# ISHEM 2005 Abstracts

**First International Forum on\
Integrated System Health\
Engineering and Management\
in Aerospace**

##### November 7-10, 2005

##### Napa, California, USA

### ISHEM Sponsored by Corporate Sponsors

NASA Ames Research Center ATK Thiokol

NASA Marshall Space Flight Center Boeing

Gormley and Associates

Pratt & Whitney Rocketdyne

Qualtech Systems, Inc.

# ISHEM Forum 2005

Integrated System Health Engineering and Management (ISHEM) is a term
describing the discipline of health management for systems in general.
It consists of the processes, techniques, and technologies used to
design, analyze, build, verify, and operate complex human-machine
systems with the goal of preventing failures or minimizing their
effects.

The Forum on Integrated System Health Engineering and Management in
Aerospace will present a broad overview of the field with the objective
of creating a "desk reference" document that can be used by managers,
project leaders, and engineers as they create new systems. This will
provide a concrete, cross-cutting, and accepted starting point for
researchers and designers in the field.

Each forum paper will provide a basic overview of its subject area,
including an introduction to the subject area, methods and techniques,
what has happened in the past, the current state of the art, the tools
used in this area for analysis and design, what direction this subject
is taking for future applications of relevance to ISHEM as a whole, and
a list of essential reference books and articles for the subject matter.
Each invited author will present a 20-minute synopsis of his or her
paper. A question-and-answer period will be held before each break where
the previous 3-4 speakers will answer questions.

# Forum Organization

### Forum Organizers 

Serdar Uckun, MD, PhD Technical Area Lead, Discovery and Systems Health\
Intelligent Systems Division, NASA Ames Research Center

Andy Hess Prognostics and Health Management Lead\
Joint Strike Fighter Program Office

Stephen Johnson, PhD Research Professor, Institute for Science and Space
Studies\
University of Colorado at Colorado Springs

Charles Mott Department of Space Studies\
University of North Dakota

Ann Patterson-Hine, PhD, PE Lead, ISHM Applications Group\
Discovery and Systems Health, NASA Ames Research Center

Irem Tumer, PhD Lead, Complex Systems Design Group\
Discovery and Systems Health, NASA Ames Research Center

Mike Watson, PhD Chief, Advanced Sensors and Health Management Systems
Branch\
NASA Marshall Space Flight Center

### Local Organizing Committee

Dawn McIntosh NASA Ames Research Center

Sue Blumenberg NASA Ames Research Center

Robert Duffy NASA Ames Research Center

Diane Gazzano UC Santa Cruz, NASA ARC

Ann Patterson-Hine NASA Ames Research Center

Guy Power NASA Ames Research Center

## Table of Contents

### 

### Keynote Addresses

A Hitchhiker's Guide to LEO and Beyond -- An Operator's Perspective 9

Scott Altman, NASA Johnson Space Center

Prognostics and Health Management -- A Thirty-Year Retrospective 11

Andy Hess, Joint Strike Fighter Program Office

### Invited Papers

**Tuesday, November 8**

Introduction to Integrated System Health Engineering and Management in
Aerospace 15

Stephen B. Johnson

Integrated Systems Health Management: An Enabling Capability For Space
Exploration 17

Serdar Uckun

The System Life Cycle and ISHEM 19

Charles Mott

Technology Readiness Levels and Maturation Approaches for ISHM
Technologies 21

Ryan Mackey

Building a Healthy Learning Organization at the NASA Goddard Space
Flight Center 23

Edward W. Rogers

Strategic Management of Systems Integration Capabilities 25

Michael Hobday, Andrea Prencipe

Safety, Reliability, Stewardship, and Regret: Contributions to
Dependable System Design\
from the Study of Highly Reliable Organizations 27

Andrew Koehler

From Data Collection to Lessons Learned: Space Failure Information
Exploitation\
at The Aerospace Corporation 29

Jonathan F. Binkley, Paul G. Cheng, Patrick L. Smith, William F. Tosney

Human Factors of Integrated Systems Health Management on Next-Generation
Spacecraft 31

Robert S. McCann, Lilly Spirkovska

Human Spaceflight Fault Management Operations 33

Brian O'Hagan, Alan Crocker

Opportunities for Launch Site Integrated System Health Engineering and
Management 35

Robert D. Waterman, Patricia E. Langwost, Susan J. Waterman

Use of Integrated Vehicle Health Management in the Field of Commercial
Aviation 37

Gary Bird, Michael Christensen, Daniel Lutz, Philip A. Scandura, Jr.

Fault Protection Techniques in JPL Spacecraft 39

Paula S. Morgan

Launch Vehicle Health Management: An Overview 41

Edward N. Brown

Health Management Issues and Strategy for Air Force Missiles 43

Gregory A. Ruderman

Real Prognostics -- Challenges, Issues, and Lessons Learned: Chasing the
Big "P" 45

Andrew Hess, Giulio Calvello, Peter Frith

47

**Wednesday, November 9**

Rotorcraft Health Management Issues and Challenges 47

James Zakrajsek, Paula Dempsey, Edward Huff, Harry Decker, Michael
Augustin,\
Robab Safa-Bakhsh, Alan Duke, Piet Ephraim, Paul Grabill

Predictive Reliability of Tactical Missiles Using Health Monitoring Data
And Probabilistic Engineering Analysis 49

Stephen A. Marrotta, Abdul Kudiya, Teng K. Ooi, Houssam Toutanji, John
A. Gilbert

NASA Quality Assurance Policy 51

Brian Hughitt

Failure Assessment 53

Robyn R. Lutz, Allen P. Nikora

Quantitative Risk Analysis: Challenges and Opportunities at NASA 55

William Vesely

Maintainability: Theory and Practice 57

Gary O'Neill

ISHM Co-Design: Methods and Practices for Fault Avoidance and
Management\
During Early Phase Design 59

Irem Y. Tumer

Applications of Data Mining in Automated ISHM and Control for Complex\
Engineering Systems 61

Karl Reichard, Ed Crow, Lora Weiss, Chris Rogan

A Review of Diagnostic Techniques for ISHM Applications 63

Ann Patterson-Hine, Gordon Aaseng, Gautam Biswas, Sriram Narasimhan,\
Krishna Pattipati

An Overview of Selected Air Vehicle Prognostic and Health Management
Technologies 65

Michael J. Roemer, Gregory J. Kacprzynski, Carl S. Byington, George
Vachtsevanos

Physics of Failure 67

Kumar V. Jata, T.A. Parthasarathy

Safety in Integrated Systems Health Engineering and Management 69

Nancy Leveson

Fault Tolerant Architectures for Space and Avionics Applications 71

Daniel P. Siewiorek, Priya Narasimhan

V&V of ISHM for Space Exploration 73

Lawrence Markosian, Martin Feather, David Brinza, Fernando Figueroa

**Thursday, November 10**

Engine Health Management for Aircraft Propulsion Systems 75

Al Volponi, Bruce Wood, James Larkin

Space Propulsion Systems Propulsion Systems Health Management 77

Anthony R. Kelley, W.T. Powers

Integrated System Health Management for Exploration Applications:
Intelligent Sensor\
Systems and Software, and Complete Vehicle Integration 79

G. W. Hunter, L. G. Oberle, G. Baakalini, W.A. Maul, C.E. Fulton. J.
Perotti, T. Hong

SHM Design for Space Operation Vehicles 81

Fu-Kuo Chang

Electrical Power System Health Management 83

Robert M. Button, Amy K. Chicatelli

Avionics Health Management 85

Michael D. Watson, Kosta Varnavas, Clint Patrick, Carl S. Byington.
Savio Chau,\
Edmund C. Baroth

Issues in Integrated Health Management of Life Support Systems 87

David Kortenkamp, Gautam Biswas, Eric Jan Manders

### Posters

A Unified Model-based Systems and Software Engineering Approach to
Integrated\
System Health Management 90

Michel D. Ingham, Oliver B. Martin, Seung H. Chung, Gregory A. Horvath,\
Brian C. Williams

Active System Health Maintenance -- Self-Healing Wire Insulation and
Robotic Inspection 92

Dryver R. Huston, Dylan Burns, Brian Esser, Graham Spencer, Bernard
Tolmie

Advanced Diagnostics and Prognostics Testbed (ADAPT) 93

Andre Goforth, Dougal MacLise, Dwight Sanderfer, David Nishikawa, Eric
Barszcz

Applying Human Factor Concepts to Space Payload Ground Operations
Training 94

Emily Watson

Architecture for Actuator Health Monitoring 95

Steve Rogers

Certifying a Structural Health Monitoring System: Characterizing
Durability, Reliability and Longevity 96

Seth S. Kessler

Diagnosing Complex Systems with Software-Extended Behavior Using
Constraint\
Optimization 97

Tsoline Mikaelian, Brian C. Williams, Martin Sachenbacher

Distributed System Health Management in Complex Systems 98

Kagan Tumer, Adrian Agogino

Embedded Integrated System Health Management in a Closed Loop Life Cycle
99

Gerald L. Nissen

Integrated Self-Diagnostic Health Management for Thermal Protection of
Entry and\
Re-Entry Vehicles 100

Robert W. Hyers, Alaina B. Hanlon, Abhijit Deshmukh

Meeting the Challenges of Exploration Systems: Health Management
Technologies for\
Propulsion and Power 101

Kevin J. Melcher, William A. Maul, Shane S. Sowers

Progress in Prognostics Health Management Advanced Life Prediction
System 103

Eva L. Suarez, Michael J. Duffy

Real Time Anomaly Detection for Expendable Launch Vehicles 104

Stephen Jeffress

SIPS, A Structural Integrity Prognosis System 105

John M. Papazian, Elias L. Anagnostou, Stephen Engel, John Madsen,
Daniel Fridline,\
Jerrell Nardiello, Robert P. Silberstein, Greg Welsh, James B. Whiteside

SQL-based Approach for Compiling Ordered Decision Diagrams from Device
Models 106

Yousri El Fattah

Strider -- An Enhanced Caution and Warning System That Uses Model-Based
Reasoning 107

Peter Robinson, Charles Lee, Daryl Fletcher, Rick Alena, Bill
McDermott,\
Mark Shirley, Tom Cochrane, Dan Duncavage

Technology Readiness of Structural Health Monitoring Systems 108

Amrita Kumar, Shawn Beard, Peter Qing, Roy Ikegami

Unsupervised Anomaly Detection for Rocket Propulsion Health Monitoring
109

Mark Schwabacher

Validation of a COTS EHM Solution for the JSF Program 110

Somnath Deb, Venkata N. Malepati, Michel D. Paquet, Baban Baliga

Verification of Model-based Software Systems for Space Applications 111

Guillaume Brat

What is the value proposition for wire integrity management using
sensors on-board manned aerospacecraft? -- exploring the business case
for ground processing operations 112

Philip Wysocki, James Cockrell, Ralph Hodgson

### Author Index

115

## Keynote Addresses

#   {#section-1 .unnumbered}

# A Hitchhiker's Guide to LEO and Beyond -- An Operator's Perspective

######### Scott Altman

*Astronaut Office*

*Flight Crew Operations Directorate*

*NASA Johnson Space Center*

Scott Altman is a Navy test pilot and astronaut with a bachelor of
science degree in aeronautical and astronautical engineering from the
University of Illinois and a master of science degree in aeronautical
engineering from the Naval Postgraduate School. Prior to his selection
as an astronaut candidate, he was an F-14 test pilot, and was awarded
the Navy Air Medal for his role as a strike leader flying over Southern
Iraq in support of Operation SOUTHERN WATCH. He has logged over 4000
flight hours in more than 40 types of aircraft.

