Search NASA⌕ Search

SEARCH · Search NASA

Results for “software fault modeling”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 217 records · Page 12

Fault Management Algorithm Risk Assessment for the NASA Space Launch System

This paper presents the false positive (FP) and false negative (FN) risk assessment process currently being conducted for the Space Launch System (SLS) Artemis II Fault Management (FM) detection functions. The analysis scope, general assumptions and guide rules, and key modeling concepts were discussed to establish the basis of the risk assessments conducted. Initial analyses indicated a dominance in the total risk by software and firmware failures. This paper presents efforts applied to refine the software risks and the overall impact of implementing those modifications. Current analyses conducted on the detection functions implemented for the SLS Artemis II mission indicate primary risk drivers for the individual FM detection functions are flight software failures, firmware design failures, and hardware Common Cause Failures (CCFs). There still remains issues of how to account for time and redundancy in the software risk estimations.

probability risk analysis↗

Applying Model-based Diagnosis to a Rapid Propellant Loading System

The overall objective of the US Air Force Research Laboratory (AFRL) Rapid Propellant Loading (RPL) Program is to develop a launch vehicle, payload and ground support equipment that can support a rapid propellant load and launch within one hour. NASA Kennedy Space Center (KSC) has been funded by AFRL to develop hardware and software to demonstrate this capability. The key features of the software would be the ability to recognize and adapt to failures in the physical hardware components, advise operators of equipment faults and workarounds, and put the system in a safe configuration if unable to fly. In December 2008 NASA KSC and NASA Ames Research Center (ARC) demonstrated model based simulation and diagnosis capabilities for a scaled-down configuration of the RPL hardware. In this paper we present a description of the model-based technologies that were included as part of this demonstration and the results that were achieved. In continuation of this work we are currently testing the technologies on a simulation of the complete RPL system. Later in the year, when the RPL hardware is ready, we will be integrating these technologies with the real-time operation of the system to provide live state estimates. In future years we will be developing the capability to recover from faulty conditions via redundancy and reconfiguration.

Goodrich, Charlie H.↗

Rover Attitude and Pointing System Simulation Testbed

The MER (Mars Exploration Rover) Attitude and Pointing System Simulation Testbed Environment (RAPSSTER) provides a simulation platform used for the development and test of GNC (guidance, navigation, and control) flight algorithm designs for the Mars rovers, which was specifically tailored to the MERs, but has since been used in the development of rover algorithms for the Mars Science Laboratory (MSL) as well. The software provides an integrated simulation and software testbed environment for the development of Mars rover attitude and pointing flight software. It provides an environment that is able to run the MER GNC flight software directly (as opposed to running an algorithmic model of the MER GNC flight code). This improves simulation fidelity and confidence in the results. Further more, the simulation environment allows the user to single step through its execution, pausing, and restarting at will. The system also provides for the introduction of simulated faults specific to Mars rover environments that cannot be replicated in other testbed platforms, to stress test the GNC flight algorithms under examination. The software provides facilities to do these stress tests in ways that cannot be done in the real-time flight system testbeds, such as time-jumping (both forwards and backwards), and introduction of simulated actuator faults that would be difficult, expensive, and/or destructive to implement in the real-time testbeds. Actual flight-quality codes can be incorporated back into the development-test suite of GNC developers, closing the loop between the GNC developers and the flight software developers. The software provides fully automated scripting, allowing multiple tests to be run with varying parameters, without human supervision.

Vanelli, Charles A.↗

A fault-tolerant intelligent robotic control system

This paper describes the concept, design, and features of a fault-tolerant intelligent robotic control system being developed for space and commercial applications that require high dependability. The comprehensive strategy integrates system level hardware/software fault tolerance with task level handling of uncertainties and unexpected events for robotic control. The underlying architecture for system level fault tolerance is the distributed recovery block which protects against application software, system software, hardware, and network failures. Task level fault tolerance provisions are implemented in a knowledge-based system which utilizes advanced automation techniques such as rule-based and model-based reasoning to monitor, diagnose, and recover from unexpected events. The two level design provides tolerance of two or more faults occurring serially at any level of command, control, sensing, or actuation. The potential benefits of such a fault tolerant robotic control system include: (1) a minimized potential for damage to humans, the work site, and the robot itself; (2) continuous operation with a minimum of uncommanded motion in the presence of failures; and (3) more reliable autonomous operation providing increased efficiency in the execution of robotic tasks and decreased demand on human operators for controlling and monitoring the robotic servicing routines.

