AeroSense, April System Health Tracking and Safe Testing André Bos, Arjan van Gemund Jonne Zutt Delft University of Technology

AeroSense, April Contents The role of diagnosis in autonomous systems Health tracking Diagnosis as health tracking Modeling Safe testing Future work

AeroSense, April The role of diagnosis in autonomous systems Accomplish mission goals without human intervention even in a harsh environment Harsh environment: system failures Without human intervention: identify, isolate, and cope with system failures automatically Graceful degradation

AeroSense, April Accomplishing mission goals Mission goals State(t j ) State(t 0 ) Action...Action plan Resources (fuel, system components,…) Health state

AeroSense, April Architecture S/C FDI Health mode TC TM Planning/recovery and safety validation Mission goals Safe plan

AeroSense, April Diagnostic system requirements Dynamic and hybrid systems Accumulating faults Test vector generate to further isolate faulty components Easy to model Single model (if possible) to support diagnostic reasoning, test vector generation, planning, and simulation

AeroSense, April Health tracking Dynamic and hybrid systems Variables: U - Inputs: close shutter, switch-on lamp,… X - State: shutter position, lamp current Y - Observables dx/dtH

AeroSense, April Health tracking (cont.) Extend behavioural description: X to include fault states F, H to accommodate for fault state behavior. Note: non- deterministic system

AeroSense, April Example system S/R latch Set Reset Set Out time Set Out time Error can be detected only here

AeroSense, April UpTime model-based approach (1) UpTime design system to construct model-based diagnosis systems. Based on our experience of constructing a model-based diagnosis system for the GOME instrument (ERS-2 satellite).

AeroSense, April UpTime model-based approach (2) Component-based. Coarse formalism Finite Domain constraints. Finite state machine to capture dynamics. Simplified behavioral description. dU  dI E.g.: If I goes up, pressure difference goes up. Each component: dx/dth

AeroSense, April UpTime: Component description Behavioral description Finite State Machine. Inter and intra state equations. Both nominal and fault state changes. cl st-cl op st-op switch in = cl, st = op : next st := cl in = cl, st = st-op: next st := st-op … state = op: dI = 0 state = cl: dI  dU state = stuck-open: dI = 0 …

AeroSense, April UpTime: algorithm (3) Likelihood trajectory determined using: A priori likelihood state transition per component. The number of output variables explained. Time State

AeroSense, April sone Example system S/R latch Set Reset Set Out time Set Out time Likelihood All Components okay Likelihood #S1_AB Likelihood #S1_AB Likelihood #S2_AB

AeroSense, April Safe-testing Test vectors: As system is only partially observable, use test vectors to discriminate between possible (health) states. Be careful, test vectors may induce errors. load Possible Shortage fault

AeroSense, April Hazard conditions (1) Hazard conditions describe conditions that should not happen. Same language and model as used for diagnostic system. Conditions on the state of the S/C.

AeroSense, April Hazard conditions (2) Battery: Not directly connected to ground. Need extra variables to describe “connectedness” behavior. Not always possible to give hazard conditions per component. load Possible Shortage fault

AeroSense, April Test action Test action must: Discriminate between possible trajectories. Must not violate any hazard condition.

AeroSense, April Checking a test action … S i-1 SiSi SiSi S i+1 … … S i+k Effect of test action

AeroSense, April Future work Model-based approach: Domain dependent: model of the S/C Domain independent: Reasoning methods:  diagnosis  testing Target system System model Safety conditions, mission goals,... S/W generator Diagnostic reasoner Simulator Planning system

AeroSense, April Example Time State Set switch closed Both S2 ok and S2 stuck open predict output high Set Reset S2 stuck open S2 ok Set switch released S2 ok: predicts output remains high S2 stuck open: predicts output low