Search NASA⌕ Search

SEARCH · Search NASA

Results for “software fault modeling”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 379 records · Page 21

NASA Taxonomies for Searching Problem Reports and FMEAs

Many types of hazard and risk analyses are used during the life cycle of complex systems, including Failure Modes and Effects Analysis (FMEA), Hazard Analysis, Fault Tree and Event Tree Analysis, Probabilistic Risk Assessment, Reliability Analysis and analysis of Problem Reporting and Corrective Action (PRACA) databases. The success of these methods depends on the availability of input data and the analysts knowledge. Standard nomenclature can increase the reusability of hazard, risk and problem data. When nomenclature in the source texts is not standard, taxonomies with mapping words (sets of rough synonyms) can be combined with semantic search to identify items and tag them with metadata based on a rich standard nomenclature. Semantic search uses word meanings in the context of parsed phrases to find matches. The NASA taxonomies provide the word meanings. Spacecraft taxonomies and ontologies (generalization hierarchies with attributes and relationships, based on terms meanings) are being developed for types of subsystems, functions, entities, hazards and failures. The ontologies are broad and general, covering hardware, software and human systems. Semantic search of Space Station texts was used to validate and extend the taxonomies. The taxonomies have also been used to extract system connectivity (interaction) models and functions from requirements text. Now the Reconciler semantic search tool and the taxonomies are being applied to improve search in the Space Shuttle PRACA database, to discover recurring patterns of failure. Usual methods of string search and keyword search fall short because the entries are terse and have numerous shortcuts (irregular abbreviations, nonstandard acronyms, cryptic codes) and modifier words cannot be used in sentence context to refine the search. The limited and fixed FMEA categories associated with the entries do not make the fine distinctions needed in the search. The approach assigns PRACA report titles to problem classes in the taxonomy. Each ontology class includes mapping words - near-synonyms naming different manifestations of that problem class. The mapping words for Problems, Entities and Functions are converted to a canonical form plus any of a small set of modifier words (e.g. non-uniformity NOT + UNIFORM.) The report titles are parsed as sentences if possible, or treated as a flat sequence of word tokens if parsing fails. When canonical forms in the title match mapping words, the PRACA entry is associated with the corresponding Problem, Entity or Function in the ontology. The user can search for types of failures associated with types of equipment, clustering by type of problem (e.g., all bearings found with problems of being uneven: rough, irregular, gritty ). The results could also be used for tagging PRACA report entries with rich metadata. This approach could also be applied to searching and tagging failure modes, failure effects and mitigations in FMEAs. In the pilot work, parsing 52K+ truncated titles (the test cases that were available), has resulted in identification of both a type of equipment and type of problem in about 75% of the cases. The results are displayed in a manner analogous to Google search results. The effort has also led to the enrichment of the taxonomy, adding some new categories and many new mapping words. Further work would make enhancements that have been identified for improving the clustering and further reducing the false alarm rate. (In searching for recurring problems, good clustering is more important than reducing false alarms). Searching complete PRACA reports should lead to immediate improvement.

Malin, Jane T.↗

A Reference Model for Software and System Inspections. White Paper

Software Quality Assurance (SQA) is an important component of the software development process. SQA processes provide assurance that the software products and processes in the project life cycle conform to their specified requirements by planning, enacting, and performing a set of activities to provide adequate confidence that quality is being built into the software. Typical techniques include: (1) Testing (2) Simulation (3) Model checking (4) Symbolic execution (5) Management reviews (6) Technical reviews (7) Inspections (8) Walk-throughs (9) Audits (10) Analysis (complexity analysis, control flow analysis, algorithmic analysis) (11) Formal method Our work over the last few years has resulted in substantial knowledge about SQA techniques, especially the areas of technical reviews and inspections. But can we apply the same QA techniques to the system development process? If yes, what kind of tailoring do we need before applying them in the system engineering context? If not, what types of QA techniques are actually used at system level? And, is there any room for improvement.) After a brief examination of the system engineering literature (especially focused on NASA and DoD guidance) we found that: (1) System and software development process interact with each other at different phases through development life cycle (2) Reviews are emphasized in both system and software development. (Figl.3). For some reviews (e.g. SRR, PDR, CDR), there are both system versions and software versions. (3) Analysis techniques are emphasized (e.g. Fault Tree Analysis, Preliminary Hazard Analysis) and some details are given about how to apply them. (4) Reviews are expected to use the outputs of the analysis techniques. In other words, these particular analyses are usually conducted in preparation for (before) reviews. The goal of our work is to explore the interaction between the Quality Assurance (QA) techniques at the system level and the software level.

