Search NASA⌕ Search

SEARCH · Search NASA

Results for “software fault modeling”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 127 records · Page 7

The Infeasibility of Quantifying the Reliability of Life-Critical Real-Time Software

This paper affirms that the quantification of life-critical software reliability is infeasible using statistical methods whether applied to standard software or fault-tolerant software. The classical methods of estimating reliability are shown to lead to exhorbitant amounts of testing when applied to life-critical software. Reliability growth models are examined and also shown to be incapable of overcoming the need for excessive amounts of testing. The key assumption of software fault tolerance separately programmed versions fail independently is shown to be problematic. This assumption cannot be justified by experimentation in the ultrareliability region and subjective arguments in its favor are not sufficiently strong to justify it as an axiom. Also, the implications of the recent multiversion software experiments support this affirmation.

Butler, Ricky W.↗

An experiment in software reliability

The results of a software reliability experiment conducted in a controlled laboratory setting are reported. The experiment was undertaken to gather data on software failures and is one in a series of experiments being pursued by the Fault Tolerant Systems Branch of NASA Langley Research Center to find a means of credibly performing reliability evaluations of flight control software. The experiment tests a small sample of implementations of radar tracking software having ultra-reliability requirements and uses n-version programming for error detection, and repetitive run modeling for failure and fault rate estimation. The experiment results agree with those of Nagel and Skrivan in that the program error rates suggest an approximate log-linear pattern and the individual faults occurred with significantly different error rates. Additional analysis of the experimental data raises new questions concerning the phenomenon of interacting faults. This phenomenon may provide one explanation for software reliability decay.

Dunham, J. R.↗

Application of a bayesian belief network model to reliability assessment of nuclear safety-related software - 207

As the instrumentation and control (I and C) systems in nuclear power plants (NPPs) have been replaced with digital-based systems, the need to incorporate software failures into NPP probabilistic risk assessments has arisen. In order to assess the probability of software failure on demand, a Bayesian belief network (BBN) model was developed which estimates the number of defects and the resulting probability of software failure on demand in nuclear safety-related software. To assess the feasibility of the BBN framework, the BBN model was applied to the prototype Integrated Digital Protection System-Reactor Protection System (IDiPS-RPS) to estimate the number of remaining faults and the software failure probability of a target software. The developmental- and V and V-activities carried out during the IDiPS-RPS development process were evaluated based on the well-defined checklist derived by the V and V team and were estimated based on expert elicitation. In addition, the attribute evaluations and the number of FPs of the target software is provided as the inputs for the BBN model. The application results showed the feasibility of using BBNs for quantifying software failure probabilities and several insights were gained from the applications of the BBN model. The proposed BBN framework can be applied to estimate the software failure probability for other safety-related NPP software and provide an insight on modeling the software development process that involves iterations between different development phases. (authors)

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

A model-based approach to the symbolic control of space subsystems

A multilayered approach to the symbolic control of complex electromechanical assemblies, such as spaceborne thermal, power, and life subsystems, is discussed. An example of this approach is given in some recent tests of the Thermal Expert System (TEXSYS) in control of the Boeing Aerospace Thermal Bus System (BATBS), a prototype two-phase Space Station Freedom thermal bus. The BATBS hardware requires read-update-act cycles of under a minute, and it is subject to dynamic reconfiguration while operating. These performance requirements are addressed by layering model-based expert system software on a conventional numerical data acquisition and control system. TEXSYS test results demonstrate both nominal control and fault recovery actions with the BATBS. Dynamic modification of the symbolic model used in this approach is compared to that of a classical numerical adaptive controller.