Marzwell, Neville I.↗

The NASA Integrated Vehicle Health Management Technology Experiment for X-37

The NASA Integrated Vehicle Health Management (IVHM) Technology Experiment for X-37 was intended to run IVHM software on-board the X-37 spacecraft. The X-37 is intended to be an unpiloted vehicle that would orbit the Earth for up to 21 days before landing on a runway. The objectives of the experiment were to demonstrate the benefits of in-flight IVHM to the operation of a Reusable Launch Vehicle, to advance the Technology Readiness Level of this IVHM technology within a flight environment, and to demonstrate that the IVHM software could operate on the Vehicle Management Computer. The scope of the experiment was to perform real-time fault detection and isolation for X-37's electrical power system and electro-mechanical actuators. The experiment used Livingstone, a software system that performs diagnosis using a qualitative, model-based reasoning approach that searches system-wide interactions to detect and isolate failures. Two of the challenges we faced were to make this research software more efficient so that it would fit within the limited computational resources that were available to us on the X-37 spacecraft, and to modify it so that it satisfied the X-37's software safety requirements. Although the experiment is currently unfunded, the development effort had value in that it resulted in major improvements in Livingstone's efficiency and safety. This paper reviews some of the details of the modeling and integration efforts, and some of the lessons that were learned.

Schwabacher, Mark↗

IBR Short Circuit Modeling in ETAP

Mohammad Zadeh from ETAP presented various modeling improvements that included the following: • Address convergence issues by using complete Norton Equivalent model including the IBR series filter impedance. • Fault ride through identification within iterations while short circuit results have not been converged and how that may impact final SC results. • Options for FRT curve 1- using a timer to lock FRT logic vs a hysteresis in FRT curve to avoid unwanted toggling. • Report recent co-operation between software vendors (Aspen, CAPE and ETAP) for adopting a C++ interface for IBR blackbox SC modeling. There was lot of interest to know about the model improvements that are being considered.

24 POWER TRANSMISSION AND DISTRIBUTION↗

A method of measuring fault latency in a digital flight control system

This paper describes the motivation, conduct, and analysis of some 2500 low-level hardware fault cases applied in automated testing at the NASA Ames Reconfigurable Digital Flight Control System Facility. Fault detection was correlated with hardware and software fault monitoring and, in limited cases, with sensitivity to flight program execution modes. The results are statistically assessed to ascertain system-level reliability implications based on a single-fault model. Extension to multiple-fault models is addressed. The overall methodology/facility itself is judged to be a promising enhancement to current practice.

Mcgough, John↗

Program Finds Minimal Cut Sets

CUTSETS computer program identifies all minimal cut sets for given node. Software package contains subprograms that solve for minimal cut sets of fault trees and digraphs by use of object-oriented programming techniques. Cut-set codes used to solve graph models for reliability analysis and identify potential single-point failures in modeled system. Includes utility subprogram that converts popular COD-format diagraph-model-description files into text input files suitable for use with other CUT-SETS subprograms. FEAT (MSC-21873) and FIRM (MSC-21860). Written in C language.

Iverson, D. L.↗

Trade Studies of Space Launch Architectures using Modular Probabilistic Risk Analysis