He, Lulu↗

Fault tolerant system performance modeling

With the proliferation of complex digital systems on aircraft, the need to accurately predict system performance early in the system design cycle becomes imperative. In the past, system designers have relied on ad hoc methods for evaluating performance issues. This has produced systems that have not always worked as originally intended. To alleviate these design deficiencies, formal methods, with supporting tools, must be adhered to during the system design process. The use of performance modeling tools is becoming widely accepted as a way to address timing considerations of system design. An additional incentive for the use of these tools is that they allow the system architect to analyze system component interactions (i.e., bus contention, contention of functions for a processing site, and system repair activity on application performance). This inherent flexibility can result in an explicit specification of the system architecture. This paper addresses a method that supports performance modeling of fault tolerant systems using a discrete event simulation tool. An additional focus is on lessons learned from analyzing these classes of problems. The methodology and supporting work provide system architects with the capability to specify candidate architectures and accurately predict their performance in the early stages of design, where changes to system design is most cost effective. The work has been supported under NASA contract NAS1-18099. Integrated Airframe Propulsion Control System Architecture (IAPSA II). This contract addresses methodology, analysis, and detailed design of integrated control system architectures suitable for high-performance aircraft of the 1990's.

Discrete event simulation↗

A Generic and Multifunctional Electromagnetic Transient Model for Grid-Following Inverters

This article presents a generic and multi-functional electromagnetic transient (EMT) dynamic model of grid following (GFL) inverter-based resource (IBR) using the PSCAD software platform. The features of the developed model includes the flexibility in selecting various types and combinations of DC sources covering PV modules, battery modules, ideal DC source module, as well as flexibility in selecting either switched or averaged model of inverter. This model also covers exhaustive lists of controller logic covering open-loop/closed-loop PQ dispatch control, DC voltage and AC terminal voltage control along with the conventional current control designed in dq-domain, ate- domain and positive-negative sequence domain. Moreover, this model is equipped with the flexibility in selecting various types of current limiting schemes that includes saturation-based as well as latching-based current limiter, anti-windup protection. Moreover, the EMT model is agnostic to the MVA rating and is suitable for interfacing transmission systems by being complaint with the IEEE Std. 2800. The generality in the power circuits and the multi-functional options in operation and control of the developed EMT model makes it suitable for both academia and industry to study various power system aspects not limited to but such as fault behavior of GFL IBR and impacts on protection system, transient stability of a system interfaced with large number of GFL IBRs etc.

14 SOLAR ENERGY↗

A Generic and Multi-Functional Electromagnetic Transient Model for Grid-Following Inverter: Preprint

This article presents a generic and multi-functional electromagnetic transient (EMT) dynamic model of grid following (GFL) inverter-based resource (IBR) using the PSCAD TM software platform. The features of the developed model includes the flexibility in selecting various types and combinations of DC sources covering PV modules, battery modules, ideal DC source module, as well as flexibility in selecting either switched or averaged model of inverter. This model also covers exhaustive lists of controller logic covering open-loop/closed-loop PQ dispatch control, DC voltage and AC terminal voltage control along with the conventional current control designed in dq-domain, aB- domain and positive-negative sequence domain. Moreover, this model is equipped with the flexibility in selecting various types of current limiting schemes that includes saturation-based as well as latching-based current limiter, anti-windup protection. Moreover, the EMT model is agnostic to the MVA rating and is suitable for interfacing transmission systems by being complaint with the IEEE Std. 2800. The generality in the power circuits and the multi-functional options in operation and control of the developed EMT model makes it suitable for both academia and industry to study various power system aspects not limited to but such as fault behavior of GFL IBR and impacts on protection system, transient stability of a system interfaced with large number of GFL IBRs etc.