Glass, B. J.↗

Integration of Data Analytics with Plant System Health Program

This report summarizes the R&D activities of the Plant Health Management (PHM) project during fiscal year 2020 (FY20). This project focuses on the development of methods that integrate component health data and propagate such information at the system level to evaluate system sources of risk. This project development lives in cooperation with the Risk Informed Asset Management (RIAM) project. The RIAM project, in fact, uses the reliability models and data generated by the PHM project to optimize plant operations (e.g., maintenance/replacement schedule, optimal maintenance posture). This year’s activities for the PHM project focused mainly on the development of two classes of models. The first one includes a series of component reliability models which include aging, testing and maintenance. The second class includes a series of system reliability models which focus on the secondary side of exiting U.S. reactors. These models are based on fault tree logic structures such that they can be used by existing plant PRA software. We also started to focus on the management of health data and we tackled this issue in two directions. The first one focuses on the integration of monitor data with simulation models to assess component health. This approach is moving from a classical data based to a model+data based approach with the goal of improving higher component health information. The second direction focuses on linking equipment reliability data (e.g., maintenance/failure reports, component monitoring data) directly to system reliability models using a safety margin based language rather than a probability based language. The main advantage of a safety margin based language is that it can provide to system engineers more tangible information on system/component health and how it propagates to the system level.

97 MATHEMATICS AND COMPUTING↗

Simplex GPS and InSAR Inversion Software

Changes in the shape of the Earth's surface can be routinely measured with precisions better than centimeters. Processes below the surface often drive these changes and as a result, investigators require models with inversion methods to characterize the sources. Simplex inverts any combination of GPS (global positioning system), UAVSAR (uninhabited aerial vehicle synthetic aperture radar), and InSAR (interferometric synthetic aperture radar) data simultaneously for elastic response from fault and fluid motions. It can be used to solve for multiple faults and parameters, all of which can be specified or allowed to vary. The software can be used to study long-term tectonic motions and the faults responsible for those motions, or can be used to invert for co-seismic slip from earthquakes. Solutions involving estimation of fault motion and changes in fluid reservoirs such as magma or water are possible. Any arbitrary number of faults or parameters can be considered. Simplex specifically solves for any of location, geometry, fault slip, and expansion/contraction of a single or multiple faults. It inverts GPS and InSAR data for elastic dislocations in a half-space. Slip parameters include strike slip, dip slip, and tensile dislocations. It includes a map interface for both setting up the models and viewing the results. Results, including faults, and observed, computed, and residual displacements, are output in text format, a map interface, and can be exported to KML. The software interfaces with the QuakeTables database allowing a user to select existing fault parameters or data. Simplex can be accessed through the QuakeSim portal graphical user interface or run from a UNIX command line.

Donnellan, Andrea↗

PIP-II Beam Current Monitor Fault Case & Beam Position Monitor Linearity Studies in CST Studio

The use of non-invasive sensors & systems to measure particle beam characteristics is a crucial part of modern accelerator control systems. As such, simulations predicting the behavior of these sensors are essential for guiding beamline control system design. This poster details the results returned by two beam sensor models created using CST Studio software: the signal linearity of an elliptical beam position monitor (BPM), and the fault cases of an AC current transformer (ACCT) beam current monitor (BCM).

Rouzky, Adam↗

Pahute Mesa-Oasis Valley Hydrostratigraphic Framework Model for Corrective Action Units 101 and 102: Central and Western Pahute Mesa, Nye County, Nevada (Rev. 0)

