SEARCH · Engineering Papers
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Two level system checkout in which first level satisfies continuous monitoring requirements and second level provides fault isolation to satisfy maintenance requirements, provides self-checking capability for monitoring system and enables recovery from unexpected error or failure interruptions. System must perform operational duties of navigation, control, and experimentation.
Longitudinal handling qualities evaluations were conducted on the Ames Research Center Flight Simulator for Advanced Aircraft (FSAA) for the approach and landing tasks of a powered lift STOL research aircraft. The test vehicle was a C-8A aircraft modified with a new wing incorporating internal blowing over an augmentor flap. The investigation included: (1) use of various flight path and airspeed control techniques for the basic vehicle; (2) assessment of stability and command augmentation schemes for pitch attitude and airspeed control; (3) determination of the influence of longitudinal and vertical force coupling for the power control; (4) determination of the influence of pitch axis coupling with the thrust vector control; and (5) evaluations of the contribution of stability and command augmentation to recovery from a single engine failure. Results are presented in the form of pilot ratings and commentary substantiated by landing approach time histories.
Schneider demonstrates that many fault tolerant clock synchronization algorithms can be represented as refinements of a single proven correct paradigm. Shankar provides mechanical proof that Schneider's schema achieves Byzantine fault tolerant clock synchronization provided that 11 constraints are satisfied. Some of the constraints are assumptions about physical properties of the system and cannot be established formally. Proofs are given that the fault tolerant midpoint convergence function satisfies three of the constraints. A hardware design is presented, implementing the fault tolerant midpoint function, which is shown to satisfy the remaining constraints. The synchronization circuit will recover completely from transient faults provided the maximum fault assumption is not violated. The initialization protocol for the circuit also provides a recovery mechanism from total system failure caused by correlated transient faults.
Costs of a simplex or single-version system are compared with fault-tolerant software systems including N-version programming (NVP), recovery block (RB), and consensus recovery block (CRB). Assuming that failures are independent, CRB followed by RB are found to be the most cost-justifiable fault-tolerant techniques. NVP is not competitive with the other two methods in terms of costs.
The present invention provides computer implemented methodology that permits the safe landing and recovery of rotorcraft following engine failure. With this invention successful autorotations may be performed from well within the unsafe operating area of the height-velocity profile of a helicopter by employing the fast and robust real-time trajectory optimization algorithm that commands control motion through an intuitive pilot display, or directly in the case of autonomous rotorcraft. The algorithm generates optimal trajectories and control commands via the direct-collocation optimization method, solved using a nonlinear programming problem solver. The control inputs computed are collective pitch and aircraft pitch, which are easily tracked and manipulated by the pilot or converted to control actuator commands for automated operation during autorotation in the case of an autonomous rotorcraft. The formulation of the optimal control problem has been carefully tailored so the solutions resemble those of an expert pilot, accounting for the performance limitations of the rotorcraft and safety concerns.
For the safe operation of a complex system like a (manned) launch vehicle, real-time information about the state of the system and potential faults is extremely important. The on-board FDDR (Failure Detection, Diagnostics, and Response) system is a software system to detect and identify failures, provide real-time diagnostics, and to initiate fault recovery and mitigation. The ERIS (Evaluation of Rocket Integrated Subsystems) failure simulation is a unified Matlab/Simulink model of the Ares I Launch Vehicle with modular, hierarchical subsystems and components. With this model, the nominal flight performance characteristics can be studied. Additionally, failures can be injected to see their effects on vehicle state and on vehicle behavior. A comprehensive test and analysis of such a complicated model is virtually impossible. In this paper, we will describe, how parametric testing (PT) can be used to support testing and analysis of the ERIS failure simulation. PT uses a combination of Monte Carlo techniques with n-factor combinatorial exploration to generate a small, yet comprehensive set of parameters for the test runs. For the analysis of the high-dimensional simulation data, we are using multivariate clustering to automatically find structure in this high-dimensional data space. Our tools can generate detailed HTML reports that facilitate the analysis.
The New Millennium Remote Agent (NMRA) will be the first AI system to control an actual spacecraft. The spacecraft domain places a strong premium on autonomy and requires dynamic recoveries and robust concurrent execution, all in the presence of tight real-time deadlines, changing goals, scarce resource constraints, and a wide variety of possible failures. To achieve this level of execution robustness, we have integrated a procedural executive based on generic procedures with a deductive model-based executive. A procedural executive provides sophisticated control constructs such as loops, parallel activity, locks, and synchronization which are used for robust schedule execution, hierarchical task decomposition, and routine configuration management. A deductive executive provides algorithms for sophisticated state inference and optimal failure recover), planning. The integrated executive enables designers to code knowledge via a combination of procedures and declarative models, yielding a rich modeling capability suitable to the challenges of real spacecraft control. The interface between the two executives ensures both that recovery sequences are smoothly merged into high-level schedule execution and that a high degree of reactivity is retained to effectively handle additional failures during recovery.
