Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Failing Safely”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 73 records · Page 4
All sourcesNASA NTRSDOE OSTI
NASA NTRS1997

A Statistical Simulation Approach to Safe Life Fatigue Analysis of Redundant Metallic Components

This paper introduces a dual active load path fail-safe fatigue design concept analyzed by Monte Carlo simulation. The concept utilizes the inherent fatigue life differences between selected pairs of components for an active dual path system, enhanced by a stress level bias in one component. The design is applied to a baseline design; a safe life fatigue problem studied in an American Helicopter Society (AHS) round robin. The dual active path design is compared with a two-element standby fail-safe system and the baseline design for life at specified reliability levels and weight. The sensitivity of life estimates for both the baseline and fail-safe designs was examined by considering normal and Weibull distribution laws and coefficient of variation levels. Results showed that the biased dual path system lifetimes, for both the first element failure and residual life, were much greater than for standby systems. The sensitivity of the residual life-weight relationship was not excessive at reliability levels up to R = 0.9999 and the weight penalty was small. The sensitivity of life estimates increases dramatically at higher reliability levels.

Matthews, William T.↗
NASA NTRS2013

Engineering Evaluation of International Low Impact Docking System Latch Hooks

The international Low Impact Docking System (iLIDS) provides a structural arrangement that allows for visiting vehicles to dock with the International Space Station (ISS) (Fig 1). The iLIDS docking units are mechanically joined together by a series of active and passive latch hooks. In order to preserve docking capability at the existing Russian docking interfaces, the iLIDS latch hooks are required to conform to the existing Russian design. The latch hooks are classified as being fail-safe. Since the latch hooks are fail-safe, the hooks are not fracture critical and a fatigue based service life assessment will satisfy the structural integrity requirements. Constant amplitude fatigue testing to failure on four sets of active/passive iLIDS latch hooks was performed at load magnitudes of 10, 11, and 12 kips. Failure analysis of the hook fatigue failures identified multi-site fatigue initiation that was effectively centered about the hook mid-plane (consistent with the 3D model results). The fatigue crack initiation distribution implies that the fatigue damage accumulation effectively results in a very low aspect ratio surface crack (which can be simulated as thru-thickness crack). Fatigue damage progression resulted in numerous close proximity fatigue crack initiation sites. It was not possible to determine if fatigue crack coalescence occurs during cyclic loading or as result of the fast fracture response. The presence of multiple fatigue crack initiation sites on different planes will result in the formation of ratchet marks as the cracks coalesce. Once the stable fatigue crack becomes unstable and the fast fracture advances across the remaining ligament and the plane stress condition at a free-surface will result in failure along a 45 deg. shear plane (slant fracture) and the resulting inclined edge is called a shear lip. The hook thickness on the plane of fatigue crack initiation is 0.787". The distance between the shear lips on this plane was on the order of 0.48" and it was effectively centered about the mid-plane of the section. The numerous ratchet marks between the shear lips on the fracture initiation plane are indicative of multiple fatigue initiation sites within this region. The distribution of the fatigue damage about the centerline of the hook is consistent with the analytical results that demonstrate peak stress/strain response at the mid-plane that decreases in the direction of the hook outer surfaces. Scanning electron microscope images of the failed sections detected fatigue crack striations in close proximity to the free surface of the hook radius. These findings were documented at three locations on the fracture surface : 1) adjacent to the left shear lip, 2) adjacent to the right shear lip, and 3) near the centerline of the section. The features of the titanium fracture surface did not allow for a determination of a critical crack size via identification of the region where the fatigue crack propagation became unstable. The fracture based service life projections where benchmarked with strain-life analyses. The strainrange response in the hook radius was defined via the correlated finite element models and the modified method of universal slopes was incorporated to define the strain-life equation for the titanium alloy. The strain-life assessment confirmed that the fracture based projections were reasonable for the loading range of interest. Based upon the analysis and component level fatigue test data a preliminary service life capability for the iLIDS active and passive hooks of 2 lifetimes is projected (includes a scatter factor of 4).

