Avionics Health Management

Michael D. Watson, Kosta Varnavas, Clint Patrick, Carl S. Byington,
Savio Chau, Ron Hodge, and Edmund C. Baroth

*Avionics Overview*

Avionics consists of the components necessary to manage the operation of
a flight vehicle and supply electrical energy to the vehicle systems.
Flight vehicles fall into two broad and overlapping categories: aircraft
at any altitudes (generally below 70,000 feet) and spacecraft traveling
anywhere from low earth orbit (LEO) to interstellar space. Although the
environments are different for these two flight categories, the
functions and technologies are generally similar. Avionics consists of 6
basic components, of which there may be multiple instantiations
depending on the application: The flight computer; data networks or data
busses; guidance, navigation, and control (GN&C) system; communications
and tracking system; electrical power system (EPS); software that
executes on the hardware components; and sensors within all vehicle
subsystems. These avionics components are then integrated
architecturally to produce a functioning avionics system. This
integration can be either loose or tight depending on the architectural
concept.

> *Avionics Components*

Flight computers provide the main processing for management algorithms
on the flight vehicle. They host a variety of software including
timeline management, caution and warning message processing and
response, display of information to the crew, downlink of information,
receipt of commands from the crew or ground centers, command generation
for automatic responses, command transmission to other components,
command execution, and data storage and management. These functions are
generally timeline driven and react to errors and failures as opposed to
proactively managing system error states. Thus, current state of the art
is for automatic systems rather than intelligent systems.

As vehicles become more intelligent, flight computers are beginning to
host artificial intelligence algorithms that can infer vehicle
conditions and make decisions much more quickly than ground-based
decisions and more proactively than timeline driven systems. Vehicles
are being made progressively more intelligent, particularly in error and
fault management. These vehicles host diagnostic routines that determine
the cause of system failures, thus improving vehicle safety and
maintainability. The diagnostic routines run on a flight processor,
sometimes with the control software and sometimes on a separate flight
processor depending on the focus of the diagnostic application.
Maintenance applications tend to be hosted on separate flight
processors, while diagnostics affecting the vehicle control loops tend
to run on the main flight control processor.

The flight processors are connected to vehicle systems through a data
network or data bus. Data busses have been the primary interconnection
medium in the industry since the first flight computer was added to a
flight vehicle. These early data busses primarily supported data between
systems with audio and video being transmitted through analog networks.
More recently, however, audio and video are being digitally encoded and
transmitted over the data busses as well causing increase data volumes.
As data volumes increase, data networks are becoming more prevalent. The
choice of architecture depends on the application and is driven by
considerations of latency, determinism, reliability, bandwidth, and
environmental tolerances. Data networks or busses are critical to health
management systems, as they provide the means to reliably communicate
health data and responses across the vehicle. Typical data network
standards include Ethernet (IEEE 802.3), and Time-Triggered Protocol.
Typical data bus standards include Firewire (IEEE-1394),
MIL-STD-1553/1773, CAN bus, RS-422, RS-485, etc. Each of these network
and bus standards specifies physical media for the data transmission.
For avionics systems this is typically shielded twisted-pair copper
wire. Optical standards are also becoming prevalent including Fiber
Distributed Data Interface (FDDI) and Fibrechannel.

The software that executes on these systems provides telemetry and
command responses for various conditions and states on the vehicles.
Software encodes the basic control algorithms, health management
algorithms, communication algorithms, etc., to enable the vehicle to
convert data into information and take appropriate responsive action.
Aviation and space systems today are primarily timeline driven systems
with humans in the cockpit or on the ground providing the intelligence
to deal with complex anomalies. Intelligence functions, such as
diagnostics, prognostics, and decision executives are starting to
emerge. These functions are primarily implemented in software and
provide the vehicles a broader response to unexpected events.

One of the main components connected through the data network or bus is
the Guidance, Navigation, and Control (GN&C) system. GN&C provides the
capability to determine the vehicle's flight path based on destination
and current location; the capability to determine the vehicle's current
velocity, attitude, and heading; and the capability to generate and send
commands to the flight controls to execute the desired flight path and
make corrections due to deviations. Systems typically have a separate
box containing three gyroscopes (one for each rotational axis) and three
accelerometers (one for each translational axis) to sense the vehicle's
rotational and linear velocities. The box also contains a GPS receiver
(aircraft or LEO spacecraft) or a star tracker (interplanetary or
interstellar spacecraft) to determine the vehicle's position. GN&C
systems also include altimeters to determine altitude. The flight
processor generally hosts algorithms that use velocity and position data
to determine vehicle position, orientation, and heading, and then to
generate flight control commands.

Another component is the Communications and Tracking (C&T) system. This
system provides for communications with ground stations and other
vehicles. Telemetry is sent, along with audio and video data, via the
C&T system. Similarly commands, audio, and video are received from
ground stations or other vehicles.

Sensors are connected to the flight processor(s) through data networks
and busses. The sensors are contained in all vehicle systems,
subsystems, and components, providing a variety of information including
operational performance and health information. Sensors determine a
variety of information including pressures, temperatures, stress,
strain, valve positions, fuel levels, etc. Sensors also include flight
radars used to detect and monitor storm systems for aircraft or orbital
debris for spacecraft, for example.

All vehicle systems are provided electrical energy through the
Electrical Power System (EPS). This system provides for generation,
storage, distribution, and management of electrical power. Power
generation methods include solar cells, fuel cells, Radioisotope Thermal
Generators (RTG), and nuclear reactors. Power storage includes
batteries, capacitors, and flywheels. Power Management and Distribution
(PMAD) includes the power distribution network, power conversion, and
management of power components. Flight systems are typically direct
current (DC) 28 Volts (V) DC is a standard) and are stepped up or down
to meet higher or lower power voltage requirements.

> *Avionics Architectures*

There are two architectural models used to implement avionic systems:
Federated Systems and Modular Integrated Systems. Federated systems are
the traditional architectural approach and are comprised of a set of
integrated, but dissimilar avionics components. Each avionics component
is an independent unit possibly made by different manufacturers, and
with potentially varying technology. Diagnostic capabilities are
provided at the component (i.e., box) level by the manufacturers. Each
manufacturer provides diagnostic capability for each component in the
form of a Built In Test (BIT), automated test equipment (ATE), and test
program sets (TPS). In addition, separate interactive electronic
technical manuals (IETMs) may or may not be provided. All of the
independent LRUs are expected to function side by side in a largely
autonomous fashion to provide the total system functionality required to
fulfill the vehicle's mission. Since each box is considered independent
of all others, health management is performed individually and
integrated vehicle health management is often not considered.

Modular Integrated Systems is an emerging design approach that seeks to
maximize the benefits of system interconnectivity gained by providing
common interfaces to components in the avionics systems. Avionics
components are integrated into a system with common interfaces,
communication protocols, etc. This approach takes a strong integrated
vehicle view of health management for the avionics system. Military
examples include the F-22 Advanced Tactical Fighter, the F-35 Joint
Strike Fighter, and the RAH-66 Comanche helicopter. Many benefits are
provided in these designs such as: system redundancy, situational
awareness, real time diagnosis, and dynamic reconfiguration. In short,
they are designed with more consideration of the overall system and its
dynamics \[1\]. Integration is achieved at various levels in these
approaches through architectures ranging from benign message passing on
a bus, where the failure of one LRU simply means that results won't be
completely accurate, to complete level integration where a global
controller (software, hardware, or a combination of both) assembles all
data for manipulation and display \[2,3\].

