SEARCH · Engineering Papers
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
This document provides guidelines for the accomplishment of Failure Mode, Effects, and Criticality Analysis (FMECA) on the Apollo program. It is a procedure for analysis of hardware items to determine those items contributing most to system unreliability and crew safety problems.
An engineering model and a qualification model of the EDIM were constructed and tested to Scout flight qualification criteria. The qualification model incorporated design improvements resulting from the engineering model tests. Compatibility with single bridgewire Apollo standard initiator (SBASI) was proven by test firing forty-five (45) SBASI's with worst case voltage and temperature conditions. The EDIM was successfully qualified for Scout flight application with no failures during testing of the qualification unit. Included is a method of implementing the EDIM into Scout vehicle hardware and the ground support equipment necessary to check out the system.
The paper compares computer architectures for the NASA demonstration advanced avionics system. Two computer architectures are described with an unusual approach to fault tolerance: a single spare processor can correct for faults in any of the distributed processors by taking on the role of a failed module. It was shown the system must be used from a functional point of view to properly apply redundancy and achieve fault tolerance and ultra reliability. Data are presented on complexity and mission failure probability which show that the revised version offers equivalent mission reliability at lower cost as measured by hardware and software complexity.
This chapter provides data and analysis of the dependability and fault tolerance for three operating systems: the Tandem/GUARDIAN fault-tolerant system, the VAX/VMS distributed system, and the IBM/MVS system. Based on measurements from these systems, basic software error characteristics are investigated. Fault tolerance in operating systems resulting from the use of process pairs and recovery routines is evaluated. Two levels of models are developed to analyze error and recovery processes inside an operating system and interactions among multiple instances of an operating system running in a distributed environment. The measurements show that the use of process pairs in Tandem systems, which was originally intended for tolerating hardware faults, allows the system to tolerate about 70% of defects in system software that result in processor failures. The loose coupling between processors which results in the backup execution (the processor state and the sequence of events occurring) being different from the original execution is a major reason for the measured software fault tolerance. The IBM/MVS system fault tolerance almost doubles when recovery routines are provided, in comparison to the case in which no recovery routines are available. However, even when recovery routines are provided, there is almost a 50% chance of system failure when critical system jobs are involved.
This CD-ROM contains a two-part case study of the Apollo 13 accident. The first lesson contains an overview of the electrical system hardware on the Apollo spacecraft, providing a context for the details of the oxygen tank explosion, and the failure chain reconstruction that led to the conditions present at the time of the accident. Given this background, the lesson then covers the tank explosion and immediate damage to the spacecraft, and the immediate response of Mission Control to what they saw. Part 2 of the lesson picks up shortly after the explosion of the oxygen tank on Apollo 13, and discusses how Mission Control gained insight to and understanding of the damage in the aftermath. Impacts to various spacecraft systems are presented, along with Mission Control's reactions and plans for in-flight recovery leading to a successful entry. Finally, post-flight vehicle changes are presented along with the lessons learned.
The Orion Crew Module (CM) is NASA's next generation manned space vehicle, scheduled to return humans to lunar orbit in the coming decade. The Orion avionics and GN&C architectures have progressed through a number of project phases and are nearing completion of a major milestone. The first unmanned test mission, dubbed "Exploration Flight Test One" (EFT-1) is scheduled to launch from NASA Kennedy Space Center late next year and provides the first integrated test of all the vehicle systems, avionics and software. The EFT-1 mission will be an unmanned test flight that includes a high speed re-entry from an elliptical orbit, which will be launched on an expendable launch vehicle (ELV). The ELV will place CM and the ELV upper stage into a low Earth orbit (LEO) for one revolution. After the first LEO, the ELV upper stage will re-ignite and place the combined upper stage/CM into an elliptical orbit whose perigee results in a high energy entry to test CM response in a relatively high velocity, high heating environment. While not producing entry velocities as high as those experienced in returning from a lunar orbit, the trajectory was chosen to provide higher stresses on the thermal protection and guided entry systems, as compared against a lower energy LEO entry. However the required entry geometry with constraints on inclination and landing site result in a trajectory that lingers for many hours in the Van Allen radiation belts. This exposes the vehicle and avionics to much higher levels of high energy proton radiation than a typical LEO or lunar trajectory would encounter. As a result, Van Allen radiation poses a significant risk to the Orion avionics system, and particularly the Flight Control Module (FCM) computers that house the GN&C flight software. The measures taken by the Orion GN&C, Flight Software and Avionics teams to mitigate the risks associated with the Van Allen radiation on EFT-1 are covered in the paper. Background on the Orion avionics subsystem is provided, as well as an overview of the GN&C software architecture. The measures taken to handle radiation induced failure of the one or both of the FCM's are presented, and finally simulation and actual hardware-in-the-loop (HWIL) results are shown confirming the validity of the implementation. The paper presents an overview of the Orion avionics architecture describing the GNC sensors, onboard data network as well as the flight control computers and their planned restart capabilities. GN&C sensors include two Orion Inertial Measurement Units (OIMU's), a Vision Processing Unit (VPU) to process camera images, three barometric altimeters and a single GPS receiver. All of the sensors communicate to one of two Power and Data Units (PDU's). The PDU's multiplex analog and serial data from the sensors and write the data to the Orion Data Network (ODN). The OIMU s write measurement messages directly as onto the ODN, but they are routed through PDU network switches.
