Contents

AUTOGEF Process and Enviroment

AUTOGEF has followed a model-based approach to achieve the automated model generation for FDIR sub-system development. This approach is compatible with the modelling and analyses provided by the COMPASS (Correctness, Modelling and Performance of Aerospace System) environment using SLIM (System-Level Integrated Modelling) formalism, as well as with the current FDIR architectures and strategies. AUTOGEF project has developed the Automated Model Generation Toolset for FDIR (AUTOGEF) implementing the defined synthesis approach as an add-on to the COMPASS Toolset.
The AUTOGEF toolset generates FDIR subsystem(s)/component(s) automatically based on:
Figure below depicts the integration of AUTOGEF within COMPASS context graphically. A star highlights the inputs, outputs and tools developed by AUTOGEF project. Pink boxes represent the inputs that the System/RAMS Engineer has to load. AUTOGEF Process and Enviroment Below are summarized the steps of the FDIR development process following AUTOGEF methodology using AUTOGEF toolset. It includes the whole actions that the System/RAMS Engineer has to perform (including the COMPASS ones) to generate the FDIR model. FDIR diagnosis and controllers are synthesized generating FDIR model in SLIM language. The controllers are compliant with the FDIR specification. FDIR component(s) identifies the attributes that represent the detection means for the system properties. When a fault is detected, FDIR model triggers the recovery actions defined in the nominal model.
The methodology and the toolset have been demonstrated in the context of the FDIR development process lifecycle, taking advantage of a case study implementing a sub-set of the Trace Gas Orbiter (TGO) of the EXOMARS project.
A set of metrics were defined providing different criteria to check their adequacy in terms of applicability, scalability, usability, and performance for its use in the context of critical on-board space systems and software development. The relationship and impact of AUTOGEF methodology and toolset on the current industrial practices and processes in the context of the corresponding ECSS standards have also been assessed.
The AUTOGEF toolset and methodology guide the FDIR engineer in the different steps of the FDIR design process. On one hand, the modelling of the nominal system allows to identify system architecture, system data and behaviour, and to verify the correctness of this model against the real system by means of simulation and model checking.
In a second step, the top down feared event analysis, and the bottom up Failure mode analysis allows to identify the set of errors that can lead to a system failure, or to the loss of a function. COMPASS toolset allows analysing the “extended” model composed of the nominal model with injected faults. Fault trees can be generated, and if needed, mitigation means can be added in the system design to improve its robustness and safety.
Looking at the operational analysis, the FDIR engineer can then capture thanks to AUTOGEF the mission phases and operational modes of the project. This is useful to identify FDIR requirements per phase/mode, and to start identifying recovery objectives. When all these activities are completed, AUTOGEF can be used to formalize FDIR specification in terms of Fault detection requirements, and fault recovery requirements.
Synthesis routines of AUTOGEF are then used to generate a FDIR design compliant with input specification. This design, back-translated in SLIM, is combined with the nominal model, and COMPASS analysis allows the FDIR engineer to evaluate the correctness and efficiency of the synthesised elements.