A top-down risk assessment in the early phases of space exploration architecture development can provide understanding and intuition of the potential risks associated with new designs and technologies. In this approach, risk analysts draw from their past experience and the heritage of similar existing systems as a source for reliability data. This top-down approach captures the complex interactions of the risk driving parts of the integrated system without requiring detailed knowledge of the parts themselves, which is often unavailable in the early design stages. Traditional probabilistic risk analysis (PRA) technologies, however, suffer several drawbacks that limit their timely application to complex technology development programs. The most restrictive of these is a dependence on static planning scenarios, expressed through fault and event trees. Fault trees incorporating comprehensive mission scenarios are routinely constructed for complex space systems, and several commercial software products are available for evaluating fault statistics. These static representations cannot capture the dynamic behavior of system failures without substantial modification of the initial tree. Consequently, the development of dynamic models using fault tree analysis has been an active area of research in recent years. This paper discusses the implementation and demonstration of dynamic, modular scenario modeling for integration of subsystem fault evaluation modules using the Space Architecture Failure Evaluation (SAFE) tool. SAFE is a C++ code that was originally developed to support NASA s Space Launch Initiative. It provides a flexible framework for system architecture definition and trade studies. SAFE supports extensible modeling of dynamic, time-dependent risk drivers of the system and functions at the level of fidelity for which design and failure data exists. The approach is scalable, allowing inclusion of additional information as detailed data becomes available. The tool performs a Monte Carlo analysis to provide statistical estimates. Example results of an architecture system reliability study are summarized for an exploration system concept using heritage data from liquid-fueled expendable Saturn V/Apollo launch vehicles.

Mathias, Donovan L.↗

Advanced Diagnostic and Prognostic Testbed (ADAPT) Testability Analysis Report

As system designs become more complex, determining the best locations to add sensors and test points for the purpose of testing and monitoring these designs becomes more difficult. Not only must the designer take into consideration all real and potential faults of the system, he or she must also find efficient ways of detecting and isolating those faults. Because sensors and cabling take up valuable space and weight on a system, and given constraints on bandwidth and power, it is even more difficult to add sensors into these complex designs after the design has been completed. As a result, a number of software tools have been developed to assist the system designer in proper placement of these sensors during the system design phase of a project. One of the key functions provided by many of these software programs is a testability analysis of the system essentially an evaluation of how observable the system behavior is using available tests. During the design phase, testability metrics can help guide the designer in improving the inherent testability of the design. This may include adding, removing, or modifying tests; breaking up feedback loops, or changing the system to reduce fault propagation. Given a set of test requirements, the analysis can also help to verify that the system will meet those requirements. Of course, a testability analysis requires that a software model of the physical system is available. For the analysis to be most effective in guiding system design, this model should ideally be constructed in parallel with these efforts. The purpose of this paper is to present the final testability results of the Advanced Diagnostic and Prognostic Testbed (ADAPT) after the system model was completed. The tool chosen to build the model and to perform the testability analysis with is the Testability Engineering and Maintenance System Designer (TEAMS-Designer). The TEAMS toolset is intended to be a solution to span all phases of the system, from design and development through health management and maintenance. TEAMS-Designer is the model-building and testability analysis software in that suite.

Ossenfort, John↗

Physics-Based Methods of Failure Analysis and Diagnostics in Human Space Flight

The Integrated Health Management (IHM) for the future aerospace systems requires to interface models of multiple subsystems in an efficient and accurate information environment at the earlier stages of system design. The complexity of modern aeronautic and aircraft systems (including e.g. the power distribution, flight control, solid and liquid motors) dictates employment of hybrid models and high-level reasoners for analysing mixed continuous and discrete information flow involving multiple modes of operation in uncertain environments, unknown state variables, heterogeneous software and hardware components. To provide the information link between key design/performance parameters and high-level reasoners we rely on development of multi-physics performance models, distributed sensors networks, and fault diagnostic and prognostic (FD&P) technologies in close collaboration with system designers. The main challenges of our research are related to the in-flight assessment of the structural stability, engine performance, and trajectory control. The main goal is to develop an intelligent IHM that not only enhances components and system reliability, but also provides a post-flight feedback helping to optimize design of the next generation of aerospace systems. Our efforts are concentrated on several directions of the research. One of the key components of our strategy is an innovative approach to the diagnostics/prognostics based on the real time dynamical inference (DI) technologies extended to encompass hybrid systems with hidden state trajectories. The major investments are into the multiphysics performance modelling that provides an access of the FD&P technologies to the main performance parameters of e.g. solid and liquid rocket motors and composite materials of the nozzle and case. Some of the recent results of our research are discussed in this chapter. We begin by introducing the problem of dynamical inference of stochastic nonlinear models and reviewing earlier results. Next, we present our analytical approach to the solution of this problem based on the path integral formulation. The resulting algorithm does not require an extensive global search for the model parameters, provides optimal compensation for the effects of dynamical noise, and is robust for a broad range of dynamical models. In the following Section the strengths of the algorithm are illustrated illustrated by inferring the parameters of the stochastic Lorenz system and comparing the results with those of earlier research. Next, we discuss a number of recent results in application to the development of the IHM for aerospace system. Firstly, we apply dynamical inference approach to a solution of classical three tank problems with mixed unknown continuous and binary parameters. The problem is considered in the context of ground support system for filling fuel tanks of liquid rocket motors. It is shown that the DI algorithm is well suited for successful solution of a hybrid version of this benchmark problem even in the presence of additional periodic and stochastic perturbation of unknown strength. Secondly, we illustrate our approach by its application to an analysis of the nozzle fault in a solid rocket motor (SRM). The internal ballistics of the SRM is modelled as a set of one-dimensional partial differential equations coupled to the dynamics of the propellant regression. In this example we are specifically focussed on the inference of discrete and continuous parameters of the nozzle blocking fault and on the possibility of an application of the DI algorithm to reducing the probability of "misses" of an on-board FD&P for SRM. In the next section re-contact problem caused by first stage/upper stage separation failure is discussed. The reaction forces imposed on the nozzle of the upper stage during the re-contact and their connection to the nozzle damage and to the thrust vector control (TVC) signal are obtained. It is shown that transient impact induced torquean be modelled as a response of an effective damped oscillator. A possible application of the DI algorithm to the inference of damage parameters and predicting fault dynamics ahead of time using the actuator signal is discussed. Finally, we formulate Bayesian inferential framework for development of the IHM system for in-flight structural health monitoring (SHM) of composite materials. We consider the signal generated by piezoelectric actuator mounted on composite structure generating elastic waves in it. The signal received by the sensor is than compared with the baseline signal. The possibility of damage inference is discussed in the context of development of the SHM.

