Completeness, robustness, and safety in real-time software requirements specification

This paper presents an approach to providing a rigorous basis for ascertaining whether or not a given set of software requirements is internally complete, i.e., closed with respect to questions and inferences that can be made on the basis of information included in the specification. Emphasis is placed on aspects of software requirements specifications that previously have not been adequately handled, including timing abstractions, safety, and robustness

Multiple Access Trade Study

The Personal Access Satellite System (PASS) strawman design uses a hybrid Time Division Multiple Access (TDMA)/Frequency Division Multiple Access (FDMA) implementation. TDMA is used for the forward direction (from Suppliers to Users), and FDMA for the return direction (from Users to Suppliers). An alternative architecture is proposed that will require minimal real time coordination and yet provide a fast access method by using random access Code Division Multiple Access (CDMA). The CDMA system issues are addressed such as connecting suppliers and users, both of whom may be located anywhere in the CONUS, when the user terminals are constrained in size and weight; and providing efficient traffic routing under highly variable traffic requirements. It is assumed that bandwidth efficiency is not of paramount importance. CDMA or Spread Spectrum Multiple Access (SSMA) communication is a method in which a group of carriers operate at the same nominal center frequency but are separable from each other by the low cross correlation of the spreading codes used. Interference and multipath rejection capability, ease of selective addressing and message screening, low density power spectra for signal hiding and security, and high resolution ranging are among the benefits of spread spectrum communications

Design of a fault tolerant airborne digital computer. Volume 1: Architecture

This volume is concerned with the architecture of a fault tolerant digital computer for an advanced commercial aircraft. All of the computations of the aircraft, including those presently carried out by analogue techniques, are to be carried out in this digital computer. Among the important qualities of the computer are the following: (1) The capacity is to be matched to the aircraft environment. (2) The reliability is to be selectively matched to the criticality and deadline requirements of each of the computations. (3) The system is to be readily expandable. contractible, and (4) The design is to appropriate to post 1975 technology. Three candidate architectures are discussed and assessed in terms of the above qualities. Of the three candidates, a newly conceived architecture, Software Implemented Fault Tolerance (SIFT), provides the best match to the above qualities. In addition SIFT is particularly simple and believable. The other candidates, Bus Checker System (BUCS), also newly conceived in this project, and the Hopkins multiprocessor are potentially more efficient than SIFT in the use of redundancy, but otherwise are not as attractive

Continued study of NAVSTAR/GPS for general aviation

A conceptual approach for examining the full potential of Global Positioning Systems (GPS) for the general aviation community is presented. Aspects of an experimental program to demonstrate these concepts are discussed. The report concludes with the observation that the true potential of GPS can only be exploited by utilization in concert with a data link. The capability afforded by the combination of position location and reporting stimulates the concept of GPS providing the auxiliary functions of collision avoidance, and approach and landing guidance. A series of general recommendations for future NASA and civil community efforts in order to continue to support GPS for general aviation are included

Active power sharing and frequency regulation in inverter-based islanded microgrids subject to clock drifts, damage in power links and loss of communications