A new, revised three-dimensional (3-D) hydrostratigraphic framework model (HFM) for the Central and Western Pahute Mesa Corrective Action Units 101 and 102 was completed in 2019. The initial (Phase I) model was completed in 2002 and was documented in A Hydrostratigraphic Model and Alternatives for the Groundwater Flow and Contaminant Transport Model of Corrective Action Units 101 and 102: Central and Western Pahute Mesa, Nye County, Nevada (BN, 2002). Subsequent flow and transport modeling revealed the need to collect additional data to reduce uncertainties. The Phase II data collection and characterization effort included extensive well drilling and testing activities, and rebuilding of the Phase I 3-D HFM, resulting in the Phase II HFM (NSTec, 2014). Further drilling (Well ER-20-12), data collection, and interpretive work (e.g., Thirsty Canyon Lineament [Wurtz and Day, 2018]) were incorporated into the Pahute Mesa-Oasis Valley (PM-OV) HFM. The PM-OV HFM incorporates the area of interest from the Phase II HFM and adds additional areas, primarily to the north and west with minor additions to the south and east. The new, expanded area matches the PM-OV groundwater basin as defined in Fenelon et al. (2016) and includes Pahute Mesa, a former nuclear testing area at the Nevada National Security Site; and Oasis Valley, a groundwater discharge area downgradient from contaminant source areas on Pahute Mesa. The data and information necessary to build the PM-OV HFM are provided in Navarro (2019). The PM-OV HFM will be used by hydrologic modelers who are tasked with developing a model to determine how contaminants are transported by groundwater flow in an area of complex geology. The model area is large (more than 6,250 square kilometers) and geologically complex, including Paleozoic- to Mesozoic-age structures (e.g., thrust faults, Thirsty Canyon Lineament), at least seven Tertiary-age calderas, several intrusive bodies, and many relatively recent basin-and-range normal faults. Investigators from the U.S. Geological Survey; National Security Technologies, LLC; National Laboratories; and U.S. Department of Energy contractors have organized the more than 300 volcanic units and other rocks in the model area into 77 hydrostratigraphic units (HSUs). The volcanic rocks are subdivided into 42 aquifers, 11 confining units, and 9 composite units (containing both aquifer and confining unit rocks). The underlying pre-Tertiary rocks were divided into 5 HSUs, comprising 2 aquifers and 3 confining units. The model also includes 1 alluvial aquifer unit, 8 intrusive confining units, and 1 granite confining unit. The model depicts the thickness, extent, and geometric relationships of these HSUs (“layers” in the model) along with all the major structural features that control them, including calderas and faults. The most substantive differences between the Phase II HFM and the PM-OVHFM include (1) addition of the new data and resulting revised interpretations from the additional area encompassed by the PM-OV groundwater basin; (2) incorporation of 16 new faults; (3) 12 boreholes from the northern extension; (4) 2 additional caldera-collapse collars; and (5) correlation of the simulated faulting and hydrostratigraphy in the eastern part of the model domain with the delineations represented in the neighboring Rainier Mesa-Shoshone Mountain HFM-Prime and Yucca Flat-Climax Mine HFM. All PM-OV HFM delineations were based on published and unpublished data from geophysical investigations, surface geologic maps, and drill-hole records. Phase II approached model uncertainty using the model-building software to test model configurations and hydrologic consequences using a range of values for parameters such as fault offset amounts and HSU elevations. The PM-OV HFM expands on this approach to encompass the entire PM-OV groundwater basin.

54 ENVIRONMENTAL SCIENCES↗

Failure Assessment

Three questions to which software developers want accurate, precise answers are "How can the software system fail?", "mat bad things will happen if the software fails?t', and "How many failures will the software experience?". Numerous techniques have been devised to answer these questions; three of the best known are: 1) Software Fault Tree Analysis (SFTA) 2) Software Failure Modes, Effects, and Criticality Analysis (SFMECA 3) Software Fault/Failure Modeling. SFTA and SFMECA have been successfully used to analyze the flight software for a number of robotic planetary exploration missions, including Galileo, Cassini, and Deep Space 1. Given the increasing interest in reusing software components from mission to mission, one of us has developed techniques for reusing the corresponding portions of the SFTA and SFMECA, reducing the effort required to conduct these analyses. SFTA has also been shown to be effective in analyzing the security aspects of software systems; intrusion mechanisms and effects can easily be modeled using these techniques. The Bi- Directional Safety Analysis (BDSA) method combines a forward search (similar to SFMECA) from potential failure modes to their effects, with a backward search (similar to SFTA) from feasible hazards to the contributing causes of each hazard. BDSA offers an efficient way to identify latent failures. Recent work has extended BDSA to product-line applications such as flight-instrumentation displays and developed tool support for the reuse of the failure-analysis artifacts within a product line. BDSA has also been streamlined to support those projects having tight cost and/or schedule constraints for their failure analysis efforts. We discuss lessons learned from practice, describe available tools, and identi@ some future directions for the topic. A substantial amount of research has been devoted to estimating the number of failures that a software system will experience during test and operations, as well as the number of faults that have been inserted into that system during its development. One of us has found that the amount of structural change to a system during its development is strongly related to the number of faults inserted into it. Using techniques requiring no additional effort on the part of the development organization, the required measurements of structural evolution can be easily obtained from a development effort's configuration management system and readily transformed into an estimate of fault content. So far, structure-fault relationships have been identified for source code; current work seeks to examine artifacts available earlier in the lifecycle to determine if similar relationships between structure and fault content can be found. In particular, relationships between requirements change requests and the number of faults inserted into the implemented system would provide a significant improvement in our ability to control software quality during the early development phases.

