Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “system fault protection”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2
All sourcesNASA NTRSDOE OSTI
NASA NTRS1992

Power system monitoring and source control of the Space Station Freedom DC power system testbed

Unlike a terrestrial electric utility which can purchase power from a neighboring utility, the Space Station Freedom (SSF) has strictly limited energy resources; as a result, source control, system monitoring, system protection, and load management are essential to the safe and efficient operation of the SSF Electric Power System (EPS). These functions are being evaluated in the DC Power Management and Distribution (PMAD) Testbed which NASA LeRC has developed at the Power System Facility (PSF) located in Cleveland, Ohio. The testbed is an ideal platform to develop, integrate, and verify power system monitoring and control algorithms. State Estimation (SE) is a monitoring tool used extensively in terrestrial electric utilities to ensure safe power system operation. It uses redundant system information to calculate the actual state of the EPS, to isolate faulty sensors, to determine source operating points, to verify faults detected by subsidiary controllers, and to identify high impedance faults. Source control and monitoring safeguard the power generation and storage subsystems and ensure that the power system operates within safe limits while satisfying user demands with minimal interruptions. System monitoring functions, in coordination with hardware implemented schemes, provide for a complete fault protection system. The objective of this paper is to overview the development and integration of the state estimator and the source control algorithms.

Kimnach, Greg L.↗
NASA NTRS1992

Power system monitoring and source control of the Space Station Freedom dc-power system testbed

Unlike a terrestrial electric utility which can purchase power from a neighboring utility, the Space Station Freedom (SSF) has strictly limited energy resources; as a result, source control, system monitoring, system protection, and load management are essential to the safe and efficient operation of the SSF Electric Power System (EPS). These functions are being evaluated in the dc Power Management and Distribution (PMAD) Testbed which NASA LeRC has developed at the Power System Facility (PSF) located in Cleveland, Ohio. The testbed is an ideal platform to develop, integrate, and verify power system monitoring and control algorithms. State Estimation (SE) is a monitoring tool used extensively in terrestrial electric utilities to ensure safe power system operation. It uses redundant system information to calculate the actual state of the EPS, to isolate faulty sensors, to determine source operating points, to verify faults detected by subsidiary controllers, and to identify high impedance faults. Source control and monitoring safeguard the power generation and storage subsystems and ensure that the power system operates within safe limits while satisfying user demands with minimal interruptions. System monitoring functions, in coordination with hardware implemented schemes, provide for a complete fault protection system. The objective of this paper is to overview the development and integration of the state estimator and the source control algorithms.

Kimnach, Greg L.↗
NASA NTRS2022

Mars 2020 Entry, Descent, and Landing System Software Implementation

On February 18th, 2021, the Mars 2020 project's Perseverance Rover successfully touched down on the Martian surface after nearly eight years of development. The Mars 2020 Entry, Descent, and Landing (EDL) System largely leveraged heritage from the Mars Science Laboratory (MSL) EDL System while employing targeted technological advancements. The landing process is autonomously directed by a software behavior implemented in the rover's primary flight computer called the EDL Timeline that assumes control of the vehicle six days before atmospheric entry. This paper first walks through the basics of the EDL Timeline mechanics and how the behavior is designed to account for internal system variations and environmental unknowns. It then summarizes the interactions between the EDL timeline and other high-level system behaviors like spacecraft mode transitions and system fault protection, focusing on the complications that arise when passing spacecraft control between executive functions. Although the MSL-inherited EDL System is reliable and capable, targeted updates and a thorough verification and validation program were required for Mars 2020. This paper discusses changes made to close vulnerabilities discovered during both MSL and Mars 2020 development cycles, landing system capability enhancements that were enabling for Mars 2020's mission, and how these updates were integrated with the heritage system. It then describes how both analysis and testing campaigns were utilized to verify and validate all aspects of EDL and system behaviors that run during the six days before landing, as well as the operational workarounds that were needed to address problems found during the development and commissioning process. Finally, this paper imparts lessons learned from Mars 2020 EDL development, implementation, and operations, emphasizing how systems designed to conduct time-critical mission events with low margin of error can be improved in the future.

