READY FOR TAKEOFF! GE SYSTEM CONTROLS TESTS OF NASA'S LAB DESTINY
13 December 2001 - GE Industrial Systems

To get ready for the long trip to its space station home, the Destiny was leak-tested in a specially renovated vacuum chamber controlled by a GE Fanuc Genius Modular Redundancy (GMR) safety system in a 1oo2D voting configuration for maximum reliability.

Michele Taylor - Systems Engineer, NASA said - 'GE Fanuc GMR eliminated the extensive testing required to validate the appropriateness of the selected hardware. And, since GMR is user-configurable without requiring us to provide diagnostics and voting algorithms, implementation was a snap.'

Results

Maximum life and equipment safety assurance.
Faster implementation.
Automatic fault reports for maintenance and operations personnel.
Intelligent, rugged, self-contained modules.
Compliant with international safety standards.

A Date with Destiny
One of two vacuum chambers built by NASA in 1964 to test the famous Apollo program flight hardware, the module selected to test the Destiny was originally used to simulate a low-Earth orbit environment. Though both of the three-story stainless steel vacuum chambers were deactivated in 1975 when the Apollo-Soyuz project ended, one was resurrected when NASA selected Boeing and Dynacs Engineering to renovate the chambers to leak test pressurized elements of the space station. Responsible for proving the Destiny space-worthy and helping to ensure astronaut safety, the vacuum chamber required a high level of reliability for effective test operations. With these considerations, the NASA team selected the TÜV Certified GE Fanuc GMR 1oo2D safety system. The vacuum chamber's revamped control system employs the GMR to oversee pressure/vacuum functions, gas detection, temperature and humidity sensors, system integrity, and facility security, as well as pumping and equipment controls, control room components, and the rotation and handling fixture that inserts the Destiny into the 33-foot-wide by 50-foot-tall vacuum chamber.

To perform the leak test, the laboratory was placed on the rotation and handling fixture inside NASA's Operations and Checkout Building's high bay, raised to vertical, lifted and moved to a point above the chamber, then lowered inside. Once the lid was secured, the chamber created a vacuum environment equivalent to 257,000 feet altitude, or 48 miles, to determine if the module contained any element leaks and to confirm the rates at which various gases were consumed. The 28-foot-long, 14-foot-wide Destiny entered the chamber and spent seven days inside.

According to Tip Talone, director of the ISS and Payload Processing at the Kennedy Space Center, the completion of the leak test was a giant step in satisfying requirements for the lab's launch. 'Destiny's performance in the vacuum chamber tests has boosted our confidence in the lab's ability to perform as a vital component of the ISS,' Talone explains. 'The lab team has really done an impressive job.'

The Diagnostic Design
Since no system is known to be functional without being fully tested, the NASA team decided to apply advanced control techniques in testing and diagnostics - noted by the 'D' in 1oo2D - to increase the reliability of the vacuum chamber. The GMR's 1oo2D design allowed NASA to configure the system for both fail-safe and fault-tolerant operation and simultaneously enjoy the ability to reject component failure signals by increasing system availability. Combining the flexibility and power of two GE Fanuc Series 90?-70 PLCs with the advanced functionality of Genius I/O, the GE Fanuc GMR system employs three mixed-use duplex, triplex, and simplex circuits for mechanical and electrical failsafeing. The I/O configuration used by the chamber's control system is remotely linked to redundant processors, providing the coverage needed for high reliability and system safety. Since the GMR system is automatically 100 percent electrically tested from the sensor to the final field element, any failure is immediately detected, reported, and acted on by one or both of the parallel CPU processors.

Within this fault-tolerant environment, the detected failure is ignored and the remaining correctly functioning circuits maintain the system operation. If multiple parallel circuits become simultaneously faulty, the system is immediately made fail-safe by shutting down and/or enabling systems as appropriate while also continuing to monitor all parameters. The advanced GMR executive continually detects overt and covert failures, reducing mean time to repair (MTTR) and generating automatic fault reports for maintenance and operations personnel. Other automatic diagnostic features include memory error checking, as well as data and address line testing. Upon detection of a deviant parameter, the GMR system responds in a safe manner to prevent damage to equipment and the release of hazardous gases into the environment, and to protect personnel from physical harm.

In addition to monitoring and controlling pressure sensor units, the Series 90-70 PLCs also monitor the chamber's residual gas analyzer for partial pressures of water, hydrocarbons, nitrogen, helium, and oxygen. Both PLCs are housed in the control room accompanied by a Windows NT® 4 server and master and slave stations. The system's Genius I/O, with its distributed design, allows the I/O to monitor the actions of other intelligent devices on the chamber's system and provide automatic diagnostic checks. The Genius I/O also offers a full line of discrete, analog, and relay blocks, ranging from six to 32 circuits. These intelligent, rugged, self-contained modules with blocks are customized to make the Genius I/O more efficient than traditional I/O configurations. In addition, Genius block design and Genius advanced diagnostics allowed NASA to cut initial setup time, as well as reduce overall downtime.

'GMR eliminated the extensive testing required to validate the appropriateness of the selected hardware,' explains NASA Systems Engineer Michele Taylor.

'And, since GMR is user-configurable without requiring us to provide diagnostics and voting algorithms, implementation was a snap.' Historically, the downside of dual systems is that when a diagnostic fault or data discrepancy occurred, the system had to be repaired or shut down according to established time-out restrictions.

However, the GMR 1oo2D system offers a fail-safe/fault tolerant design, degrading in a 2-1-0 manner. The fail-safe feature trips the outputs to a safe state upon detection of a field input change or diagnostic anomaly, while the fault-tolerant state employs redundancy techniques to maintain the ability to operate as designed even in the presence of a diagnostic failure. In the vacuum chamber's GMR, the 1oo2D system is configured so that either of the system logic solvers can deactivate or trip the final output, providing process safety, as compared to a 2oo2D design in which both logic solvers must agree for an output action to take place.

To avoid shutdown, both channels in the GMR system integrate a diagnostic watchdog unit that periodically detects a heartbeat pulse transmitted through the system by the CPU. If the watchdog's interval timer is not reset within a user-selectable time frame, the system outputs will be de-energized. The outputs of these secondary diagnostic channels are configured to 'AND/OR,' with each primary logic solver output providing shutdown coverage on a channel basis. This backup or secondary means of de-energizing the outputs allows each system to operate independently and degrade without affecting the operation of the complementary system.

The first PLC technology flexible enough to receive a risk class 6 rating from the internationally recognized German safety testing organization TÜV Rhineland, GE Fanuc's GMR system has also been designed to comply with the demanding requirements of the Instrument Society of America's ISA S84.01 process safety guideline and IEC 65 international standard when adopted. John Elbon, Boeing director of ISS ground operations at the Space Center, adds, 'The vacuum chamber was of critical importance in providing us with the test data that reassures us the lab is a safe, leak-free habitat for astronauts to occupy during ISS missions.'

http://www.geindustrial.com

More News:
  • For December 2001
  • From GE Industrial Systems
  • For Electric Motors