fault tree↗

Model-Based Verification and Validation of Spacecraft Avionics

Verification and Validation (V&V) at JPL is traditionally performed on flight or flight-like hardware running flight software. For some time, the complexity of avionics has increased exponentially while the time allocated for system integration and associated V&V testing has remained fixed. There is an increasing need to perform comprehensive system level V&V using modeling and simulation, and to use scarce hardware testing time to validate models; the norm for thermal and structural V&V for some time. Our approach extends model-based V&V to electronics and software through functional and structural models implemented in SysML. We develop component models of electronics and software that are validated by comparison with test results from actual equipment. The models are then simulated enabling a more complete set of test cases than possible on flight hardware. SysML simulations provide access and control of internal nodes that may not be available in physical systems. This is particularly helpful in testing fault protection behaviors when injecting faults is either not possible or potentially damaging to the hardware. We can also model both hardware and software behaviors in SysML, which allows us to simulate hardware and software interactions. With an integrated model and simulation capability we can evaluate the hardware and software interactions and identify problems sooner. The primary missing piece is validating SysML model correctness against hardware; this experiment demonstrated such an approach is possible.

MBV&V↗

Thermal Expert System (TEXSYS): Systems autonomy demonstration project, volume 2. Results

The Systems Autonomy Demonstration Project (SADP) produced a knowledge-based real-time control system for control and fault detection, isolation, and recovery (FDIR) of a prototype two-phase Space Station Freedom external active thermal control system (EATCS). The Thermal Expert System (TEXSYS) was demonstrated in recent tests to be capable of reliable fault anticipation and detection, as well as ordinary control of the thermal bus. Performance requirements were addressed by adopting a hierarchical symbolic control approach-layering model-based expert system software on a conventional, numerical data acquisition and control system. The model-based reasoning capabilities of TEXSYS were shown to be advantageous over typical rule-based expert systems, particularly for detection of unforeseen faults and sensor failures. Volume 1 gives a project overview and testing highlights. Volume 2 provides detail on the EATCS testbed, test operations, and online test results. Appendix A is a test archive, while Appendix B is a compendium of design and user manuals for the TEXSYS software.

Glass, B. J.↗

Thermal Expert System (TEXSYS): Systems automony demonstration project, volume 1. Overview

The Systems Autonomy Demonstration Project (SADP) produced a knowledge-based real-time control system for control and fault detection, isolation, and recovery (FDIR) of a prototype two-phase Space Station Freedom external active thermal control system (EATCS). The Thermal Expert System (TEXSYS) was demonstrated in recent tests to be capable of reliable fault anticipation and detection, as well as ordinary control of the thermal bus. Performance requirements were addressed by adopting a hierarchical symbolic control approach-layering model-based expert system software on a conventional, numerical data acquisition and control system. The model-based reasoning capabilities of TEXSYS were shown to be advantageous over typical rule-based expert systems, particularly for detection of unforeseen faults and sensor failures. Volume 1 gives a project overview and testing highlights. Volume 2 provides detail on the EATCS test bed, test operations, and online test results. Appendix A is a test archive, while Appendix B is a compendium of design and user manuals for the TEXSYS software.