A veteran of three space flights, Scott has also logged over 38 days in
space. He was the pilot on STS-90 Neurolab (1998) and STS-106 (2000),
and mission commander on STS-109 (2002), the fourth Hubble Space
Telescope servicing mission. He was Shuttle Branch chief for the
Astronaut Office for two years and lead for the Cockpit Avionics
Upgrade.

#   {#section-2 .unnumbered}

# Prognostics & Health Management -- A Thirty-Year Retrospective

######### Andy Hess

*Prognostics and Health Management Lead*

*Joint Strike Fighter Program Office*

Andy Hess is world renowned for his work in fixed and rotary wing health
monitoring, and is recognized as the father of naval aviation propulsion
diagnostics. Beginning with the A-7E engine health-monitoring program of
the early 70s, Andy has been a leading advocate for health monitoring in
the Navy and has been instrumental in the development of every Navy
aircraft application since the A-7E through the F/A-18 and V-22. His
efforts have largely led to the successful transition of a development
program Helicopter Integrated Diagnostic System into production (IMD
HUMS) for all H-60, H-53, and AH-1 aircraft.

More recently, Andy has been a strong advocate of prognostic
capabilities and has been involved in many efforts advancing the
development of these predictive capabilities for sundry systems and
their component elements. Currently, he is hard at work leading the
development and integration of the Prognostic and Health Management
(PHM) system for the Joint Strike Fighter program, and is a frequent
participant in the international technical community.

Andy is a graduate of the University of Virginia with a degree in
Aerospace Engineering, and of the U. S. Navy Test Pilot School.

## Invited Papers

# Notes  {#notes .Notes}

# Introduction to Integrated System Health Engineering and Management in Aerospace

######### Stephen B. Johnson

*Institute for Science and Space Studies,\
University of Colorado at Colorado Springs\
and NASA Marshall Space Flight Center*

This paper provides an historical and technical overview of Integrated
System Health Engineering and Management (ISHEM). We define ISHEM as
"the processes, techniques, and technologies used to design, analyze,
build, verify, and operate a system to prevent faults and/or minimize
their effects." This includes design and manufacturing techniques as
well operational and managerial methods. ISHEM is not a "purely
technical issue" as it also involves and must account for
organizational, communicative, and cognitive features of humans as
social beings and as individuals. Thus the paper will discuss in more
detail why all of these elements, from the technical to the cognitive
and social, are necessary to build dependable human-machine systems. The
paper outlines a functional framework and architecture for ISHEM
operations, providing a theoretical framework to understand the
relationship between the different aspects of the discipline. It then
derives from these and the social and cognitive bases a set of design
and operational principles for ISHEM.

# Notes  {#notes-1 .Notes}

# Integrated Systems Health Management: An Enabling Capability For Space Exploration

######### Serdar Uckun

*NASA Ames Research Center*

Integrated Systems Health Management (ISHM) is a strategic investment in
sustainable space exploration. Often considered a real-time avionics
function for vehicle subsystems and procured as such, ISHM actually is a
crosscutting design driver where a variety of tools, technologies, and
system engineering methods come into play.

ISHM concepts and technologies may be applied to any complex engineered
system such as transportation systems, orbital or planetary habitats,
observatories, command and control systems, life support systems,
safety-critical software, and even the health of flight crews. As an
overarching design and operational principle implemented at the
system-of-systems level, ISHM holds substantial promise in terms of
affordability, safety, reliability, and effectiveness of future
exploration missions.

# Notes  {#notes-2 .Notes}

# The System Life Cycle and ISHEM

######### Charles Mott

*University of North Dakota*

The creation of dependable systems involves the application of methods
from a variety of subject areas and disciplines. Integrated System
Health Engineering and Management (ISHEM) draws on these methods
throughout the system life cycle to achieve dependability. The system
life cycle is described in many ways in the literature. A generic
approach to the system life cycle is presented and developed as a
framework for understanding the relationships and contributions of the
various methods used to create dependable systems.

The generic life cycle consists of six phases: research, planning,
design, testing, manufacture, and operations. The interconnectedness of
these phases is explored to promote awareness of how the actions taken
in one phase can influence the choices of action available in other
phases. The need to consider this interconnectivity and the effects it
can have on system dependability, costs, and efficiency is examined.

Each of the phases of the system life cycle can be associated with
several different subject areas or disciplines that affect system
dependability. Categorizing the subject areas according to the phase of
the system life cycle where they have the greatest influence facilitates
increased understanding of the critical factors that create
dependability during each phase. It also reveals opportunities for
increased information sharing, better decision making, and reduced
redundancy, leading to more efficient and consistent system creation.

# Notes  {#notes-3 .Notes}

# Technology Readiness Levels and Maturation Approaches for ISHM Technologies

######### Ryan Mackey

*NASA Jet Propulsion Laboratory*

Integrated System Health Management is a necessary component for NASA's
new near-term goals. New technologies are needed to improve safety,
reliability, affordability, and ultimately capability of upcoming and
increasingly complicated exploration systems. Many of these new
technologies are needed in the short term, and must be matured from
concept to space-proven applications within five to ten years.
Furthermore, the technologies themselves are often inherently complex
and difficult to validate. This paper focuses on these issues of ISHM
development, with the aim to facilitate technology maturation and
certification.

Much of the difficulty arises because ISHM technologies are commonly
associated with complex software and modeling components. To understand
the challenges in more detail, we begin by considering equivalent
efforts to bound and understand software and information technologies,
and expand these conventions to include the broader scope of ISHM.
Previous studies of TRL for autonomy-related information technology
provide us a solid foundation to evaluate ISHM maturity.

Another issue hindering maturation is that rigorous testing of ISHM
generally involves rare situations that are risky or impossible to
simulate. One required function of ISHM in space applications is
automatic crew escape in case of catastrophic vehicle failure, a
situation that is difficult to test. Virtually all ISHM functions are
triggered by failures -- events that are random, unusual, and often
poorly understood if they are known at all. The expense and time delay
associated with spaceflight makes in-space validation of ISHM
technologies a daunting prospect. However, as we will argue, a careful
analysis of the true ISHM maturation needs substantially reduces
dependence on in-space testing, permitting cost-effective alternatives
in many cases.

We will conclude this paper with a brief example, drawing from our
efforts to validate two specific ISHM technologies, both in the mid-TRL
range, using an F-18 aircraft as a test platform. In this discussion, we
will illustrate the specific challenges of ISHM maturation, where these
needs were met by our aircraft testbed, where further validation effort
remains, and how we could adapt our testbed to address as many
validation needs as possible. We will also discuss how other facilities
and other testbeds associated with the F-18 were leveraged to simplify
and improve ISHM validation. Finally, we will compare our experience to
other categories of ISHM functions, in an effort to propose optimal
means of technology maturation on an individual basis.

# Notes  {#notes-4 .Notes}

# Building a Healthy Learning Organization at the NASA Goddard Space Flight Center

# 

######### Edward W. Rogers

*NASA Goddard Space Flight Center*

An organizational system can be considered healthy if it is both
reliable and sustainable. Unreliable systems have too many errors that
could have been avoided. Unsustainable systems are inefficient because
of costly replenishment cycles and loss of vision during structural
realignments. For example, NASA has been faulted for not functioning as
a learning organization by the Columbia Accident Investigation Board
(CAIB) Report (2003).

Unpacking what the CAIB statements mean leads to analysis of the
organization as a system and identification of challenges relating to
reliability and sustainability of the NASA organization. To address this
type of challenge, an organization must connect organizational system
health with systems engineering, project management practices, and
safety in an integrated learning environment.

Many knowledge management efforts are focused solely on transactional
efficiency. Less well understood in most attempts at knowledge
management are the human factors that make sharing both possible and
worthwhile. The core of an organization's knowledge resides in the work
units and projects where it is being generated. The key to managing
knowledge is not to extract it from its origins but to facilitate its
use both at the source and within communities of practice across the
organization (Wegner, 1998; Rogers, 2004).

To be effective then, knowledge management must go beyond
first-generation KM characterized by single-loop learning. McElroy
(1999) concludes that "conventional knowledge management practice, then,
boils down to little more than *getting the right information to the
right people at the right time*. Think *single*-loop learning."
\[italics in original\]. Shukla and Srinivasan (2002) go further and
state "The purpose of first generation KM programs is to improve
operational efficiency of the employees by enhancing access to rule
sets." An effective KM architecture must focus on second-generation
knowledge management, not just the rules.

For example, part of NASA's response to a 2002 GAO report was the
formation of a NASA Knowledge Management Team chartered to write a KM
Strategic Plan for the Agency. Unfortunately, that plan fell short of
achieving effective change primarily because it focused exclusively on
IT as a KM driver with an over-emphasis on *capturing knowledge from
workers* for the organization as opposed to *facilitating knowledge
sharing among workers*. Many KM efforts fail precisely because they
"emphasize technology and codified knowledge" (Pfeffer & Sutton, 1999)
rather than learning.

McElroy, M.W. (1999). *Double-Loop Knowledge Management*,
MacroInnovation Inc. Available from www.macroinnovation.com

Pfeffer, J. & Sutton, R. (1999). *The Knowing-Doing Gap: How smart
companies turn knowledge into action*. Harvard Business School Press.