grid following inverter↗

NASA Tech Briefs, October 2006

Topics covered include: Protein Sensors Based on Optical Ring Resonators; Phase Sensor for Aligning a Segmented Telescope Mirror; Control Software for Advanced Video Guidance Sensor; Generating Control Commands From Gestures Sensed by EMG; Multiple-Flat-Panel System Displays Multidimensional Data; 3D X-Ray Luggage-Screening System; Probe Station and Near-Field Scanner for Testing Antennas; Photodetector Arrays for Multicolor Visible/Infrared Imaging; Semiconductor Bolometers Give Background-Limited Performance; Multichannel X-Band Dielectric-Resonator Oscillator; Automatic Alignment of Displacement-Measuring Interferometer; Earth Observing System Data Gateway; Power User Interface; Mercury Shopping Cart Interface; Cassini Archive Tracking System; Architecture Adaptive Computing Environment; Computing Fault Displacements from Surface Deformations; Oxygen-Permeable, Hydrophobic Membranes of Silanized alpha-Al2O3; SiC Composite Turbine Vanes; Retaining Device for the Interior Structure of a Spacecraft Payload; Tool for Torquing Circular Electrical-Connector Collars; System for Continuous Deaeration of Hydraulic Oil; Solar-Powered Cooler and Heater for an Automobile Interior; Improved Oxygen-Beam Texturing of Glucose-Monitoring Optics; Tool for Two Types of Friction Stir Welding; Stationary Apparatus Would Apply Forces of Walking to Feet; Instrument Would Detect and Collect Biological Aerosols; Boundary Condition for Modeling Semiconductor Nanostructures; Miniature Distillation Column for Producing LOX From Air; Even Illumination from Fiber-Optic-Coupled Laser Diodes; Optically Driven Deformable Mirrors; Algorithm for Automated Detection of Edges of Clouds; Exploiting Quantum Resonance to Solve Combinatorial Problems; Hybrid Terrain Database; On Release of Microbe-Laden Particles from Mars Landers; A Concept for Run-Time Support of the Chapel Language; Thermoelectric Inhomogeneities in (Ag(sub 1-y)SbTe2)(sub x)(PbTe)(sub 1-x); and Spacecraft Escape Capsule.

Source record↗

A Comparison Between Publish-and-Subscribe and Client-Server Models in Distributed Control System Networks

The BIO-Plex control system requires real-time, flexible, and reliable data delivery. There is no simple "off-the-shelf 'solution. However, several commercial packages will be evaluated using a testbed at ARC for publish- and-subscribe and client-server communication architectures. Point-to-point communication architecture is not suitable for real-time BIO-Plex control system. Client-server architecture provides more flexible data delivery. However, it does not provide direct communication among nodes on the network. Publish-and-subscribe implementation allows direct information exchange among nodes on the net, providing the best time-critical communication. In this work Network Data Delivery Service (NDDS) from Real-Time Innovations, Inc. ARTIE will be used to implement publish-and subscribe architecture. It offers update guarantees and deadlines for real-time data delivery. Bridgestone, a data acquisition and control software package from National Instruments, will be tested for client-server arrangement. A microwave incinerator located at ARC will be instrumented with a fieldbus network of control devices. BridgeVIEW will be used to implement an enterprise server. An enterprise network consisting of several nodes at ARC and a WAN connecting ARC and RISC will then be setup to evaluate proposed control system architectures. Several network configurations will be evaluated for fault tolerance, quality of service, reliability and efficiency. Data acquired from these network evaluation tests will then be used to determine preliminary design criteria for the BIO-Plex distributed control system.

Boulanger, Richard P., Jr.↗

Modular, Autonomous Command and Data Handling Software with Built-In Simulation and Test