> *Avionics Technology*

Avionics components are primarily electronic systems but also include
key radio frequency (e.g., communications and radar), optical (e.g.,
optical gyroscopes and optical data networks), and Micro Electro
Mechanical Systems (MEMS) (e.g., MEMS gyroscopes and various sensor
types) components.

Analog electronics are important in numerous components. GN&C uses
analog electronics in laser drive modules (optical gyroscopes) and MEMS
drive and read electronics (MEMS gyroscopes and accelerometers). For
ring laser gyroscopes, accurate thermal stability is key for wavelength
stability and system performance. MEMS devices have both thermal and
pressure stability sensitivities. Analog control circuitry is utilized
to maintain tight control of these parameters. Analog electronics are
crucial in numerous sensors using voltage or current to read physical
changes. Examples include Resistive Temperature Devices (RTD),
thermocouples, capacitive sensors, and inductive sensors. EPS uses
analog electronics for power conditioning hardware.

Digital electronics are important in all avionics components.
Microprocessors, digital control logic, programmable and reprogrammable
devices, and other forms of discrete logic are ubiquitous. Flight
processors, data networks, and data busses are predominantly digital.
GN&C systems contain processors to perform calibration and engineering
unit conversion of sensor data. C&T systems use digital logic to
communicate across data networks and busses to flight processors. C&T
also applies digital electronics in control and management of its
components, as does EPS. Sensor applications contain digital logic for
smart sensors, providing embedded network communications,
self-calibration, fault detection, and embedded engineering unit
conversion.

Radio frequency (RF) electronics are important in GN&C and C&T
components, wireless sensor applications and weather. GN&C applies RF
electronics to receive Global Positioning System (GPS) reference signals
for GPS-based sensors. C&T is the main application of RF electronics for
vehicle external communications and radar systems. Wireless sensors also
employ RF electronics to transmit data and receive commands.

Optical systems are found in Ring Laser Gyroscopes (RLG) and optical
data networks. Some sensors also employ optical techniques. Optical
systems are strongly driven by thermal stability considerations to
maintain optical wavelength stability.

MEMS are also employed in low-accuracy gyroscopes and various sensor
applications. MEMS are strongly driven by pressure and temperature
considerations. For resonating devices used in motion sensors, pressure
levels must generally be maintained at a low level to prevent damping
sensor responses. Thermal considerations are also important since
thermal gradients can induce stress deformations in all types of MEMS
sensors. In addition, unique design aspects can lead to other
considerations depending on what is being sensed and what physical
relationship is being used to make the measurement.

> *Electrical, Electronic, and Electromechanical (EEE) Parts
> Qualification*

Avionics parts are graded based on their application environment. These
are broken down into four categories: Commercial, Industrial, Military,
and Space. Table 1 summarizes these part grades. Health management is
strongly affected by and also strongly affects parts selection. As the
parts reliability improves, health management techniques focus more on
detection and recovery of design or operational errors. As the parts
reliability decreases, manufacturing errors, material faults, and
environmental susceptibility become more prevalent. However, proactive
avionics health management also improves part reliability so that an
effective avionics health management system may allow lower parts grades
(allowing lower costs) to meet higher reliability applications. This
will be an application-specific decision but holds great promise for
improving system reliability and reduced implementation costs.

## Table I -- EEE Parts Grade Description

  ------------ ---------------------- ----------------- ---------- ---------- --------------
  **Grade**    **Summary**            **Reliability**   **MTBF**   **Cost**   **Typical
                                                                              Use**

  Space        \"Space\" quality      Highest           Longest    Very High  Human and/or
               class qualified parts,                                         long duration
               or equivalent.                                                 space flight

  Military     \"Full Military\"      Very High         Very Long  High       Space flight,
               quality class                                                  Military
               qualified parts, or                                            Aviation,
               equivalent.                                                    Commercial
                                                                              Aviation, or
                                                                              critical
                                                                              ground support
                                                                              equipment

  Industrial   \"Low Military\"       High              Long       Moderate   Space flight
               quality class parts,                                           experiments,
               and Vendor Hi-Rel or                                           Commercial
               equivalent.                                                    Aviation, and
                                                                              ground support

  Commercial   "Commercial\" quality  Variable          Variable   Low        Aviation
               class parts. No                                                flight
               qualification                                                  experiments
               required.                                                      and ground
                                                                              support
  ------------ ---------------------- ----------------- ---------- ---------- --------------

> *Commercial Grade*

Commercial Grade EEE parts typically meet vendor standards for high
reliability or commercial market place reliability, but have not been
independently verified. These parts meet the requirements for the ground
environments are suitable for avionics where high reliability is not a
primary factor, the mission is not critical or a repeat mission (to
replace a failed mission) is possible. The duration of an operation
would typically not be lengthy (a few hours). These systems are
accessible for repair and repair is an acceptable response to a failure.
This is a typical choice for aviation flight experiments and ground
support equipment.

> *Industrial Grade*

Industrial Grade EEE parts typically meet standards for high
reliability, but there may be significant exceptions and they may not
have been independently verified. These parts meet the requirements for
the aviation environments and are suitable for equipment where high
reliability is desired, but is not mandatory. These parts can be counted
on for long term continuous operations. Down time for repair during the
operation is not desirable, but repair is possible. The systems are
counted on to work, but system failures can be tolerated so that
redundancy is not required. The application could be space flight
experiments, commercial aviation, or ground support equipment.

> *Military Grade*

Military Grade EEE parts typically meet rigorous (but not the highest)
industry reliability standards, and have been subjected to independent
verification. These parts meet requirements for the aviation
environments and are suitable for equipment that requires high
reliability, but for which a low risk of failure can be tolerated to
meet cost constraints. Space missions of 1 to 5 years duration may also
use Military Grade parts with proper radiation shielding and thermal
control. Down time for repair during the operation is not desirable, but
repair is possible. The systems are counted on to work and redundancy is
necessary at the component level for all primary objectives. Higher risk
tolerances may make single string design acceptable. The application
usually is space flight equipment, military aviation, commercial, or
critical ground support equipment.

> *Space Grade*

Space Grade EEE parts typically meet the highest reliability standards,
and have been subjected to independent verification. These parts meet
requirements for operation in the space environments and are suitable
for equipment requiring maximum feasible reliability because of critical
mission objectives and safety. The related project typically would have
high visibility and could involve objectives which may be difficult to
repeat in another mission. Space missions of 5 years or longer or with
human dependency require Space Grade parts. These parts are counted on
to work for long durations without failure and repair during the mission
is not a practical or desirable option. The mission requires complete
functional or block redundancy. The applications are human space flight
and long duration space flight.

> *Environments*

Environments are a strong external influence on avionics health. Several
environmental parameters affect system health in three main categories
of environments encountered. The environmental parameters exist in all
environment categories, but their impact on avionics health can be
significantly different. The three main environment categories are:
ground, aviation, and space. Much has been documented in the literature
on various environments. Several references are included for the
interested reader \[4 -- 20\].