Martinez, J.↗
NASA NTRS1995

The Alpha-Proton-X-ray Spectrometer deployment mechanism: An anthropomorphic approach to sensor placement on Martian rocks and soil

On July 4,1997, the Mars Pathfinder spacecraft lands on Mars and starts conducting technological and scientific experiments. One experiment, the Alpha-Proton-X-ray Spectrometer, uses a sensor head placed against rocks and soil to determine their composition. To guarantee proper placement, a deployment mechanism mounted on the Mars Rover aligns the sensor head to within 20 deg of the rock and soil surfaces. In carrying out its task, the mechanism mimics the action of a human hand and arm. Consisting of a flexible wrist, a parallel link arm, a brush dc motor actuator, and a revolutionary non-pyrotechnic fail-safe release device, the mechanism correctly positions the sensor head on rocks as high as 0.29 m and on targets whose surfaces are tilted as much as 45 deg from the nominal orientation of the sensor head face. The mechanism weighs less than 0.5 kg, can withstand 100 g's, and requires less than 2.8 N x m of actuation torque. The fail-safe coupler utilizes Cerrobend, a metal alloy that melts at 60 C, to fuse the actuator and the rest of the mechanism together. A film heater wrapped around the coupler melts the metal, and Negator springs drive the mechanism into its stowed position. The fail-safe actuates using 6.75 Watts for 5 minutes in the event of an actuator failure.

Blomquist, Richard S.↗
NASA NTRS2004

Improved Electromagnetic Brake

A proposed design for an electromagnetic brake would increase the reliability while reducing the number of parts and the weight, relative to a prior commercially available electromagnetic brake. The reductions of weight and the number of parts could also lead to a reduction of cost. A description of the commercial brake is prerequisite to a description of the proposed electromagnetic brake. The commercial brake (see upper part of figure) includes (1) a permanent magnet and an electromagnet coil on a stator and (2) a rotor that includes a steel contact plate mounted, with tension spring loading, on an aluminum hub. The stator is mounted securely on a stationary object, which would ordinarily be the housing of a gear drive or a motor. The rotor is mounted on the shaft of the gear drive or motor. The commercial brake nominally operates in a fail-safe (in the sense of normally braking) mode: In the absence of current in the electromagnet coil, the permanent magnet pulls the contact plate, against the spring tension, into contact with the stator. To release the brake, one excites the electromagnet with a current of the magnitude and polarity chosen to cancel the magnetic flux of the permanent magnet, thereby enabling the spring tension to pull the contact plate out of contact with the stator. The fail-safe operation of the commercial brake depends on careful mounting of the rotor in relation to the stator. The rotor/stator gap must be set with a tolerance between 10 and 15 mils (between about 0.25 and about 0.38 mm). If the gap or the contact pad is thicker than the maximum allowable value, then the permanent magnetic field will not be strong enough to pull the steel plate across the gap. (For this reason, any contact pad between the contact plate and the stator must also be correspondingly thin.) If the gap exceeds the maximum allowable value because of shaft end play, it becomes impossible to set the brake by turning off the electromagnet current. Although it may still be possible to set the brake by applying an electromagnet current to aid the permanent magnetic field instead of canceling it, this action can mask an out-of-tolerance condition in the brake and it does not restore the fail-safe function of setting the brake when current is lost.

Martin, Toby B.↗
NASA NTRS1977

Integrity in flight control systems

In connection with advances in technology, mainly in the electronic area, aircraft flight control applications have evolved from simple pilot-relief autopilots to flight-critical and redundant fly-by-wire and active control systems. For flight-critical implementations which required accommodation of inflight failures, additional levels of redundancy were incorporated to provide fail-safe and fail-operative performance. The current status of flight control systems reliability is examined and high-reliability approaches are discussed. Attention is given to the design of ring laser gyros and magnetohydrodynamic rate sensors, redundancy configurations for component failure protection, improvements of hydraulic actuators made on the component level, integrated actuators, problems of software reliability, lightning considerations, and failure detection methods for component and system failures.

Kurzhals, P. R.↗
NASA NTRS1994

Residual strength of thin panels with cracks

The previous design philosophies involving safe life, fail-safe and damage tolerance concepts become inadequate for assuring the safety of aging aircraft structures. For example, the failure mechanism for the Aloha Airline accident involved the coalescence of undetected small cracks at the rivet holes causing a section of the fuselage to peel open during flight. Therefore, the fuselage structure should be designed to have sufficient residual strength under worst case crack configurations and in-flight load conditions. Residual strength is interpreted as the maximum load carrying capacity prior to unstable crack growth. Internal pressure and bending moment constitute the two major components of the external loads on the fuselage section during flight. Although the stiffeners in the form of stringers, frames and tear straps sustain part of the external loads, the significant portion of the load is taken up by the skin. In the presence of a large crack in the skin, the crack lips bulge out with considerable yielding; thus, the geometric and material nonlinearities must be included in the analysis for predicting residual strength. Also, these nonlinearities do not permit the decoupling of in-plane and out-of-plane bending deformations. The failure criterion combining the concepts of absorbed specific energy and strain energy density addresses the aforementioned concerns. The critical absorbed specific energy (local toughness) for the material is determined from the global specimen response and deformation geometry based on the uniaxial tensile test data and detailed finite element modeling of the specimen response. The use of the local toughness and stress-strain response at the continuum level eliminates the size effect. With this critical parameter and stress-strain response, the finite element analysis of the component by using STAGS along with the application of this failure criterion provides the stable crack growth calculations for residual strength predictions.

