New Developments in Field Programmable Gate Array (FPGA) Single Event Upsets (SEUs) and Fail-Safe Strategies
No abstract available
Berg, Melanie↗
SEARCH · Engineering Papers
Results for “Failing Safely”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Investigation of Structural Factors of Safety for the Space Shuttle
A study was made of the factors governing the structural design of the fully reusable space shuttle booster to establish a rational approach to select optimum structural factors of safety. The study included trade studies of structural factors of safety versus booster service life, weight, cost, and reliability. Similar trade studies can be made on other vehicles using the procedures developed. The major structural components of a selected baseline booster were studied in depth, each being examined to determine the fatigue life, safe-life, and fail-safe capabilities of the baseline design. Each component was further examined to determine its reliability and safety requirements, and the change of structural weight with factors of safety. The apparent factors of safety resulting from fatigue, safe-life, proof test, and fail-safe requirements were identified. The feasibility of reduced factors of safety for design loads such as engine thrust, which are well defined, was examined.
Source record↗
Compendium of fracture mechanics problems
Fracture mechanics analysis results are presented from the following structures/components analyzed at Marshall Space Flight Center (MSFC) between 1982 and 1989: space shuttle main engine (SSME), Hubble Space Telescope (HST), external tank attach ring, B-1 stand LOX inner tank, and solid rocket booster (SRB). Results from the SSME high pressure fuel turbopump (HPFTP) second stage blade parametric analysis determine a critical flaw size for a wide variety of stress intensity values. The engine 0212 failure analysis was a time dependent fracture life assessment. Results indicated that the disk ruptured due to an overspeed condition. Results also indicated that very small flaws in the curvic coupling area could propagate and lead to failure under normal operating conditions. It was strongly recommended that a nondestructive evaluation inspection schedule be implemented. The main ring of the HST, scheduled to launch in 1990, was analyzed by safe-life and fail-safe analyses. First safe-life inspection criteria curves for the ring inner and outer skins and the fore and aft channels were derived. Afterwards the skins and channels were determined to be fail-safe by analysis. A conservative safe-life analysis was done on the 270 redesign external tank attach ring. Results from the analysis were used to determine the nondestructive evaluation technique required.
Stallworth, R.↗
Space shuttle environmental control/life support systems
This study analyzes and defines a baseline Environmental Control/Life Support System (EC/LSS) for a four-man, seven-day orbital shuttle. In addition, the impact of various mission parameters, crew size, mission length, etc. are examined for their influence on the selected system. Pacing technology items are identified to serve as a guide for application of effort to enhance the total system optimization. A fail safe-fail operation philosophy was utilized in designing the system. This has resulted in a system that requires only one daily routine operation. All other critical item malfunctions are automatically resolved by switching to redundant modes of operation. As a result of this study, it is evident that a practical, flexible, simple and long life, EC/LSS can be designed and manufactured for the shuttle orbiter within the time phase required.
Source record↗
Flight test and evaluation of Omega navigation for general aviation
A seventy hour flight test program was performed to determine the suitability and accuracy of a low cost Omega navigation receiver in a general aviation aircraft. An analysis was made of signal availability in two widely separated geographic areas. Comparison is made of the results of these flights with other navigation systems. Conclusions drawn from the test experience indicate that developmental system improvement is necessary before a competent fail safe or fail soft area navigation system is offered to general aviation.
Hwoschinsky, P. V.↗
Design Concepts to Meet EASA SC-VTOL-01 Single Failure Criteria
The objective of the current work is to discuss European Union Aviation Safety Agency (EASA) SC-VTOL-01 single failure criteria, VTOL.2250(c). Prior studies have developed concept distributed propulsion and flight control (DPFC) system architectures and found they comply with EASA SC-VTOL-01 probabilistic failure criteria, VTOL.2510(a). Prior work developed two all-electric DPFC systems utilized in a quadrotor concept aircraft developed by the National Aeronautics and Space Administration (NASA); one uses interconnecting shafts and gearboxes to interconnect redundant motors with each rotor system and the other uses gearboxes to connect redundant motors locally, near each rotor. Common between the two electric DPFC systems were rotor shafts, epicyclic systems, and motors. The current work explores Category I failures in drive systems, relevant research to support fail-safe design practices for gear systems, research and adjacent industry trends in motor fail-safety and reliability, and proposed design concepts to comply with VTOL.2250(c). Continued research in fail-safe design concepts and design guidance will benefit eVTOL and conventional rotorcraft, alike. Continued research in these areas will benefit eVTOL certification against SC-VTOL-01, and could optimistically translate to more widespread adoption of similar fail-safe design concepts into new rotorcraft designs certified against CS-29.