The systems engineering process is well established and well understood. While this statement could be argued in the light of the many systems engineering guidelines and that have been developed, comparative review of these respective descriptions reveal that they differ primarily in the number of discrete steps or other nuances, and are at their core essentially common. Likewise, the systems engineering textbooks differ primarily in the context for application of systems engineering or in the utilization of evolved tools and techniques, not in the basic method. Thus, failures in systems engineering cannot credibly be attributed to implementation of the wrong systems engineering process among alternatives. However, numerous systems failures can be attributed to deficient implementation of the systems engineering process. What may clearly be perceived as a system engineering deficiency in retrospect can appear to be a well considered system engineering efficiency in real time - an efficiency taken to reduce cost or meet a schedule, or more often both. Typically these efficiencies are grounded on apparently solid rationale, such as reuse of heritage hardware or software. Over time, unintended consequences of a systems engineering process deficiency may begin to be realized, and unfortunately often the consequence is system failure. This paper describes several actual cases of system failures that resulted from deficiencies in their systems engineering process implementation, including the Ariane 5 and the Hubble Space Telescope.
The LOX-Hydrogen J-2X Rocket Engine, which is proposed for use as an upper-stage engine for numerous earth-to-orbit and heavy lift launch vehicle architectures, is presently in the design phase and will move shortly to the initial development test phase. Analysis of the design has revealed numerous potential resonance issues with hardware in the turbomachinery turbine-side flow-path. The analysis of the fuel pump turbine blades requires particular care because resonant failure of the blades, which are rotating in excess of 30,000 revolutions/minutes (RPM), could be catastrophic for the engine and the entire launch vehicle. This paper describes a series of probabilistic analyses performed to assess the risk of failure of the turbine blades due to resonant vibration during past and present test series. Some significant results are that the probability of failure during a single complete engine hot-fire test is low (~1%) because of the small likelihood of resonance, but that the probability increases to around 30% for a more focused turbomachinery-only test because all speeds will be ramped through and there is a greater likelihood of dwelling at more speeds. These risk calculations have been invaluable for use by program management in deciding if risk-reduction methods such as dampers are necessary immediately or if the test can be performed before the risk-reduction hardware is ready.
The first production DRIRU 2 (NASA standard high performance inertial reference unit) system was launched as a subsystem of the Modular Attitude Control System for the Solar Maximum Mission (SMM) spacecraft in February 1980. This hardware was retrieved during the repair of the SMM during Shuttle Flight 41-C in April 1984 and returned to Teledyne Systems Company (manufacturer) for investigation and performance measurements as directed by Goddard Space Flight Center. A failure of one of the three gyro channels occurred approximately 6.5 months after launch. The built in redundancy functioned properly, the DRIRU 2 continued to provide the required attitude control function without performance degradation. Subsequent failure of other attitude control subsystems made the SMM a candidate for the first demonstration of the shuttle in-orbit repair capabilty. The in-orbit DRIRU 2 II failure scenario and the results of the analyses/tests conducted after retrieval are discussed. Comparison of this data with similar data prior to launch demonstates the excellent stability of performance parameters achieveable with DRIRU 2.