Glass, B. J.↗

Real-Time Testbed for Transmission Line Protection

Hardware in the loop (HIL) testing is crucial for designing and managing electric power grids. These grids are becoming larger and more complex. The importance for students to have safe and intuitive ways to interact with the devices associated with the power grids has never been more crucial. Since most of these tests involve high voltages, this can be a deterrent for instructors and students in undergraduate programs. HIL testing is a solution to these common issues. This method has become one of the most popular methods for testing these power systems. With the use of Western Michigan University’s (WMU) Real-Time Digital Simulator (RTDS) and SEL-421-7 protection relay, a HIL testbed has been created. These devices were interconnected using the communication protocol known as Generic Object-Oriented Substation Event (GOOSE). A simulated transmission line system was modeled in an RTDS software RSCAD as the basis for this testbed. This model simulated different types of faults that could occur in a transmission line while in operation. The SEL-421-7 relay is connected to the RSCAD simulation via GOOSE to protect our simulated transmission line. This testbed was set up to give students a clear understanding of how distance protection works as well as how the SEL-421-7 will react to various kinds of faults, in addition to how useful the RTDS can be when testing different power systems.

24 POWER TRANSMISSION AND DISTRIBUTION↗

The SIFT Code Specification

The specification of Software Implemented Fault Tolerance (SIFT) consists of two parts, the specifications of the SIFT models and the specifications of the SIFT PASCAL program which actually implements the SIFT system. The code specifications are the last of a hierarchy of models describing the operation of the SIFT system and are related to the SIFT models as well as the PASCAL program. These Specifications serve to link the SIFT models to the running program. The specifications are very large and detailed and closely follow the form and organization of the PASCAL code. In addition to describing each of the components of the SIFT code, the code specifications describe the assumptions of the upper SIFT models which are required to actually prove that the code will work as specified. These constraints are imposed primarily on the schedule tables.

Source record↗

Development and validation of techniques for improving software dependability

A collection of document abstracts are presented on the topic of improving software dependability through NASA grant NAG-1-1123. Specific topics include: modeling of error detection; software inspection; test cases; Magnetic Stereotaxis System safety specifications and fault trees; and injection of synthetic faults into software.

Knight, John C.↗

Results of software error-data experiments

In order to evaluate existing software reliability models and proposed modeling approaches, a search was conducted for data on the software failure process. This search revealed that the data necessary for this evaluation were not available. As a result, a research effort was initiated by NASA to generate data on which to base the development of credible methods for assessing the reliability of software targeted for flight-crucial applications. Two sets of software error-data experiments were conducted by different research groups. The results of the experiments were consistent: errors caused by different faults in a program occurred at widely varying rates; program failure rates exhibited a log-linear trend with respect to the number of faults corrected; some faults were found to interact in either concealing or revealing ways; and contiguous regions of the input space which cause a program to generate errors, called error crystals, were found and characterized for some faults. Collectively, these experiments have produced information on software failure which must be accounted for in software reliability modeling approaches.

Finelli, George B.↗

Results of the Systems Autonomy Demonstration Project

The Systems Autonomy Demonstration Project (SADP) produced a knowledge-based real-time control system for real-time control and fault detection, isolation and recovery (FDIR) of a prototype two-phase Space Station Freedom external control system (TCS). The Thermal Expert System (TEXSYS) was demonstrated in recent tests to be capable of reliable fault anticipation and detection, as well as nominal control of the thermal bus. Performance requirements were addressed by adopting a hierarchical symbolic control approach, layering model-based expert system software on a conventional numerical data acquisition and control system. The model-based capabilities of TEXSYS were shown to be advantageous, particularly for detection of unforeseen faults and sensor failures.

Glass, B. J.↗