> *Environmental Parameters*

The environmental parameters strongly drive the operation failure modes
of the avionics components. In some cases, the device environments are
actively controlled to maintain a proper operating environment. This
control creates a dependency on other systems such as thermal
management, which are required to maintain the avionics operating
environment. The following summarizes the main environmental parameters
related to avionics.

> *Temperature*

Temperature affects all types of avionics devices. Operating ranges
vary, but standard military specifications are -55 C to 85 C. Most
electronics and MEMS are designed to operate in these ranges. Moving
outside of the ranges leads to device failures. Systems where high or
low temperature limits are exceeded require active cooling and heating
to maintain the operating environment. Systems can work great at room
temperature but timings can change significantly when the temperature
increases or decreases significantly. Optical devices can require
extremely tight active temperature control (e.g., within 1 C) to
maintain wavelength stability and device performance. This generally
requires active temperature control using devices such as Thermal
Electric Coolers (TEC) embedded with the optical sources. Failure of
temperature control can quickly lead to avionics component failures.

> *Pressure*

Pressure is generally a concern, particularly at low pressure. As the
pressure decreases, systems must be designed to prevent electric corona
discharges. Such discharges can lead to severe damage to avionics
components. Pressure is also a concern for some MEMS devices that
require vacuum conditions. Increased pressure on these systems due to
leaks results in damping of the MEMS system oscillations. This damping
degrades and can terminate the device sensitivity.

> *Shock/Vibration*

Shock and vibration are very application dependent. Avionics are
generally tested to ensure the application shock levels and vibration
magnitudes/frequencies are survivable. Avionics components packaging
including chip mounting is critical to meet the application
requirements. Failure of mounting and connectors can cause complete loss
of the component capabilities. Space launch vehicles create the most
severe vibration environments. Military missiles have the most severe
shock environments. Helicopters in general also have high vibration
environments.

> *Humidity*

Humidity is a concern for applications working in high humidity
environment such as tropical climates. Water in the system can create
shorts, damaging components. Salt water environments are also highly
corrosive to avionics packaging due to the salt contained in the water
vapor.

> *Radiation*

Radiation is a key environmental parameter found naturally in space.
Most terrestrial avionics systems cannot survive radiation doses due to
system latch-ups and single event upsets. Operating in a radiation
environment requires materials and designs that will not latch-up and
which minimize or eliminate the possibility of upsets. Often, component
packaging can aid in this area by shielding electronics from the
radiation. However, this reduces but does not eliminate the exposure.

> *Electrical*

The electrical environment deals with electromagnetic interference (EMI)
and lightning. EMI can be either natural or produced by the system. All
electrical systems' leads and wires are antennas in some form. Thus,
they all will transmit and receive signals. Avionics systems design must
carefully address the Electro Magnetic Compatibility (EMC) of devices.
This is often done by shielding of wires and packaging, placement of
wiring, and elimination of component features that lead to transmission
effects. This is particularly important with C&T systems as they must
transmit high powered signals without interfering with other flight
systems. Lighting strikes are a significant threat to flight avionics.
Thus, flight systems require grounding systems that can divert large
currents away from avionics components.

> *Dust*

Dust is a key concern for particulate contamination which leads to
shorts. Particles as small as 100 nm can create shorts in modern
integrated circuit chips. There are two concerns for dust: dust left
inside components as a result of manufacturing processes and dust from
planetary environments. For industrial or aviation applications, dust
must be removed or prevented from contaminating electrical connections.
Dust particles can create shorts between electrical leads. For space
applications, all component surfaces must be dust free as the dust
floats. Dust from any surface can float to an electrical contact and
create a short during flight. Avionic systems which operate in dust
environments require tight seals to keep out the small particles which
are generally very challenging. Active detection and mitigation
techniques would greatly benefit avionics in high dust environments but
have not been pursued.

> *Ground Environments*

For avionics, the ground environment consists of the depot, air fields,
and launch sites. The ground environment has a variety of considerations
not found in aviation or space environments. Temperatures range over the
full military specifications depending on locations. Pressure is fairly
constant at 1 atmosphere. Shock and vibration are generally only a
concern during flight operations, but some transport conditions require
monitoring to ensure damage has not been induced in components. Humidity
is primarily a concern at ground sites, particularly those in tropical
environments such as launch sites. Radiation is not a primary concern
for ground environments as the Earth's magnetic field and atmosphere
provide adequate shielding of the planetary surface. EMI is a concern
not only from on-board systems, but also other sources such as local
radio transmitters, radar, etc. Lightning is not a significant concern
for ground systems and can generally be protected by an earth grounded
lightning rod. Dust is also a concern at ground sites. Avionics are
generally protected at these sites through the packaging and generally
only exposed in clean environments.

> *Aviation*

The aviation environment is generally defined from sea level to 70,000
feet. Temperature ranges across the full military specification and
generally gets colder with increasing altitude. Similarly, pressure
drops with altitude but is still sufficient below 70,000 feet to not
cause concern for corona discharge. Shock and vibration are more
prevalent during flight conditions and are very dependent on the
vehicle. Humidity is not generally a concern when flying at altitude,
but condensation is a concern with temperature changes. Radiation is not
a particular concern in the aviation environment as the Earth's magnetic
field and atmosphere are still providing good shielding levels. EMI is
primarily an on-board system concern. Lighting is a major concern and
systems must be capable of safe recovery or landing after lightning
strikes. Dust is not a concern in flight.

> *Space*

The space environment captures a wide range of conditions. Temperature
control is strongly affected by the absence of convection. This leads to
the need to cool or heat avionics through either direct radiation or
conduction. This often leads to challenging thermal management
requirements when flying avionics components designed for aviation
environments. Pressure varies depending on the location of the avionics.
In the crew cabin, pressure is similar to the aviation environments. For
components outside the crew cabin or on robotic vehicles, vacuum
conditions are encountered. This requires component designs to address
corona discharge and presents another limitation to applying aviation
environment components for space applications. Shock and vibration are
extreme during launch and ascent of the space vehicle. High g levels are
often encountered and vibration magnitudes can be large. Humidity is not
a concern in the space environment, but radiation is a strong concern
for space. Low Earth Orbit (LEO) is the most benign space environment
while medium earth orbit (MEO) is the most significant (upwards to 100
Mrad --si annual dose rates). Interplanetary space has a smaller
radiation environment than MEO. Operation around other planets, however,
can lead to environment similar to or worse than MEO depending on the
planetary atmosphere and magnetic fields. EMI is primarily an on-board
system concern. Lightning is a major concern and the avionics must
remain operational in the presence of lightning strikes. Dust is not a
concern in space, but is a major issue if dust from manufacturing on
Earth contaminates inside the spacecraft and floats, potentially
shorting out electronic components. It is also significant in other
planetary environments such as on the Moon and Mars.

> *Failure Sources*

Several error sources affect avionics components and systems. These
originate during design and manufacturing or due to the external
environment. Errors occurring during design and manufacturing include
design errors, material defects, and fabrication errors. Faults and
errors are also induced by the environment in which the system operates
as discussed in the previous section. Various testing standards have
been developed to detect design and manufacturing errors and will be
discussed in section below.

> *Design Faults*

Numerous causes are responsible for design faults from the actual design
stage all the way through layout and even manufacturing. Design faults
can be significantly reduced by the right combination of simulations,
intensive checking at each stage of the design cycle and board, and
system level testing to uncover any problems. This includes
environmental testing to root out problems that may occur only under
special conditions. Environmental testing can catch design errors that
will occur at the extreme ranges of operation. Testing such as
temperature cycling can detect timing issues that are temperature
dependant.

