COMPASS

AUTOGEF Process and Enviroment

AUTOGEF has followed a model-based approach to achieve the automated model generation for FDIR sub-system development. This approach is compatible with the modelling and analyses provided by the COMPASS (Correctness, Modelling and Performance of Aerospace System) environment using SLIM (System-Level Integrated Modelling) formalism, as well as with the current FDIR architectures and strategies. AUTOGEF project has developed the Automated Model Generation Toolset for FDIR (AUTOGEF) implementing the defined synthesis approach as an add-on to the COMPASS Toolset.
The AUTOGEF toolset generates FDIR subsystem(s)/component(s) automatically based on:

• COMPASS extended model. It is generated automatically by COMPASS when the System/RAMS Engineer loads the SLIM models (nominal and error) and defines one or more fault injections. The nominal model shall include:
  • The set of system observables. The System/RAMS Engineer shall identify the set of parameters that are accessible by the FDIR component(s).
  • The set of recovery actions.

  Both the observables and recovery actions are specified in the nominal model but this information is also represented in the extended model.

• COMPASS dependability and safety analyses (i.e., FTA and FMEA). The results of these analyses provide information to extract the list of faults.
• Mission specification: Mission characteristics such as mission phases, operational modes and spacecraft configurations.
• FDIR specification: operational objectives, target system dependability (safety) characteristics and architectural requirements. These data are also specified by the System/RAMS Engineer and loaded through the AUTOGEF GUI.

Figure below depicts the integration of AUTOGEF within COMPASS context graphically. A star highlights the inputs, outputs and tools developed by AUTOGEF project. Pink boxes represent the inputs that the System/RAMS Engineer has to load. Below are summarized the steps of the FDIR development process following AUTOGEF methodology using AUTOGEF toolset. It includes the whole actions that the System/RAMS Engineer has to perform (including the COMPASS ones) to generate the FDIR model.

• Design system nominal and error models (SLIM language).
• Specify observable attributes in the nominal model (observable keyword).
• Load nominal and error models (‘Model’ window of COMPASS tool).
• Specification of one or more fault injections (‘Model’ window of COMPASS tool). Then, COMPASS generates the Extended Model automatically. By default, faults are extracted from the fault injections which are enabled.
• Specification of the mission. The mission specification provides additional model characteristics, namely: mission phases, operational modes, and spacecraft configurations.
• Definition of properties (‘Properties’ window of COMPASS tool) to be verified during Fault Tree and FMEA analyses.
• Generation of FTA (‘Safety-Fault Tree Generation’ window of COMPASS tool):
  • Selection of those properties to be analysed.
  • Generation of FTA which shows how the state of the property is reached expressed in terms of fault events in the SLIM language.
• Generation of FMEA tables (‘Safety-Failure Mode Effect Analysis’ window of COMPASS tool):
  • Selection of those properties to be analysed.
  • Selection of the cardinality.
  • Generation of FMEA which shows the failure modes and effects.
• Load FDIR specification (AUTOGEF GUI).
• Start AUTOGEF execution (AUTOGEF GUI).

FDIR diagnosis and controllers are synthesized generating FDIR model in SLIM language. The controllers are compliant with the FDIR specification. FDIR component(s) identifies the attributes that represent the detection means for the system properties. When a fault is detected, FDIR model triggers the recovery actions defined in the nominal model.
The methodology and the toolset have been demonstrated in the context of the FDIR development process lifecycle, taking advantage of a case study implementing a sub-set of the Trace Gas Orbiter (TGO) of the EXOMARS project.
A set of metrics were defined providing different criteria to check their adequacy in terms of applicability, scalability, usability, and performance for its use in the context of critical on-board space systems and software development. The relationship and impact of AUTOGEF methodology and toolset on the current industrial practices and processes in the context of the corresponding ECSS standards have also been assessed.
The AUTOGEF toolset and methodology guide the FDIR engineer in the different steps of the FDIR design process. On one hand, the modelling of the nominal system allows to identify system architecture, system data and behaviour, and to verify the correctness of this model against the real system by means of simulation and model checking.
In a second step, the top down feared event analysis, and the bottom up Failure mode analysis allows to identify the set of errors that can lead to a system failure, or to the loss of a function. COMPASS toolset allows analysing the “extended” model composed of the nominal model with injected faults. Fault trees can be generated, and if needed, mitigation means can be added in the system design to improve its robustness and safety.
Looking at the operational analysis, the FDIR engineer can then capture thanks to AUTOGEF the mission phases and operational modes of the project. This is useful to identify FDIR requirements per phase/mode, and to start identifying recovery objectives. When all these activities are completed, AUTOGEF can be used to formalize FDIR specification in terms of Fault detection requirements, and fault recovery requirements.
Synthesis routines of AUTOGEF are then used to generate a FDIR design compliant with input specification. This design, back-translated in SLIM, is combined with the nominal model, and COMPASS analysis allows the FDIR engineer to evaluate the correctness and efficiency of the synthesised elements.