Rotorcraft↗
HOME - An application of fault-tolerant techniques and system self-testing
Hard Over Monitoring Equipment (HOME) has been designed to complement and enhance the flight safety of a flight research helicopter. HOME is an independent, highly reliable, and fail-safe special purpose computer that monitors the flight control commands issued by the flight control computer of the helicopter. In particular, HOME detects the issuance of a hazardous hard-over command for any of the four flight control axes and transfers the control of the helicopter to the flight safety pilot. The design of HOME incorporates certain reliability and fail-safe enhancement design features, such as triple modular redundancy, majority logic voting, fail-safe dual circuits, independent status monitors, in-flight self-test, and a built-in preflight exerciser. The HOME design and operation is described with special emphasis on the reliability and fail-safe aspects of the design.
Holden, D. G.↗
A Statistical Simulation Approach to Safe Life Fatigue Analysis of Redundant Metallic Components
This paper introduces a dual active load path fail-safe fatigue design concept analyzed by Monte Carlo simulation. The concept utilizes the inherent fatigue life differences between selected pairs of components for an active dual path system, enhanced by a stress level bias in one component. The design is applied to a baseline design; a safe life fatigue problem studied in an American Helicopter Society (AHS) round robin. The dual active path design is compared with a two-element standby fail-safe system and the baseline design for life at specified reliability levels and weight. The sensitivity of life estimates for both the baseline and fail-safe designs was examined by considering normal and Weibull distribution laws and coefficient of variation levels. Results showed that the biased dual path system lifetimes, for both the first element failure and residual life, were much greater than for standby systems. The sensitivity of the residual life-weight relationship was not excessive at reliability levels up to R = 0.9999 and the weight penalty was small. The sensitivity of life estimates increases dramatically at higher reliability levels.
Matthews, William T.↗
Engineering Evaluation of International Low Impact Docking System Latch Hooks
The international Low Impact Docking System (iLIDS) provides a structural arrangement that allows for visiting vehicles to dock with the International Space Station (ISS) (Fig 1). The iLIDS docking units are mechanically joined together by a series of active and passive latch hooks. In order to preserve docking capability at the existing Russian docking interfaces, the iLIDS latch hooks are required to conform to the existing Russian design. The latch hooks are classified as being fail-safe. Since the latch hooks are fail-safe, the hooks are not fracture critical and a fatigue based service life assessment will satisfy the structural integrity requirements. Constant amplitude fatigue testing to failure on four sets of active/passive iLIDS latch hooks was performed at load magnitudes of 10, 11, and 12 kips. Failure analysis of the hook fatigue failures identified multi-site fatigue initiation that was effectively centered about the hook mid-plane (consistent with the 3D model results). The fatigue crack initiation distribution implies that the fatigue damage accumulation effectively results in a very low aspect ratio surface crack (which can be simulated as thru-thickness crack). Fatigue damage progression resulted in numerous close proximity fatigue crack initiation sites. It was not possible to determine if fatigue crack coalescence occurs during cyclic loading or as result of the fast fracture response. The presence of multiple fatigue crack initiation sites on different planes will result in the formation of ratchet marks as the cracks coalesce. Once the stable fatigue crack becomes unstable and the fast fracture advances across the remaining ligament and the plane stress condition at a free-surface will result in failure along a 45 deg. shear plane (slant fracture) and the resulting inclined edge is called a shear lip. The hook thickness on the plane of fatigue crack initiation is 0.787". The distance between the shear lips on this plane was on the order of 0.48" and it was effectively centered about the mid-plane of the section. The numerous ratchet marks between the shear lips on the fracture initiation plane are indicative of multiple fatigue initiation sites within this region. The distribution of the fatigue damage about the centerline of the hook is consistent with the analytical results that demonstrate peak stress/strain response at the mid-plane that decreases in the direction of the hook outer surfaces. Scanning electron microscope images of the failed sections detected