To demonstrate the high reliability of fault-tolerant computing systems, experimental testing can be performed by injecting faults into their hardware and observing the times needed to detect and isolate failed components and reconfigure the good components. Coverage, a parameter measuring continued system success, is the probability that recovery occurs before other, perhaps catastrophic, component failures occur. Methods of estimating coverage are given for the case of randomly selecting a subset of the pins or chips for testing. Pin-level samples of times to recovery are treated by the Type I censoring model often used in life testing.
The existing water recovery system on the International Space Station (ISS) is limited to 75% reclamation; consequently, long duration space missions are currently unfeasible due to the large quantity of water necessary to sustain the crew. The Brine Evaporation Bag (BEB) is a proposed system to supplement the existing water recovery system aboard the ISS that can to increase water recovery to 99%. The largest barrier to high water recovery is mineral scaling inside the water recovery equipment, which leads to equipment failure; therefore, some water must remain to keep the minerals dissolved. This waste stream is liquid brine containing salts, acids, organics, and water. The BEB is designed to recover this remaining water while protecting the equipment from scale. The BEB consists of a sealed bag containing a hydrophobic membrane that allows water vapor and gas to pass through. It is operated under vacuum, heated, and continuously filled with brine to boil away the water. The water vapor is recovered and the solids are contained inside the bag for disposal. The BEB can dry the brine to a solid block. Ongoing work includes improving the design of the BEB and the evaporator to prevent leaks, maximize the rate of water removal, and minimize energy use and weight. Additional testing will determine whether designs are heat- or mass-transfer limited and the optimal water recovery rate.
This study critically evaluates human reliability analysis (HRA) methodologies applicable to regulatory probabilistic safety assessment (PSA) model, with a particular focus on their role in supporting the significance determination process (SDP) in nuclear safety assessment. Firstly, three widely utilized HRA methods – IDHEAS-ECA, SPAR-H, and ASEP/THERP – were qualitatively and quantitatively assessed. Qualitative assessments were conducted using attributes from the NEA/CSNI/R(2015)1 report, while quantitative evaluations employed regression and correlation analyses to compare predicted human error probabilities (HEPs) against empirical data. Results reveal distinct strengths, for example, IDHEAS-ECA’s robust predictive accuracy and K-HRA’s alignment with operational practices. In addition, dependency analysis and recovery analysis were critically evaluated. For dependency analysis, the methods’ handling of inter-task dependencies and their impact on HEPs were examined, while recovery analysis highlighted strategies for mitigating failure events. Furthermore, strategies were proposed to evaluate performance-shaping factors under conditions of reduced human performance, such as stress, fatigue, or cognitive overload, addressing specific challenges faced in SDP evaluations. Human errors from KINS’s operational performance information system event reports were evaluated as a case study. This study identifies gaps and provides actionable insights to ensure their validity and applicability in SDP HRA applications. This paper is a part of research conducted by KINS, and it should be noted that this result does not represent the regulatory position of KINS.
Formal robustness analysis of aircraft control upset prevention and recovery systems could play an important role in their validation and ultimate certification. Such systems (developed for failure detection, identification, and reconfiguration, as well as upset recovery) need to be evaluated over broad regions of the flight envelope and under extreme flight conditions, and should include various sources of uncertainty. However, formulation of linear fractional transformation (LFT) models for representing system uncertainty can be very difficult for complex parameter-dependent systems. This paper describes a preliminary LFT modeling software tool which uses a matrix-based computational approach that can be directly applied to parametric uncertainty problems involving multivariate matrix polynomial dependencies. Several examples are presented (including an F-16 at an extreme flight condition, a missile model, and a generic example with numerous crossproduct terms), and comparisons are given with other LFT modeling tools that are currently available. The LFT modeling method and preliminary software tool presented in this paper are shown to compare favorably with these methods.
Seamless recovery of power to critical infrastructures, after grid failure, is a crucial need arising in scenarios that are increasingly becoming more frequent. Here, this article proposes a seamless transition strategy using a single and unified mode-dependent droop controlled grid-forming inverters. The control strategy achieves the following objectives: 1) regulates the output active and reactive power by the droop-controlled inverters to a desired value while operating in on-grid mode; 2) seamless transition and recovery of power injections into the load after grid failure by inverters that operates in grid-forming mode all the time; 3) requires only a single bit of information on the grid/network status for the mode transition. A framework for assessing the stability of the system and to guide the choice of parameters for controllers is developed using control-oriented modeling. A controller hardware-in-the-loop-based real-time simulation study on a test system based on the realistic electrical network of a commercial-scale medical center is conducted for initial prototyping of the control strategy. A hardware experiment is conducted with two 3 - $\phi$, 480 -V, 125 -kVA grid-forming inverters, a 3 - $\phi$, 480 -V, 270 -kVA grid simulator, a physical grid switch, and a physical load bank. The experimental data establishes the effectiveness of the always grid-forming operation and control of inverters in meeting power delivery objectives when on-grid and off-grid under various kinds of loads and scenarios while minimizing transients during transitions. Furthermore, performance comparison with existing strategies showcases the advantage of the proposed strategy.