Tesi en modalitat de compendi de publicacions; hi ha diferents seccions retallades per drets de l'editorMicrogrids (MGs) are small-scale power systems containing storage elements, loads and distributed generators that are interfaced with the electric network via power electronic inverters. When an MG is in islanded mode, its dynamics are no longer dominated by the main grid. Then, inverters, driven by digital processors that may exchange data over digital communication, must act as voltage source inverters (VSIs) to take coordinated actions to ensure power quality and supply. The scope of this thesis is bounded to control strategies for active power sharing and frequency regulation in islanded MGs. The focus is on the analysis of prototype control policies when operating conditions are no longer ideal. In particular, the thesis covers the effect that a) clock drifts of digital processors, b) damage in power transmission lines, and c) failures in digital communications have in control performance. The work is submitted as a compendium of publications, including journal and international conference papers, where two main areas of research can be distinguished. The first area refers to the analysis of the effect that clock drifts have on frequency regulation and active power sharing. VSIs digital processors are equipped with oscillators, which run at not necessarily identical frequencies. As consequence, the local clocks in the physically distributed VSIs may differ. This part, reported in two conference papers and one journal paper, investigates state-of-the-art control policies when clocks of the computational devices drift. The contributions related to this part are a) the reformulation of existing control policies in terms of clock drifts, b) the steady-state analysis of these policies that offers analytical expressions to quantify the impact that drifts have on frequency and active power equilibrium points, c) the closed-loop model capable of accommodating all the policies, d) the stability analysis of the equilibrium points, and e) the experimental results. The second area copes with the analysis of the effect that electrical and communication failures have on frequency regulation and active power sharing. This investigation focuses on distributed/cooperative control policies where each inverter control action is computed using both local measures and data received from other inverters within the MG. This part, reported in one conference paper and two journal papers, investigates two control policies when the considered failures in terms of damage in power links and/or loss of communication between inverters provoke partitions within the MG. The contributions related to this part are a) the formulation of the MG as two connected graphs corresponding to the electrical and communication networks where both type of failures lead to disconnected electrical/communication sub-graphs, named partitions, that co-exist within the MG, b) the closed-loop model integrating the two graph Laplacian matrices, c) the stability analysis that identifies which type of partitions may lead to MG instability, d) the steady-state analysis that indicates how to compute the equilibrium points for the case of stable dynamics, e) a new control strategy based on switched control principles that permits avoiding the instability scenario, and f) the experimental results. For the purpose of verifying the operational performance of the analytical results, diverse experiments on a laboratory MG have been performed. The outcomes obtained are discussed and analyzed in terms of the objectives sought. Finally, conclusions and future research lines complete the thesis.Las microredes (MG) son sistemas de energía a pequeña escala que contienen elementos de almacenamiento, cargas y generadores distribuidos que están conectados con la red eléctrica a través de inversores de potencia. Cuando una MG está en modo aislado, su dinámica no está dominada por la red principal. Así, los inversores, comandados por procesadores digitales que pueden intercambiar información a través de comunicaciones digitales, deben actuar como fuentes de voltaje para ejecutar acciones coordinadas que garanticen el suministro de energía. Esta tesis se enmarca dentro de estrategias de control de última generación para compartir potencia activa y regular frecuencia en MG aisladas basadas en inversores. Su enfoque se centra en analizar estas políticas cuando las condiciones de operación no son ideales. En particular, la tesis cubre el efecto que a) desviaciones del reloj de los procesadores digitales, b) daños en las líneas de transmisión de energía, y c) fallas en las comunicaciones digitales, provocan en el rendimiento de control. El trabajo se presenta como un compendio que incluye publicaciones de revistas y de conferencias internacionales, donde se pueden distinguir dos temas principales de investigación. El primer tema comprende el análisis del efecto que tienen las desviaciones de reloj sobre la regulación de frecuencia y la compartición de potencia activa. Los procesadores de los inversores están equipados con osciladores que funcionan a frecuencias no necesariamente idénticas. Como consecuencia, los relojes locales en los inversores distribuidos físicamente, pueden diferir. Esta parte, descrita a través de dos artículos de conferencia y uno de revista, analiza el comportamiento de las políticas de control cuando los relojes de los dispositivos computacionales se desvían. Las contribuciones relacionadas con este tema son a) reformulación de las políticas de control de última generación en términos de desviaciones de reloj, b) análisis de estado estacionario de estas estrategias que ofrece expresiones analíticas para cuantificar el impacto que las desviaciones de reloj tienen sobre los puntos de equilibrio de frecuencia y potencia activa, c) modelo de lazo cerrado adaptable a todas las políticas, d) análisis de estabilidad de los puntos de equilibrio, y e) resultados experimentales. El segundo tema hace frente al análisis del efecto que las fallas eléctricas y de comunicaciones tienen sobre la regulación de frecuencia y el uso compartido de potencia activa. Esta parte se centra en políticas de control distribuido/cooperativo donde cada acción de control del inversor se calcula utilizando medidas locales y datos recibidos de otros inversores de la MG. Esta parte, descrita a través de un artículo de conferencia y dos de revista, investiga dos políticas de control cuando particiones en la MG son provocadas por daños en los enlaces de alimentación y/o por pérdida de comunicación entre inversores. Las contribuciones relacionadas con este tema son a) formulación de la MG como dos grafos correspondientes a las redes eléctrica y de comunicación donde ambos tipos de fallas conducen a sub-grafos eléctricos/comunicacionales desconectados, llamados particiones, que coexisten dentro de la MG, b) modelo de lazo cerrado que integra las matrices Laplacianas de los dos grafos, c) análisis de estabilidad que identifica las particiones que pueden conducir a inestabilidad en la MG, d) análisis de estado estacionario para calcular puntos de equilibrio cuando la dinámica es estable, e) nueva estrategia basada en principios de control conmutado para evitar el escenario de inestabilidad, y f) resultados experimentales. Con el fin de verificar el rendimiento operativo de los resultados analíticos, se han realizado diversos experimentos sobre una microred de laboratorio, los mismos que se discuten en términos de los objetivos de la tesis. El trabajo finaliza con las conclusionesPostprint (published version

SpiNNaker: Fault tolerance in a power- and area- constrained large-scale neuromimetic architecture

AbstractSpiNNaker is a biologically-inspired massively-parallel computer designed to model up to a billion spiking neurons in real-time. A full-fledged implementation of a SpiNNaker system will comprise more than 105 integrated circuits (half of which are SDRAMs and half multi-core systems-on-chip). Given this scale, it is unavoidable that some components fail and, in consequence, fault-tolerance is a foundation of the system design. Although the target application can tolerate a certain, low level of failures, important efforts have been devoted to incorporate different techniques for fault tolerance. This paper is devoted to discussing how hardware and software mechanisms collaborate to make SpiNNaker operate properly even in the very likely scenario of component failures and how it can tolerate system-degradation levels well above those expected

Wildcard dimensions, coding theory and fault-tolerant meshes and hypercubes

Hypercubes, meshes and tori are well known interconnection networks for parallel computers. The sets of edges in those graphs can be partitioned to dimensions. It is well known that the hypercube can be extended by adding a wildcard dimension resulting in a folded hypercube that has better fault-tolerant and communication capabilities. First we prove that the folded hypercube is optimal in the sense that only a single wildcard dimension can be added to the hypercube. We then investigate the idea of adding wildcard dimensions to d-dimensional meshes and tori. Using techniques from error correcting codes we construct d-dimensional meshes and tori with wildcard dimensions. Finally, we show how these constructions can be used to tolerate edge and node faults in mesh and torus networks

Advanced information processing system: The Army fault tolerant architecture conceptual study. Volume 2: Army fault tolerant architecture design and analysis

Described here is the Army Fault Tolerant Architecture (AFTA) hardware architecture and components and the operating system. The architectural and operational theory of the AFTA Fault Tolerant Data Bus is discussed. The test and maintenance strategy developed for use in fielded AFTA installations is presented. An approach to be used in reducing the probability of AFTA failure due to common mode faults is described. Analytical models for AFTA performance, reliability, availability, life cycle cost, weight, power, and volume are developed. An approach is presented for using VHSIC Hardware Description Language (VHDL) to describe and design AFTA's developmental hardware. A plan is described for verifying and validating key AFTA concepts during the Dem/Val phase. Analytical models and partial mission requirements are used to generate AFTA configurations for the TF/TA/NOE and Ground Vehicle missions