fatigue crack striations in close proximity to the free surface of the hook radius. These findings were documented at three locations on the fracture surface : 1) adjacent to the left shear lip, 2) adjacent to the right shear lip, and 3) near the centerline of the section. The features of the titanium fracture surface did not allow for a determination of a critical crack size via identification of the region where the fatigue crack propagation became unstable. The fracture based service life projections where benchmarked with strain-life analyses. The strainrange response in the hook radius was defined via the correlated finite element models and the modified method of universal slopes was incorporated to define the strain-life equation for the titanium alloy. The strain-life assessment confirmed that the fracture based projections were reasonable for the loading range of interest. Based upon the analysis and component level fatigue test data a preliminary service life capability for the iLIDS active and passive hooks of 2 lifetimes is projected (includes a scatter factor of 4).
Martinez, J.↗
The Alpha-Proton-X-ray Spectrometer deployment mechanism: An anthropomorphic approach to sensor placement on Martian rocks and soil
On July 4,1997, the Mars Pathfinder spacecraft lands on Mars and starts conducting technological and scientific experiments. One experiment, the Alpha-Proton-X-ray Spectrometer, uses a sensor head placed against rocks and soil to determine their composition. To guarantee proper placement, a deployment mechanism mounted on the Mars Rover aligns the sensor head to within 20 deg of the rock and soil surfaces. In carrying out its task, the mechanism mimics the action of a human hand and arm. Consisting of a flexible wrist, a parallel link arm, a brush dc motor actuator, and a revolutionary non-pyrotechnic fail-safe release device, the mechanism correctly positions the sensor head on rocks as high as 0.29 m and on targets whose surfaces are tilted as much as 45 deg from the nominal orientation of the sensor head face. The mechanism weighs less than 0.5 kg, can withstand 100 g's, and requires less than 2.8 N x m of actuation torque. The fail-safe coupler utilizes Cerrobend, a metal alloy that melts at 60 C, to fuse the actuator and the rest of the mechanism together. A film heater wrapped around the coupler melts the metal, and Negator springs drive the mechanism into its stowed position. The fail-safe actuates using 6.75 Watts for 5 minutes in the event of an actuator failure.
Blomquist, Richard S.↗
Improved Electromagnetic Brake
A proposed design for an electromagnetic brake would increase the reliability while reducing the number of parts and the weight, relative to a prior commercially available electromagnetic brake. The reductions of weight and the number of parts could also lead to a reduction of cost. A description of the commercial brake is prerequisite to a description of the proposed electromagnetic brake. The commercial brake (see upper part of figure) includes (1) a permanent magnet and an electromagnet coil on a stator and (2) a rotor that includes a steel contact plate mounted, with tension spring loading, on an aluminum hub. The stator is mounted securely on a stationary object, which would ordinarily be the housing of a gear drive or a motor. The rotor is mounted on the shaft of the gear drive or motor. The commercial brake nominally operates in a fail-safe (in the sense of normally braking) mode: In the absence of current in the electromagnet coil, the permanent magnet pulls the contact plate, against the spring tension, into contact with the stator. To release the brake, one excites the electromagnet with a current of the magnitude and polarity chosen to cancel the magnetic flux of the permanent magnet, thereby enabling the spring tension to pull the contact plate out of contact with the stator. The fail-safe operation of the commercial brake depends on careful mounting of the rotor in relation to the stator. The rotor/stator gap must be set with a tolerance between 10 and 15 mils (between about 0.25 and about 0.38 mm). If the gap or the contact pad is thicker than the maximum allowable value, then the permanent magnetic field will not be strong enough to pull the steel plate across the gap. (For this reason, any contact pad between the contact plate and the stator must also be correspondingly thin.) If the gap exceeds the maximum allowable value because of shaft end play, it becomes impossible to set the brake by turning off the electromagnet current. Although it may still be possible to set the brake by applying an electromagnet current to aid the permanent magnetic field instead of canceling it, this action can mask an out-of-tolerance condition in the brake and it does not restore the fail-safe function of setting the brake when current is lost.