Described here is the Army Fault Tolerant Architecture (AFTA) hardware architecture and components and the operating system. The architectural and operational theory of the AFTA Fault Tolerant Data Bus is discussed. The test and maintenance strategy developed for use in fielded AFTA installations is presented. An approach to be used in reducing the probability of AFTA failure due to common mode faults is described. Analytical models for AFTA performance, reliability, availability, life cycle cost, weight, power, and volume are developed. An approach is presented for using VHSIC Hardware Description Language (VHDL) to describe and design AFTA's developmental hardware. A plan is described for verifying and validating key AFTA concepts during the Dem/Val phase. Analytical models and partial mission requirements are used to generate AFTA configurations for the TF/TA/NOE and Ground Vehicle missions.
Aerospace electrical systems are required to withstand and adequately operate in extremely harsh environments that include, for example, high radiation exposure, temperature extremes, intense vibrational stress and drastic temperature cycling. The nature of aerospace electronics also demands high reliability since, with very few exceptions, there is no chance for hardware servicing or repairs. Common risk mitigation techniques for this type of situation are to perform a Reliability Analysis of the system throughout the development cycle, and to use electrical components that are regarded as “high reliability” because of additional controls and requirements applied in their design, manufacturing and testing. Unfortunately, studies have shown that even though these techniques are used, many systems fail to meet mission requirements well before the predicted lifetimes. This paper presents the analysis of failures of electrical parts, experienced during various stages of system development, at NASA Goddard Space Flight Center, Greenbelt MD, between the years 2001 and 2013. These components were subjected to qualification, screening and testing in which the goal was to ensure that the components would survive the stresses of the mission. The analysis categorizes failures by part type and failure mechanisms. One of the results of the analysis was the realization that a surprising proportion of failures experienced during system integration and testing were caused by human error (i.e. human induced defect). Further analysis included the determination of root failure mechanisms and any influencing factors contributing to these failures. The major causes of these defects were attributed to electrostatic damage (ESD), electrical overstress (EOS), mechanical overstress (MOS), and thermal overstress (TOS). Finally, the study proposes a risk analysis tool which incorporates these major causes for the failures, termed error-producing conditions (EPCs), and a proportionality factor representing the number of each type of failure that has occurred at the facility under study. These factors are quantified and used to communicate the risk of human induced defects for the assembly, integration and testing of space hardware based on the system’s electrical parts list. The new risk identification can trigger risk-mitigating actions more effectively, based on the presence of component categories or other hazardous conditions that have a history of failure due to human error.
This document outlines the structural verification approach for the Space Shuttle External Tank Forward Bipod Foam Closeout. Due to the Space Shuttle Columbia accident, debris has become a major concern. The intent of the structural verification is to ensure that any debris shed from the bipod is within acceptable limits. Since cohesive failure due to internal defects was identified as the most likely cause of the STS-107 bipod ramp foam failure, verification for this failure mode receives particular emphasis. However, all failure modes for TPS are considered and appropriate verification rationale is developed for each failure mode. Figure 1 depicts the structural verification of a production design where analysis and test are the primary methods of verification. It can be seen that the successful completion of structural verification is dependent on three main areas: 1. Production process control and quality assurance must ensure that test articles and/or analytical models are representative of (or conservatively envelope) production hardware in terms of geometry, materials and processing. Variability and defects must be considered. 2. Flight environments must be sufficiently characterized to bound driving environments for all failure modes. Applied environments, either test or analytical, must be representative of flight environments and have a load factor that satisfies design requirements. 3. Structural verification must include all failure modes. A comprehensive list of failure modes and the underlying failure mechanisms has been generated based on flight and test experience. Verification tests and / or analyses must address each failure mode. ET TPS Verification is accomplished by a combination of analysis, test, and similarity.
Two basic factors influence the design of highly reliable computer systems: the amount of failures required to be tol erated and the reliability or MTBF required. A computer system designed to tolerate any three single failures in a fail-operational-fail-operational-fail-safe manner for a real-time control application is presented. The design approach uses adaptive majority voting in both hardware and software with a four-level redundant system. Various methods of performing the adaptive majority voting functions were evaluated with the selected approach using a special module termed a voter-comparator switch (VCS). The VCS module allows the computer system to be operated in a variety of redundant modes, depending on the failure tolerance required at any particular time.