Smelyanskiy, Vadim N.↗

Development and evaluation of a fault-tolerant multiprocessor (FTMP) computer. Volume 4: FTMP executive summary

The FTMP architecture is a high reliability computer concept modeled after a homogeneous multiprocessor architecture. Elements of the FTMP are operated in tight synchronism with one another and hardware fault-detection and fault-masking is provided which is transparent to the software. Operating system design and user software design is thus greatly simplified. Performance of the FTMP is also comparable to that of a simplex equivalent due to the efficiency of fault handling hardware. The FTMP project constructed an engineering module of the FTMP, programmed the machine and extensively tested the architecture through fault injection and other stress testing. This testing confirmed the soundness of the FTMP concepts.

Smith, T. B., III↗

3D Geologic Framework Modelling of the Los Alamos National Laboratory Site and Pajarito Plateau: Integrating a realistic 3D fault network and modelling subsurface relationships in a sparsely sampled and complex geologic region

The subsurface geology beneath the Pajarito Plateau is critical to understanding the seismic hazard of the Pajarito Fault System, yet our understanding of this geology is relatively poor. While previous 3D geologic framework models of the area have been created for the purposes of understanding hydrogeologic flow, they are inadequate for the purposes of understanding the Pajarito Fault System. The specific challenges of using oil and gas software for this purpose include: (1) the geologic complexities resulting from volcanism and tectonism; (2) a need for a high level of stratigraphic detail over a large area; (3) a near complete lack of seismic data; and (4) sparse wellbore data. Presented here is a workflow that handles these challenges of adapting commercially available software used by the oil and gas industries to this seismic hazard problem.

58 GEOSCIENCES↗

Detection of faults and software reliability analysis

Multiversion or N-version programming was proposed as a method of providing fault tolerance in software. The approach requires the separate, independent preparation of multiple versions of a piece of software for some application. Specific topics addressed are: failure probabilities in N-version systems, consistent comparison in N-version systems, descriptions of the faults found in the Knight and Leveson experiment, analytic models of comparison testing, characteristics of the input regions that trigger faults, fault tolerance through data diversity, and the relationship between failures caused by automatically seeded faults.

