Improving Hazard Analysis and Certification of Integrated Modular Avionics
Total Page:16
File Type:pdf, Size:1020Kb
C S R L Improving Hazard Analysis and Certification of Integrated Modular Avionics Cody Fleming 28 March 2013 C S Federated vs IMA Architectures R L From dedicated, de-coupled systems ↓ Integrated[Wind[Watkins River 2006], tightly2008] coupled systems with real-time requirements and virtual interfaces 1 C S Background R L IMA Regulatory Approach Establish Software Make the Real- Integrity Level Time OS according to Functional Fault Tolerant Hazard Analysis [Rushby 2011] [ARP-4761, 1996] Software Quality Ensure Robust Assurance Partition [DO-178, 2011] [DO-297, 2005] 2 C S Current Approach R L Partitioning & Interface Control Document (ICD) ICD ‘defines the message structure and protocols which govern the interchange of data and communication paths’ [NASA RP–1370] Generating Receiving • Premise: Function Function – Different functions isolated from each other by robust partitioning – If ICD revision is not necessary for any change to function, then cross-function Change Impact Analysis is also not necessary 3 C S Problem with Approach R L FAA illustrates their concerns with this example: Interface Control Document (ICD) only specifies what variables go on the Data Bus, and which systems have access to them NOT HOW THEY ARE GENERATED Examples of valid Flaps EXTENDED variable generation: “Up” – Flap surfaces detected in the “1” or greater flap detent. – Flap surfaces detected not in the “Up” flap detent. – Flap Lever Handle detected in the “1” or “1” greater flap handle detent. – Flap Lever Handle detected not in the “Up” http://en.wikipedia.org/wiki/Flap_(aircraft) [Bartley 2008] 4 C S Limitations of Current Approach R L 1. Capturing hazardous behavior due to component interaction, which will become much more prevalent in an IMA regime. 2. Change Management – very little guidance & assumes partitioning will isolate modified functions [Baker 2011] , [Bartley 2008] , [Betancourt 2012], [Conmy & McDermid 2001] , [Graydon & Kelly 2012], [Rushby 2011] , [Watkins 2007] 5 C S Objectives R L 1. Create a method to identify potentially hazardous interactions between applications in IMA and other tightly coupled avionics architectures 2. Create a method for doing Change Impact Hazard Analysis for these complex avionics systems that will be more effective than an ICD 6 C S Proposed Methodology R L Independence Coupling Safety Hazard Analysis Analysis Assessment Perform STPA on Check for consistent Hazardous scenarios applications in use of “Global Process due to functional Integrated Modular Model Variables” by interactions, Avionics local function(s) cascading effects Change Impact Modify connectivity of control structure, controller behavior, or insert new components (depending on change) STPA : “Systems Theoretic Process Analysis” 7 C S A Note on STAMP & STPA R L STAMP STPA Hazard • Accidents are more than a chain of Analysis failures, they involve complex dynamic processes. Hazards • Treat accidents as a control problem, not a failure problem • Prevent accidents by enforcing Control constraints on component behavior Structure and interactions • Handles behavior that is not handled by other methods Unsafe Control – Failure Modes and Effects Analysis Actions (FMEA) – Fault Tree Analysis (FTA) – Event Tree Analysis Causal Analysis [Leveson 2012] 8 C S Controller Process Model R L Human Operator Controller Many accidents occur when model of process is inconsistent Software with real state of process and Model of controller provides inadequate Process control actions Control Feedback Actions Need to have correct model to begin with Controlled Process Feedback channels are critical for maintaining correct model [Adapted from “1st STAMP/STPA WORKSHOP”, MIT 2012] 9 C S Proposal: Global Process Model Variable R L • What if different controllers (controlling different processes) need information about the same state variable? • Inconsistent use / perception of this variable may lead to hazardous behavior Controller 1 Controller 2 Controller n Model of Model of Model of … Process Process Process Variable 1.1 Variable 2.1 Variable n.1 Variable 2.1 Variable 2.2 Variable n.2 … … … Control Actions Feedback Controlled Controlled Controlled Process 1 Process 2 Process n 10 C S Proposed Methodology R L Independence Coupling Safety Hazard Analysis Analysis Assessment Perform STPA on Check for consistent Hazardous scenarios applications in use of “Global Process due to functional Integrated Modular Model Variables” by interactions, Avionics local function(s) cascading effects Change Impact Modify connectivity of control structure, controller behavior, or insert new components (depending on change) 11 C S Control Structure R L [H-1] Controlled Flight into Terrain [H-1.1] Loss of lift