Madenci, Erdogan↗
NASA NTRS1988

Telescope protection algorithm for the Space Infrared Telescope Facility

This paper presents a proposed on-board Telescope Protection Algorithm (TPA) for the Space Infrared Telescope Facility (SIRTF). This TPA consists of hardware and software capable of performing both fail-operational and fail-safe modes of operation. In the fail-operational mode, each ephemeris load and slew/dwell command sequence is checked on-board before use. The slew command monitor detects unallowable slew/dwell commands and transfers control to an algorithm which slews to and maintains a safe telescope orientation while preserving precise attitude determination and control. This fail-operational mode is also given the authority to autonomously restart the slew/dwell sequence at a point beyond the faulty command. The fail-safe system consists of software and hardware which detects impending earth, moon, or sun avoidance zone violations and activates a backup hardware safe hold mode. The subject TPA and relevant sensor complement were designed for the SIRTF mission; however, this system can easily be used as a basis for failure detection and correction in a wide range of other missions.

Class, B. F.↗
NASA NTRS1996

Shape Control of Solar Collectors Using Shape Memory Alloy Actuators

Solar collectors that are focused on a central receiver are designed with a mechanism for defocusing the collector or disabling it by turning it out of the path of the sun's rays. This is required to avoid damaging the receiver during periods of inoperability. In either of these two cases a fail-safe operation is very desirable where during power outages the collector passively goes to its defocused or deactivated state. This paper is principally concerned with focusing and defocusing the collector in a fail-safe manner using shape memory alloy actuators. Shape memory alloys are well suited to this application in that once calibrated the actuators can be operated in an on/off mode using a minimal amount of electric power. Also, in contrast to other smart materials that were investigated for this application, shape memory alloys are capable of providing enough stroke at the appropriate force levels to focus the collector. Design and analysis details presented, along with comparisons to test data taken from an actual prototype, demonstrate that the collector can be repeatedly focused and defocused within accuracies required by typical solar energy systems. In this paper the design, analysis and testing of a solar collector which is deformed into its desired shape by shape memory alloy actuators is presented. Computations indicate collector shapes much closer to spherical and with smaller focal lengths can be achieved by moving the actuators inward to a radius of approximately 6 inches. This would require actuators with considerably more stroke and some alternate SMA actuators are currently under consideration. Whatever SMA actuator is finally chosen for this application, repeatability and fatigue tests will be required to investigate the long term performance of the actuator.

Lobitz, D. W.↗
DOE OSTI2021

Electromechanical response of piezoelectric thin films subjected to large strain

The use of piezoelectric thin sensors, when subjected to large static strain levels in ultrasonic applications is reported in this paper. A novel flipped beam bending method is proposed to induce static strain level nearing twice the incipient yield strain in the beam material (~0.39%). First, the effect of static large strain on ultrasonic guided wave propagation in the beam was studied using the velocity measurements obtained from a laser Doppler vibrometer. Next, the ultrasonic response of thin sensors is studied under compressive and tensile static strain (±0.72%) with the sensors symmetrically bonded on the lower and upper surfaces, and at the same axial location. The ultrasonic guided wave response to varying levels of static strain is recorded at different center frequencies (50–400 kHz) of the narrow banded ultrasonic excitation. As a case study, the variation of the ultrasonic guided wave response of polyvinylidene difluoride (PVDF) thin sensors with center frequencies at different static strain levels was analyzed and compared with that of lead zirconate titanate (PZT) thin sensors. PZT sensors show a higher variation of sensing performance with strain when compared to PVDF sensors. Apart from static strain, the possible effects on the change in performance of sensors, such as the change in the capacitance is discussed. The characterization method provides a reusable beam arrangement to study the ultrasonic sensor performance at large static strain levels. Characterization at large strain level allows the development of fail-safe sensors even under large strain and permanent plastic deformation of structure on which they are bonded, allowing accurate ultrasonic structural health monitoring even in the presence of damage progression. Piezopolymer sensor like PVDF are least susceptible to static strain due to large yield strain and low modulus and can serve as fail-safe sensors under large strain.