Shukla, A. & Srinivasan, R. (2002). *Designing Knowledge Management
Architecture*, Response Books (Sage Publications), New Delhi.

Rogers, E. W. (2004). The role of perceptions of reciprocity in
achieving cooperative knowledge behavior in high tech firms. *Journal of
High Technology Management Research*. Vol. 15/1 pp. 17-36.

Wenger, Etienne (1998). *Communities of Practice: Learning, Meaning and
Identity*, Cambridge University Press, Cambridge, UK.

***Notes***

# Strategic Management of Systems Integration Capabilities

######### Michael Hobday

*University of Sussex, Brighton, UK*

######### Andrea Prencipe

*University G. d'Annunzio, Pescara, Italy\
and University of Sussex, Brighton, UK*

This paper shows how and why systems integration has evolved into an
emerging model of industrial organization whereby organizations join
together different types of knowledge, skill, and activity, as well as
hardware, software, and human resources to produce new products for the
marketplace. Systems integration has "two faces." The first face refers
to the internal activities of organizations as they integrate the inputs
needed to produce new products. The second face, which has assumed much
greater importance in recent years, refers to the external activities of
organizations as they integrate components, skills, and knowledge from
other firms, including suppliers, users, and partners, in order to
deliver ever more complex products and systems. Both "faces" of systems
integration go well beyond the engineering level, having become central
to the strategies and competitive advantages of General Electric, IBM,
Hewlett-Packard, Cable & Wireless, Siemens, Nokia, Boeing, and many
other of the world's leading corporations.

This paper identifies two analytical categories of systems integration
in multitechnology multicomponent products, namely synchronic and
diachronic. Synchronic systems integration refers to the capabilities
required to set the product concept design, decompose it, coordinate the
network of suppliers, and then recompose the product within a given
family. Diachronic systems integration refers to the capabilities to
envisage and move progressively towards different and alternative paths
of product architectures (i.e., new product families) to meet evolving
customer requirements. From a dynamic point of view, products are better
conceptualized as a continuous flow of innovations deriving from
different, distant, and often intertwined technological paths.

Based on this categorization, the paper raises the issue of training of
engineers of systems integrating organizations. Successful systems
integrating organizations have trained their engineers through their
direct involvement in manufacturing activities. More recently,
organizations have started offshoring manufacturing activities to
low-cost countries. This entails that newly appointed systems engineers
have not been exposed to hands-on training in design and/or
manufacturing activities. This may cause the undesirable result that
newly appointed engineers may find it more difficult to develop systems
skills required to understand the large-scale consequences of seemingly
minor problems. If organizations plan to act as integrators of somebody
else's knowledge and components, then they ought to face the issue of
developing and maintaining the in-house systems knowledge required to
coordinate external organizations' activities. Hands-on training and
career paths become therefore strategic issues in order to develop such
knowledge. The chief task of systems integrating organizations is in
fact to act as catalysts of change between the evolution of bodies of
scientific and technological knowledge on which they rely and the
evolution of artifacts that ultimately determine their survival.

***Notes***

# Safety, Reliability, Stewardship, and Regret: Contributions to Dependable System Design from the Study of Highly Reliable Organizations

######### Andrew Koehler

*Los Alamos National Laboratory*

Part of the Dependable System Design and Engineering project is the idea
that a technology's operational experience is determined both by the
nature of the physical artifacts comprising the technical system and the
organizational environment in which those artifacts function. For
example, completion of national policy objectives by the Apollo effort
resulted from causal factors beyond those explained by the collection of
parts making up the Saturn V system. Rather, system outcome was caused
by a complex, highly interconnected set of processes and relationships
between social, organizational, and technical components. Through a
long, dynamic, development process, rocket designers, mission
controllers, flight crews, and a multitude of others had to fabricate an
organizational form capable of managing a complex and unforgiving
enterprise. With perfect safety of space flight a known impossibility,
effective attention at all stages of program life to operational
vigilance, to learning from failure, to controlling such risks as could
be managed, were consciously and seriously undertaken parts of the
organizational "design," woven together with technical system
engineering activities.

The objective of the High Reliability Organization (HRO) project,
started at UC Berkeley in the mid-1980s and since taken up elsewhere,
has been to study how organizations charged with performing activities
characterized by high hazard and demanding technical features either
manage or fail to meet operational challenges. The HRO project started
with the identification of an anomaly: Despite general agreement with
organizational theory literature seeking to explain the causes of system
accidents, researchers were puzzled by the relative success of some
organizations at performing better than would be expected by this
literature. For example, given the extreme hazards in operating aircraft
off a carrier, how is it that the US Navy has successfully created,
maintained, and improved this activity? From the standpoint of
contemporary organizational theory, any sane bottom-up statistical
model, or experience gleaned from failed foreign efforts to create
carrier aviation capabilities, landing weapon-laden aircraft onto a
rolling, pitching deck in the middle of the night should be unacceptably
dangerous. Yet, the US Navy has managed, through a variety of
interrelated technical and organizational strategies, to "work in
practice, but not in theory," reducing the rate of major (class A)
accidents from approximately 50 per 100,000 flight hours in 1950 to less
than 2 in 2003.

Initially, the HRO project focused on characterizing the form this
anomaly took on, in the hope of posing a challenge to existing
organizational theory approaches to explaining technology-related
performance. However, as study of activities such as operation of
nuclear/conventional power plants, air traffic control, and aircraft
carriers, broadened out to include waste management, spacecraft, and
other types of activities, a body of general regularities characterizing
HRO behaviors emerged. While social "design" is far more difficult to
prescribe than engineering design, these organizational regularities do
provide a means by which the form of technology employed as part of the
operation of a hazardous/complex socio-technical system can be linked to
the necessary kinds of organizational structures that must be created to
explain a particular level of performance.

This paper explores the different threads in the HRO literature that are
of particular interest in thinking about and designing systems with
dependable operational characteristics. Drawing upon this literature, I
argue that the opportunity to become seriously engaged with the system
design and engineering community in the creation of dependable systems
offers the possibility for the development of new forms of
socio-technical system design and management tools. These tools do not
yet exist; however in thinking about HRO in the context of the system
design task, the outline of these tools may now become visible.

# Notes  {#notes-5 .Notes}

# From Data Collection to Lessons Learned: Space Failure Information Exploitation at The Aerospace Corporation

### 

######### Jonathan F. Binkley, Paul G. Cheng, Patrick L. Smith, William F. Tosney

*The Aerospace Corporation*

The Aerospace Corporation extracts lessons learned from launch vehicle
and satellite anomalies to help the space community avoid repetition of
mishaps. Incorporated in reports to industry, program reviews, and
journal publications, the lessons lend themselves to influence new
acquisition guidelines and military specifications. Government and the
commercial space communities, which share a common interest in quality
improvement, should work together to establish more comprehensive and
effective approaches to developing and disseminating lessons learned.

# Notes  {#notes-6 .Notes}

#  Human Factors of Integrated Systems Health Management on Next-Generation Spacecraft

######### Robert S. McCann and Lilly Spirkovska

*NASA Ames Research Center*

A shuttle crew's ability to manage the health of the spacecraft systems
is compromised by the limited capabilities of the onboard health
management technologies, many of which date from the 1970s and 1980s.
Most notably, the Caution and Warning system does little more than
generate auditory alerts and fault messages in response to out-of-limit
sensor readings. Today's health management technologies have much more
extensive capabilities that range from detecting off-nominal trends and
data patterns to executing fault isolation and recovery procedures. On
next-generation spacecraft, these technologies could be harnessed to
replace the traditional Caution and Warning system with a decision and
action support system that assists the crew with all aspects of
real-time health management operations.

We discuss several aspects of the design of such a system, including
human-machine functional allocations, user interfaces to enable and
support human-machine interaction, and methodologies for testing and
evaluating collaborative operational concepts and associated user
interfaces.

# Notes  {#notes-7 .Notes}

# Human Spaceflight Fault Management Operations

######### Brian O'Hagan and Alan Crocker

*NASA Johnson Space Center*

This paper will discuss human spaceflight fault management operations.
Fault detection and response capabilities available in current US human
spaceflight programs -- Space Shuttle and International Space Station --
will be described, while emphasizing system design impacts on
operational techniques and constraints. Preflight and inflight
processes, along with products used to anticipate, mitigate, and respond
to failures, will be introduced. Examples of operational products used
to support failure responses will also be presented. Possible
improvements in the state of the art, as well as prioritization and
success criteria for their implementation, will be proposed.

This paper describes how the architecture of a command and control
system impacts operations in areas such as the required fault response
times, automated vs. manual fault responses, use of workarounds, etc.
The architecture includes the use of redundancy at the system and
software function level, software capabilities, use of intelligent or
autonomous systems, number and severity of software defects, etc. This
in turn drives which Caution and Warning (C&W) events should be
annunciated, C&W event classification, operator display designs, crew
training, Flight Control Team (FCT) training, and procedure development.
Other factors impacting operations are the complexity of a system,
skills needed to understand and operate a system, and the use of
commonality vs. optimized solutions for software and responses.

Fault detection, annunciation, safing responses, and recovery
capabilities are explored using real examples to uncover underlying
philosophies and constraints. These factors directly impact operations
in that the crew and FCT need to understand what happened, why it
happened, what the system is doing, and what, if any, corrective actions
they need to perform. If a fault results in multiple C&W events, or if
several faults occur simultaneously, the root cause(s) of the fault(s),
as well as their vehicle-wide impacts, must be determined in order to
maintain situational awareness. This allows both automated and manual
recovery operations to focus on the real cause of the fault(s). An
appropriate balance must be struck between correcting the root cause
failure and addressing the impacts of that fault on other vehicle
components.

Lastly, this paper presents a strategy for using lessons learned to
improve the software, displays, and procedures in addition to
determining what is a candidate for automation. Enabling technologies
and techniques are identified to promote system evolution from one that
requires manual fault responses to one that uses automation and autonomy
where they are most effective. These considerations include the value in
correcting software defects in a timely manner, automation of repetitive
tasks, making time-critical responses autonomous, etc. The paper
recommends the appropriate use of intelligent systems to determine the
root causes of faults and correctly identify separate unrelated faults.