> *Material Defects*

Often material defects are caused by manufacturing processes. These
defects are often unknown by the users. However, good environmental
testing expose these defects. Also, significant parts qualification and
inspection can often reveal material defects. For example, many flight
components are x-rayed, which can reveal many material defects. Proper
inspections and environmental testing are important for unearthing
possible defects and errors at different stages of the development
cycle.

> *Fabrication Faults*

These faults are associated with problems in doping, metal deposition,
and etching at the chip level, soldering and component placement at the
board level. Good visual inspection along with thorough lab testing and
environmental testing can reveal problems. Also, particle impact noise
detection (PIND) testing can reveal fabrication errors such as loose
solder balls and components. PIND testing can also reveal particle
contamination that exists within the component.

> *External Effects*

External effects include environmental parameters and electrical surges.
Environmental monitoring is done in some cases to detect if
environmental operating ranges are exceeded. Parameters measured depend
on the device. Temperature is generally measured, especially for optical
components, to maintain device control. Pressure is not normally
measured directly for the avionics, but it is measured for the crew
cabin maintenance and aeronautical flight conditions. These
measurements, however, could be applied by an avionics health management
system when external pressures are crucial to avionics performance. MEMS
devices require internal pressure sensing. This is often done by
monitoring the resonant frequency of a reference component. Shock and
vibration are generally measured at the vehicle level, if at all, and
would have to be incorporated into an avionics health management system.
Humidity is generally not monitored on vehicles, requiring additional
sensors for health management. Radiation events are not directly
monitored but are counted indirectly through the number of processor
upsets that occur. This is not proactive and provides only indirect post
failure data for health management evaluation. Electrical events are
generally designed out and tested for compliance as feasible. There is
not direct monitoring currently employed for an avionics health
management system to gather information on electrical events. Dust is
not monitored in flight. This is another area that requires new sensors
and techniques to implement proactive health management.

*Current Avionics Health Management Techniques*

Current health management approaches utilize various electronics error
detection and testing techniques at the component level. These
techniques include Built In Test/Built In System Test (BIT/BIST), Error
Detection and Correction (EDAC), and Boundary Scan and Module Test and
Maintenance (MTM) bus. These techniques address errors and failures at
the chip and board level. Voting techniques are also employed to detect
errors at the board and box level. Across the integrated avionics
system, various techniques are also being developed to detect
system-level errors that occur between components as opposed to within
the components. These approaches can be summarized by three levels of
testing.

*Component Level*: Testing of the internal circuits of components.

*Board Level*: Testing the connectivity between components.

*System Level*: Testing to identify failed boards.

The electronics used in avionics components are highly integrated
devices. It is commonplace that a single (Application Specific
Integrated Circuit (ASIC)or Field Programmable Gate Array (FPGA)contains
millions of gates. A problem associated with this high-level of
integration is the packaging and Input/Output (I/O) pins of the
integrated circuits. A large ASIC can have over 500 pins. The pins are
extremely refined and closely spaced. Worse yet, some packaging
technologies such as flip-chip bonding hides all the I/O pins. These
packaging techniques make the probing of pins and signal lines during
integration impractical. To enable testing of these highly-integrated
electronics during system integration and test, techniques have to be
incorporated into the design at all levels of the system.

Within a component, two types of failures affect the health of vehicle
avionics: random failure and component life limitation failure. The
random failure is mainly caused by either premature failure of
components or by environmental factors. Short duration missions (\< 10
years) usually are dominated by this failure type. Life limitation
failures are more common on longer missions, and are factors for outer
Solar System missions.

> *Built In Test (BIT)/Built In System Test (BIST)*

There are two important testing techniques at the component level:
Built-in-test (BIT) (i.e., scan design) and built-in-self-test (BIST)

The main idea of scan design is to provide access to the combinational
logic circuits that are surrounded by registers. If a piece of
combinational logic is directly connected to the primary inputs and
outputs of a chip, it can easily be tested because when a test vector is
applied to the primary input, the output can be observed immediately and
then compared with the expected output. On the other hand, if the
combinational logic circuit is surrounded by embedded registers, it is
very difficult to set the input registers of the circuit to the desired
test vector or observe the value of the output registers of the circuit.
BIT links all the registers on the chip to form a single shift register
in the test mode, so that the desired test vectors can be shifted into
the inputs of the circuit and the test output can be shifted out. In
other words, this technique converts the embedded register to virtual
primary inputs and primary outputs of the circuit.

While the BIT can improve the controllability and observability of
embedded combinational circuits, it has to generate the test vectors. As
the ASIC/FPGA have become more complex, test vector generation has
turned into a difficult, lengthy, and labor intensive task. To solve
this problem, built-in-self-test (BIST) techniques can be employed.

BIST can generate a sequence of test vectors pseudo-randomly with a
simple Linear-Feedback-Shift-Register (LFSR). An example of LFSR is
shown in Figure 1, where the feedback connection is determined by a
polynomial in the form of *a~n~X^n^* + *a~n-1~X^n-1^*+
*a~n-2~X^n-2^...*+ *a~1~X^1^*+ *a~0~X^0^*. The order of each term
corresponds to the position in the LFSR, and the coefficient *a* has a
value of either 1 or 0. If the coefficient of a term has the value of 1,
then a feedback connection is added to the bit corresponding to the
order of that term. Hence, the polynomial of the LFSR in Figure 1 is

*0⋅X^15^*+*0⋅X^14^*+*0⋅X^13^*+*0⋅X^12^*+*0⋅X^11^*+*0⋅X^10^*+*0⋅X^9^*+*0⋅X^8^*+*0⋅X^7^*+*0⋅X^6^*+*1⋅X^5^*+*0⋅X^4^*+*1⋅X^3^*+*1⋅X^2^*+*0⋅X^1^*+*0⋅X^0^*

*= X^5^*+*X^3^*+*X^2^*

To generate pseudo-random patterns, the LFSR is reset and initialized to
a seed value. Then, the content of the shift register is shifted one bit
to the right in each clock cycle. Through the feedback connections, a
new pattern is generated in the shift register. The output of each bit
in the register is applied to the circuit-under-test.

After the test pattern is applied to the circuit-under-test, a test
result is generated at the output of the circuit. All the test results
generated in each clock can be accumulated into a single signature using
a *signature analyzer*, which is a LFSR used in a reverse manner (see
Figure 2). At the end of the test, the content of the LFSR, which is the
final signature, can be compared with an expected signature.

> *Error Detection and Correction (EDAC)*

EDAC is a method of detecting bit errors in memory systems or
transmission systems and correcting them. There are many techniques for
error detection applied normally to serial transmissions but can also be
applied to some parallel systems. Correction of detected errors has
fewer options. For error detection and correction of parallel memory
systems additional memory bits are used to implement Hamming codes.
These additional bits and coding methods are used to determine when a
single or double bit error has occurred in the memory system. These
codes can even correct single bit errors in real time in the memory
system. EDAC can be used for real-time error detection without having to
bring the board off line.

