor on MAP. Fortunately, as of the end of 2004, only two such resets have occurred. The reset on MAP was not the first malfunction on a spacecraft attributed to a transient. That occurred shortly after the launch of NASA s TOPEX/Poseidon satellite in 1992. It was suspected, and later confirmed, that an anomaly in the Earth Sensor was caused by a transient in an operational amplifier (OP-15) [KO93]. Over the next few years, problems on TDRS, CASSINI, [PR02] SOHO [HA99,HA01] and TERRA were also attributed to transients. In some cases, such events produced resets by falsely triggering circuits designed to protect against over- voltage or over-current. On at least three occasions, transients caused satellites to switch into "safe mode" in which most of the systems on board the satellites were powered down for an extended period. By the time the satellites were reconfigured and returned to full operational state, much scientific data had been lost. Fortunately, no permanent damage occurred in any of the systems and they were all successfully re-activated.

Buchner, Stephen↗

Adaptive Augmenting Control Flight Characterization Experiment on an F/A-18

This paper summarizes the Adaptive Augmenting Control (AAC) flight characterization experiments performed using an F/A-18 (TN 853). AAC was designed and developed specifically for launch vehicles, and is currently part of the baseline autopilot design for NASA's Space Launch System (SLS). The scope covered here includes a brief overview of the algorithm (covered in more detail elsewhere), motivation and benefits of flight testing, top-level SLS flight test objectives, applicability of the F/A-18 as a platform for testing a launch vehicle control design, test cases designed to fully vet the AAC algorithm, flight test results, and conclusions regarding the functionality of AAC. The AAC algorithm developed at Marshall Space Flight Center is a forward loop gain multiplicative adaptive algorithm that modifies the total attitude control system gain in response to sensed model errors or undesirable parasitic mode resonances. The AAC algorithm provides the capability to improve or decrease performance by balancing attitude tracking with the mitigation of parasitic dynamics, such as control-structure interaction or servo-actuator limit cycles. In the case of the latter, if unmodeled or mismodeled parasitic dynamics are present that would otherwise result in a closed-loop instability or near instability, the adaptive controller decreases the total loop gain to reduce the interaction between these dynamics and the controller. This is in contrast to traditional adaptive control logic, which focuses on improving performance by increasing gain. The computationally simple AAC attitude control algorithm has stability properties that are reconcilable in the context of classical frequency-domain criteria (i.e., gain and phase margin). The algorithm assumes that the baseline attitude control design is well-tuned for a nominal trajectory and is designed to adapt only when necessary. Furthermore, the adaptation is attracted to the nominal design and adapts only on an as-needed basis (see Figure 1). The MSFC algorithm design was formulated during the Constellation Program and reached a high maturity level during SLS through simulation-based development and internal and external analytical review. The AAC algorithm design has three summary-level objectives: (1) "Do no harm;" return to baseline control design when not needed, (2) Increase performance; respond to error in ability of vehicle to track command, and (3) Regain stability; respond to undesirable control-structure interaction or other parasitic dynamics. AAC has been successfully implemented as part of the Space Launch System baseline design, including extensive testing in high-fidelity 6-DOF simulations the details of which are described in [1]. The Dryden Flight Research Center's F/A-18 Full-Scale Advanced Systems Testbed (FAST) platform is used to conduct an algorithm flight characterization experiment intended to fully vet the aforementioned design objectives. FAST was specifically designed with this type of test program in mind. The onboard flight control system has full-authority experiment control of ten aerodynamic effectors and two throttles. It has production and research sensor inputs and pilot engage/disengage and real-time configuration of up to eight different experiments on a single flight. It has failure detection and automatic reversion to fail-safe mode. The F/A-18 aircraft has an experiment envelope cleared for full-authority control and maneuvering and exhibits characteristics for robust recovery from unusual attitudes and configurations aided by the presence of a qualified test pilot. The F/A-18 aircraft has relatively high mass and inertia with exceptional performance; the F/A-18 also has a large thrust-to-weight ratio, owing to its military heritage. This enables the simulation of a portion of the ascent trajectory with a high degree of dynamic similarity to a launch vehicle, and the research flight control system can simulate unstable longitudinal dynamics. Parasitic dynamics such as slosh and bending modes, as well as atmospheric disturbances, are being produced by the airframe via modification of bending filters and the use of secondary control surfaces, including leading and trailing edge flaps, symmetric ailerons, and symmetric rudders. The platform also has the ability to inject signals in flight to simulate structural mode resonances or other challenging dynamics. This platform also offers more test maneuvers and longer maneuver times than a single rocket or missile test, which provides ample opportunity to fully and repeatedly exercise all aspects of the algorithm. Prior to testing on an F/A-18, AAC was the only component of the SLS autopilot design that had not been flight tested. The testing described in this paper raises the Technology Readiness Level (TRL) early in the SLS Program and is able to demonstrate its capabilities and robustness in a flight environment.

