Reliable software systems design: defect prevention, detection, and containment
Explore the source record for details and available documents.
SEARCH · Engineering Papers
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Explore the source record for details and available documents.
The penetration of wind energy has increased significantly in the power grid in recent times. Although wind is abundant, environment-friendly, and cheap, it is variable in nature and does not contribute to system inertia as much as conventional synchronous generators. Coupled with the low inertia contribution, the generation intermittency of wind power leads to reliability and stability issues in the power system. Energy storage systems (ESSs) are among the most prominent alternatives to alleviate these concerns associated with high wind penetration. This paper proposes a planning strategy to size ESS for the reliability and frequency security of wind-rich power grids. A probabilistic methodology for ESS sizing is developed utilizing a composite reliability-based framework with sequential Monte Carlo simulation (MCS). The MCS generates composite reliability indices for the power system, which are employed to obtain the capacity for a reliability energy storage system (RESS). Simultaneously, the MCS-derived probability of synchronization of conventional generators is integrated into an analytical approach for sizing a frequency support energy storage system (FESS). The effect of wind farm dispersion across geographical regions is incorporated in the framework to study possible reductions in the ESS size while maintaining the system reliability and frequency security. Furthermore, the efficacy of the proposed strategy is demonstrated on the RTS-GMLC test system.
The stability of inter-area electromechanical oscillations are critical to power system reliability. Due to the complexities of power systems, relationships between system conditions and oscillation characteristics, such as damping and frequency, tend to be expressed only in generalities. In this study, a list of influential factors on Western Electricity Coordinating Council (WECC) interconnect modal characteristics are identified and evaluated with advanced machine learning techniques including principal component analysis, analysis of variance, random forest feature selection, support vector machine, and artificial neural network approaches.
Presentation about margin-based reliability modeling for EPRI
The problem to be addressed in this paper is to explore how the use of Soft Computing Technologies (SCT) could be employed to improve overall vehicle system safety, reliability, and rocket engine performance by development of a qualitative and reliable engine control system (QRECS). Specifically, this will be addressed by enhancing rocket engine control using SCT, innovative data mining tools, and sound software engineering practices used in Marshall's Flight Software Group (FSG). The principle goals for addressing the issue of quality are to improve software management, software development time, software maintenance, processor execution, fault tolerance and mitigation, and nonlinear control in power level transitions. The intent is not to discuss any shortcomings of existing engine control methodologies, but to provide alternative design choices for control, implementation, performance, and sustaining engineering, all relative to addressing the issue of reliability. The approaches outlined in this paper will require knowledge in the fields of rocket engine propulsion (system level), software engineering for embedded flight software systems, and soft computing technologies (i.e., neural networks, fuzzy logic, data mining, and Bayesian belief networks); some of which are briefed in this paper. For this effort, the targeted demonstration rocket engine testbed is the MC-1 engine (formerly FASTRAC) which is simulated with hardware and software in the Marshall Avionics & Software Testbed (MAST) laboratory that currently resides at NASA's Marshall Space Flight Center, building 4476, and is managed by the Avionics Department. A brief plan of action for design, development, implementation, and testing a Phase One effort for QRECS is given, along with expected results. Phase One will focus on development of a Smart Start Engine Module and a Mainstage Engine Module for proper engine start and mainstage engine operations. The overall intent is to demonstrate that by employing soft computing technologies, the quality and reliability of the overall scheme to engine controller development is further improved and vehicle safety is further insured. The final product that this paper proposes is an approach to development of an alternative low cost engine controller that would be capable of performing in unique vision spacecraft vehicles requiring low cost advanced avionics architectures for autonomous operations from engine pre-start to engine shutdown.
This paper contains an overview of a theoretical framework for the design of reliable multivariable control systems, with special emphasis on actuator failures and necessary actuator redundancy levels. Using a linear model of the system, with Markovian failure probabilities and quadratic performance index, an optimal stochastic control problem is posed and solved. The solution requires the iteration of a set of highly coupled Riccati-like matrix difference equations; if these converge one has a reliable design; if they diverge, the design is unreliable, and the system design cannot be stabilized. In addition, it is shown that the existence of a stabilizing constant feedback gain and the reliability of its implementation is equivalent to the convergence properties of a set of coupled Riccati-like matrix difference equations. In summary, these results can be used for offline studies relating the open loop dynamics, required performance, actuator mean time to failure, and functional or identical actuator redundancy, with and without feedback gain reconfiguration strategies.