For serial transmission systems, there are many techniques for detecting
errors in the transmission. One popular method used in Ethernet systems
and others is CRC, or cyclic redundancy checking. This basically uses
the data in the packet to calculate a 16 or 32 bit value. This CRC value
is unique to the calculation method chosen and the data in the packet.
This 16 or 32 bit CRC value is transmitted at the end of the data
packet. On the receiving side, the CRC is recalculated using the data
received and is compared to the CRC value in the packet. Any
mis-compares will alert the system to an error.

> *Boundary Scan*

![](media/image1.png){width="2.769291338582677in"
height="3.6251968503937007in"}The most important test techniques at the
board level use the boundary scan design. The most widely supported scan
design is the boundary scan developed by the Joint Test Action Group
(JTAG), which has been standardized as the IEEE 1149.1 standard \[1\].
The IEEE 1149.1 design is shown in Figure 3.

JTAG standards define a serial interface that many large chips such as
microprocessors and FPGA's have that allow programming and testing of
internal data paths without having to remove boards. There are many
advantages to using JTAG:

-   Test populated boards for soldering faults (open, shorts)

-   Test populated boards for Printed Circuit Board (PCB) construction
    faults (cut traces, cracked vias)

-   Test hidden solder joints (Ball Grid Arrays)

-   Program/Test memories in-circuit

-   Simpler parts lists -- no need for unique part numbers for
    pre-programmed devices

-   Fewer errors from loading a part in the wrong location

-   Verify a memory image in-circuit

-   Tests run very quickly and test hardware compatible with thermal
    chambers will allow several test iterations during temperature
    cycling tests

-   Supports connecting JTAG chains between boards (test entire box)

-   Supports some level of in-circuit integrated circuit (IC) test.

-   Pin drivers are used so electrostatic discharge (ESD) damage can
    usually be detected

The key feature of the IEEE 1149.1 standard is a simple four-signal test
interface comprised of the Test Data In (TDI) signal, the Test Data Out
(TDO) signal, the Test Clock (TCK), and the Test Mode Select (TMS)
signal. The TMS is used to set up the operation of the boundary scan
operations.

The architecture of the IEEE 1149.A consists of an instruction register,
a bypass register, a boundary-scan register (highlighted), an optional
user data register(s), and a test interface referred to as the test
access port (TAP). The boundary-scan register is located at the
input/output boundary of the chip and is made up of a series of
boundary-scan cells (BSC). The boundary-scan register is disabled in
normal operation. In test mode, all the boundary-scan cells are linked
together to from the serial boundary-scan register. Test data is shifted
(or "scanned") into the boundary-scan register through the TDI pin and
shifted out through the TDO pin. The TAP is used to set up the test
mode, load the instruction register, and control the data scan according
to the TMS input.

To test the board, all the boundary-scan registers in the chips are
chained together. A test pattern is shifted into the boundary-scan
register chain. Then, the board is switched back to normal mode for one
clock; the contents of the boundary-scan register are shifted out
afterwards. If the connectivity between chips has no defects, the test
pattern in the boundary-scan cells at the output pins of the chips
should be registered by the boundary-scan cells at the input pins of its
immediate downstream neighbor. Otherwise, the connectivity defect will
be detected after the contents of the boundary-scan register chain is
shifted out and compared with the expected pattern. This is depicted in
Figure 4.

Normally, boundary scan testing or programming is done when the board is
not running application software. The boundary scan software takes over
although the application software can be loaded and run using the JTAG
interface. Thus, this type of testing is generally done during
manufacturing and maintenance testing. Current boundary scan techniques
thus are useful for offline testing, but do not support real-time fault
detection or diagnosis. Real-time capabilities could be developed, but
would represent a significant update to the JTAG standards.

> *Voting*

Current fault-tolerant designs employ fault detection techniques such as
error-correcting codes, duplicate-and-compare, and multiple modular
redundancies. These techniques can detect random failures very
effectively.

Error-correcting codes often not only reveal an error, but also
automatically make repairs. A simple example of a purely error-detecting
technique is bit parity in serial data communication, where an
additional transmitted bit indicates whether the number of '1' bits sent
was odd or even. An incorrect recheck on the receiving end triggers the
recovery method of choice. An example of an actual error-correcting code
involves transmission of three copies of each data element, with a
voting scheme at the receiving end to choose the data pattern that
survived in at least two of three cases as the output. Of course, much
more complex and capable techniques exist.

Duplicate-and-compare and multiple-redundant techniques are primarily
different from error-correcting codes in the areas of their application.
Error-correcting codes typically apply to data transmission, while the
other techniques usually apply to general hardware performance. In these
cases, if the behavior of an element can be replicated elsewhere and the
additional set of results compared to the primary results, some judgment
of the quality of the primary results may be made.

Multiple-redundant systems go to the extent of actually copying the
hardware set associated with an element any number of times, as required
to guarantee a desired level of reliability. Each element then has that
number of results to compare in order to produce the most correct
result, and also to judge the health of the copies that repeatedly
produce unacceptable results.

It is important to note here that whenever there is replication of
elements, it may be advisable to produce at least one completely
different copy, in terms of software or hardware, or both. Design errors
will replicate along with copies of elements, so that common failures
could go completely undetected, resulting in catastrophe.

In any of these schemes, some form of judgment must be made to determine
what to do with the output or outputs. In the simplest example made, a
parity checker is put in the data stream on a serial communication
receiver; in more complex cases, a voting scheme or other
decision-making algorithm must be implemented.

> *Idle Data Pattern Diagnosis*

Idle data pattern testing is normally done on serial channels of any
kind. Some serial protocols such as Ethernet and others have an idle
pattern that is continuous even when actual data is not being
transmitted. The idle pattern is still subjected to cyclic redundancy
testing on some systems. Even if no CRC is performed on it, just knowing
the idle data pattern can allow the receiver to constantly monitor for
any errors in transmission. If the idle pattern stops, and the following
pattern does not match any type of data packet then the system will know
that an error has taken place and can take appropriate action. This is
another test that can be done without taking the system off line and
with very little additional hardware or software overhead.

> *Input Protection*

Fault containment is an important capability for avionics components.
One means of preventing failure propagation is to build into an
electronic system a means of protecting the circuitry from damaging
stimuli. A number of electronic components come with a mixture of the
following technologies already on board, while others must be
supplemented. These techniques where developed to protect the inputs of
electronics and are often termed "input protection" rather than "fault
containment".

Many electronic devices and systems incorporate voltage and current
protection into their design. A basic approach is to limit response of
inputs to just under the full range of the power supply, and block or
bleed off to ground any excess stimulus. Since most electronic outputs
are designed as high-impedance, there is usually little need to heavily
protect outputs; in the case that concern exists for a specific circuit,
similar measures may be taken to limit or bleed off overly high stimuli
fed back from the inputs of downstream circuits.

Surge suppression is a similar concept, with slightly different
considerations. Over stimulus in this case comes from less predictable
sources, such as lightning strikes or electromagnetic interference
(EMI). Combating this usually involves inclusion of excess capacitance
into circuitry wherever possible, a technique so common that it is found
in household surge suppressors. In extreme cases, a cable may be
intentionally kinked and placed near a good ground prior to entry into a
vulnerable system; the high-frequency pulses usually associated with
surges are less likely to be able to negotiate a hard turn, and will be
bled off across the gap to ground.