Martin, Toby B.↗
Integrity in flight control systems
In connection with advances in technology, mainly in the electronic area, aircraft flight control applications have evolved from simple pilot-relief autopilots to flight-critical and redundant fly-by-wire and active control systems. For flight-critical implementations which required accommodation of inflight failures, additional levels of redundancy were incorporated to provide fail-safe and fail-operative performance. The current status of flight control systems reliability is examined and high-reliability approaches are discussed. Attention is given to the design of ring laser gyros and magnetohydrodynamic rate sensors, redundancy configurations for component failure protection, improvements of hydraulic actuators made on the component level, integrated actuators, problems of software reliability, lightning considerations, and failure detection methods for component and system failures.
Kurzhals, P. R.↗
Residual strength of thin panels with cracks
The previous design philosophies involving safe life, fail-safe and damage tolerance concepts become inadequate for assuring the safety of aging aircraft structures. For example, the failure mechanism for the Aloha Airline accident involved the coalescence of undetected small cracks at the rivet holes causing a section of the fuselage to peel open during flight. Therefore, the fuselage structure should be designed to have sufficient residual strength under worst case crack configurations and in-flight load conditions. Residual strength is interpreted as the maximum load carrying capacity prior to unstable crack growth. Internal pressure and bending moment constitute the two major components of the external loads on the fuselage section during flight. Although the stiffeners in the form of stringers, frames and tear straps sustain part of the external loads, the significant portion of the load is taken up by the skin. In the presence of a large crack in the skin, the crack lips bulge out with considerable yielding; thus, the geometric and material nonlinearities must be included in the analysis for predicting residual strength. Also, these nonlinearities do not permit the decoupling of in-plane and out-of-plane bending deformations. The failure criterion combining the concepts of absorbed specific energy and strain energy density addresses the aforementioned concerns. The critical absorbed specific energy (local toughness) for the material is determined from the global specimen response and deformation geometry based on the uniaxial tensile test data and detailed finite element modeling of the specimen response. The use of the local toughness and stress-strain response at the continuum level eliminates the size effect. With this critical parameter and stress-strain response, the finite element analysis of the component by using STAGS along with the application of this failure criterion provides the stable crack growth calculations for residual strength predictions.
Madenci, Erdogan↗
Telescope protection algorithm for the Space Infrared Telescope Facility
This paper presents a proposed on-board Telescope Protection Algorithm (TPA) for the Space Infrared Telescope Facility (SIRTF). This TPA consists of hardware and software capable of performing both fail-operational and fail-safe modes of operation. In the fail-operational mode, each ephemeris load and slew/dwell command sequence is checked on-board before use. The slew command monitor detects unallowable slew/dwell commands and transfers control to an algorithm which slews to and maintains a safe telescope orientation while preserving precise attitude determination and control. This fail-operational mode is also given the authority to autonomously restart the slew/dwell sequence at a point beyond the faulty command. The fail-safe system consists of software and hardware which detects impending earth, moon, or sun avoidance zone violations and activates a backup hardware safe hold mode. The subject TPA and relevant sensor complement were designed for the SIRTF mission; however, this system can easily be used as a basis for failure detection and correction in a wide range of other missions.
