Hybrid Modeling and Analysis of Error Recovery in Safety Critical Flight Control Systems

嵌入式计算机系统已经成为技术产品和系统的重要组成部分。波音777飞机上的实时计算机系统对安全至关重要，这是一种数字电传飞机。为了完全证明安全关键系统将按预期运行，需要对软件和硬件进行验证和验证。另一个挑战是在产生电磁干扰（EMI）的恶劣环境中使用安全关键系统，例如高强度辐射场（HIRF）或闪电。在这些恶劣的条件下，众所周知，三模冗余、纠错码和其他容错计算技术的用途有限，因为多个故障遏制区域几乎同时受到相关或共模故障的影响。该项目正在从头开始开发增强模型和分析工具，即从物理系统、控制器和环境的模型开始，以研究闭环系统的稳定性和嵌入式软件的安全特性。为了确保正在发展的理论基础是健全的，我们考虑了一类特殊的系统：具有错误恢复功能的计算机系统，它控制物理过程并减轻共模故障的影响。外部事件以一定的概率由强烈的电磁干扰的存在触发。内部事件由错误恢复逻辑生成。这类系统是混合的，因为它包括控制过程和电磁环境的连续时间动力学，控制器的离散时间动力学和过渡模型。正在开发的模型和工具是对交换系统模型和分析工具的增强。它们的能力通过一个特定的飞行控制系统一起或独立地进行验证。控制器正在使用一种过去30年来不断发展的体系结构来实现：回滚恢复。该体系结构已广泛应用于数字化过程控制系统和实时数据库事务系统中。特别是，使用双锁步处理器的回滚错误恢复架构是可恢复计算机系统（RCS）原型的一部分，该系统正在由nasa和工业界合作研究，用于处理瞬态或软共模故障。新模型将通过合作研究协议使用NASA兰利研究中心HIRF实验室的数据进行验证。在这个项目中开发的分析工具将允许系统设计人员在进行更昂贵和耗时的物理测试之前快速评估新的可恢复的计算机体系结构。

Oscar R. GonzalezCCR-0209094"Hybrid Modeling and Analysis of Error Recovery in Safety Critical Flight Control Systems"Embedded computer systems have become an essential component of technological products and systems. An example is the safety-critical real-time computer systems on board the Boeing 777, a digital fly-by-wire aircraft. To completely certify that safety-critical systems will operate as intended requires the validation and verification of both the software and the hardware. An additional challenge is the use of safety critical systems in harsh environments that produce electromagnetic interference (EMI) such as high intensity radiated fields (HIRF) or lightning. Under these harsh conditions, it is known that triple modular redundancy, error correcting codes, and other fault-tolerant computing techniques are of limited use, since multiple fault containment regions are near-simultaneously affected by correlated or common-mode faults. The project is developing enhanced models and analysis tools from the ground up, that is, it starts with models of the physical system, the controller, and the environment in order to study the stability of closed-loop systems and the safety properties of embedded software. To make sure that the theoretical foundations being developed are sound, a particular class of systems is considered: computer systems with error recovery, which control physical processes and mitigate the effects of common-mode faults. The external events are triggered with a certain probability by the presence of a harsh electromagnetic disturbance. The internal events are generated by the error recovery logic. This class of systems is hybrid since it includes the continuous-time dynamics of the process under control and of the electromagnetic environment, the discrete-time dynamics of the controller, and the models for the transitions. The models and tools being developed are enhancements of switched system models and analysis tools. Their capabilities are validated together and independently with a particular flight control system. The controller is being implemented using an architecture that has been evolving for the past 30 years: rollback recovery. This architecture has been widely used in digital process control systems and in real-time database transaction systems. In particular, a rollback error recovery architecture using dual-lock step processors is part of a prototype of a recoverable computer system (RCS) being investigated by a NASA-industry partnership to deal with transient or soft common-mode faults. The new models will be validated using data from NASA Langley Research Center's HIRF Laboratory via a Cooperative Research Agreement. The analytical tools developed in this project will allow system designers to quickly evaluate new recoverable computer architectures before doing the more expensive and time consuming physical tests.