Stehura, Aaron↗
NASA NTRS2022

Mars 2020 Entry, Descent, and Landing Software Implementation

On February 18th, 2021, the Mars 2020 project's Perseverance Rover successfully touched down on the Martian surface after nearly eight years of development. The Mars 2020 Entry, Descent, and Landing (EDL) System largely leveraged heritage from the Mars Science Laboratory (MSL) EDL System while employing targeted technological advancements. The landing process is autonomously directed by a software behavior implemented in the rover's primary flight computer called the EDL Timeline that assumes control of the vehicle six days before atmospheric entry. In addition to performing the critical function of landing the rover on the Martian surface, the EDL timeline behavior must co-exist in a non-partitioned software and system environment with other high-level functions that accomplish the goals for the rest of the mission. Due to the criticality of EDL, the potential for loss of mission, and a need for complete system autonomy, the standard for how the EDL Timeline interacts with other functions in the system is highly constrained. This paper first walks through the basics of the EDL Timeline mechanics and how the behavior is designed to account for internal system variations and environmental unknowns. It then summarizes the interactions between the EDL timeline and other high-level system behaviors like spacecraft mode transitions and system fault protection, focusing on the complications that arise when passing spacecraft control between executive functions. Although the MSL-inherited EDL System is reliable and capable, targeted updates and a thorough verification and validation program were required for Mars 2020. This paper discusses changes made to close vulnerabilities discovered during both MSL and Mars 2020 development cycles, landing system capability enhancements that were enabling for Mars 2020's mission, and how these updates were integrated with the heritage system. It then describes how both analysis and testing campaigns were utilized to verify and validate all aspects of EDL and system behaviors that run during the six days before landing, as well as the operational workarounds that were needed to address problems found during the development and commissioning process. Finally, this paper imparts lessons learned from Mars 2020 EDL development, implementation, and operations, emphasizing how systems designed to conduct time-critical mission events with low margin of error can be improved in the future.

Stehura, Aaron↗
NASA NTRS1983

Photovoltaic system grounding and fault protection

The grounding and fault protection aspects of large photovoltaic power systems are studied. Broadly, the overlapping functions of these two plant subsystems include providing for the safety of personnel and equipment. Grounding subsystem design is generaly governed by considerations of personnel safety and the limiting of hazardous voltages to which they are exposed during the occurrence of a fault or other misoperation of equipment. A ground system is designed to provide a safe path for fault currents. Metal portions of the modules, array structures, and array foundations are used as a part of the ground system, provided that they and their interconnection are designed to be suitably reliable over the life of the plant. Several alternative types of fault protection and detection equipment are designed into the source circuits and dc buses feeding the input terminals of the subfield power conditioner. This design process requires evaluation of plausible faults, equipment, and remedial actions planned to correct faults. The evaluation should also consider life cycle cost impacts.

Stolte, W. J.↗
NASA NTRS1990

System control of an autonomous planetary mobile spacecraft

The goal is to suggest the scheduling and control functions necessary for accomplishing mission objectives of a fairly autonomous interplanetary mobile spacecraft, while maximizing reliability. Goals are to provide an extensible, reliable system conservative in its use of on-board resources, while getting full value from subsystem autonomy, and avoiding the lure of ground micromanagement. A functional layout consisting of four basic elements is proposed: GROUND and SYSTEM EXECUTIVE system functions and RESOURCE CONTROL and ACTIVITY MANAGER subsystem functions. The system executive includes six subfunctions: SYSTEM MANAGER, SYSTEM FAULT PROTECTION, PLANNER, SCHEDULE ADAPTER, EVENT MONITOR and RESOURCE MONITOR. The full configuration is needed for autonomous operation on Moon or Mars, whereas a reduced version without the planning, schedule adaption and event monitoring functions could be appropriate for lower-autonomy use on the Moon. An implementation concept is suggested which is conservative in use of system resources and consists of modules combined with a network communications fabric. A language concept termed a scheduling calculus for rapidly performing essential on-board schedule adaption functions is introduced.

Dias, William C.↗
NASA NTRS1985

Orbit-on-demand vehicles - Mission possible, but one-day turnaround?

The next generation launch-on-demand manned orbital vehicles will ideally be able to perform plane change maneuvers for rendezvous. Plane-changes of, e.g., 11 deg, will require a 3000 fps on-orbit maneuver velocity. Any plane-change capabilities beyond 800 fps rapidly increase the necessary vehicle weight. Sensitivity studies of the payload weight/vehicle weight, the presence or absence of air-breathing engines, high acceleration, etc., indicated that advances are required in the payload stowage pallet, thermal protection system, fault detection electronics, line-replaceable units, and accessibility to realize one-day turnaround. The spacecraft would also need autonomous systems checks and launch from minimum support sites reached by air ferry. A horizontal take-off, two-stage subsonic launch vehicle so far offers the lowest weight, maximum flexibility and minimum support combination of all configurations under consideration.