Rathod, Vivek↗
NASA NTRS2010

Magnetostrictive Brake

A magnetostrictive brake has been designed as a more energy-efficient alternative to a magnetic fail-safe brake in a robot. (In the specific application, failsafe signifies that the brake is normally engaged; that is, power must be supplied to allow free rotation.) The magnetic failsafe brake must be supplied with about 8 W of electric power to initiate and maintain disengagement. In contrast, the magnetostrictive brake, which would have about the same dimensions and the same torque rating as those of the magnetic fail-safe brake, would demand only about 2 W of power for disengagement. The brake (see figure) would include a stationary base plate and a hub mounted on the base plate. Two solenoid assemblies would be mounted in diametrically opposed recesses in the hub. The cores of the solenoids would be made of the magnetostrictive alloy Terfenol-D or equivalent. The rotating part of the brake would be a ring-and spring- disk subassembly. By means of leaf springs not shown in the figure, this subassembly would be coupled with the shaft that the brake is meant to restrain. With no power supplied to the solenoids, a permanent magnet would pull axially on a stepped disk and on a shelf in the hub, causing the ring to be squeezed axially between the stepped disk and the hub. The friction associated with this axial squeeze would effect the braking action. Supplying electric power to the solenoids would cause the magnetostrictive cylinders to push radially inward against a set of wedges that would be in axial contact with the stepped disk. The wedges would convert the radial magnetostrictive strain to a multiplied axial displacement of the stepped disk. This axial displacement would be just large enough to lift the stepped disk, against the permanent magnetic force, out of contact with the ring. The ring would then be free to turn because it would no longer be squeezed axially between the stepped disk and the hub.

Diftler, Myron A.↗
NASA NTRS1974

Adaptive voting computer system

A computer system is reported that uses adaptive voting to tolerate failures and operates in a fail-operational, fail-safe manner. Each of four computers is individually connected to one of four external input/output (I/O) busses which interface with external subsystems. Each computer is connected to receive input data and commands from the other three computers and to furnish output data commands to the other three computers. An adaptive control apparatus including a voter-comparator-switch (VCS) is provided for each computer to receive signals from each of the computers and permits adaptive voting among the computers to permit the fail-operational, fail-safe operation.

Koczela, L. J.↗
NASA NTRS1987

Braking System for Wind Turbines

Operating turbine stopped smoothly by fail-safe mechanism. Windturbine braking systems improved by system consisting of two large steel-alloy disks mounted on high-speed shaft of gear box, and brakepad assembly mounted on bracket fastened to top of gear box. Lever arms (with brake pads) actuated by spring-powered, pneumatic cylinders connected to these arms. Springs give specific spring-loading constant and exert predetermined load onto brake pads through lever arms. Pneumatic cylinders actuated positively to compress springs and disengage brake pads from disks. During power failure, brakes automatically lock onto disks, producing highly reliable, fail-safe stops. System doubles as stopping brake and "parking" brake.

Krysiak, J. E.↗
NASA NTRS1999

Automated Testing Experience of the Linear Aerospike SR-71 Experiment (LASRE) Controller

System controllers must be fail-safe, low cost, flexible to software changes, able to output health and status words, and permit rapid retest qualification. The system controller designed and tested for the aerospike engine program was an attempt to meet these requirements. This paper describes (1) the aerospike controller design, (2) the automated simulation testing techniques, and (3) the real time monitoring data visualization structure. Controller cost was minimized by design of a single-string system that used an off-the-shelf 486 central processing unit (CPU). A linked-list architecture, with states (nodes) defined in a user-friendly state table, accomplished software changes to the controller. Proven to be fail-safe, this system reported the abort cause and automatically reverted to a safe condition for any first failure. A real time simulation and test system automated the software checkout and retest requirements. A program requirement to decode all abort causes in real time during all ground and flight tests assured the safety of flight decisions and the proper execution of mission rules. The design also included health and status words, and provided a real time analysis interpretation for all health and status data.