Very often, power conversion components themselves are reasonably
well-isolated from the outside world, thus removing one more layer of
concern from designers' minds. It is encouraging to note that many more
options now exist for power conversion and conditioning closer to
supplied components -- either at the inputs to individual boards, or
even built into a microelectronic device.

Decoupling is a further method of isolation for input and output
protection of circuits. Digital decoupling is accomplished much more
readily than analog decoupling, simply because digital signals have much
less stringent requirements for transmission of the exact electronic
information encoded. One of the most effective ways to accomplish this
is to use optical isolators. These ingenious devices have light-emitting
diodes (LEDs) and light-sensitive photodiodes paired to replicate an
input '1' or '0' level by an on or off condition of the LED received at
the photodiode; however, there is no need to electrically connect the
two circuits together, even on the ground side, so that they can be
completely separate electronic entities.

Analog signals are more difficult to isolate. Transformer coupling is
one means that is reasonably effective. This works for digital systems
also, but has fallen out of favor, primarily because of the cost, bulk
and difficulty of implementation compared to optical isolation. Analog
optical interconnection systems exist, of course, but also are quite
expensive, and introduce inherent errors into the system.

> *Module Test and Maintenance (MTM) Bus*

When components are assembled on boards, boards into subsystems, and
subsystems into systems, a hierarchy of test buses is needed to retain
access to the design-for-testability features. The Module Test and
Maintenance (MTM) Bus specified in the IEEE 1149.5 standard is developed
to meet the requirements of such a bus hierarchy. The MTM Bus provides
subsystem test control access or external test equipment access to test
features on modules within a system.

The MTM Bus is a backplane serial test bus intended to be used with
on-board test buses such as the IEEE 1149.1 Bus. The relationship
between the MTM Bus and the IEEE 1149.1 buses is shown in Figure 5.

The MTM Bus is a synchronous, serial, backplane bus comprised of four
required signals and an optional fifth signal. This is shown in Figure
6. The bus is designed to have a single bus master module that can
communicate with up to 250 individually addressable slave modules. Each
master or slave module can be a board or subsystem. The bus mastership
can be transferred to backup masters in fault-tolerant configurations of
the bus. The MTM Bus also adopts a multi-drop topology. The addressing
capability of the MTM Bus allows the master to address and communicate
with one, a subset, or all of the slave modules on the bus.

The MTM Bus master communicates with the slaves using messages that
consist of a series of packet transfers. A message consists of a HEADER
packet, an optional ACKNOWLEDGE / PACKET COUNT packet, and a variable
number of DATA packets. Figure 7 depicts the message protocol between
the master and a single slave. If multiple slaves are addressed, the
ACKNOWLEDGE packet will not be sent by the slaves. The number of DATA
packets to be transferred is dependent upon the type of command
contained within the HEADER packet. More details about the MTM Bus can
be found in \[2\].

> *Intelligent Sensors and Actuators*

Intelligent sensors hold great promise for application in sensor and
actuator (i.e. transducers) system health management. Intelligent
sensors are an emerging technology which is addressed by the IEEE 1451
Standard for a Smart Transducer Interface for Sensors and Actuators.
Intelligent transducers include analog to digital conversion, direct
interfaces to the vehicle network or bus, and provide Transducer
Electronic Data Sheets (TEDS) that provide transducer type, operation
parameters, and attributes \[21\]. This allows the sensor to operate as
a network or bus element without the need for a
multiplexer/de-multiplexer (MDM). Intelligent transducers can also
provide calibration, engineering unit conversion, electrical power, and
timing synchronization. TEDS also support diagnostics in the form of
self checks by the sensor to maintain health. Recently, a Health
Electronic Data Sheet (HEDS) has been developed which provides data on a
transducer's health. \[22\] Thus, the sensor is able to monitor and
detect anomalous behavior internally and provide this information in a
readable format for the flight processor to act upon.

> *Avionics Systems*

At the system level, health management approaches currently focus on
maintenance of systems. As discussed above, health management benefits
greatly from the Modular Integrated Systems approach as opposed to the
Federated Systems approach. The field is diverse. Opportunities to
integrate an embedded avionics system are numerous. Some of the earliest
opportunities may come in the arena of legacy system upgrades. Federated
components operating together within an aircraft share many common bonds
and can affect each other in ways that can be detected globally. Power
systems, data busses, environmental factors, and wiring infrastructures
are examples of some of these common bonds. The interactions among these
factors create confounding issues to diagnostic systems that are not
accounted for in component built-in-tests or at any other level of the
maintenance infrastructure. From a global perspective this Modular
Integrated "systems" relationship can provide a large opportunity to
collect evidence that can be used to diagnose faults and predict
failures. Rather than confounding, these relationships can be used to an
avionics health management system's advantage to lower the total life
cycle cost (LCC) associated with the avionics system.

A key in implementing avionic system health management is the
architectural standard. These standards focus on the abstraction of
system knowledge which can be defined at 3 levels: data, information,
and knowledge. System data is the basic bits (ones and zeros) defining
system states and conditions. Converting this data requires information
on what parameter is being measured in what context or environment.
Converting data to this level produces information about the system.
This information provides a logical understanding of the current system
states and conditions. Understanding the implications of this
information requires knowledge about system functions and operations.
Understanding the information in the context of these functions and
operations coverts information into system knowledge.

An open data architecture facilitates information continuity throughout
the avionics health management system by encapsulating a standard of
what information will be represented by the information stream and a
standardized meta-data description of what the individual data elements
represent. Two examples of open systems approaches are IEEE 1232,
Artificial Intelligence Exchange and Service Tie to All Test
Environments (AI-ESTATE), and Open System Architecture-Condition Based
Maintenance (OSA-CBM). The Automatic Test Meta Language (ATML) working
group is exploring the development of an Extensible Mark-up Language
(XML) standard for automated test equipment (ATE). Currently available
OSA-CBM protocols describe an open standard for data collection,
condition monitoring and maintenance information exchange. OSA-CBM
describes the exchange of information from data collection to
manipulation, diagnostic reasoning and health assessment. Modalities
described by OSA-CBM include XML, Common Object Request Broker
Architecture (CORBA) and Component Object Model/Distributed Component
Object Model (COM/DCOM) \[9\]. Important standards, such as ATML, Open
System Architecture for Enterprise Application Integration (OSA-EAI) and
Predictive Model Markup Language (PMML) are also being examined by
several researchers.

The overall architectural approach chosen should support continual
learning, system assessment, and discovery of hidden patterns at each
level. Discovered knowledge manifests the greatest possible usefulness
at the logistics level where data from individual units, installed in
individual systems, merges with other units installed on systems from
other vehicles (when working with a fleet of vehicles), organizational
units, and service branches for macro level mining. More effective
avionics troubleshooting and diagnosis begins onboard with a system
level perspective \[1, 2\] and greater capture and utilization of
available data. Time stamp, system power parameters, temperature,
vibration, and BIT error code, design logic of BIT errors, reliability,
life history, and logistics are a few examples of useful evidence
sources. In some applications, all of this information is analyzed by a
diagnostic algorithm. Rule-Based and Model-Based Reasoners are currently
the most mature in diagnostic applications. Figure 1 illustrates the
basic inputs to diagnostic reasoner analyzing avionic system data.