VanZwieten, Tannen S.↗

Attitude and articulation control for CRAF/Cassini

The Comet Rendezvous/Asteroid Flyby (CRAF) and Cassini planetary missions provide exciting pointing and control challenges. The mission and science objectives, and an attitude and articulation control concept designed to meet these challenges, are described. CRAF/Cassini mission characteristics which drive pointing and control include: close range flybys of asteroids and icy satellites; Huygens probe guidance and communication; Saturn orbit insertion; comet rendezvous and orbit insertion; closed loop target tracking from a comet orbit perturbed by gas and dust pressure; fine spacecraft pointing for Titan radar mapping and Earth communications; requirements for autonomous failure detection; isolation; recovery; and 13.5 year lifetime. The philosophy and approach chosen to meet these challenges and the overall control architecture are addressed, including operational and autonomous safe modes. Critical functions are highlighted, such as charge coupled device imaging of stars and extended bodies which provide references for inertial and target referenced pointing respectively. Tradeoffs and rationale for the selection and location of sensors and actuators are reviewed.

Bell, C. E.↗

Welding space vacuum technology

The objective was to assist the EH 42 Division in putting together a vacuum system that could attain the desired pressure and be large enough to accommodate the gas-metal arc (GMA) welding fixture apparatus. A major accomplishment was the design and fabrication of the controller/annunciator for the 4' by 8' system. It contains many safety features such as thermocouple set point relays that will only allow inlet and exit gas and vacuum valves to be operated at pre-selected system pressures, and a fail safe mode for power interruptions and operator mistakes. It is felt that significant progress was made in this research effort to weld in a vacuum environment. With continued efforts to increase the pump speeds for vacuum chambers and further studies on weld fixtures and gas inlet pressures, the NASA program will be successful.

Johnson, R. Barry↗

Thermal analysis of an arc heater electrode with a rotating arc foot

A smoothly rotating arc foot and an arc foot that jumps between multiple sticking points were analyzed using analytic formulations and numerical solution procedures. For each case the temperature distribution for a copper electrode was obtained for the plausible range of operating conditions. It is shown that the smoothly rotating arc foot is an extremely safe mode of operation, whereas the jumping arc foot produces excessively high electrode surface temperatures which are not greatly alleviated by increasing the average rotational frequency of the arc foot. It is suggested to eliminate arc-foot rotation and rely on the distribution of fixed electrodes with stationary arc attachment to avoid electrode failure at high current.

Milos, Frank S.↗

Magellan aerobrake navigation

The Magellan spacecraft has been aerobraked into a 197 x 541 km near-circular orbit around Venus from which it is conducting a high-resolution gravity mapping mission. This was the first interplanetary aerobrake maneuver and involved flying the spacecraft through the upper reaches of the Venusian atmosphere 730 times over a 70 day period. Round-trip light-time varied from 9.57 to 18.83 minutes during this period. Navigation for this dynamic phase of the Magellan mission was planned and executed in the face of budget-driven down-sizing with all spacecraft safe modes disabled and a flight-team one-third the size of comparable interplanetary missions. Successful execution of this manuever using spacecraft hardware not designed to operate in a planetary atmosphere, demonstrated a practical cost-saving technique for both large and small future interplanetary missions.

Giorgini, Jon↗

Compact Holographic Data Storage

NASA's future missions would require massive high-speed onboard data storage capability to Space Science missions. For Space Science, such as the Europa Lander mission, the onboard data storage requirements would be focused on maximizing the spacecraft's ability to survive fault conditions (i.e., no loss in stored science data when spacecraft enters the 'safe mode') and autonomously recover from them during NASA's long-life and deep space missions. This would require the development of non-volatile memory. In order to survive in the stringent environment during space exploration missions, onboard memory requirements would also include: (1) survive a high radiation environment (1 Mrad), (2) operate effectively and efficiently for a very long time (10 years), and (3) sustain at least a billion write cycles. Therefore, memory technologies requirements of NASA's Earth Science and Space Science missions are large capacity, non-volatility, high-transfer rate, high radiation resistance, high storage density, and high power efficiency. JPL, under current sponsorship from NASA Space Science and Earth Science Programs, is developing a high-density, nonvolatile and rad-hard Compact Holographic Data Storage (CHDS) system to enable large-capacity, high-speed, low power consumption, and read/write of data in a space environment. The entire read/write operation will be controlled with electrooptic mechanism without any moving parts. This CHDS will consist of laser diodes, photorefractive crystal, spatial light modulator, photodetector array, and I/O electronic interface. In operation, pages of information would be recorded and retrieved with random access and high-speed. The nonvolatile, rad-hard characteristics of the holographic memory will provide a revolutionary memory technology meeting the high radiation challenge facing the Europa Lander mission. Additional information is contained in the original extended abstract.

Chao, T. H.↗