Talay, T. A.↗
NASA NTRS1993

Galileo spacecraft anomaly and safing recovery

A high-level anomaly recovery plan which identifies the steps necessary to recover from a spacecraft 'Safing' incident was developed for the Galileo spacecraft prior to launch. Since launch, a total of four in-flight anomalies have lead to entry into a system fault protection 'Safing' routine which has required the Galileo flight team to refine and execute the recovery plan. These failures have allowed the flight team to develop an efficient recovery process when permanent spacecraft capability degradation is minimal and the cause of the anomaly is quickly diagnosed. With this previous recovery experience and the very focused boundary conditions of a specific potential failure, a Gaspra asteroid recovery plan was designed to be implemented in as quickly as forty hours (desired goal). This paper documents the work performed above, however, the Galileo project remains challenged to develop a generic detailed recovery plan which can be implemented in a relatively short time to configure the spacecraft to a nominal state prior to future high priority mission objectives.

Basilio, Ralph R.↗
NASA NTRS1996

Experiences Using Formal Methods for Requirements Modeling

This paper describes three cases studies in the lightweight application of formal methods to requirements modeling for spacecraft fault protection systems. The case studies differ from previously reported applications of formal methods in that formal methods were applied very early in the requirements engineering process, to validate the evolving requirements. The results were fed back into the projects, to improve the informal specifications. For each case study, we describe what methods were applied, how they were applied, how much effort was involved, and what the findings were. In all three cases, the formal modeling provided a cost effective enhancement of the existing verification and validation processes. We conclude that the benefits gained from early modeling of unstable requirements more than outweigh the effort needed to maintain multiple representations.

Easterbrook, Steve↗
NASA NTRS1997

Experiences Using Lightweight Formal Methods for Requirements Modeling

This paper describes three case studies in the lightweight application of formal methods to requirements modeling for spacecraft fault protection systems. The case studies differ from previously reported applications of formal methods in that formal methods were applied very early in the requirements engineering process, to validate the evolving requirements. The results were fed back into the projects, to improve the informal specifications. For each case study, we describe what methods were applied, how they were applied, how much effort was involved, and what the findings were. In all three cases, formal methods enhanced the existing verification and validation processes, by testing key properties of the evolving requirements, and helping to identify weaknesses. We conclude that the benefits gained from early modeling of unstable requirements more than outweigh the effort needed to maintain multiple representations.

Easterbrook, Steve↗
NASA NTRS2003

Experiments with Test Case Generation and Runtime Analysis

Software testing is typically an ad hoc process where human testers manually write many test inputs and expected test results, perhaps automating their execution in a regression suite. This process is cumbersome and costly. This paper reports preliminary results on an approach to further automate this process. The approach consists of combining automated test case generation based on systematically exploring the program's input domain, with runtime analysis, where execution traces are monitored and verified against temporal logic specifications, or analyzed using advanced algorithms for detecting concurrency errors such as data races and deadlocks. The approach suggests to generate specifications dynamically per input instance rather than statically once-and-for-all. The paper describes experiments with variants of this approach in the context of two examples, a planetary rover controller and a space craft fault protection system.

Artho, Cyrille↗
NASA NTRS2012

Tools Ensure Reliability of Critical Software

In November 2006, after attempting to make a routine maneuver, NASA's Mars Global Surveyor (MGS) reported unexpected errors. The onboard software switched to backup resources, and a 2-day lapse in communication took place between the spacecraft and Earth. When a signal was finally received, it indicated that MGS had entered safe mode, a state of restricted activity in which the computer awaits instructions from Earth. After more than 9 years of successful operation gathering data and snapping pictures of Mars to characterize the planet's land and weather communication between MGS and Earth suddenly stopped. Months later, a report from NASA's internal review board found the spacecraft's battery failed due to an unfortunate sequence of events. Updates to the spacecraft's software, which had taken place months earlier, were written to the wrong memory address in the spacecraft's computer. In short, the mission ended because of a software defect. Over the last decade, spacecraft have become increasingly reliant on software to carry out mission operations. In fact, the next mission to Mars, the Mars Science Laboratory, will rely on more software than all earlier missions to Mars combined. According to Gerard Holzmann, manager at the Laboratory for Reliable Software (LaRS) at NASA's Jet Propulsion Laboratory (JPL), even the fault protection systems on a spacecraft are mostly software-based. For reasons like these, well-functioning software is critical for NASA. In the same year as the failure of MGS, Holzmann presented a new approach to critical software development to help reduce risk and provide consistency. He proposed The Power of 10: Rules for Developing Safety-Critical Code, which is a small set of rules that can easily be remembered, clearly relate to risk, and allow compliance to be verified. The reaction at JPL was positive, and developers in the private sector embraced Holzmann's ideas.

