SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Requirements and specifications for a method of optimizing the design of fault-tolerant flight control systems are provided. Algorithms that could be used for developing new and modifying existing computer programs are also provided, with recommendations for follow-on work.
Documentation is presented of the December 1986 version of the ADA code for the fault detection, isolation, and reconfiguration (FDIR) functions of the Advanced Information processing System (AIPS) Fault-Tolerant Processor (FTP). Because the FTP is still under development and the software is constantly undergoing changes, this should not be considered final documentation of the FDIR software of the FTP.
Attention is given to the design and evaluation of a fault-tolerant multiprocessor whose rollback recovery mechanism is based on hardware recovery blocks constructed by consecutive state-save operations and several state-save units in every processor and memory module. Upon detection of failure, the multiprocessor reconfigures itself to replace the faulty module and the process originally assigned to the faulty module retreats to one of the previously saved states, in order to resume fault-free execution. A mathematical model is proposed for the calculation of multistep rollback recovery coverage and the risk of restart when all available saved states are exhausted. The mean and the variance of task execution time with the occurrence of rollbacks and/or restarts are evaluated.
Functional programming frameworks for the design of highly reliable multiprocessor systems are proposed. In contrast to imperative programming environments, a functional environment offers elegant, relatively simple, and efficient solutions to concurrent error detection and recovery problems in multiprocessors. Specific fault tolerance mechanisms for upset exposure, fault containment, secure task assignment, and recovery are developed for a class of applicative multiprocessor architectures. Verification of abstract behavioral characteristics of applicative tasks is used for exposing faults during the execution of tasks. The fault containment mechanism is based on isolation of stack and heap segments of tasks. A protocol for secure task assignment is defined between system components. The architecture permits incremental, distributed, and asynchronous backups of system state. Finally, recovery is accomplished, even in the worst cases, by re-execution of a small number of tasks.
The experimental test and evaluation of the Fault-Tolerant Multiprocessor (FTMP) is described. Major objectives of this exercise include expanding validation envelope, building confidence in the system, revealing any weaknesses in the architectural concepts and in their execution in hardware and software, and in general, stressing the hardware and software. To this end, pin-level faults were injected into one LRU of the FTMP and the FTMP response was measured in terms of fault detection, isolation, and recovery times. A total of 21,055 stuck-at-0, stuck-at-1 and invert-signal faults were injected in the CPU, memory, bus interface circuits, Bus Guardian Units, and voters and error latches. Of these, 17,418 were detected. At least 80 percent of undetected faults are estimated to be on unused pins. The multiprocessor identified all detected faults correctly and recovered successfully in each case. Total recovery time for all faults averaged a little over one second. This can be reduced to half a second by including appropriate self-tests.
A new method for quantitatively evaluating the performance of fault-tolerant systems is developed and applied to an example. The method assumes that the random failure and diagnostic decision behavior of the system can be modeled by a finite state Markov process. A performance value must be assigned to each of the states of the model. The method then generates the moments of the probability mass function of the cumulative performance and uses these to generate a maximum entropy approximation to the performance PMF. Some computational considerations are discussed. The method is applied to a typical mission for the Inertial Upper Stage to examine the attitude accuracy performance of the inertial system.
The main objectives are: a model of a replicated system with exact-match voting; a fault model that includes transients; a theorem that establishes the conditions under which the system provides fault tolerance; a formal specification of the model; and a mechanically checked verification of the theorem that is consonant with the journal-level presentation. Formal specification and verification revealed typos in the original report, exposed omission in original proof, led to the stronger theorem and more elegant proof, and confirmed that Enhanced Hierarchical Development Methodology (EHDM) has the capability to specify interesting and useful properties in a direct, natural, and readable manner.
This paper proposes functional programming frameworks for the design of highly reliable multiprocessor systems. In contrast to imperative programming environments, a functional environment offers elegant, relatively simple, and efficient solutions to concurrent error detection and recovery problems in multiprocessors. Specific fault tolerance mechanisms for upset exposure, fault containment, secure task assignment, and recovery are developed for a class of applicative multiprocessor architectures. Verification of abstract behavioral characteristics of applicative tasks is used for exposing faults during the execution of tasks. The fault containment mechanism is based on isolation of stack and heap segments of tasks. A protocol for secure task assignment is defined between system components. The architecture permits incremental, distributed, and asynchronous backups of system state. Finally, recovery is accomplished, even in the worst cases, by reexecution of a small number of tasks.