Apollo gyro reliability covering Guidance, Navigation and Control systems, stressing failure mode prediction
Despite state-of-the-art technologies like artificial intelligence, human judgment is critically essential in cooperative systems, such as the multi-agent system (MAS), which collect information among agents based on multiple-cue judgment. Human agents can prevent impaired situational awareness of automated agents by confirming situations under environmental uncertainty. System error caused by uncertainty can result in an unreliable system environment, and this environment affects the human agent, resulting in non-optimal decision-making in MAS. Thus, it is necessary to know how human behavior is changed to capture system reliability under uncertainty. Another issue affecting MAS is time delay, which can delay agent information transfer, resulting in low performance and instability. However, it is difficult to find studies on the influence of time delay on human agents. This study is about understanding the human decision-making process under a specific system reliability environment by uncertainty with time delay. We used concepts of expected and unexpected uncertainty to implement reliability of the system usage environment with three types of time delay conditions: no time delay, regular time delay, and irregular time delay conditions. We used electroencephalogram (EEG) for human cognitive neural mechanisms in multiple-cue judgment systems to understand human decision-making. In the reliability of system usage environment, the unreliable system environment significantly creates less memory load by less utilization of system rules for decision-making. In terms of time delay, delayed information delivery does not significantly affect memory load for decision-making.
Reliability modeling must take into account two different types of phenomena, including the fault-occurrence behavior and the fault/error-handling behavior of a system. The effectiveness of the fault/error-handling behavior can be captured by instantaneous coverage probabilities. This paper has the objective to show that the assumption of instantaneous coverage leads to conservative predictions of system reliability for systems characterized by relatively long interevent times for fault occurrences and relatively short interevent times for fault/error-handling actions. The importance of this result is related to the fact that it can now be shown that model predictions based on instantaneous coverage are lower bounds on the true system reliability. Attention is given to a semi-Markov reliability model, instantaneous coverage approximations, the proof of conservative prediction, and the computation of coverage probabilities.
In this work, we propose a Generalized Disjunctive Programming (GDP) model that optimizes both long-term capacity planning (such as the number and size of dispatchable/renewable generators, batteries, and transmission lines) and hourly operation (such as on/off schedules of dispatchable generators, power output from each generator, and power flow) to maximize power system reliability while minimizing total cost and CO2 emissions.
Reliability data employed in plant reliability models are an approximated integral representation of the past industrywide operational experience, and they neglect the present asset health status (available, for example, from online monitoring data and diagnostic assessments) and forecasted health projection (when available from prognostic models). Ideally, in a predictive maintenance context, system reliability models should support decision making by propagating actual health information from the asset to the system level in order to provide a quantitative snapshot of system health and identify the most critical assets. Asset health should be informed solely by that specific asset’s current and historical performance data and should not be an approximated integral representation of the past industrywide operational experience (as currently performed by system reliability models through Bayesian updating processes). This paper proposes a reliability modeling approach that relies on asset diagnostic and prognostic assessments, along with monitoring data to measure asset health. We show how state-of-the art condition-based, diagnostic, prognostic, and anomaly detection models can be linked to system reliability models not in probability terms, but in terms of margin where margin is defined as the “distance” between the present status and an undesired event (e.g., failure or unacceptable performance). Then, we show how the propagation of margin data from the asset to the system level is performed through classical reliability models such as fault trees or reliability block diagrams. The described method is in fact able to propagate heterogenous health data from the asset to the system level in order to analytically assess system health.
Systems for Space Defense Initiative (SDI) space applications typically require both high performance and very high reliability. These requirements present the systems engineer evaluating such systems with the extremely difficult problem of conducting performance and reliability trade-offs over large design spaces. A controlled development process supported by appropriate automated tools must be used to assure that the system will meet design objectives. This report describes an investigation of methods, tools, and techniques necessary to support performance and reliability modeling for SDI systems development. Models of the JPL Hypercubes, the Encore Multimax, and the C.S. Draper Lab Fault-Tolerant Parallel Processor (FTPP) parallel-computing architectures using candidate SDI weapons-to-target assignment algorithms as workloads were built and analyzed as a means of identifying the necessary system models, how the models interact, and what experiments and analyses should be performed. As a result of this effort, weaknesses in the existing methods and tools were revealed and capabilities that will be required for both individual tools and an integrated toolset were identified.
This Phase I project Summary will be formatted as a series of summary statements, with additional comments. The summary statements are intended to focus on the most significant findings and discoveries – things that the project team knows now, but we didn’t know at the beginning of the project: 1) Direct Contact Between Gases is an ECLS (Environmental Control and Life Support) System enabling capability; 2) CO2 capture using liquid sorbents in microgravity is feasible; 3) There are other ways to contact gases and liquids – but thin film capillary techniques are new, exciting, and have amazing potential; 4) ECLS system reliability is the key to exploration missions – the key to reliability is having system attributes that favor reliability; 5) The processes with favorable reliability attributes tend to be biological; 6) The single greatest impact on launch mass of an ECLS system is water. The best way to enable biological water processing is to develop a capillary based method of urine capture that doesn’t use pretreat chemicals; 7) There is good, promising, forward design and development work – but no fundamental “show stoppers” – to develop a thin film liquid sorbent CO2 capture system; 8) The most capable Ionic Liquids are not presently feasible, but other chemically active liquids can be used to make an effective thin film CO2 capture device; 9) The C9 reduced gravity flight showed feasibility – and taught us about flow instability issues; 10) Capillary fluid management has ECLS system wide implications.