We report on our experiences replicating 7.3 petabytes (PB) of Earth System Grid Federation (ESGF) computational simulation data from Lawrence Livermore National Laboratory (LLNL) in California to Argonne National Laboratory (ANL) in Illinois and Oak Ridge National Laboratory (ORNL) in Tennessee—a task motivated by a need for increased reliability, capacity, and performance. This task presented significant challenges: the need to move 29 million files twice under time pressure from aging storage hardware; a source file system bottleneck limiting throughput to 1.5 GB/s; frequent site maintenance windows; and the need for complete reliability at scale. We addressed these challenges using a simple replication tool that invoked Globus to transfer large bundles of files while tracking progress in a database, dynamically rerouting transfers to work around maintenance periods and file system limitations. Under the covers, Globus organized transfers to make efficient use of the high-speed Energy Sciences network (ESnet) and the data transfer nodes deployed at participating sites, and also addressed security, integrity checking, and recovery from a variety of transient failures. This success demonstrates the considerable benefits that can accrue from the adoption of performant data replication infrastructure. The replication tool is available at https://github.com/esgf2-us/data-replication-tools.
Integrated Life Support System hardware tests, discussing oxygen and water recovery, contaminant control, personal accommodations and failure detection
A document presents some additional information on the subject matter of "Integrated Hardware and Software for No- Loss Computing" (NPO-42554), which appears elsewhere in this issue of NASA Tech Briefs. To recapitulate: The hardware and software designs of a developmental parallel computing system are integrated to effectuate a concept of no-loss computing (NLC). The system is designed to reconfigure an application program such that it can be monitored in real time and further reconfigured to continue a computation in the event of failure of one of the computers. The design provides for (1) a distributed class of NLC computation agents, denoted introspection agents, that effects hierarchical detection of anomalies; (2) enhancement of the compiler of the parallel computing system to cause generation of state vectors that can be used to continue a computation in the event of a failure; and (3) activation of a recovery component when an anomaly is detected.
The ISS utilizes two large rotating mechanisms, the SARJ, as part of the solar arrays alignment system for more efficient power generation. The SARJ is a 10.3m circumference, nitrided 15-5PH steel race ring of triangular cross-section, with 12 sets of trundle bearing assemblies transferring load across the rolling joint. The SARJ mechanism rotates continuously and slowly - once every orbit, or every 90 minutes. In 2008, the starboard SARJ suffered a lubrication failure, resulting in severe damage (spalling) of one of the race ring surfaces. Extensive effort was conducted to prevent the port SARJ from suffering the same failure, and fortunately was ultimately successful in recovering the functionality of the starboard SARJ. The M&P function was key in determining the cause of failure and the means for mechanism recovery. From a M&P lessons-learned perspective, observations are made concerning the original SARJ design parameters (boundary conditions), the perceived need for nitriding the race ring, the test conditions employed during qualification, the environmental controls used for the hardware preflight, and the lubrication robustness necessary for complex kinematic mechanisms expecting high-reliability and long-life.
The International Space Station (ISS) utilizes two large rotating mechanisms, the solar alpha rotary joints (SARJs), as part of the solar arrays' alignment system for more efficient power generation. Each SARJ is a 10.3m circumference, nitrided 15-5PH steel race ring of triangular cross-section, with 12 sets of trundle bearing assemblies transferring load across the rolling joint. The SARJ mechanism rotates continuously and slowly - once every orbit, or every 90 minutes. In 2007, the starboard SARJ suffered a lubrication failure, resulting in severe damage (spalling) to one of the race ring surfaces. Extensive effort was conducted to prevent the port SARJ from suffering the same failure, and fortunately that effort was ultimately successful in also recovering the functionality of the starboard SARJ. The M&P engineering function was key in determining the cause of failure and the means for mechanism recovery. From a M&P lessons-learned perspective, observations are made concerning the original SARJ design parameters (boundary conditions), the perceived need for nitriding the race ring, the test conditions employed during qualification, the environmental controls used for the hardware preflight, and the lubrication robustness necessary for complex kinematic mechanisms expecting high-reliability and long-life.
Formal robustness analysis of aircraft control upset prevention and recovery systems could play an important role in their validation and ultimate certification. Such systems developed for failure detection, identification, and reconfiguration, as well as upset recovery, need to be evaluated over broad regions of the flight envelope or under extreme flight conditions, and should include various sources of uncertainty. To apply formal robustness analysis, formulation of linear fractional transformation (LFT) models of complex parameter-dependent systems is required, which represent system uncertainty due to parameter uncertainty and actuator faults. This paper describes a detailed LFT model formulation procedure from the nonlinear model of a transport aircraft by using a preliminary LFT modeling software tool developed at the NASA Langley Research Center, which utilizes a matrix-based computational approach. The closed-loop system is evaluated over the entire flight envelope based on the generated LFT model which can cover nonlinear dynamics. The robustness analysis results of the closed-loop fault tolerant control system of a transport aircraft are presented. A reliable flight envelope (safe flight regime) is also calculated from the robust performance analysis results, over which the closed-loop system can achieve the desired performance of command tracking and failure detection.