RAMP consists of distributed sets of parallel computers partioned on the basis of software and packaging constraints. To minimize hardware and software complexity, the processors operate asynchronously. It was shown that through the design of asymptotically stable control laws, data errors due to the asynchronism were minimized. It was further shown that by designing control laws with this property and making minor hardware modifications to the RAMP modules, the system became inherently tolerant to intermittent faults. A laboratory version of RAMP was constructed and is described in the paper along with the experimental results.
The requirements for mechanisms used in the Space Transportation System (STS) are to provide dual fault tolerance, and if the payload equipment violates the Shuttle bay door envelope, these deployment/restow mechanisms must have independent primary and backup features. The research and development of an electromechanical actuator that meets these requirements and will be used on the Transfer Orbit Stage (TOS) program is described.
Report describes first phase of continuing program of research on fault-tolerant control subsystem of telerobotic visual-inspection system. Goal of program to develop robotic system for remotely controlled visual inspection of structures in outer space.
State machines are commonly used to control sequential logic in FPGAs and ASKS. An errant state machine can cause considerable damage to the device it is controlling. For example in space applications, the FPGA might be controlling Pyros, which when fired at the wrong time will cause a mission failure. Even a well designed state machine can be subject to random errors us a result of SEUs from the radiation environment in space. There are various ways to encode the states of a state machine, and the type of encoding makes a large difference in the susceptibility of the state machine to radiation. In this paper we compare 4 methods of state machine encoding and find which method gives the best fault tolerance, as well as determining the resources needed for each method.
A classification scheme for errors and a technique for the provision of software fault tolerance in cyclic real-time systems is presented. The technique requires that the process structure of a system be represented by a synchronization graph which is used by an executive as a specification of the relative times at which they will communicate during execution. Communication between concurrent processes is severely limited and may only take place between processes engaged in an exchange. A history of error occurrences is maintained by an error handler. When an error is detected, the error handler classifies it using the error history information and then initiates appropriate recovery action.
Bounds are established on the probability of system failure for fault-tolerant systems of the type used, for example, in aviation control. Event series leading to system failure are assumed to follow a semi-Markov model in which the potential sojourn times associated with component failures have exponential distributions and those associated with system responses have distributions with unspecified form. A product form of the bounds is derived by using a model that provides for multiple competing system responses to component failures.
It is pointed out that advanced avionics applications increasingly require underlying machine architectures which are damage and fault tolerant, and which provide access to distributed sensors, effectors and high-throughput computational resources. The Advanced Information Processing System (AIPS), sponsored by NASA, is to provide an architecture which can meet the considered requirements. Ada was selected for implementing the AIPS system software. Advantages of Ada are related to its provisions for real-time programming, error detection, modularity and separate compilation, and standardization and portability. Chief drawbacks of this language are currently limited availability and maturity of language implementations, and limited experience in applying the language to real-time applications. The present investigation is concerned with current plans for employing Ada in the design of the software for AIPS. Attention is given to an overview of AIPS, AIPS software services, and representative design issues in each of four major software categories.
Bounds are established on the probability of system failure for fault-tolerant systems of the type used, for example, in aviation control. Event series leading to system failure are assumed to follow a semi-Markov model in which the potential sojourn times associated with component failures have exponential distributions and those associated with system responses have distributions with unspecified form. A product form of the bounds is derived by using a model that provides for multiple competing system responses to component failures.
An approximate method for calculating the statistics of the performance of a fault-tolerant system is developed. An approximate method is necessary because the statistical model of the system behavior is large-scale and the time horizon of interest encompasses many cycles of the Redundancy Management logic. In the development, a compact representation of the necessary information called the v-transform is introduced and discussed. Based upon this representation, an approximation that leads to a very efficient computational procedure is suggested and numerically analyzed. A very brief discussion of other related work is also presented.
In 1987, Schneider presented a general paradigm that provides a single proof of a number of fault tolerant clock synchronization algorithms. His proof was subsequently subjected to the rigor of mechanical verification by Shankar. However, both Schneider and Shankar assumed a condition Shankar refers to as a bounded delay. This condition states that the elapsed time between synchronization events (i.e., the time that the local process applies an adjustment to its logical clock) is bounded. This property is really a result of the algorithm and should not be assumed in a proof of correctness. This paper remedies this by providing a proof of this property in the context of the general paradigm proposed by Schneider. The argument given is a generalization of Welch and Lynch's proof of a related property for their algorithm.