Solar photovoltaic (PV) installations have experienced unprecedented growth in the United States. PV will become not only an energy producer but also a necessary provider of ancillary services at multiple timescales. Conventional methods to simulate power systems operations - such as long-term production simulation (which typically considers schedules from hours to minutes by using an optimization framework) and short-term transient studies (which simulate dynamics from seconds to sub-seconds using state variables and differential equations) - are not sufficient for studying the multiple-timescale variation of solar generation and its impact on system reliability. Long-term system economics and short-term system dynamics are highly coupled, particularly when the penetration level of renewable generation is extremely high, because the uncertainty and variability of solar generation will impact both power system steady-state and dynamic performance. This project helps meet and exceed the U.S. Department of Energy Office of Energy Efficiency and Renewable Energy Solar Energy Technologies Office goal of systems integration by directly addressing this stability and reliability challenge for power grid planning and operation. We have developed a temporally comprehensive, closed-loop simulation model, named Multi-timescale Integrated Dynamics and Scheduling (MIDAS), that seamlessly simulates power system operations from economic scheduling (day-ahead to hours) to dynamic response analysis (seconds to sub-seconds). For schedules with very high levels of inverter-based resources (IBRs), up to and including 100%, the stability of grid controls has been evaluated through electromagnetic transient (EMT) simulations and power-hardware-in-the-loop (PHIL) simulations of key transient events at key schedule points. Specifically, MIDAS provides: 1) a closed-loop simulation framework for simulating timescales from economic scheduling to dynamic stability analysis; 2) machine learning-based stability assessment; 3) EMT modeling and analysis for large-scale power systems; 4) MIDAS PHIL test bed. We worked with Hawaii Electric Companies to apply the MIDAS study framework to a Maui grid study. The entire island's transmission system was modeled in detail - from a yearly scheduling model, to a second-level frequency dynamic model, down to a sub-second-scale EMT model to address critical stability issues. The project demonstrated how MIDAS can help system planners and operators assess system reliability and stability while the power grid is marching toward a high-renewable, high-IBR future. In this Maui grid study, we found that 100% instantaneous IBR operation is achievable in EMT simulation and PHIL testing, and grid planners and operators might need new analysis/simulation tools to assess grid reliability and stability in the scheduling stage. MIDAS will bring Maui and other systems closer to 100% clean and stable energy futures. (In this study, we examined transient stability. Other topics necessary for 100% IBR operation, such as protection and resource adequacy, were not examined.)
A digital computer code was developed to simulate the time-dependent behavior of the 5-kwe reactor thermoelectric system. The code was used to determine lifetime sensitivity coefficients for a number of system design parameters, such as thermoelectric module efficiency and degradation rate, radiator absorptivity and emissivity, fuel element barrier defect constant, beginning-of-life reactivity, etc. A probability distribution (mean and standard deviation) was estimated for each of these design parameters. Then, error analysis was used to obtain a probability distribution for the system lifetime (mean = 7.7 years, standard deviation = 1.1 years). From this, the probability that the system will achieve the design goal of 5 years lifetime is 0.993. This value represents an estimate of the degradation reliability of the system.
Nasa reliability evaluation program for operational systems set forth in npc 250-1
This report analyzes the reliability of NASA's Ultra-reliable Fault Tolerant Control System (UFTCS) architecture as it is currently envisioned for helicopter control. The analysis is extended to air transport and spacecraft control using the same computational and voter modules applied within the UFTCS architecture. The system reliability is calculated for several points in the helicopter, air transport, and space flight missions when there are initially 4, 5, and 6 operating channels. Sensitivity analyses are used to explore the effects of sensor failure rates and different system configurations at the 10 hour point of the helicopter mission. These analyses show that the primary limitation to system reliability is the number of flux windings on each flux summer (4 are assumed for the baseline case). Tables of system reliability at the 10 hour point are provided to allow designers to choose a configuration to meet specified reliability goals.
The study of a comparative analysis of distinct multiplex and fault-tolerant configurations for a PLC-based safety system from a reliability point of view is presented. It considers simplex, duplex and fault-tolerant triple redundancy configurations. The standby unit in case of a duplex configuration has a failure rate which is k times the failure rate of the standby unit, the value of k varying from 0 to 1. For distinct values of MTTR and MTTF of the main unit, MTBF and availability for these configurations are calculated. The effect of duplexing only the PLC module or only the sensors and the actuators module, on the MTBF of the configuration, is also presented. The results are summarized and merits and demerits of various configurations under distinct environments are discussed.