# Notes  {#notes-8 .Notes}

# Opportunities for Launch Site Integrated System Health Engineering and Management

######### Robert D. Waterman, Patricia E. Langwost, Susan J. Waterman

*NASA Kennedy Space Center*

The launch site processing flow involves operations such as functional
verification, preflight servicing, and launch. These operations often
include hazards that must be controlled to protect human life and
critical space hardware assets. Existing command and control
capabilities are limited to simple limit checking during automated
monitoring. Contingency actions are highly dependent on human
recognition, decision making, and execution. Many opportunities for
Integrated System Health Engineering and Management (ISHEM) exist
throughout the processing flow. This paper will present the current
human-centered approach to health management as performed today for the
shuttle and space station programs. In addition, it will address some of
the more critical ISHEM needs, and provide recommendations for future
implementation of ISHEM at the launch site.

# Notes  {#notes-9 .Notes}

# Use of Integrated Vehicle Health Management in the Field of Commercial Aviation

######### Gary Bird, Michael Christensen, Daniel Lutz, Philip A. Scandura, Jr.

*Honeywell International*

In the early days of analog aircraft systems, the notion of Built-In
Test (BIT) was nothing more than a simple pushbutton that supplied
current to the internal circuitry. If intact, a green light would
illuminate, signifying a successful test. Known as push-to-test or
go/no-go systems, this simple approach sufficed for early analog
systems. With the advent of digital avionics computers in the early
1980s, however, the ability to detect faults and isolate them to the
offending component posed a significant challenge to airline mechanics
and repair technicians. Working with industry, Aeronautical Radio, Inc.
(ARINC) developed the first industry standard for health management,
ARINC-604 "Guidance for Design and use of Built-In Test Equipment." From
that standard, the field of Vehicle Health Management (VHM) in
commercial aviation was born, although the acronym VHM would not come
into usage until nearly 20 years later. In the years that followed
ARINC-604, additional industry standards have been developed, driven by
the advances made as new aircraft families were introduced. Even today
commercial aviation has begun to adopt techniques used in other
industries, for example, process control and automotive.

Often times, it seems that the definition of Integrated Vehicle Health
Management (IVHM) is as varied as the individuals providing the
definition. For the purposes of this paper, a common definition is
presented that answers the questions "Why IVHM?"; "Where is IVHM used?";
and "What are the safety & economic benefits of IVHM?" Once established,
the common definition is used as the basis of discussion for several
state-of-the-art IVHM commercial aviation systems. For each system, a
high-level overview is provided, emphasizing the key features of the
system and significant differences from previous systems. For those
systems already fielded, the challenges, lessons learned, and benefits
that were achieved are discussed. For those systems currently in
development, the anticipated challenges and benefits of the new systems
are discussed. Finally, a glimpse into the future direction of IVHM for
commercial aviation is provided, suggesting those areas in which further
improvements are necessary.

# Notes  {#notes-10 .Notes}

# Fault Protection Techniques in JPL Spacecraft

######### Paula S. Morgan

*NASA Jet Propulsion Laboratory*

For all JPL spacecraft, maintaining the health and functionality of
spacecraft subsystems and science instruments is an ongoing task; a
challenge which must be met throughout the lifetime of every mission.
Material stresses in flight caused by solar heating, the cold of deep
space, solar radiation bombardment, etc., can degrade the mission or
contribute to malfunctions in subsystem components. In addition to these
health risks, flight software sequences and coding updates periodically
sent to the spacecraft can potentially introduce human error. As
spacecraft design sophistication and complexity increases, fault
diagnosis and resolution becomes a more difficult and time-consuming
task for the Spacecraft Operations Ground-based Team who must collect
large volumes of telemetry data to diagnose faults. These telemetry
streams contain hundreds of system data products which must be compared
to archived historical data and spacecraft design information to
determine fault causes and resolution actions. Additionally, those
spacecraft missions which experience great Earth-spacecraft distances
(such as outer planet exploration) present an additional challenge, as
the ever-increasing delay period between commands sent and received by
the spacecraft limits the ability to respond to fault occurrences in a
timely manner. Time delays also present problems when spacecraft mission
objectives contain "crucial events" which must take place at specific
times, or when serious, potentially mission-catastrophic faults must be
fixed immediately.

Fault management may be approached by implementing functional
redundancy, redundant hardware, and Fault Protection (FP) techniques.
This strategy provides autonomous monitoring of component operation,
device health, internal and external temperature conditions, and power
allocation, by responding to any anomalous conditions through automated
responses containing "preprogrammed instructions." Thus, mission
integrity may be optimized by implementing Fault Protection strategies
which will provide a more robust spacecraft system with greater
diagnostic capabilities.

While every JPL spacecraft requires some unique mission-specific fault
protection, there are many requirements which are common to all
spacecraft configurations. These consist of protecting command and data
processing and attitude control computers, protection against
communication loss with the spacecraft, ensuring that safe external and
internal temperature levels are maintained, and recovery from power
overloads. Additionally, most JPL spacecraft are equipped with a
general-purpose "Safe Mode" response algorithm which configures the
spacecraft to a lower power state which is safe and predictable so that
diagnosis of more complex faults can be addressed by the Operations
Team. This paper details the generic application of fault protection
techniques which are implemented into most JPL spacecraft designs.

# Notes  {#notes-11 .Notes}

# Launch Vehicle Health Management: An Overview

######### Edward N. Brown

*The Boeing Company*

Launch Vehicle Health Management (LVHM) is a technology that is
presently maturing but still suffers from terminology confusion. Health
maintenance systems, first as "monitoring" and more recently as
"management," have been in use by the airlines and the military (with
varying levels of sophistication) for over 30 years. Similar concepts
for launch vehicles are also evolving from single-discipline
instrumentation-based measurement systems to interdisciplinary and
integrated health management systems that combine fault detection with
health assessment and display, operational flight control, and
operational launch preparation/maintenance control. LVHM has two
separate areas of emphasis: supporting operational readiness and
supporting the safety and effectiveness of operational flight. The
"management" aspects of LVHM are generally organized and structured
under conventional programmatic entities (flight/subsystem control,
mission/maintenance management) that are extensively covered elsewhere,
whereas the "monitoring" aspects, generally recognized as data
acquisition, instrumentation, or measurement processing (non-subsystem
specific), form the thrust of this Overview.

# Notes  {#notes-12 .Notes}

# Health Management Issues and Strategy for Air Force Missiles

# 

######### Gregory A. Ruderman

*Air Force Research Laboratory\
Edwards Air Force Base*

As so-called "wooden rounds," which are intended to sit stably in
storage for extended periods and then function precisely as desired, at
a moment's notice, Air Force missiles would appear to be an ideal
application for health monitoring. However, solid rocket motors that
serve as the propulsion system for these missiles present a number of
unique challenges for the development of integrated vehicle health
monitoring systems. Mechanical and chemical complexity, long service
lives, aging materials, and designs with small margins are typical for
solid motors. But the payoff for health monitoring is extreme as well.
Maintaining a healthy and capable fleet---ensuring the viability of the
missiles in the fleet while not retiring or destroying good assets
before it is necessary---could save as much as 50% in costs over a
60-year life cycle. In this paper, a number of the unique aspects of
solid rocket motors will be explored, the difficulties and successes in
development of sensors and diagnostic systems will be discussed, and a
path to further continue development of these systems will be proposed.

# Notes  {#notes-13 .Notes}

# Real Prognostics -- Challenges, Issues, and Lessons Learned: Chasing the Big "P" 

######### Andrew Hess, Giulio Calvello, Peter Frith

*Joint Strike Fighter Program Office*

The desire and need for real predictive prognostic capabilities have
been around for as long as man has operated complex and expensive
machinery. This has been true for both mechanical and electronic
systems. There has been a long history of trying to develop and
implement various degrees of prognostic and useful life remaining
capabilities. Stringent Diagnostic, Prognostic, and Health Management
(PHM) capability requirements are being placed on new applications, like
the Joint Strike Fighter (JSF), in order to enable and reap the benefits
of revolutionary Autonomic Logistic support concepts. While fault
detection and fault isolation effectiveness with very low false alarm
rates continue to improve on these new applications, prognostics
requirements are even more ambitious and present very significant
challenges to the system design teams. These prognostic challenges have
been aggressively addressed for mechanical systems for some time, but
are only recently being fully explored for electronics systems. This
paper will explore some of these design challenges and issues, discuss
the various degrees of prognostic capabilities, address potential
development methodologies, and draw heavily on lessons learned from
previous prognostic development efforts.

# Notes {#notes-14 .Notes}

# Rotorcraft Health Management Issues and Challenges

### 

######### James Zakrajsek, Paula Dempsey

*NASA Glenn Research Center*

######### Edward Huff

*NASA Ames Research Center (retired)*

######### Harry Decker

*U.S. Army Research Laboratory, Glenn Research Center*

#########  Michael Augustin Robab Safa-Bakhsh

> *Bell Helicopter Textron Boeing Phantom Works*

######### Alan Duke Piet Ephraim

*Goodrich Fuel and Utilities Division Smiths Aerospace*

######### Paul Grabill 

*Intelligent Automation Corporation*

This paper presents an overview of health management issues and
challenges that are specific to rotorcraft. Rotorcraft form a unique
subset of air vehicles in that their propulsion system is used not only
for propulsion, but also serves as the primary source of lift and
maneuvering of the vehicle. No other air vehicle relies on the
propulsion system to provide these functions through a transmission
system with single critical load paths without duplication or
redundancy. As such, health management of the power train is a critical
and unique part of any rotorcraft health management system. This paper
focuses specifically on the issues and challenges related to the dynamic
mechanical components in the main power train. This includes the
transmission and main rotor mechanisms. This paper will review standard
practices used for rotorcraft health management, lessons learned from
fielded trials, and future challenges.

# Notes  {#notes-15 .Notes}

# Predictive Reliability of Tactical Missiles Using Health Monitoring Data and Probabilistic Engineering Analysis

### 

######### Stephen A. Marrotta, Abdul Kudiya, Teng K. Ooi, Houssam Toutanji, John A. Gilbert

*US Army Aviation and Missile Research and Development Center*

Tactical missiles within the US Army are regularly subjected to severe
stresses such as long-term exposure in harsh environments and
transportation handling. These stresses factor into the ageing,
deterioration, and eventual decommissioning of some of the Army's
critical warfighting assets. The negative reliability impacts associated
with long-term ageing and deterioration significantly affect the total
lifecycle cost of fielding these weapons in a high state of readiness.
Reliability evaluation of past data has indicated failures in missile
structural, energetic, and electronic components associated with the
long-term exposure to heat, humidity, and transportation shocks. Unlike
strategic missiles, tactical missiles undergo a very minimum of field
checks and non-destructive evaluation on a routine basis. The Army
Aviation and Missile Research and Development and Engineering Center
have been developing a health monitoring system called Remote Readiness
Asset Prognostics and Diagnostics System (RRAPDS) to assess and improve
reliability of the missiles during storage and field exposures. RRAPDS
will use external and internal sensors to provide data to assess missile
conditions and predict reliability. This paper describes the approach to
predict reliability of missile components like propellant, nozzles, and
thermal batteries using sensor data from RRAPDS, and prognostic models
for structural integrity and damage mechanisms. Probabilistic models
will quantify all the uncertainties present in the health monitoring
data and finite element models, to provide a realistic reliability
evaluation.