The spacecraft system that plays the greatest role throughout the program lifecycle is the Command and Data Handling System (C&DH), along with the associated algorithms and software. The C&DH takes on this role as cost driver because it is the brains of the spacecraft and is the element of the system that is primarily responsible for the integration and interoperability of all spacecraft subsystems. During design and development, many activities associated with mission design, system engineering, and subsystem development result in products that are directly supported by the C&DH, such as interfaces, algorithms, flight software (FSW), and parameter sets. A modular system architecture has been developed that provides a means for rapid spacecraft assembly, test, and integration. This modular C&DH software architecture, which can be targeted and adapted to a wide variety of spacecraft architectures, payloads, and mission requirements, eliminates the current practice of rewriting the spacecraft software and test environment for every mission. This software allows missionspecific software and algorithms to be rapidly integrated and tested, significantly decreasing time involved in the software development cycle. Additionally, the FSW includes an Onboard Dynamic Simulation System (ODySSy) that allows the C&DH software to support rapid integration and test. With this solution, the C&DH software capabilities will encompass all phases of the spacecraft lifecycle. ODySSy is an on-board simulation capability built directly into the FSW that provides dynamic built-in test capabilities as soon as the FSW image is loaded onto the processor. It includes a six-degrees- of-freedom, high-fidelity simulation that allows complete closed-loop and hardware-in-the-loop testing of a spacecraft in a ground processing environment without any additional external stimuli. ODySSy can intercept and modify sensor inputs using mathematical sensor models, and can intercept and respond to actuator commands. ODySSy integration is unique in that it allows testing of actual mission sequences on the flight vehicle while the spacecraft is in various stages of assembly, test, and launch operations all without any external support equipment or simulators. The ODySSy component of the FSW significantly decreases the time required for integration and test by providing an automated, standardized, and modular approach to integrated avionics and component interface and functional verification. ODySSy further provides the capability for on-orbit support in the form of autonomous mission planning and fault protection.

Cuseo, John↗

NASA Tech Briefs, January 2013

Topics include: Single-Photon-Sensitive HgCdTe Avalanche Photodiode Detector; Surface-Enhanced Raman Scattering Using Silica Whispering-Gallery Mode Resonators; 3D Hail Size Distribution Interpolation/Extrapolation Algorithm; Color-Changing Sensors for Detecting the Presence of Hypergolic Fuels; Artificial Intelligence Software for Assessing Postural Stability; Transformers: Shape-Changing Space Systems Built with Robotic Textiles; Fibrillar Adhesive for Climbing Robots; Using Pre-Melted Phase Change Material to Keep Payloads in Space Warm for Hours without Power; Development of a Centrifugal Technique for the Microbial Bioburden Analysis of Freon (CFC-11); Microwave Sinterator Freeform Additive Construction System (MS-FACS); DSP/FPGA Design for a High-Speed Programmable S-Band Space Transceiver; On-Chip Power-Combining for High-Power Schottky Diode-Based Frequency Multipliers; FPGA Vision Data Architecture; Memory Circuit Fault Simulator; Ultra-Compact Transputer-Based Controller for High-Level, Multi-Axis Coordination; Regolith Advanced Surface Systems Operations Robot Excavator; Magnetically Actuated Seal; Hybrid Electrostatic/Flextensional Mirror for Lightweight, Large-Aperture, and Cryogenic Space Telescopes; System for Contributing and Discovering Derived Mission and Science Data; Remote Viewer for Maritime Robotics Software; Stackfile Database; Reachability Maps for In Situ Operations; JPL Space Telecommunications Radio System Operating Environment; RFI-SIM: RFI Simulation Package; ION Configuration Editor; Dtest Testing Software; IMPaCT - Integration of Missions, Programs, and Core Technologies; Integrated Systems Health Management (ISHM) Toolkit; Wind-Driven Wireless Networked System of Mobile Sensors for Mars Exploration; In Situ Solid Particle Generator; Analysis of the Effects of Streamwise Lift Distribution on Sonic Boom Signature; Rad-Tolerant, Thermally Stable, High-Speed Fiber-Optic Network for Harsh Environments; Towed Subsurface Optical Communications Buoy; High-Collection-Efficiency Fluorescence Detection Cell; Ultra-Compact, Superconducting Spectrometer-on-a-Chip at Submillimeter Wavelengths; UV Resonant Raman Spectrometer with Multi-Line Laser Excitation; Medicine Delivery Device with Integrated Sterilization and Detection; Ionospheric Simulation System for Satellite Observations and Global Assimilative Model Experiments - ISOGAME; Airborne Tomographic Swath Ice Sounding Processing System; flexplan: Mission Planning System for the Lunar Reconnaissance Orbiter; Estimating Torque Imparted on Spacecraft Using Telemetry; PowderSim: Lagrangian Discrete and Mesh-Free Continuum Simulation Code for Cohesive Soils; Multiple-Frame Detection of Subpixel Targets in Thermal Image Sequences; Metric Learning to Enhance Hyperspectral Image Segmentation; Basic Operational Robotics Instructional System; Sheet Membrane Spacesuit Water Membrane Evaporator; Advanced Materials and Manufacturing for Low-Cost, High-Performance Liquid Rocket Combustion Chambers; Motor Qualification for Long-Duration Mars Missions.