![](media/image2.wmf){width="3.248611111111111in"
height="1.8444444444444446in"}

Figure 1: Diagnostic Reasoner Interactions

Avionic systems have a variety of error sources as discussed in the
previous paragraphs. Diagnostic systems seek to detect these errors in
order for flight systems or ground maintenance systems to respond
appropriately. The types of problems that may be encountered in avionics
components from an observable perspective is summarized below.

![](media/image3.wmf){width="5.996527777777778in"
height="3.6277777777777778in"}

Figure 2: Avionics System Error Types

Prognostics are important to detect failures prior to their occurrence.
This is an area in need of much research and development for avionics
systems. One approach for prognostics considers fault features that can
be identified either discretely or over time. Feature-based diagnostics
and prognostics can be implemented for electronic systems by identifying
key prognostic features that correlate with failure progression. Once
these features are obtained, they can be tracked and trended over the
systems life and compared with model-based useful-life-remaining
estimates to provide corroborative evidence of a degrading or failing
condition. Such an automated avionics health management system can be
implemented using a feature driven artificial intelligence-based
approach. With examples of good, bad, and unknown feature sets,
classifiers can be developed using an array of techniques from
straightforward statistical methods to artificial intelligence methods
such as neural networks and fuzzy logic systems. For a prognostics
implementation, the automated reasoning algorithm can be trained on
evidenced features that progress through a failure. In such cases, the
probability of failure as defined by some measure of the "ground truth"
is used to train the predictive algorithm based on the input features
and desired output prediction. In the case of a neural network, the
network automatically adjusts its weights and thresholds based on the
relationships it sees between the probability of failure curve and the
correlated feature magnitudes.

![](media/image4.jpeg){width="6.995833333333334in"
height="4.114583333333333in"}

Figure 3: Avionics Fault Progression

From a ground maintenance standpoint, information processing and
reasoner software technology provide a means to more effectively
transition towards 2-level maintenance strategies. Figure 4 depicts some
of the attributes that could be accommodated from the current 3-level
approach. The intermediate process could be better supported with this
concept, or if the associated process changes were adopted, many of the
intermediate functions could be tran­sitioned to the operational (i.e.,
on board) and depot capabilities.

![](media/image5.wmf){width="6.159722222222222in"
height="3.6902777777777778in"}

Figure 4: Aircraft Maintenance Levels

Advanced reasoning, enabled by the captured data and integrated with the
depot repair process, can decrease repair times and reduce overall
costs. Advanced reasoning can also enable systems to respond proactively
to problems in flight maintaining vehicle operational integrity under
adverse conditions. On the ground, capture of maintenance data
throughout all levels of repair will provide the foundation for bet­ter
future system design and advanced imple­mentation of prognostics through
a better under­standing of avionics failures.

*Avionics Health Management Requirements*

Requirements for health management vary greatly with the application,
application environment, and human health and safety dependencies. There
are three main environments that need to be considered: Industrial,
Aviation, and Space.

Industrial grade systems are characterized by harsh temperature,
corrosive, high pressure environments. Failures of these systems
generally result in the loss of system functions. There is some
potential for impact to human safety, but this is application-specific.

Aviation grade systems are characterized by harsh temperature,
corrosive, low and high pressure environments. Failure of these systems
is more crucial than for industrial systems and can lead to a loss of
vehicle. Thus, there is a need for the system to be able to safely
return to base or land after a critical failure. Human safety is
dependent on these systems and loss of vehicle can lead to loss of human
life. Thus, failures require more stringent management and avoiding a
failure through prognostic applications greatly enhances vehicle
reliability and human safety.

Space grade systems are characterized by harsh temperatures, vacuum,
space radiation, solar ultra-violet (UV), atomic oxygen (LEO),
micro-gravity environment. Failures of these systems are even more
crucial than for aviation systems, due to limited or complete inability
to recover a failed vehicle. Thus, space vehicles must operate in the
presence of multiple failures. Abort modes are generally limited and
failures must be detected to enable abort mode activation in a timely
fashion. Prognostics are important for operation of space vehicles from
LEO to interstellar space. Crewed-vehicle health directly impacts human
health and safety.

As can be seen from the different types of systems, human health and
safety dependence varies with type and application. Human health and
safety dependence can be characterized by human interaction with the
system and human dependence on the system for survivability. The most
critical systems are those in which human survivability is dependent.
Space and high-altitude aircraft applications are a key example of this
dependence. In these applications vehicle systems are depended upon to
maintain human health and safety. Failure of these systems leads to a
loss of human life (loss of crew). Low altitude aircraft have a less
stringent dependence, but still have impacts on human health and safety
depending on the ability to safely land. There are systems in which no
dependence exists for human health and safety. Robotic spacecraft,
Unmanned Aerial Vehicles (UAV), and industrial plant operations are
examples of this non-dependence.

*Proactive Health Management and Recovery*

Conventional health management techniques focus heavily on reactive
rather than predictive behavior. The ability to predict problems that
might be encountered, and to adapt for problems which were not
necessarily anticipated, becomes far more crucial as human survivability
dependence, mission expectations, and timelines increase. Knowledge of
impending, developing and extant failures before they impact vehicle
health is far more critical than reactive responses.

Also, while dual-, triple-, or even quad-redundant techniques are
commonly effective for relatively short missions, they may not be
suitable for long-duration missions since they are not very efficient in
utilizing redundant components. For example, in dual-string
architectures which are not cross-strapped, when elements in both
strings have failed, the system fails. It is impossible to use other
components in the system to resurrect it even though they are still
functioning properly, because they are simply incapable of performing
the failed pair's tasks. In addition, component life becomes critical
for ultra-long-life missions (i.e., a decade or more). Since the
predominant failure mode in an ultra-long-life system is component life,
all active components in the system will approach end of life conditions
by the end of the mission. Therefore, conventional fault-tolerant
techniques would require many more redundant components to come on-line
later in the mission to maintain system reliability. Proactive health
management combined with recovery options is necessary to make sure the
system can function reliably through the end of the mission.

> *Error and Fault Detection*
>
> *Real Time Logic Checking*

This involves integrating test patterns in the data or in the downtime
between data sets to test for known conditions. For instance if you
wanted to check the logic controlling the memory and the memory itself,
a known data pattern could be written to and read from a block of memory
at specific time intervals. A known pattern could uncover bit errors and
highlight potential logic faults. This could be incorporated into live
real time running hardware. In depth testing, of every memory location
and bit would require off-line testing.

> *Vector Testing*

Vector testing refers to certain bit patterns or vectors that can be
used to diagnose the health of a logic circuit. By using a known vector
in a memory test then you can write and read it and compare the two to
uncover any problems. Applied to a unique logic circuit, applying a
vector will result in a specific output. By analyzing the output and
comparing it to what the output should be, errors can be uncovered.

> *Idle Data Pattern Diagnosis*

In many communications systems, even though actual data is not being
sent, an idle pattern is constantly sent back and forth. In some
systems, the idle pattern itself is an indication of channel health. If
the idle data pattern changes and is incorrect, this is detected on the
receiving side and appropriate actions are taken.

> *Ground Plane Frequency Diagnosis*

This is a very complicated technique that would rarely justify the added
complexity and cost. This would entail monitoring the ground plane by
digitizing the signal on it looking for frequency patterns that could
determine a problem on the board. To do this would require
Analog-to-Digital (A/D) circuits for data acquisition and a digital
signal processor to run algorithms on the data to determine the health
of the system. This may be worthwhile at the system level cause the
amount of electronics necessary to accomplish this could take up half a
6U card (the Versa Module Eurocard (VME) specifications, IEEE 1014,
define a 6U card as 233mm x 160 mm).