# Notes  {#notes-16 .Notes}

# NASA Quality Assurance Policy

### 

######### Brian Hughitt

*Office of Safety and Mission Assurance*

*NASA Headquarters*

It is NASA policy to comply with prescribed technical requirements and
to provide for independent assurance of compliance with requirements.
Activities responsible for the performance of NASA work are required to
implement quality assurance programs based upon risks resulting from
potential noncompliance. Determination of risk considers the likelihood
and consequences associated with noncompliance, including the maturity,
complexity, criticality, importance, and cost of work performed, as well
as past quality performance.

NASA Quality Assurance programs are required to:

(1) Be periodically adjusted based on changing risk factors

(2) Attain confidence levels commensurate with risks associated with
    noncompliance, including 100% verification of critical attributes

(3) Include pre-work, concurrent-work, and post-work assurance measures
    to ensure that work is performed in accordance with prescribed
    requirements

(4) Ensure flow-down of applicable technical/quality requirements,
    supplier control of subtier suppliers, and verification of critical
    requirements at all levels of the supply chain

(5) Achieve continual improvement through advocacy; awareness training;
    integration of quality processes; dissemination and implementation
    of lessons learned; sharing of tools, techniques and quality data;
    and standardization of best practices

(6) Provide for timely customer notification of nonconformities or
    failure experiences affecting product safety, reliability, or
    functionality

(7) Provide for regular communication between activities responsible for
    assigning/contracting work, activities responsible for performance
    of work, and activities responsible for operation of delivered end
    item to ensure clear/mutual understanding of prescribed requirements
    and customer objectives

(8) Be performed by persons that are competent on the basis of
    demonstrated knowledge, skills, and experience related to quality
    assurance principles/practices and the specific product, process, or
    attribute for which assurance is being provided

(9) Be performed by persons that are independent of program management
    responsibilities for ensuring that cost or schedule objectives are
    met.

NASA work is required to be performed in accordance with the quality
requirements of AS9100, ISO 9001, or AS9003, depending on the
criticality and complexity of work to be performed, and in accordance
with applicable/specified workmanship standards and quality clauses.

Government oversight of NASA contracts is required to include the
following Quality Assurance Program Elements:

(1) Contract Review

(2) Pre-Award and Post-Award Survey

(3) Source Selection

(4) Document Review

(5) Product Assurance

(6) Government Mandatory Inspection Points

(7) Quality System Audit

(8) Quality Data Analysis

(9) Nonconformance Reporting and Corrective/Preventive Action

(10) Final Product Acceptance

# Notes  {#notes-17 .Notes}

#  Failure Assessment

### 

######### Robyn R. Lutz

*NASA Jet Propulsion Laboratory\
and Iowa State University*

######### Allen P. Nikora

*NASA Jet Propulsion Laboratory*

Failure assessment encompasses the identification and characterization
both of potential failure mechanisms in systems under development and of
actual failure occurrences in operational systems. This paper presents
several of the most widely used and useful techniques for failure
assessment across the system lifecycle, with an emphasis on the role of
software. For each technique the paper describes its purpose and
background, summarizes the process of performing the technique, and
evaluates the technique's strengths and limitations. The discussion
provides lessons learned from practice, examples from spacecraft
applications, and pointers to additional work in the field. The paper
describes some of the tools that are available to help the practitioner
select and implement failure assessment techniques and identifies likely
future directions in failure assessment.

# Notes  {#notes-18 .Notes}

# Quantitative Risk Analysis: Challenges and Opportunities at NASA

### 

######### William Vesely

*NASA Headquarters*

NASA carries out a variety of quantitative risk assessments in
conducting its work. These assessments range from specialized studies,
such as the assessment of the safety risk involved in transfer of the
DC-8 aircraft, to large-scale probabilistic risk assessments (PRAs),
such as the PRAs conducted on the Space Station and Space Shuttle.
Because of the range of problems addressed, there are various challenges
in carrying out quantitative risk assessments involving both modeling
and implementation. There are also opportunities for using quantitative
risk analysis to improve decision making and risk management. This paper
presents a spectrum of examples of quantitative risk analyses, from
large scale to specialized. The examples also illustrate the range of
approaches being utilized or being developed. The examples are the Space
Shuttle PRA, a decision application accounting for risk uncertainties, a
project risk assessment of cumulative risks, and an assessment of
software development risks.

# Notes  {#notes-19 .Notes}

# Maintainability: Theory and Practice

### 

######### Gary O'Neill

*Georgia Tech Research Institute*

*Logistics and Maintenance Applied Research Center*

Maintainability is an attribute that is sought after by operators and
maintainers all across the world, and has long been known as "one of the
'-ilities' associated with deployment and use of equipment -- quality,
supportability, maintainability, reliability, and interoperability
(among others)." Senior leaders in the military and in commercial
transportation sectors demand that Original Equipment Manufacturers
(OEMs) produce equipment and systems that possess these attributes so
that their operations can be effective and economic.

Acquisition of equipment for the U.S. military has traditionally focused
on fielding equipment with the attributes of reliability and
maintainability. During World War II, military units prized the
ubiquitous Jeep, the M-14 rifle, and other equipment because they rarely
failed, and when they did, they were easily repaired. This combination
of steadfast performance and ability to be rapidly restored to operation
led to the linkage of reliability and maintainability that still exists.
This linkage is the foundation of our country's characteristic drive to
field the best equipment possible for defense or commercial use.
Superior technology, while always a primary driver of design, isn't
sufficient if the equipment puts military units at risk or commercial
entities in danger of extreme financial loss.

As weapon systems and equipment have become more complex, these
attributes have maintained their place. In fact, Reliability and
Maintainability (R&M) are now so important to both military and
commercial acquisition that it is common to have R&M elements built into
requirements documents and contracts; indeed, it is rare to see an
acquisition without them. Both attributes have been described in
requirements documents in many ways over the years, with an evolving
need to quantify the attributes in some measurable way. The practice of
R&M is now explicitly defined as part of the specialty engineering tasks
grouped under Systems Engineering to further that objective.

# Notes  {#notes-20 .Notes}

# ISHM Co-Design: Methods and Practices for Fault Avoidance and Management During Early Phase Design

### 

######### Irem Y. Tumer

*NASA Ames Research Center*

Integrated Systems Health Management (ISHM) is intended to become a
critical capability for all space, lunar, and planetary exploration
vehicles and systems at NASA. Monitoring and managing the health state
of diverse components, subsystems, and systems is a difficult task that
will become more challenging when implemented for long-term, evolving
deployments. A key technical challenge will be to ensure that the ISHM
technologies are reliable, effective, and low cost, resulting in turn in
safe, reliable, and affordable missions. To ensure safety and
reliability, the ISHM functionality, decisions, and knowledge have to be
incorporated into the product lifecycle as early as possible, and ISHM
must be considered as an essential element of models developed and used
in various stages during system design.

During early stage design, many decisions and tasks are still open,
including sensor and measurement point selection; modeling and
model-checking; and diagnosis, signature, and data fusion schemes;
presenting the best opportunity to catch and prevent potential failures
and anomalies in a cost-effective way. However, the nature of ISHM
knowledge and data is detailed, relying on high-fidelity, detailed
models, whereas the earlier stages of the product lifecycle utilize
low-fidelity, high-level models of systems and their functionality.
Using appropriate formal methods during early design, the design teams
can systematically explore risks without committing to design decisions
too early.

We currently lack the tools and processes necessary for integrating ISHM
into the vehicle system/subsystem design. As a result, most existing
ISHM-like technologies are retrofits that were done after the system
design was completed. It is very expensive, and sometimes futile, to
retrofit a system health management capability into existing systems.
Last-minute retrofits result in unreliable systems, ineffective
solutions, and excessive costs (e.g., Space Shuttle TPS monitoring,
which was considered only after 110 flights and the Columbia disaster).
High false alarm or false negative rates due to substandard
implementations hurt the credibility of the ISHM discipline. This paper
presents an overview of the current state of ISHM design and makes
recommendations about possible approaches to enable the ISHM
capabilities to be designed in at the system level, from the very
beginning of the vehicle design process.

# Notes  {#notes-21 .Notes}

# Applications of Data Mining in Automated ISHM and Control for Complex Engineering Systems

### 

######### Karl Reichard, Ed Crow, Lora Weiss, Chris Rogan

*Pennsylvania State University*

Integrated System Health Engineering and Management (ISHEM) requires the
monitoring and assessment of system health and condition, and the
control of the system's response to degraded health and capability.
Complex, highly engineered systems, such as the planned robotic missions
to the moon and Mars, future commercial and military aircraft, and
manufacturing systems, will require both health monitoring and
autonomous control to realize goals for effectiveness, affordability,
reliability, safety, and reconfigurability. Whether the systems are
human operated, semi-autonomous with human assistance, or fully
autonomous, the health monitoring and control functionality must be
integrated in order to meet system performance objectives and respond to
changing and unanticipated conditions. The integration of the health
monitoring and autonomous control enables intelligent self-situational
awareness (ISSA) -- the ability of a system to assess its capability to
execute a planned mission or maneuver and actively manage its health
through informed control of its actions.

This paper explores the role data mining techniques can play in ISHEM
and autonomous control. One of the critical tasks in the development,
implementation, and maintenance of health management systems is the
collection and analysis of operational and transitional failure data
that can be used to assessment the current condition, health, and
capability of the system and predict future condition, health, and
capability. The collection of this data, in particular the collection of
statistically significant amounts of data, is often difficult due to the
expense of dedicated testing, the lack of access to the systems of
interest, or the inability to collect data for the range of conditions
under which the systems are expected to operate. Data mining techniques
can be used to analyze and discover trends and relationships, and
capture operational knowledge and expertise from data collected from
large numbers of systems during routine testing and operation. The
efficient use of data mining techniques can discover hidden
relationships across large distributed data sets that might not be
apparent in a single set of data. Data mining techniques have been
applied in such diverse fields as banking, machinery condition
monitoring, and astronomy. This paper considers data analysis
techniques, knowledge representation, and issues of data preparation and
the use of open data standards which can improve the efficiency of data
mining techniques in ISHEM applications.