Source record↗

Leveraging Qubit Loss Detection in Fault-Tolerant Quantum Algorithms

Qubit loss errors constitute a dominant source of noise in many quantum hardware systems, particularly in neutral-atom quantum computers. We develop a theoretical framework to effectively detect and correct loss errors in logical algorithms and leverage such loss information in decoding. Considering general quantum error correction codes and logical circuits, we introduce a delayed-erasure decoder for experimentally motivated error models which leverages information from delayed loss detection to accurately correct loss errors, even when the precise moment of the error is unknown. Using this decoder, we identify strategies for detecting and correcting loss errors based on the logical circuit structure. For deep circuits prior to logical measurement, we explore methods to integrate loss detection into syndrome extraction with minimal overhead, identifying optimal strategies depending on the qubit loss fraction in the noise and hardware capabilities. In contrast, we find that many key algorithmic subroutines involve frequent gate teleportation, shortening the circuit depth before logical measurement and naturally replacing qubits with no additional experimental overhead. We simulate this setting using a toy model algorithm for small-angle synthesis and find a significant performance improvement as the loss fraction increases. These results provide a path forward for advancing large-scale fault-tolerant quantum computation in systems with loss error detection.

atoms↗

NASA Tech Briefs, May 2009

Topics covered include: Valve-"Health"-Monitoring System; Microstrip Antenna for Remote Sensing of Soil Moisture and Sea Surface Salinity; Biomedical Wireless Ambulatory Crew Monitor; Wireless Avionics Packet to Support Fault Tolerance for Flight Applications; Aerobot Autonomy Architecture; Submillimeter Confocal Imaging Active Module; Traveling-Wave Maser for 32 GHz; System Synchronizes Recordings from Separated Video Cameras; Piecewise-Planar Parabolic Reflectarray Antenna; Reducing Interference in ATC Voice Communication; EOS MLS Level 1B Data Processing, Version 2.2; Auto-Generated Semantic Processing Services; Geospatial Authentication; Maneuver Automation Software; Event Driven Messaging with Role-Based Subscriptions; Estimating Relative Positions of Outer-Space Structures; Fabricating PFPE Membranes for Capillary Electrophoresis; Linear Actuator Has Long Stroke and High Resolution; Installing a Test Tap on a Metal Battery Case; Fabricating PFPE Membranes for Microfluidic Valves and Pumps; Room-Temperature-Cured Copolymers for Lithium Battery Gel Electrolytes; Catalysts for Efficient Production of Carbon Nanotubes; Amorphous Silk Fibroin Membranes for Separation of CO2; "Zero-Mass" Noninvasive Pressure Transducers; Radial-Electric-Field Piezoelectric Diaphragm Pumps; Ejector-Enhanced, Pulsed, Pressure-Gain Combustor; Suppressing Ghost Diffraction in E-Beam-Written Gratings; Target-Tracking Camera for a Metrology System; Polarimetric Imaging using Two Photoelastic Modulators; Miniature Wide-Angle Lens for Small-Pixel Electronic Camera; Modal Filters for Infrared Interferometry; Mo(3)Sb(7-x)Te(x) for Thermoelectric Power Generation; Two-Dimensional Quantum Model of a Nanotransistor; Scanning Miniature Microscopes without Lenses; Manipulating Neutral Atoms in Chip-Based Magnetic Traps; Expansion Compression Contacts for Thermoelectric Legs; Processing Electromyographic Signals to Recognize Words; Physical Principle for Generation of Randomness; DSN Beowulf Cluster-Based VLBI Correlator; Hybrid NN/SVM Computational System for Optimizing Designs; Criteria for Modeling in LES of Multicomponent Fuel Flow; Computerized Machine for Cutting Space Shuttle Thermal Tiles; Orbiting Depot and Reusable Lander for Lunar Transportation; FPGA-Based Networked Phasemeter for a Heterodyne Interferometer; Aquarius Digital Processing Unit; Three-Dimensional Optical Coherence Tomography; Benchtop Antigen Detection Technique using Nanofiltration and Fluorescent Dyes; Isolation of Precursor Cells from Waste Solid Fat Tissue; Identification of Bacteria and Determination of Biological Indicators; Further Development of Scaffolds for Regeneration of Nerves; Chemically Assisted Photocatalytic Oxidation System; Use of Atomic Oxygen for Increased Water Contact Angles of Various Polymers for Biomedical Applications; Crashworthy Seats Would Afford Superior Protection; Open-Access, Low-Magnetic-Field MRI System for Lung Research; Microfluidic Mixing Technology for a Universal Health Sensor; Microfluidic Extraction of Biomarkers using Water as Solvent; Microwell Arrays for Studying Many Individual Cells; Droplet-Based Production of Liposomes; and Identifying and Inactivating Bacterial Spores