An experimental program was performed in which the individual performance of multiple VTOL model lift fans was measured. The model tested consisted of three 5.5 in. diameter tip-turbine driven model VTOL lift fans mounted chordwise in a two-dimensional wing to simulate a pod-type array. The performance data provided significant insight into possible thrust variations and losses caused by the presence of cover doors, adjacent fuselage panels, and adjacent fans. The effect of a partial loss of drive air supply (simulated gas generator failure) on fan performance was also investigated. The results of the tests demonstrated that lift fan installation variables and hardware can have a significant effect on the thrust of the individual fans.
On or about November 10, 1988 an open circuit solder joint was discovered in the Magellan Radar digital unit (DFU) during integration testing at Kennedy Space Center (KSC). A detailed analysis of the cause of the failure was conducted at the Jet Propulsion Laboratory leading to the successful repair of many pieces of affected electronic hardware on both the Magellan and Galileo spacecraft. The problem was caused by the presence of high thermal coefficient of expansion heat sink and conformal coating materials located in the large (0.055 inch) gap between Dual Inline Packages (DIPS) and the printed wiring board. The details of the observed problems are described and recommendations are made for improved design and testing activities in the future.
These Guidelines integrate state-of-the-art Elastic-Plastic Fracture Mechanics (EPFM) and proof test implementation issues into a comprehensive proof test analysis procedure in the form of a Road Map which identifies the types of data, fracture mechanics based parameters, and calculations needed to perform flaw screening and minimum proof load analyses of fracture critical components. Worked examples are presented to illustrate the application of the Road Map to proof test analysis. The state-of-the-art fracture technology employed in these Guidelines is based on the EPFM parameter, J, and a pictorial representation of a J fracture analysis, called the Failure Assessment Diagram (FAD) approach. The recommended fracture technology is validated using finite element J results, and laboratory and hardware fracture test results on the nickel-based superalloy IN-718, the aluminum alloy 2024-T351 1, and ferritic pressure vessel steels. In all cases the laboratory specimens and hardware failed by ductile mechanisms. Advanced proof test analyses involving probability analysis and Multiple Cycle Proof Testing (MCPT) are addressed. Finally, recommendations are provided on to how to account for the effects of the proof test overload on subsequent service fatigue and fracture behaviors.
This report describes work developing fault tolerant redundant robotic architectures and adaptive control strategies for robotic manipulator systems which can dynamically accommodate drastic robot manipulator mechanism, sensor or control failures and maintain stable end-point trajectory control with minimum disturbance. Kinematic designs of redundant, modular, reconfigurable arms for fault tolerance were pursued at a fundamental level. The approach developed robotic testbeds to evaluate disturbance responses of fault tolerant concepts in robotic mechanisms and controllers. The development was implemented in various fault tolerant mechanism testbeds including duality in the joint servo motor modules, parallel and serial structural architectures, and dual arms. All have real-time adaptive controller technologies to react to mechanism or controller disturbances (failures) to perform real-time reconfiguration to continue the task operations. The developments fall into three main areas: hardware, software, and theoretical.
These guidelines integrate state-of-the-art elastic-plastic fracture mechanics (EPFM) and proof test implementation issues into a comprehensive proof test analysis procedure in the form of a road map which identifies the types of data, fracture mechanics based parameters, and calculations needed to perform flaw screening and minimum proof load analyses of fracture critical components. Worked examples are presented to illustrate the application of the road map to proof test analysis. The state-of-the art fracture technology employed in these guidelines is based on the EPFM parameter, J, and a pictorial representation of a J fracture analysis, called the failure assessment diagram (FAD) approach. The recommended fracture technology is validated using finite element J results, and laboratory and hardware fracture test results on the nickel-based superalloy Inconel 718, the aluminum alloy 2024-T3511, and ferritic pressure vessel steels. In all cases the laboratory specimens and hardware failed by ductile mechanisms. Advanced proof test analyses involving probability analysis and multiple-cycle proof testing (MCPT) are addressed. Finally, recommendations are provided on how to account for the effects of the proof test overload on subsequent service fatigue and fracture behaviors.