# Notes  {#notes-22 .Notes}

# A Review of Diagnostic Techniques for ISHM Applications

### 

######### Ann Patterson-Hine Gordon Aaseng 

> *NASA Ames Research Center Honeywell Defense & Space Electronics
> Systems*

######### Gautam Biswas Sriram Narasimhan

> *Vanderbilt University University Affiliated Research Center\
> NASA Ames Research Center*

######### Krishna Pattipati

*University of Connecticut*

System diagnosis is an integral part of any Integrated System Health
Management application. Diagnostic applications utilize system
information from the design phase, such as safety and mission assurance
analysis, failure modes and effects analysis, hazards analysis, fault
propagation models, and testability analysis. In modern process control
and equipment monitoring systems, topological and analytic models of the
nominal system, derived from design documents, are also employed for
fault isolation and identification. Depending on the complexity of the
monitored signals from the physical system, diagnostic applications may
involve straightforward trending/feature extraction techniques to
retrieving the parameters of importance to diagnosis from the sensor
streams, or they may involve very complex analysis routines, such as
signal processing, learning, or classification methods. The process that
is used to go from monitored system signals to the diagnosis of
anomalous conditions varies widely across the different approaches to
system diagnosis. Rule-based expert systems, case-based reasoning
systems, model-based reasoning systems, learning systems, and
probabilistic reasoning systems are examples of the many diverse
approaches to diagnostic reasoning.

Many engineering disciplines have specific approaches to modeling,
monitoring, and diagnosing anomalous conditions. Therefore, there is no
"one-size-fits-all" approach to building diagnostic and health
monitoring capabilities for a system. For instance, the conventional
approaches to diagnosing failures in rotorcraft applications are very
different from those used in communications systems. Further, online and
offline automated diagnostic applications are integrated into an
operations framework with flight crews, flight controllers, and
maintenance teams. While the emphasis of this paper is task automation
of health management functions, striking the correct balance between
automated and human-performed tasks is a vital concern.

# Notes  {#notes-23 .Notes}

# An Overview of Selected Air Vehicle Prognostic and Health Management Technologies

### 

######### Michael J. Roemer, Gregory J. Kacprzynski, Carl S. Byington

*Impact Technologies, LLC*

######### George Vachtsevanos

*Georgia Institute of Technology*

NASA and the DoD have various vehicle platforms that require the
development of predictive health management technologies that can
detect, isolate, and assess remaining useful life of critical line
replaceable units (LRUs) or subsystems. In order to meet these needs for
next-generation vehicles, dedicated prognostic algorithms must be
developed that are capable of operating in an autonomous and real-time
vehicle health management system software architecture that is
distributed in nature. This envisioned prognostic and health management
system should allow vehicle-level reasoners to have visibility and
insight into the results of local diagnostic and prognostic technologies
implemented down at the LRU and subsystem levels. To accomplish this
effectively requires an integrated suite of prognostic technologies that
can be applied to critical systems and can capture fault/failure mode
propagation and interactions that occur in these systems, all the way up
through the vehicle level. In the paper, the authors will present a
generic set of selected prognostic algorithm approaches, as well as
provide an overview of the required vehicle-level reasoning architecture
needed to integrate the prognostic information across systems.

# Notes  {#notes-24 .Notes}

# Physics of Failure

### 

######### Kumar V. Jata and T.A. Parthasarathy

*Air Force Research Laboratory*

*Wright-Patterson Air Force Base*

The key purpose of on-line structural health monitoring in the aerospace
industry is to reliably detect, locate, and quantify damage in
structures so as to keep the fleet mission-ready and secondly, minimize
costs of unnecessary teardowns and NDE (Nondestructive Evaluation)
inspections. Structural health monitoring research and development work
is being undertaken both in the areas of diagnostics and prognostics.
However, for prognosis of remaining useful life, after a structure has
suffered a certain amount of material degradation and damage, it is not
only critical to quantify and locate the damage but also to know the
physics of damage progression to perform microstructural-based life
prediction modeling. Similarly, for structural repair and (or)
material/structure substitution, it is necessary to know the physics of
damage at different spatial and temporal level. In other words, one
needs to understand the materials degradation and failure mechanisms for
a given set of operational conditions, which can be broadly termed as
"Physics of Failure." The complex nature of failure forces us to study
through classification. One approach is to classify materials failures
in terms of ductile and brittle fracture. Within each one could classify
them as static and dynamic to account for fracture that can take place
under sustained loads, fatigue loads, or extreme high strain rate
loading. Under the same umbrella of brittle and ductile fracture, it is
necessary to bring in various material classes separately (metals,
ceramics, polymers, and their composites) because they all exhibit
various modes of fracture, the mode in turn depending on the loading
condition. This paper will attempt to present a comprehensive view of
the "Physics of Failure," at the possible risk of oversimplification.
The possibility of using such a view towards health monitoring will be
discussed.

# Notes  {#notes-25 .Notes}

# Safety in Integrated Systems Health Engineering and Management

######### Nancy Leveson

*Massachusetts Institute of Technology*

This paper describes the state of the art in system safety engineering
and management along with new models of accident causation, based on
systems theory, that may allow us to greatly expand the power of the
techniques and tools we use. The new models consider hardware, software,
humans, management decision making, and organizational design as an
integrated whole. Hazard analysis techniques, based on these expanded
models of causation, provide a means for obtaining the information
necessary to design safety into the system and to determine which are
the most critical parameters to monitor during operations and how to
respond to them.

The paper first describes and contrasts the current system safety and
reliability engineering approaches to safety and the traditional methods
used in both these fields. It then outlines the new systems-theoretic
approach being developed in Europe and the U.S. and the application of
the new approach to aerospace systems, including a recent risk analysis
and health assessment of the NASA manned space program management
structure and safety culture that used the new approach.

# Notes  {#notes-26 .Notes}

# Fault Tolerant Architectures for Space and Avionics Applications

### 

######### Daniel P. Siewiorek and Priya Narasimhan

*Carnegie Mellon University*

Over the past half century, computing systems have experienced over
three orders of magnitude improvement in average time to failure and
over seven orders of magnitude improvement in work accomplished between
outages. This paper surveys, compares, and contrasts the architectural
techniques used to improve system reliability in space and avionics
applications. The generic techniques are instantiated by actual system
examples taken from the space and avionics domains. The paper concludes
by observing trends and projecting future developments.

# Notes  {#notes-27 .Notes}

# V&V of ISHM for Space Exploration

### 

######### Lawrence Markosian

*QSS Group, Inc.\
NASA Ames Research Center*

######### Martin Feather and David Brinza

*NASA Jet Propulsion Laboratory\
and California Institute of Technology*

######### Fernando Figueroa

*NASA Stennis Space Center*

NASA has established a far-reaching and long-term program for robotic
and manned exploration of the solar system, beginning with missions to
the moon and Mars. Integrated System Health Management (ISHM) will be
key to improving the reliability, operability, and maintainability of
many of the systems deployed in this endeavor. In this setting,
Verification and Validation (V&V) and certification of ISHM systems will
be necessary but challenging.

The factors that most influence ISHM's V&V and certification needs stem
from two main sources -- the system of which ISHM is a part, and the
implementation of ISHM itself. The system of which ISHM is a part levies
requirements on ISHM -- for example, the need for ISHM to respond within
a given time period with a stipulated level of confidence in the
correctness of its response. The combination of these externally imposed
requirements, coupled with the manner in which ISHM will be utilized,
drive much of the V&V and certification process. Also highly influential
is the nature of the ISHM implementation. Often it takes a combination
of techniques to implement an ISHM system. These techniques include
well-understood algorithms for low-level data analysis, validation, and
reporting; traditional capabilities for fault detection, isolation, and
recovery; and, at the more novel end, Artificial Intelligence (AI)
techniques for state estimation and planning. Detailed descriptions of
these techniques are beyond the scope of this paper, and may be found
elsewhere. Here we focus on their ramifications for V&V and
certification. In particular, this range of techniques that will be
utilized within an overall ISHM system imposes internal challenges to
V&V.

The conjunction of these external and internal influences on ISHM V&V
and certification, and the challenges that stem from them, is the focus
of this paper. We outline existing V&V approaches and analogs in other
software application areas, and possible new approaches to the V&V
challenges for space exploration ISHM.

# Notes {#notes-28 .Notes}

# Engine Health Management for Aircraft Propulsion Systems

### 

######### Al Volponi, Bruce Wood, James Larkin

*Pratt & Whitney Rocketdyne*

In its broadest context, an Engine Health Management System (EHMS) deals
with the monitoring, detection, isolation, predictive trending, and
accommodation of engine degradation, faults, and failures. Its approach
draws from methodologies and processes employing both physics-based and
empirical techniques, derived from a wide range of engine system
disciplines including Materials, Structures, and Controls. Minimizing
total cost of (engine) ownership and increasing asset availability/and
mission readiness while maintaining or even increasing safety are just
some of the key drivers for the implementation of an EHMS. Relative
weightings of these factors vary in importance depending on the end
user's operating and business environment, as well as
application-specific needs. Although they share a common vein, it is not
unusual for Commercial Aircraft EHM systems to direct a different
emphasis than Military Aircraft EHM systems. As a result, there is no
specific one-size-fits-all approach for an EHMS, but rather an array of
capabilities that can be assembled to address the specific needs of an
end user. The range of capabilities employed in these systems includes
not only those that are engine specific, but also draws from
mathematical, statistical, and artificial intelligent methods that are
more generic in nature and have potential cross-cutting application to
other propulsion and space vehicle health tracking.

This paper provides an overview of current and evolving Engine Health
Management System capabilities available for the spectrum of possible
aircraft applications. An applicability assessment of existing gas
turbine techniques to rocket/hypersonic propulsion systems is presented,
to emphasize the cross-cutting nature of these capabilities.
Disciplined, systematic methodologies, by which a specific suite of
capabilities is selected for particular applications, are discussed.
Design considerations for coalescing individual capabilities into
integrated EHM systems are examined. Finally, notional benefits obtained
through implementation of specific capabilities are identified.