Source record↗

Detection and Modeling of High-Dimensional Thresholds for Fault Detection and Diagnosis

Many Fault Detection and Diagnosis (FDD) systems use discrete models for detection and reasoning. To obtain categorical values like oil pressure too high, analog sensor values need to be discretized using a suitablethreshold. Time series of analog and discrete sensor readings are processed and discretized as they come in. This task isusually performed by the wrapper code'' of the FDD system, together with signal preprocessing and filtering. In practice,selecting the right threshold is very difficult, because it heavily influences the quality of diagnosis. If a threshold causesthe alarm trigger even in nominal situations, false alarms will be the consequence. On the other hand, if threshold settingdoes not trigger in case of an off-nominal condition, important alarms might be missed, potentially causing hazardoussituations. In this paper, we will in detail describe the underlying statistical modeling techniques and algorithm as well as the Bayesian method for selecting the most likely shape and its parameters. Our approach will be illustrated by several examples from the Aerospace domain.

Computer Systems↗

Control algorithm implementation for a redundant degree of freedom manipulator

This project's purpose is to develop and implement control algorithms for a kinematically redundant robotic manipulator. The manipulator is being developed concurrently by Odetics Inc., under internal research and development funding. This SBIR contract supports algorithm conception, development, and simulation, as well as software implementation and integration with the manipulator hardware. The Odetics Dexterous Manipulator is a lightweight, high strength, modular manipulator being developed for space and commercial applications. It has seven fully active degrees of freedom, is electrically powered, and is fully operational in 1 G. The manipulator consists of five self-contained modules. These modules join via simple quick-disconnect couplings and self-mating connectors which allow rapid assembly/disassembly for reconfiguration, transport, or servicing. Each joint incorporates a unique drive train design which provides zero backlash operation, is insensitive to wear, and is single fault tolerant to motor or servo amplifier failure. The sensing system is also designed to be single fault tolerant. Although the initial prototype is not space qualified, the design is well-suited to meeting space qualification requirements. The control algorithm design approach is to develop a hierarchical system with well defined access and interfaces at each level. The high level endpoint/configuration control algorithm transforms manipulator endpoint position/orientation commands to joint angle commands, providing task space motion. At the same time, the kinematic redundancy is resolved by controlling the configuration (pose) of the manipulator, using several different optimizing criteria. The center level of the hierarchy servos the joints to their commanded trajectories using both linear feedback and model-based nonlinear control techniques. The lowest control level uses sensed joint torque to close torque servo loops, with the goal of improving the manipulator dynamic behavior. The control algorithms are subjected to a dynamic simulation before implementation.

Cohan, Steve↗

System Validation on the Europa Clipper mission in Early Implementation Phase

NASA’s next flag-ship mission - Europa Clipper, will embark on a journey to Jupiter’s icy moon Europa in 2024 to assess its environment and habitability with a highly capable spacecraft. Post Jupiter-Orbit-Insertion, the spacecraft will be commanded to perform intricate, yet meticulously planned Europa flybys to perform science investigations using a suite of instruments, while withstanding Jupiter’s harsh radiation environment. The success of this mission is dependent on a well-coordinated project and its elements such as the flight hardware and software, the ground support and mission operations teams, procedures and other cross-cutting elements. The Europa Clipper project needs to ensure that these elements are realized at a reasonable confidence level prior to launch and other mission critical events. System Validation test and analysis activities exercise and confirm the integrity of the system of all project elements in the expected flight environment with reasonable stressing conditions. These activities go beyond system design requirements verification and are driven by validation objectives that describe the end-to-end functional and operational capabilities required during nominal and off-nominal flight-like scenarios and critical events. The challenges associated with validating that the Europa Clipper project as a whole can function and perform correctly to meet the intended mission objectives with the as-delivered capabilities of all of its elements are daunting. This paper discusses the systematic methodology established in the early implementation phase of the Europa Clipper project for developing System Validation activities and their validation objectives, and addressing any validation-related challenges on the project. Approaches include decomposition of mission objectives using activity timelines in the Mission Design plan for developing nominal scenarios, use of fault trees for exploring off-nominal cases and system boundaries, and use of Model-based Systems Engineering (MBSE) tools for planning and prioritizing these activities.

