REG NASA-LLIS-0697-2000 Lessons Learned Active Redundancy.pdf

1、Best Practices Entry: Best Practice Info:a71 Committee Approval Date: 2000-03-4a71 Center Point of Contact: GRCa71 Submitted by: Wil HarkinsSubject: Active Redundancy Practice: Use active redundancy as a design option when development testing and reliability analysis show that a single component is

2、not reliable enough to accomplish the function. Although active redundancy can be applied to various types of mechanical and electrical components and systems, the application detailed in this practice illustrates an approach using a Traveling Wave Tube amplifier in a space flight application.Progra

3、ms that Certify Usage: This practice has been used on Space Acceleration Measurement System (SAMS), Communication Technology Satellite (CTS), Atlas/Centaur, and Titan.Center to Contact for Information: GRCImplementation Method: This Lesson Learned is based on Reliability Practice No. PD-ED-1216; fro

4、m NASA Technical Memorandum 4322A, NASA Reliability Preferred Practices for Design and Test.Benefit:Provides multiple ways of accomplishing a function to improve mission reliability.Implementation Method:Provided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-

5、,-The decision to use redundant design techniques should be based on analysis of reliability and test data. Redundancy may prove to be the only available method when other techniques of improving performance (e.g., better components, additional derating, simplification, software debugging) have been

6、 exhausted or when methods of item improvements are shown to be more costly than duplications. The use of redundant equipment can allow for repair with no system downtime. Some situations exist in which equipment cannot be maintained (e.g., communication satellites), in which case dormant redundant

7、elements may be a necessary approach to prolong operating time.The application of redundancy is not without penalties. It will increase weight, space, complexity, and time to design, fabricate, assemble, and test. It may also increase costs; however, the costs may be recovered by the increased relia

8、bility. Thus, safety and mission reliability is gained at the expense of adding more items to test. The increase in testing time may be reduced by making improvements in the components such as the use of more reliable parts, more derating, design simplification, and software improvements.The incorpo

9、ration of redundancy into a design must take into account “checkable redundancy.“ It is important to be able to functionally test the redundant elements prior to mission start. If this capability is not present, the benefits of redundancy may be defeated by the uncertain functionality. However, if t

10、he designer takes into account built-in test planning, inclusion of test points, and packaging, the benefits of active redundancy will be retained.Technical Rationale:As an example, consider how redundancy was used in the transmitters of the Communications Technology Satellite (CTS). The component f

11、ailure data for the basic nonredundant configuration of the Traveling Wave Tube (TWT) is shown in Table 1.CTS TWT Component Failure Data Provided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-refer to D descriptionD KA= application factor =engineering adjus

12、tment for use application The TWT serves as the final output stage and driver for the 200W transmitter. Most space applications require long operating times for earth/satellite communications. Therefore, reliability without maintenance is a major design and manufacturing concern.(The analysis used i

13、n this example assumes that the failure rates are constant over time and, Provided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-therefore, the calculations are used as engineering estimates.)For the nonredundant circuit, the approximate total failure rate

14、is given by:Failure Rate=l 27.4x 10-6failures / hour This rate is then adjusted by an operating factor based on engineering judgement to take into account the space environment, Kop:ltotal=lKop= (27.4 x 10-6)(0.33) = 9.04x10-6failures / hour Using a mission time of 17,520 hours (2 years, the CTS per

15、formance goal), the approximate reliability for the nonredundant configuration is:R = e-ltotalt= e- (9.04 x 10-6)(17,520)R = 0.85For the simple, redundant configuration, the approximate reliability is:Rs= 1- (1-R1)(1-R2),whereR1= R2= 0.85Rs= 0.98Obviously, the use of redundancy can greatly enhance t

16、he transmitter reliability and give high confidence that the two year CTS performance goal will be met. However, there are additional considerations that need Provided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-to be taken into account. Specifically, we

17、need to address the additional components added by the redundancy, such as switches, sensors, and/or activators. In this case, two switches are added in order to activate the redundancy (see Figure 1).The first switch is a coaxial transfer switch with a failure rate of 1.1 x 10-6. The second switch,

18、 a waveguide transfer switch, has a failure rate of 1.5 x 10-6. These are the only two components added due to the redundancy. The command receiver/decoder needs to operate in order to activate the switches. However, if it fails, the whole spacecraft would fail whether the redundancy is present or n

19、ot. Therefore, the following additional calculations need to be made:lSWI= 1.1 x 10-6leqTWT= 1.15 x 10-6(sinceR = 0.98)lSW2= 1.5 x 10-6Switched Redundant TWT Block Diagram refer to D descriptionD lRED=lSW1+leqTWT+lSW2= (1.5 + 1.15 + 1.1) x 10-6=3.75 x 10-6RRED= 0.94Provided by IHSNot for ResaleNo re

20、production or networking permitted without license from IHS-,-,-Therefore, the total Reliability of the redundant system is approximately 0.94. This is still a big improvement over the single component reliability of 0.85.The success of the CTS spacecraft demonstrated this improved reliability as al

21、l CTS transmitters operated beyond their performance goal of 2 years.Both the advantages and disadvantages of redundancy should be considered prior to its use. To repeat, the disadvantages of using redundancy to solve a reliability problem are increased weight, cost, and complexity. Additions of bac

22、k-up systems and/or lower level items add the weight and cost of the additional hardware. This weight and cost may be reduced by the application of piece part redundancy. A more harmful effect may be increased complexity which would negate the reliability improvement. For example, sensing, activatio

23、n, and switching hardware added to use the redundant component may reduce the overall reliability lower than that of the simple string.There are many cases where deliberate redundancy provides reliability improvement with cost reduction. It does not necessarily follow that simple redundancy is the c

24、ost effective way to compensate for low reliability. The design engineer has the responsibility to determine what balance of redundancy alternatives is the most effective to use. In the trade-off process, it may be determined that redundancy, by the duplication of hardware, may impact the cost of pr

25、eventive maintenance. This is a significant factor in life cycle cost considerations for equipment worth. Redundancy may be practical if a designed item is readily available, and more economical than redesign. However, redundancy may be too expensive if the item is costly, or too heavy if spacecraft

26、 limitations are exceeded. These are all trade-offs which the designer Provided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-must consider.References:1. Dillard, R.B., Reliability for the Engineer, Book Two, Martin Marietta Corporation, 1973.2. “Electronic

27、 Reliability Design Handbook,“ MIL-HDBK-338-1A, October 1988.3. Klion, Jerome, A Redundancy Notebook, Rome Air Development Center, RADC-TR-77-287, December 1987.4. Lalli, Vincent R. and Speck, Carlton E., “Traveling-Wave Tube Reliability Estimates, Life Tests, and Space Flight Experience,“ NASA TM X

28、-73541, January 1977.5. “Reliability Modeling and Prediction,“ MIL-STD-756B, November 1981.Impact of Non-Practice: The designer should consider redundancy for reliability improvement of critical components having low reliability for which a single failure could cause loss of a system or one of its m

29、ajor functions, i.e. loss of control, unintentional release or inability to release space hardware, failure of space installation systems, or harm to the crew. Building a flight assembly that has low reliability can cause problems in qualification and acceptance testing, launch preparation and fligh

30、t activities, schedule delays, and budget overruns.Related Practices: N/AProvided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-Additional Info: Approval Info: a71 Approval Date: 2000-03-4a71 Approval Name: ric Raynora71 Approval Organization: Sa71 Approval Phone Number: 02-358-4738Provided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-