Class, B. F.↗
Shape Control of Solar Collectors Using Shape Memory Alloy Actuators
Solar collectors that are focused on a central receiver are designed with a mechanism for defocusing the collector or disabling it by turning it out of the path of the sun's rays. This is required to avoid damaging the receiver during periods of inoperability. In either of these two cases a fail-safe operation is very desirable where during power outages the collector passively goes to its defocused or deactivated state. This paper is principally concerned with focusing and defocusing the collector in a fail-safe manner using shape memory alloy actuators. Shape memory alloys are well suited to this application in that once calibrated the actuators can be operated in an on/off mode using a minimal amount of electric power. Also, in contrast to other smart materials that were investigated for this application, shape memory alloys are capable of providing enough stroke at the appropriate force levels to focus the collector. Design and analysis details presented, along with comparisons to test data taken from an actual prototype, demonstrate that the collector can be repeatedly focused and defocused within accuracies required by typical solar energy systems. In this paper the design, analysis and testing of a solar collector which is deformed into its desired shape by shape memory alloy actuators is presented. Computations indicate collector shapes much closer to spherical and with smaller focal lengths can be achieved by moving the actuators inward to a radius of approximately 6 inches. This would require actuators with considerably more stroke and some alternate SMA actuators are currently under consideration. Whatever SMA actuator is finally chosen for this application, repeatability and fatigue tests will be required to investigate the long term performance of the actuator.
Lobitz, D. W.↗
Magnetostrictive Brake
A magnetostrictive brake has been designed as a more energy-efficient alternative to a magnetic fail-safe brake in a robot. (In the specific application, failsafe signifies that the brake is normally engaged; that is, power must be supplied to allow free rotation.) The magnetic failsafe brake must be supplied with about 8 W of electric power to initiate and maintain disengagement. In contrast, the magnetostrictive brake, which would have about the same dimensions and the same torque rating as those of the magnetic fail-safe brake, would demand only about 2 W of power for disengagement. The brake (see figure) would include a stationary base plate and a hub mounted on the base plate. Two solenoid assemblies would be mounted in diametrically opposed recesses in the hub. The cores of the solenoids would be made of the magnetostrictive alloy Terfenol-D or equivalent. The rotating part of the brake would be a ring-and spring- disk subassembly. By means of leaf springs not shown in the figure, this subassembly would be coupled with the shaft that the brake is meant to restrain. With no power supplied to the solenoids, a permanent magnet would pull axially on a stepped disk and on a shelf in the hub, causing the ring to be squeezed axially between the stepped disk and the hub. The friction associated with this axial squeeze would effect the braking action. Supplying electric power to the solenoids would cause the magnetostrictive cylinders to push radially inward against a set of wedges that would be in axial contact with the stepped disk. The wedges would convert the radial magnetostrictive strain to a multiplied axial displacement of the stepped disk. This axial displacement would be just large enough to lift the stepped disk, against the permanent magnetic force, out of contact with the ring. The ring would then be free to turn because it would no longer be squeezed axially between the stepped disk and the hub.
Diftler, Myron A.↗
Adaptive voting computer system
A computer system is reported that uses adaptive voting to tolerate failures and operates in a fail-operational, fail-safe manner. Each of four computers is individually connected to one of four external input/output (I/O) busses which interface with external subsystems. Each computer is connected to receive input data and commands from the other three computers and to furnish output data commands to the other three computers. An adaptive control apparatus including a voter-comparator-switch (VCS) is provided for each computer to receive signals from each of the computers and permits adaptive voting among the computers to permit the fail-operational, fail-safe operation.
Koczela, L. J.↗
Braking System for Wind Turbines
Operating turbine stopped smoothly by fail-safe mechanism. Windturbine braking systems improved by system consisting of two large steel-alloy disks mounted on high-speed shaft of gear box, and brakepad assembly mounted on bracket fastened to top of gear box. Lever arms (with brake pads) actuated by spring-powered, pneumatic cylinders connected to these arms. Springs give specific spring-loading constant and exert predetermined load onto brake pads through lever arms. Pneumatic cylinders actuated positively to compress springs and disengage brake pads from disks. During power failure, brakes automatically lock onto disks, producing highly reliable, fail-safe stops. System doubles as stopping brake and "parking" brake.
Krysiak, J. E.↗