Wang, Xu↗

Automatic Testcase Generation for Flight Software

The TacSat3 project is applying Integrated Systems Health Management (ISHM) technologies to an Air Force spacecraft for operational evaluation in space. The experiment will demonstrate the effectiveness and cost of ISHM and vehicle systems management (VSM) technologies through onboard operation for extended periods. We present two approaches to automatic testcase generation for ISHM: 1) A blackbox approach that views the system as a blackbox, and uses a grammar-based specification of the system's inputs to automatically generate *all* inputs that satisfy the specifications (up to prespecified limits); these inputs are then used to exercise the system. 2) A whitebox approach that performs analysis and testcase generation directly on a representation of the internal behaviour of the system under test. The enabling technologies for both these approaches are model checking and symbolic execution, as implemented in the Ames' Java PathFinder (JPF) tool suite. Model checking is an automated technique for software verification. Unlike simulation and testing which check only some of the system executions and therefore may miss errors, model checking exhaustively explores all possible executions. Symbolic execution evaluates programs with symbolic rather than concrete values and represents variable values as symbolic expressions. We are applying the blackbox approach to generating input scripts for the Spacecraft Command Language (SCL) from Interface and Control Systems. SCL is an embedded interpreter for controlling spacecraft systems. TacSat3 will be using SCL as the controller for its ISHM systems. We translated the SCL grammar into a program that outputs scripts conforming to the grammars. Running JPF on this program generates all legal input scripts up to a prespecified size. Script generation can also be targeted to specific parts of the grammar of interest to the developers. These scripts are then fed to the SCL Executive. ICS's in-house coverage tools will be run to measure code coverage. Because the scripts exercise all parts of the grammar, we expect them to provide high code coverage. This blackbox approach is suitable for systems for which we do not have access to the source code. We are applying whitebox test generation to the Spacecraft Health INference Engine (SHINE) that is part of the ISHM system. In TacSat3, SHINE will execute an on-board knowledge base for fault detection and diagnosis. SHINE converts its knowledge base into optimized C code which runs onboard TacSat3. SHINE can translate its rules into an intermediate representation (Java) suitable for analysis with JPF. JPF will analyze SHINE's Java output using symbolic execution, producing testcases that can provide either complete or directed coverage of the code. Automatically generated test suites can provide full code coverage and be quickly regenerated when code changes. Because our tools analyze executable code, they fully cover the delivered code, not just models of the code. This approach also provides a way to generate tests that exercise specific sections of code under specific preconditions. This capability gives us more focused testing of specific sections of code.

Bushnell, David Henry↗

Reliability and Probabilistic Risk Assessment - How They Play Together

PRA methodology is one of the probabilistic analysis methods that NASA brought from the nuclear industry to assess the risk of LOM, LOV and LOC for launch vehicles. PRA is a system scenario based risk assessment that uses a combination of fault trees, event trees, event sequence diagrams, and probability and statistical data to analyze the risk of a system, a process, or an activity. It is a process designed to answer three basic questions: What can go wrong? How likely is it? What is the severity of the degradation? Since 1986, NASA, along with industry partners, has conducted a number of PRA studies to predict the overall launch vehicles risks. Planning Research Corporation conducted the first of these studies in 1988. In 1995, Science Applications International Corporation (SAIC) conducted a comprehensive PRA study. In July 1996, NASA conducted a two-year study (October 1996 - September 1998) to develop a model that provided the overall Space Shuttle risk and estimates of risk changes due to proposed Space Shuttle upgrades. After the Columbia accident, NASA conducted a PRA on the Shuttle External Tank (ET) foam. This study was the most focused and extensive risk assessment that NASA has conducted in recent years. It used a dynamic, physics-based, integrated system analysis approach to understand the integrated system risk due to ET foam loss in flight. Most recently, a PRA for Ares I launch vehicle has been performed in support of the Constellation program. Reliability, on the other hand, addresses the loss of functions. In a broader sense, reliability engineering is a discipline that involves the application of engineering principles to the design and processing of products, both hardware and software, for meeting product reliability requirements or goals. It is a very broad design-support discipline. It has important interfaces with many other engineering disciplines. Reliability as a figure of merit (i.e. the metric) is the probability that an item will perform its intended function(s) for a specified mission profile. In general, the reliability metric can be calculated through the analyses using reliability demonstration and reliability prediction methodologies. Reliability analysis is very critical for understanding component failure mechanisms and in identifying reliability critical design and process drivers. The following sections discuss the PRA process and reliability engineering in detail and provide an application where reliability analysis and PRA were jointly used in a complementary manner to support a Space Shuttle flight risk assessment.