# Notes  {#notes-29 .Notes}

# Space Propulsion Systems

# Propulsion Systems Health Management

# 

######### Anthony R. Kelley

*NASA Marshall Space Flight Center*

######### W.T. Powers

*Consultant, Health Management and Instrumentation*

The purpose of this paper is to explore issues relating to propulsion
system health monitoring and management. Of the many systems and
techniques applied to date, few have provided relevant information with
sufficient accuracy to drive maintenance issues on safety-critical
hardware. Explanations about system and component needs will be
explored. Due to similarity between NASA propulsion systems and industry
components, many techniques for performing health management in space
propulsion systems are applicable to industrial applications. A brief
overview will be provided covering the techniques that have been
attempted and applied to date. Current state-of-the-art hardware and
software systems that perform engine health management will be
identified and described within the limitations of ITAR and proprietary
issues. Private industry successfully applies several advanced
monitoring and management techniques to different flight platforms. The
types of hardware, software, and verification systems required to make a
comprehensive health management system will be discussed, along with the
system issues of sharing health and status information between
subsystems. The future possibilities of truly intelligent, fully
implemented engine health management systems will be explored and
development needs identified.

# Notes  {#notes-30 .Notes}

# Integrated System Health Management for Exploration Applications: Intelligent Sensor Systems and Software, and Complete Vehicle Integration

### 

######### G. W. Hunter, L. G. Oberle, G. Baakalini

*NASA Glenn Research Center*

######### W.A. Maul, C.E. Fulton

*Analex / NASA Glenn Research Center*

######### J. Perotti

*NASA Kennedy Space Center*

######### T. Hong

*NASA Johnson Space Center*

Future Exploration Missions will require significantly improved
Integrated System Health Management (ISHM) throughout the mission.
Vehicle systems that require intense investment of human intervention or
monitoring are impediments to realization of the Exploration Vision.
Therefore, ISHM and the sensor systems which enable ISHM are necessary
throughout the vehicle to enable the next-generation Exploration
Vehicles. This paper focuses on developments in sensor technology
necessary to enable the next-generation ISHM systems. These developments
include improved ease of sensor integration, improved sensor
reliability, redundancy and cross-correlation in vehicle sensor systems,
and orthogonality in sensors measurement. This means sensors must be
smarter, smaller, multifunctional, more reliable, and easier to apply.
Examples of cutting-edge sensor systems which illustrate aspects of
these improved capabilities are given: Smart Sensors, "Lick and Stick"
technology, spray-on sensors, multiparameter physical sensors, and a
fire detection system using orthogonality to improve reliability.
Further, the successful operation of a sensor in a given environment
depends strongly on supporting technology beyond the sensor element
itself, e.g. packaging, signal conditioning, and an understanding of
what a sensor response means in a given environment. Examples are given
of some of the necessary technologies needed in order to make a sensor
element into an operational sensor system. It is concluded that
improvements in sensor technology are necessary to enable ISHM and
achieve the goals of the Exploration program. Most importantly, the
decisions must be made early on in the vehicle design that support the
inclusion of sensor technology and ISHM.

# Notes  {#notes-31 .Notes}

# SHM Design for Space Operation Vehicles

### 

######### Fu-Kuo Chang

*Stanford University*

Reliability and safety are crucial for space operation vehicles. Thermal
protection panels, the launch system, and crew escape vehicles, to name
just a few, require extensive inspection and monitoring before, during,
and after each flight. The sustainment cost for maintaining a safe
flight can be exhaustively expensive. Structural health monitoring
technology provides a key solution for ensuring the reliability and
safety of these structures with minimal sustainment cost.

Unlike aircraft structures where localized fatigue or corrosion-induced
damage is a major concern, SOVs are exposed to foreign-object impact or
harsh environments, which makes the safety of the entire structural
system a concern. Accordingly, there is a fundamental difference in the
requirements of SHM for SOV and for aircraft structures.

Current development of SHM technology primarily focuses on retrofitting
and rehabilitation of existing structures, so the SHM system must
accommodate the original design and become an added component or extra
element whose functionality and efficiency may have to be substantially
compromised in order to gain acceptance. This approach for SHM may be
adequate for "hot spot" monitoring with known damage locations where the
size of concern is limited. However, this approach may not be
appropriate for SOV application where the SHM design will have to be
compromised to overall system functions and design, which can be a very
challenging and prohibitive task once the design is finalized or the
structure has been built. Therefore, building SHM into structures in the
design phase is crucial and a must for SOV, particularly for the next
generation of space vehicles.

In this presentation, discussion will be made through two studies on
both bolted and bonded thermal protection panels with SHM to demonstrate
the need to consider SHM in the initial design process.

# Notes  {#notes-32 .Notes}

# Electrical Power System Health Management

### 

######### Robert M. Button Amy Chicatelli

*NASA Glenn Research Center Analex Corporation*

*NASA Glenn Research Center*

One of the most critical systems in any aerospace vehicle is the
electrical power system. Comprised of energy generation, energy storage,
power distribution, and power management, the electrical power system
(EPS) is relied upon by every major subsystem for proper operation. In
order to meet the safety requirements of aeronautics and space systems
-- and provide for their reliability, maintainability, and
supportability -- advanced health management (HM) techniques for
electrical power systems are required. A detailed review of the major
EPS component failure modes shows that power generation and energy
storage components generally employ some basic HM techniques to estimate
and manage remaining life. However, power management and distribution
components and systems employ almost no on-board HM techniques. A survey
of current aerospace vehicles and platforms will show that power HM
systems have employed simple performance and environmental monitoring to
provide indications of possible component and subsystem failures, and
used redundant components as a "safety-net" when failures do occur. More
advanced methods that detect fault locations in wiring are used for
maintenance purposes and not as an on-board safety system. In order to
move beyond this, future power HM systems need to be "intelligent" and
operate autonomously. This means that they need to be able to detect and
isolate incipient faults, mitigate failures, or predict impending
failures so that mitigating actions can be taken. The historical method
of "adding" on HM capabilities after a system has been developed leads
to high cost for implementation, limited capabilities, and low
reliability in operation. Future aerospace power systems need to
incorporate HM capability early in the design cycle for maximum benefit.

# Notes  {#notes-33 .Notes}

# Avionics Health Management

### 

######### Michael D. Watson, Kosta Varnavas, Clint Patrick

*NASA Marshall Space Flight Center*

######### Carl S. Byington

*Impact Technologies, LLC*

######### Savio Chau, Edmund C. Baroth

*NASA Jet Propulsion Laboratory*

Avionics Health Management covers the maintenance of health of avionic
systems. Avionic systems encompass flight processors; electrical power
distribution and management (PMAD); guidance, navigation, and control
(GN&C) systems; communications; data networks; etc. These systems
consist of electronic elements comprising the flight computers, systems
controllers, data buses and networks, and sensors. Electronics failure
sources can be grouped into four basic categories: design errors,
material defects, fabrication errors (including packaging defects), and
external damage (e.g., radiation effects, thermal effects, electrical
surges). Some errors are detected during the design and manufacturing
processes using extensive design simulation and testing, manufacturing
quality inspections, and burn-in testing. However, these methods do not
detect all possible errors. Thus, health management of electronics is
necessary to prevent loss of critical electronic components. Standard
fault detection, isolation, and recovery (FDIR) in electronics has used
built in test (BIT), error detection and correction (EDAC), and Joint
Test Action Group (JTAG) boundary scan capabilities embedded within the
components for fault detection and isolation. These capabilities are
generally reactive, executing after a suspected error has been
identified. BIT executes in an offline mode, requiring the components to
be taken offline. EDAC operates in real time, but only repairs data
errors created by system faults and does not diagnose or correct the
root causes. JTAG standards provide specific test interfaces targeted
for production and offline testing primarily at the board level. In
addition, environmental monitors are sometimes added to track
environmental elements such as temperature, electrical surges, and
radiation. Avionics architectures can be integrated loosely as a
federated set of components or tightly in an Modular Integrated System
fashion. These architectures greatly influence the failure tolerance of
the systems. Failures are often detected at the system level, by
monitoring system performance values such as voltage, current, optical
power (in optical components), electrical noise, frequency stability,
etc. These methods identify failures after they occur. Failure isolation
then seeks to identify the failed component within the system, using BIT
capabilities in an offline mode. Once the faulty component is isolated,
recovery can occur, depending on the availability of redundant
components. Faulty components are turned off and redundant components
are brought on line (or left on line if redundancy is utilized during
isolation) to replace them. This redundancy can be at the component,
board, or box level depending on the application. This post-failure
response technique works well for non-critical applications, but
critical functions such as those involved in aeronautics and space
applications require a more proactive response. BIT functions operating
in real time to monitor internal voltage, current, and logic states (at
key points within a digital electronic component) are a concept to
accomplish this. When degradation is detected, response mechanisms can
then be employed to maintain uninterrupted system functionality.
Similarly, these diagnostics can be run to determine causes of
EDAC-detected errors, allowing adjustments to be accomplished to avoid
future errors. Adaptive technologies, such as reconfigurable computing,
offer great benefits to implement fault repair after isolating defective
areas within a component. This paper surveys current electronic health
management techniques and potential approaches to implement more robust
health management within electronic components.

# Notes  {#notes-34 .Notes}

# Issues in Integrated Health Management of Life Support Systems

### 

######### David Kortenkamp

*Metrica Inc.\
NASA Johnson Space Center*

######### Gautam Biswas and Eric Jan Manders 

*Vanderbilt University*

The Environmental Control and Life Support (ECLS) system of a space
vehicle or habitat is responsible for maintaining a livable environment
for human crew members. Depending on the duration of the mission, ECLS
systems can vary from a set of simple subsystems to a set of complex
interacting systems. The high importance of ECLS systems on manned space
vehicles and surface habitats being planned on the moon and Mars along
with the need to operate them continuously in a safe, reliable, and
possibly autonomous manner while ensuring very efficient utilization of
essential resources will require careful monitoring and integrated
control of the system. As NASA begins to work toward longer and more
distant missions, the complexity of this task will multiply. This paper
adopts an integrated system health management focus and uses this to
establish the unique requirements of life support systems with respect
to monitoring and control. The different components of life support
systems are discussed, including Advanced Life Support Systems (ALSS)
that are designed to operate in a closed loop by regenerating and
recycling consumables to reduce launch mass. We present a high-level
ISHM architecture for life support and some recent results in
implementing the architecture. Finally, the life support monitoring and
control issues for the Crew Exploration Vehicle (CEV) and for lunar and
martian habitats are discussed and compared.