Larson, Richard R.↗
NASA NTRS1972

Reliability analysis applied to structural tests

The application of reliability theory to predict, from structural fatigue test data, the risk of failure of a structure under service conditions because its load-carrying capability is progressively reduced by the extension of a fatigue crack, is considered. The procedure is applicable to both safe-life and fail-safe structures and, for a prescribed safety level, it will enable an inspection procedure to be planned or, if inspection is not feasible, it will evaluate the life to replacement. The theory has been further developed to cope with the case of structures with initial cracks, such as can occur in modern high-strength materials which are susceptible to the formation of small flaws during the production process. The method has been applied to a structure of high-strength steel and the results are compared with those obtained by the current life estimation procedures. This has shown that the conventional methods can be unconservative in certain cases, depending on the characteristics of the structure and the design operating conditions. The suitability of the probabilistic approach to the interpretation of the results from full-scale fatigue testing of aircraft structures is discussed and the assumptions involved are examined.

Diamond, P.↗
NASA NTRS1974

Fracture control methods for space vehicles. Volume 1: Fracture control design methods

A systematic approach for applying methods for fracture control in the structural components of space vehicles consists of four major steps. The first step is to define the primary load-carrying structural elements and the type of load, environment, and design stress levels acting upon them. The second step is to identify the potential fracture-critical parts by means of a selection logic flow diagram. The third step is to evaluate the safe-life and fail-safe capabilities of the specified part. The last step in the sequence is to apply the control procedures that will prevent damage to the fracture-critical parts. The fracture control methods discussed include fatigue design and analysis methods, methods for preventing crack-like defects, fracture mechanics analysis methods, and nondestructive evaluation methods. An example problem is presented for evaluation of the safe-crack-growth capability of the space shuttle crew compartment skin structure.

Liu, A. F.↗
NASA NTRS2010

Understanding the Space Shuttle Main Engine Hydraulic Actuation System and Reviewing Its Evolution

The complex engine start and thrust control requirements of the Space Shuttle Main Engine (SSME) require unique valve, actuator and control system hardware. The Hydraulic Actuation System (HAS) was designed, developed, and now operates to meet tight engine control requirement limits to assure safe, reliable and correct engine thrust at all times. The actuator is designed to be fail safe and fail operate in the areas where redundancy is important. The HAS has an additional pneumatic operating capability that insures a safe sequential closure of all actuators and propellant valves in the event of the loss of hydraulic system pressure or loss of electrical closed loop control of the actuator. The objective of this paper is to provide a complete description of the actuator s internal operating system, along with its interaction with all SSME system interfaces. Additionally the paper addresses the challenges, problems identified, and corrected, and lessons learned, during the course of the almost 35 years of engine operation.

McWade, Robert J.↗
NASA NTRS2000

Terrestrial Applications of Zero Boil-Off Cryogen Storage

Storing cryogenic propellants with zero boil off (ZBO) using a combination of active (cryocoolers) and passive technologies has recently received a great deal of attention for applications such as future long-term space missions. This paper will examine a variety of potential near-term terrestrial applications for ZBO and, where appropriate, provide a rough order of magnitude cost benefit of implementing ZBO technology. NASA's Space Shuttle power system uses supercritical propellant tanks, which are filled several days before launch. If the launch does not occur within 48-96 hours, the tanks must be drained and refilled, further delaying the launch. By implementing ZBO, boil off could be eliminated and pad hold time extended. At the launch site, vented liquid hydrogen (LH2) storage dewars lose 1200-1600 gal/day through boiloff. Implementing ZBO would eliminate this, saving $300,000-$400,000 per year. Similarly, overland trucking of LH2 from the supplier to the launch site via roadable dewars results in a cryogen loss of ten percent per tanker (1500 gal/tanker). Providing a cryocooler on board the rig would prevent this loss. Previous work investigating variable density insulation found that a 50% reduction in evaporation from a 6000 gallon dewar would save $5000 per year. For a 20 year dewar lifetime, the payback period would be less than two years. Similar benefits could be realized at other storage facilities across the nation. Within the superconductivity community, there is skepticism about using coolers, based upon reliability concerns. By providing a cooler on the dewar, lifetime could be extended while retaining fail-safe capability. If the cooler failed, it would merely lower the storage life of the dewar.

Salerno, L. J.↗
NASA NTRS1966

Modified hydraulic braking system limits angular deceleration to safe values

Conventional spring actuated, hydraulically released, fail-safe disk braking system is modified to control the angular deceleration of a massive antenna. The hydraulic system provides an immediate preset pressure to the spring-loaded brake shoes and holds it at this value to decelerate the antenna at the desired rate.

Briggs, R. S.↗