Hazards [H-2] Loss of Aircraft Control [H-2.1] Loss of lift [H-2.2] Structural damage to flaps Flight Crew FLAPS Discrete Control Generator Structure Flaps System Thrust Reverser Flight Deck Controller (FSC) Controller (TRC) Display Hydraulic, Sensors Throttle Detent ECS Lever Sensors LE & TE TR Cowl, Unsafe Flaps Control Cascade Actions 12 C S Unsafe Control Actions R L Controller: Not Provided Too soon, too Stopped too Flight when required Providing late, out of soon, applied Crew for safety Causes Hazard sequence too long LE flaps Flaps extended extended during too soon during Control Flaps not thrust reversal approach Structure extended (exhaust (increased drag, Flaps do not during impingement) loss of speed, achieve desired Extend takeoff or flap overload) angle (e.g. Flaps Flaps extended stopped at landing during cruise or Flaps extended incorrect (insufficient lift excessive too late during discrete) during terminal airspeed & approach ops, CL) density (flap (overspeed, Unsafe overload) missed runway) Control Actions 13 C S Unsafe Control Actions R L Controller: Not Provided Too soon, too Stopped too Thrust Rev when required Providing late, out of soon, applied Ctl for safety Causes Hazard sequence too long Reverse thrust applied too soon No thrust reverse Control before landing, on short Structure resulting in loss runway* Reverse thrust of airspeed (runway during flight during approach overshoot) leads to loss of v Stopped before Thrust and therefore lift Applied too late aircraft reaches Reverse Rollout takes during rollout desired speed on ON longer than Bypass air (Needed when runway expected C and high v (conflict with impinges on L Unsafe limit other LE flaps Control effectiveness of taxiing/runway Actions friction brakes operations) located on landing gear) 14 C S Causal Analysis – STPA Generic Loop R L 1 Control input or external information Unsafe wrong or missing Control Controller Inadequate Control 2 Actions Algorithm 3 Process Model (Flaws in creation, inconsistent, Inappropriate, Process changes, Inadequate or ineffective or incomplete, or Incorrect modification incorrect missing feedback missing or adaptation) control action Causal Feedback delays Analysis Actuator Sensor 4 3 Inadequate Inadequate operation operation Incorrect or no Information Delayed provided operation Controlled Process Measurement 4 inaccuracies Controller 2 Component failures Changes over time Conflicting control actions Feedback delays Process output Process input contributes to missing or wrong Unidentified or system hazard out-of-range disturbance 15 C S Causal Analysis – Thrust Reverse R L Thrust Reverser Unsafe Controller Control Process Model Variables Actions • Flight Mode • TR Hardware (Cowl,…) • LE Flaps • … Cause: Feedback Incorrect Causal Unsafe Cntl Action: Algorithm for generating Analysis Thrust Reverse Cntl discrete is different than Provides thrust reverser what Thrust Reverse Cntl ON control command has in process model when LE flap is in path of bypass air Throttle FLAPS Lever Detent Sensors Control Function TR Cowl, Cascade 16 C S Causal Analysis – Thrust Reverse R L Unsafe Control Actions Scenario: Flaps Control Function “1” only sends EXTENDED Causal message when sensor is in Analysis “1” detent ∴ Unsafe Cntl Action: Thrust Reverse Cntl ‘Provides’ thrust reverser ON control law when LE flaps is between retracted “Up” and full extension http://captainsim.org/yabb2/ 17 C S Causal Analysis – F.D. Display R L Flight Crew Unsafe Process Model Variables Control • Flight Mode Actions • Altitude, Airspeed,… • Flaps • … Cause: Feedback Incorrect Unsafe Cntl Action: If Flaps Control Function Causal Crew does ‘Not Provide’ sends EXTENDED Analysis Extend Flaps control message if any sensor is action on approach, NOT in “0” detent. before flap is fully in “1” detent) Flight Deck Flap Lever Display Handle Flight Instruments … FLAPS Control Control Function Surfaces 18 C S Proposed Methodology R L Independence Coupling Safety Hazard Analysis Analysis Assessment Perform STPA on Check for consistent Hazardous scenarios applications in use of “Global Process due to functional Integrated Modular Model Variables” by interactions, Avionics local function(s) cascading effects Change Impact Modify connectivity of control structure, controller behavior, or insert new components (depending on change) 19 C S Independence Analysis R L 1. Identify Global Process Model Variable(s) 2. Examine each controller’s use of the Global Process Model Variable 3. Analyze for potentially inconsistent use of Global Process Model Variable 20 C S Independence Analysis R L Thrust Reverse Flight Controller Crew Process Model Variables Process Model Variables • Flight Mode • Flight Mode • TR Hardware (Cowl,…) • Altitude, Airspeed,… • Flaps • Flaps • … • … Flap Lever Flight Throttle Detent Handle Instruments