Source record↗
NASA NTRS1987

Incipient fault detection and power system protection for spaceborne systems

A program was initiated to study the feasibility of using advanced terrestrial power system protection techniques for spacecraft power systems. It was designed to enhance and automate spacecraft power distribution systems in the areas of safety, reliability and maintenance. The proposed power management/distribution system is described as well as security assessment and control, incipient and low current fault detection, and the proposed spaceborne protection system. It is noted that the intelligent remote power controller permits the implementation of digital relaying algorithms with both adaptive and programmable characteristics.

Russell, B. Don↗
DOE OSTI2026

Post-Event Fault Identification with Machine Learning for Protection System Validation

Power system protection devices have transitioned over the past few decades from mechanical to analog devices, then to solid state and finally digital. Relays and their associated critical network of equipment have significantly increased in complexity. Even internally, relays have gained significant intricacy, with relatively simple overcurrent or differential functions now being assisted by a myriad of other functions. This is necessary as the grid becomes more complex, but it brings increased difficulty in monitoring and upkeep. Misoperation caused by accidental improper relay settings or deliberate malicious actions is a constant challenge faced by all utilities. These improper settings can be difficult to identify and may require exhaustive post-mortem analysis, typically after a major outage event has already occurred. A mechanism is needed for monitoring the behavior of protection systems to validate that their performance falls within expectations. Relays that fail to isolate a fault or trip when there is no system disturbance can be flagged for settings review in situations where this behavior may not have been noticed due to manual restoration or backup protection operations. This work presents a concept for a machine learning (ML) system capable of validating the performance of protection systems by identifying fault events and characterizing protection system responses based solely on available current and voltage measurements. As a first step in its development, an experimental dataset is generated, and a random forest model is implemented with high accuracy in distinguishing four power system scenarios.

24 - POWER TRANSMISSION AND DISTRIBUTION↗
NASA NTRS1983

DC wiring system grounding and ground fault protection issues for central station photovoltaic power plants

The DC wiring system for a photovoltaic power plant presents a number of unique challenges to be overcome by the plant designers. There are a number of different configurations that the grounding of the DC wiring system can take, and the choice will affect the number and type of protective devices required to ensure safety of personnel and protection of equipment. The major grounding and fault protection considerations that must be taken into account when selecting the basic overall circuit configuration are summarized. The inherent advantages and disadvantages of each type of circuit grounding (resistance or solid) along with the personnel safety and equipment protection issues for each of these grounding methods are presented.

Simburger, E. J.↗
NASA NTRS1984

Space Station automated systems testing/verification and the Galileo Orbiter fault protection design/verification

Aspects of Space Station automated systems testing and verification are discussed, taking into account several program requirements. It is found that these requirements lead to a number of issues of uncertainties which require study and resolution during the Space Station definition phase. Most, if not all, of the considered uncertainties have implications for the overall testing and verification strategy adopted by the Space Station Program. A description is given of the Galileo Orbiter fault protection design/verification approach. Attention is given to a mission description, an Orbiter description, the design approach and process, the fault protection design verification approach/process, and problems of 'stress' testing.

Landano, M. R.↗
NASA NTRS2019

A Multiple Model Based Approach for Deep Space Power System Fault Diagnosis

Improving protection and health management capabilities onboard the electrical power system (EPS) for spacecraft is essential for ensuring safe and reliable conditions for deep space human exploration. Electrical protection and control technologies on the National Aeronautics and Space Administration's (NASA's) current human space platform relies heavily on ground support to monitor and diagnose power systems and failures. As communication bandwidth diminishes for deep space applications, a transformation in system monitoring and control becomes necessary to maintain high reliability of electric power service. This paper presents a novel approach for on-line power system security monitoring for autonomous deep space spacecraft.

Autonomous Power Controller↗
NASA NTRS1987

Fault protection design for unmanned interplanetary spacecraft

The difficulties encountered in designing a redundancy management system are discussed and strategies for minimizing the cost and schedule impacts associated with fault protection are provided. Specific examples from the Magellan project are used with emphasis placed on control system fault protection. The major problem areas are the following: (1) the interaction between two semiindependent fault protection systems, (2) the response to faults which are detected by monitoring variables with long time constants, and (3) the design of the 'action scheduler'.

Johnson, Stephen B.↗