> *Recovery*

Most computer systems provide some means for detecting and recovering
from system failure of a non-catastrophic nature. Usually, this is
effective for situations involving software errors and intermittent,
random crashes, rather than permanent damage to hardware. Reset
techniques vary from manual to automatic watchdog timers depending on
the application and safety criticality. For permanent hardware faults,
current systems depend on redundancy. Redundancy works well as long as
there are no common-cause failures (i.e., failures which will occur in
all hardware or software versions of the same type give the same set of
conditions). Concerns of these types of failures have led to concepts
such as Backup Flight Software (BFS) which use dissimilar software
and/or hardware to protect against common cause errors. BFS requires a
complete duplication of the flight system and is extremely costly.
Systems that implement BFS usually have high human survivability
dependence. The Space Shuttle Orbiter is an example of such a system
that has implemented BFS, although the BFS capability has never been
required in flight. Reconfigurable computing is an emerging field that
offers greatly improved flexibility for hardware failure recoveries. It
provides an economical solution to hardware failures and also provides a
level of protection against common cause failures as the hardware can be
configured in an alternative architecture to correct for failures.

> *Reset*

A manual hardware reset -- or hard reboot -- is very effective for
random errors (i.e., not repeatable such as a Single Event Upset) in the
event a detectable system failure has occurred. But that is not a
remotely automatic or timely safeguard. Watchdog timers and related
techniques are often a reasonably effective and fast way to capture and
respond to major crashes. The usual scheme for this utilizes a dedicated
counter in hardware constantly counting down, and some means in hardware
or software run-streams of resetting the counter periodically; if the
counter times out because it has not been reset, a reboot cycle is
automatically generated.

> *Redundant element management*

To permanently recover from a failure, some form of redundancy is
usually required. Identical redundant elements may be running in
parallel with the active elements, so that they can quickly take over if
active components fail. However, this approach is expensive, since all
the major components must be duplicated, and it leaves the backup
elements vulnerable to life-limitation failures. Other methods leave
backup elements in standby or offline entirely.

Another more cost-effective approach requires that each element in the
system be able to perform different tasks, reducing duplication. In the
event that a component fails, its function will be reassigned to other
healthy components, provided the healthy components can handle
additional workload. This approach is suitable for systems in which the
key components are computing elements such as processors or controllers.
To fully realize the functional reassignment, all the computing elements
must be symmetrical; that is, they should have the same computing
capability, memory size, and I/O interfaces. State information must be
exchanged frequently to ensure that operations of a failed element can
be taken over quickly.

A more efficient approach to utilize redundant components is to use a
generic function block (GFB) approach. An avionics architecture can
include a few spare GFBs as identical redundant components. These are
not committed to any function at launch, but can be reconfigured later
as needed. If any component fails, one of the GFBs can be configured to
replace it. One GFB can replace multiple types of components, so the
spacecraft does not have to stockpile many types of redundant
components. With the advances in FPGA technologies, it is relatively
easy to implement GFBs.

> *Reconfigurable Computing*

Reconfigurable computing lately seems to be coming into its own. In
whatever form this technology takes, it is first and foremost capable of
being partially or completely changed as needed. This may be as simple
as replacing operational software, or can include the capability to
modify behavior or order of input and output pins. Ultimately, this will
be accomplished without significant interruption of system activity --
or even between system clock cycles, with no detectable transition
artifact.

In addition to being reconfigurable, these systems typically have
massively parallel computing capabilities. Benefits of this include much
higher processing speed; orders-of-magnitude speedup over individual
serial processing has been demonstrated. Distribution of critical
functionality makes a system less prone to the devastating effects of
radiation and electromagnetic interference, and the ability to
reconfigure if such an event occurs allows the possibility to circumvent
residual hardware damage.

In the manual context, reconfigurable computing is already very much a
reality. During a mission, ground operators or flight crew commonly
command a vehicle to upload and install new software or firmware. In
fact, the scheme above for GFBs is amenable to this technique. However,
it is far more effective and timely to provide automated means of this
transition, especially in the presence of capable fault-detection
algorithms.

One challenge of in-flight reconfiguration is the verification of the
newly reconfigured FPGA block**.** If the newly configured FPGA is to
perform non-critical functions, then its I/O pins can be activated by a
hardware command so that it can start to receive inputs and produce
output signals. Operators can optionally read out and verify
configuration of the FPGA before it is activated. If a newly-configured
FPGA is to perform a critical function, then a more carefully staged
upgrade procedure should be used. In most cases, the critical function
will have already been implemented somewhere on the spacecraft, and can
be used as a reference. The newly-configured FPGA will first be put into
an observation mode, in which all inputs are received and functions
executed, but outputs do not take effect. Instead, they are used to
compare with outputs of the old implementation; by this means, most
functions of the FPGA can be verified except for differences between the
old and new implementations.

The newly-configured FPGA can be promoted to the active role when all of
its functions are verified. The old implementation can first be put into
backup mode in case the new FPGA fails unexpectedly, and then retired
from the system when the new FPGA has been operating flawlessly for some
time.

If a newly-configured FPGA is to implement a new untested critical
function, then its operation should be verified by on-board simulation,
where the FPGA will receive real inputs and execute the critical
function without active output control. The advantage of on-board
simulation over ground-based simulation is that inputs are much more
realistic. After operation of the new FPGA is fully verified, outputs of
the FPGA can begin active operation.

To make such planned improvements proactive and timely, human
intervention must be minimized. Automating these processes allows the
ob-board systems to responds quickly. This is especially important
during critical operations or for human interplanetary missions where
the light-time latency can be significant. Operations costs can also be
greatly reduced by automation by reducing the manual time required to
reprogram the FPGA.

An additional aspect of reconfigurable, massively parallel computing is
its suitability for hardware implementation of neural networks, genetic
algorithms, and other forms of advanced computer decision-making
technology. Recent developments in these arts have yielded impressive
and encouraging results. The day when computers can self-diagnose,
design repair procedures, and implement them safely and effectively may
thus be closer than many expect.

*Summary*

Avionics is comprised of a complex set of electronic, optical, and MEMS
technologies. These components have characteristic failures that are
generally tested for during manufacturing or maintenance, but which are
not tested for in flight operational modes. The vehicle operational
environment is a large source of potential errors for an avionics
system. Environmental parameters are monitored at various levels from
the vehicle level to the component level to the individual device level.
This monitoring is not consistent across components and is driven
primarily by component performance considerations. Avionics components
have traditionally been integrated in loosely federated systems
architectures that do not account well for component interactions.
Emerging Modular Integrated System (MIS) architectures address the
component interactions at all levels and provide a more robust framework
for avionics health management at the system level. These concepts are
emerging and hold great promise to increase the reliability of avionics
components. Recovery techniques are currently implemented through
redundant components and systems. Reconfigurable computer applications
hold great promise to increase in-flight system failure recovery and
flexibility. There are many fruitful areas of research and development
that are required to enable a fully proactive Avionics Health Management
System. As this work evolves, the benefits to the aerospace industry
will be substantial.