Knight, J. C.↗

Integrated Software Health Management for Aircraft GN and C

Modern aircraft rely heavily on dependable operation of many safety-critical software components. Despite careful design, verification and validation (V&V), on-board software can fail with disastrous consequences if it encounters problematic software/hardware interaction or must operate in an unexpected environment. We are using a Bayesian approach to monitor the software and its behavior during operation and provide up-to-date information about the health of the software and its components. The powerful reasoning mechanism provided by our model-based Bayesian approach makes reliable diagnosis of the root causes possible and minimizes the number of false alarms. Compilation of the Bayesian model into compact arithmetic circuits makes SWHM feasible even on platforms with limited CPU power. We show initial results of SWHM on a small simulator of an embedded aircraft software system, where software and sensor faults can be injected.

Schumann, Johann↗

Emulation of Core Flight System Applications for Flight Software Development and Validation

The Mars Sample Return (MSR) campaign is an unprecedented attempt in the return of Martian samples back to Earth. The ascent from the surface will be performed by the Mars Ascent Vehicle (MAV), a critical element in the mission that National Aeronautics and Space Administration (NASA) Marshall Space Flight Center (MSFC) is developing. To this end, innovations in flight software development, verification, and validation are occurring. The MAV flight computer will run Core Flight System (cFS), an open-source software environment developed by NASA Goddard Space Flight Center (GSFC). NASA Marshall’s MAV Mission and Fault Management (M&FM) Team has implemented an emulation of two applications of this architecture: Limit Checker and Stored Command. Using an emulation of the functionalities of these applications allows for rapid prototyping of table-based algorithms. Further, M&FM is leveraging an in-house, low-fidelity but high-throughput State Analysis Model (SAM), an integrated MATLAB Stateflow Plant and Software model. This model is run in parallel with the cFS emulation for full flyout testing of the M&FM algorithms, verification of intent of these algorithms, and for future auto-generation of application-ingestible M&FM tables. The tables can then be delivered to the MAV Flight Software (FSW) team in a seamless process, reducing the cost of traditional FSW development and the risk of starting M&FM FSW development at later points in the NASA program life cycle.

Cody Wheeler↗

Emulation of Core Flight System Applications for Flight Software Development and Validation

The Mars Sample Return (MSR) campaign is an unprecedented attempt in the return of Martian samples back to Earth. The ascent from the surface will be performed by the Mars Ascent Vehicle (MAV), a critical element in the mission that National Aeronautics and Space Administration (NASA) Marshall Space Flight Center (MSFC) is developing. To this end, innovations in flight software development, verification, and validation are occurring. The MAV flight computer will run Core Flight System (cFS), an open-source software environment developed by NASA Goddard Space Flight Center (GSFC). NASA Marshall’s MAV Mission and Fault Management (M&FM) Team has implemented an emulation of two applications of this architecture: Limit Checker and Stored Command. Using an emulation of the functionalities of these applications allows for rapid prototyping of table-based algorithms. Further, M&FM is leveraging an in-house, low-fidelity but high-throughput State Analysis Model (SAM), an integrated MATLAB Stateflow Plant and Software model. This model is run in parallel with the cFS emulation for full flyout testing of the M&FM algorithms, verification of intent of these algorithms, and for future auto-generation of application-ingestible M&FM tables. The tables can then be delivered to the MAV Flight Software (FSW) team in a seamless process, reducing the cost of traditional FSW development and the risk of starting M&FM FSW development at later points in the NASA program life cycle.

Cody Wheeler↗

Toward a Model-Based Approach to Flight System Fault Protection

Fault Protection (FP) is a distinct and separate systems engineering sub-discipline that is concerned with the off-nominal behavior of a system. Flight system fault protection is an important part of the overall flight system systems engineering effort, with its own products and processes. As with other aspects of systems engineering, the FP domain is highly amenable to expression and management in models. However, while there are standards and guidelines for performing FP related analyses, there are not standards or guidelines for formally relating the FP analyses to each other or to the system hardware and software design. As a result, the material generated for these analyses are effectively creating separate models that are only loosely-related to the system being designed. Development of approaches that enable modeling of FP concerns in the same model as the system hardware and software design enables establishment of formal relationships that has great potential for improving the efficiency, correctness, and verification of the implementation of flight system FP. This paper begins with an overview of the FP domain, and then continues with a presentation of a SysML/UML model of the FP domain and the particular analyses that it contains, by way of showing a potential model-based approach to flight system fault protection, and an exposition of the use of the FP models in FSW engineering. The analyses are small examples, inspired by current real-project examples of FP analyses.

Day, John↗