Safie, Fayssal M.↗

Asynchronous Message Service Reference Implementation

This software provides a library of middleware functions with a simple application programming interface, enabling implementation of distributed applications in conformance with the CCSDS AMS (Consultative Committee for Space Data Systems Asynchronous Message Service) specification. The AMS service, and its protocols, implement an architectural concept under which the modules of mission systems may be designed as if they were to operate in isolation, each one producing and consuming mission information without explicit awareness of which other modules are currently operating. Communication relationships among such modules are self-configuring; this tends to minimize complexity in the development and operations of modular data systems. A system built on this model is a society of generally autonomous, inter-operating modules that may fluctuate freely over time in response to changing mission objectives, modules functional upgrades, and recovery from individual module failure. The purpose of AMS, then, is to reduce mission cost and risk by providing standard, reusable infrastructure for the exchange of information among data system modules in a manner that is simple to use, highly automated, flexible, robust, scalable, and efficient. The implementation is designed to spawn multiple threads of AMS functionality under the control of an AMS application program. These threads enable all members of an AMS-based, distributed application to discover one another in real time, subscribe to messages on specific topics, and to publish messages on specific topics. The query/reply (client/server) communication model is also supported. Message exchange is optionally subject to encryption (to support confidentiality) and authorization. Fault tolerance measures in the discovery protocol minimize the likelihood of overall application failure due to any single operational error anywhere in the system. The multi-threaded design simplifies processing while enabling application nodes to operate at high speeds; linked lists protected by mutex semaphores and condition variables are used for efficient, inter-thread communication. Applications may use a variety of transport protocols underlying AMS itself, including TCP (Transmission Control Protocol), UDP (User Datagram Protocol), and message queues.

Burleigh, Scott C.↗

Inductive System Monitors Tasks

The Inductive Monitoring System (IMS) software developed at Ames Research Center uses artificial intelligence and data mining techniques to build system-monitoring knowledge bases from archived or simulated sensor data. This information is then used to detect unusual or anomalous behavior that may indicate an impending system failure. Currently helping analyze data from systems that help fly and maintain the space shuttle and the International Space Station (ISS), the IMS has also been employed by data classes are then used to build a monitoring knowledge base. In real time, IMS performs monitoring functions: determining and displaying the degree of deviation from nominal performance. IMS trend analyses can detect conditions that may indicate a failure or required system maintenance. The development of IMS was motivated by the difficulty of producing detailed diagnostic models of some system components due to complexity or unavailability of design information. Successful applications have ranged from real-time monitoring of aircraft engine and control systems to anomaly detection in space shuttle and ISS data. IMS was used on shuttle missions STS-121, STS-115, and STS-116 to search the Wing Leading Edge Impact Detection System (WLEIDS) data for signs of possible damaging impacts during launch. It independently verified findings of the WLEIDS Mission Evaluation Room (MER) analysts and indicated additional points of interest that were subsequently investigated by the MER team. In support of the Exploration Systems Mission Directorate, IMS is being deployed as an anomaly detection tool on ISS mission control consoles in the Johnson Space Center Mission Operations Directorate. IMS has been trained to detect faults in the ISS Control Moment Gyroscope (CMG) systems. In laboratory tests, it has already detected several minor anomalies in real-time CMG data. When tested on archived data, IMS was able to detect precursors of the CMG1 failure nearly 15 hours in advance of the actual failure event. In the Aeronautics Research Mission Directorate, IMS successfully performed real-time engine health analysis. IMS was able to detect simulated failures and actual engine anomalies in an F/A-18 aircraft during the course of 25 test flights. IMS is also being used in colla

Source record↗