##  

#  {#section-27 .Notes .unnumbered}

## Posters

# A Unified Model-based Systems and Software Engineering Approach to Integrated System Health Management

######### Michel D. Ingham, Oliver B. Martin, Seung H. Chung, Gregory A. Horvath

*NASA Jet Propulsion Laboratory*

######### Brian C. Williams

*Massachusetts Institute of Technology*

As spacecraft and their missions have become ever more complex and
ambitious, systems and software engineering practice has been severely
challenged to create and verify space systems that assure correctness,
reliability, and robustness in a timely and cost effective manner.
Furthermore, there is a fundamental gap between the requirements on
software specified by systems engineers and the implementation of these
requirements by software engineers. This gap opens up the possibility
for misinterpretation by the software engineer of the systems engineer's
intent, potentially leading to software errors. Nowhere is this gap more
risky than in the design and development of Integrated System Health
Management (ISHM) software for highly complex space systems, such as
those proposed to take human and robotic explorers to the surface of the
Moon, Mars, and beyond.

These challenges have motivated the development of the Mission Data
System (MDS), a unified software architecture for flight, ground, and
test systems, and a novel systems engineering methodology, called State
Analysis. State Analysis produces requirements on system and software
design in the form of explicit models of system behavior. It provides a
common language for systems and software engineers to communicate, and
thus helps to bridge the traditional gap between software requirements
and software implementation. The regular structure of State Analysis is
replicated in the MDS architecture, with every State Analysis product
having a direct counterpart in the software implementation. However,
models from State Analysis generally still require manual translation
into robust software for estimation and control of embedded systems,
including fault diagnosis and recovery capabilities for ISHM.

The objective of our work is to augment State Analysis and MDS with the
benefits of Model-based Programming, an approach to engineering software
that is able to directly reason through models of a system in order to
estimate and control its state. Endowing a spacecraft's ISHM system with
the ability to perform on-line reasoning about its modeled behavior has
a number of benefits:

1.  It relieves the software engineer of the responsibility of a priori
    encoding into estimators and controllers the complex set of
    low-level system interactions under a range of possible nominal and
    off-nominal situations. This error-prone task is instead delegated
    to a model-based reasoning engine that automatically diagnoses and
    plans courses of action at reactive time scales, based on models of
    the system under control and its environment.

2.  It enhances robustness by transparently reasoning about all nominal
    and off-nominal behavior we have modeled. Thus, the reasoning engine
    is able to detect and respond to failures on the fly.

3.  It facilitates software reuse by moving from the current practice of
    designing and implementing specialized estimators and controllers
    from scratch, to a paradigm of providing application-specific
    engineering models to a generic reusable reasoning engine that can
    correctly synthesize state estimates and control actions.

4.  It makes significant progress toward the Holy Grail of provably
    correct behavior, by decomposing the challenging problem of
    validating the estimation and control software into two simpler
    problems: validating the systems engineering models and validating
    the reasoning engine.

This paper describes the unification of Model-based Programming
principles with the State Analysis methodology, the infusion of
model-based estimation and diagnosis capabilities into the MDS software
architecture, and an assessment of the performance of our model-based
reasoning algorithms in the context of ISHM. Our approach represents a
formal and verifiable systems and software engineering paradigm that is
well suited to the development of the types of complex, fault-tolerant
spacecraft systems that future space exploration missions will require.

# Active System Health Maintenance -- Self-Healing Wire Insulation and Robotic Inspection

######### Dryver R. Huston, Dylan Burns, Brian Esser, Graham Spencer, Bernard Tolmie

*University of Vermont*

Structural and system health maintenance activities for complex
high-performance systems, such as spacecraft and aircraft, can benefit
from the use of active and adaptive systems. This presentation will
describe two applications of this concept -- self-healing wire and cable
insulation, and robotic structural and system monitoring. The breakdown
of wire and cable insulation is a principal reliability issue for
aerospace systems. Damage to the insulation can cause shorts,
arc-tracking, fires, and even systemic failure. The traditional approach
of using passive wire insulation systems represents a mature technology
that is resilient to most types of damage, but has difficulty recovering
from damage once it has occurred. Self-healing insulation holds the
promise of the wire being able to repair itself and recover from damage.
The results of a proof-of-concept study on self-healing insulation
techniques will be presented. Several concepts are examined, including
single-part toughening materials, two-part toughening materials,
microvascular repair, and foaming methods. While all of these approaches
are viable as increased-scale benchtop prototypes, it appears that the
foaming technique will be the most viable in terms of manufacturability
and insertion into existing aerospace wire and cable practices.

Robots represent another possibility for active system maintenance.
Robots and other automated machines are particularly useful in
applications where it is difficult, dangerous, monotonous, or too
expensive to use humans. Robotic inspectors are seeing routine
application in the inspection of pipes, underground liquid storage
tanks, and deep-sea structures. Demonstrations of robots have been
undertaken in several other applications, such as highway structures.
Issues related to the design and usage of robotic systems will be
discussed. These include mobility, gripping onto the structure, power,
control, navigation, sensing, safety, and fail-safe operation. Results
from a series of demonstration projects will be presented. Potential
aerospace applications that may be ripe for the use of robotic
inspectors will be identified.

# Advanced Diagnostics and Prognostics Testbed (ADAPT)

######### Andre Goforth, Dougal MacLise, Dwight Sanderfer, David Nishikawa, 

*NASA Ames Research Center*

######### Eric Barszcz

*QSS Group, Inc*

*NASA Ames Research Center*

ISHEM technologies must fight their way onto space vehicles because
their footprint of power, weight, communications, etc., competes with
other vehicle components' needs. Justifications for insertion of such
technologies include lower overall system cost for a given set of
mission assurance requirements. A significant challenge for any new
vehicle development is the selection of ISHEM technologies and how to
deploy them so as to maximize the return on investment (ROI). There are
at least two sets of users of ADAPT. The first will be industry partners
responsible for the development of major elements in aerospace systems.
They will need an independent laboratory to assess the best ways to
deploy ISHEM technology within their systems. The second set will be
providers of ISHEM tools and applications. These users will need an
independent laboratory to provide relevant and canonical test scenarios
and test cases that will demonstrate the capabilities of their products
in a uniform, consistent and unbiased manner.

In this poster we present how NASA Ames Research Center's Advanced
Diagnostics and Prognostics Testbed (ADAPT) will aid in the selection of
ISHEM technologies with the greatest ROI through the following features:

-   **Testbed Architecture**. ADAPT is a test facility focused on
    comparative evaluation and testing of ISHEM technologies and
    techniques through the use of less expensive generic space-like and
    flight-like equipment. The architecture supports all of the
    subsystems and components typically encountered in aerospace
    systems, such as the Shuttle, the International Space Station (ISS),
    robotic probes, and the Crew Exploration Vehicle (CEV). The testbed
    is adaptable and may be configured to mimic a specific aerospace
    system. The extent that a flight article may be included within the
    testbed's operational environment is limited only by budget and
    safety considerations. In some cases, incorporation of flight
    article components in experimental runs will be achieved via remote
    access.

-   **Test Environment**. A unique feature of ADAPT's test environment
    is the antagonist subsystem that includes unscripted software- and
    hardware-generated faults and anomalies. In addition, ADAPT supports
    physical faults generated through manually initiated destructive
    test cases. Such testing will offer a high level of test case
    signature fidelity with which to evaluate and compare candidate
    ISHEM technologies.

-   **Test Metrics**. One of the assets of the testbed will be the
    development of a library of test scenarios, test cases, figures of
    merit (FOMS), etc., for candidate ISHEM test articles. The library
    will include test procedures to measure such parameters as
    time-to-detect, time-to-isolate, and time-to-remediate; isolation
    group size; number of faults detected; and false-positive and
    false-negative detections. From these parameters Fault Detection
    Coverage, Isolation Rate, False Alarm Rate, and Average Fault
    Detection Time can be derived.

# Applying Human Factor Concepts to Space Payload Ground Operations Training

######### Emily Watson

*University of North Dakota*

The purpose of this paper is to show the connection of human factor
concepts to the development and implementation of training for the
ground-based operators of the Agricultural Camera (AgCam), an imagery
payload that will be housed on the International Space Station (ISS).
Based on flight system performance evaluations, a comprehensive training
curriculum has been designed to efficiently utilize human resources in
the daily operations of the Science Operations Center (SOC), the
ground-based control center for AgCam. Not only will comprehensive
training help to prevent large system failures through quick resolution
of abnormalities during monitoring, but it will also provide all
operators with tools for reducing input errors in daily scheduling
tasks. As these two areas have the highest probability for error, they
have consequently driven training design and the corresponding
curriculum. By considering the limitations of potential operators, the
training materials can then focus on the trained skills needed to
effectively manage the system. In the case of AgCam, the available
operators are of a specific demographic and skill set.

The location of the SOC is on the campus of the University of North
Dakota in Grand Forks, North Dakota, where AgCam will be operated
primarily by graduate students. While the pool of potential operators is
large, students typically have no operational experience with space
payloads. Applied human factor concepts drive interface design to combat
two opposing categories of human error seen in this combination of
potential operators. One extreme is seen when operator interaction with
the system is repetitive and tedious. Once the operator becomes
unengaged, important data can go unseen while the system is being
monitored. The opposing reaction is observed when input tasks became too
demanding with limited system training. When an operator is forced to
make multiple scheduling decisions based on numerous variables in a
short period of time, with no validation, the situation increases the
probability of computing and input errors. By giving the operator
recognizable tools in the interfaces, less training is needed to achieve
proficiency, as that knowledge has been gained through life experiences.

Training with baseline nominal operational scenarios provides operators
with the experience they need to efficiently troubleshoot without having
to learn the intricate workings of the entire system. As a result of
utilizing the strengths of the operators as well as training in areas of
weakness, time and quality of training will be achieved and
institutional knowledge maintained expected in this university setting.
Once AgCam is on-board the ISS, the SOC operators and technicians play a
critical role in its proper operation. Through specifically designed
training, operators will solve system failures at a faster rate and
interact with the payload with fewer errors. With a system whose
failures can be mitigated and continuous operations maintained, the end
result is quality science for the end user and a successful mission.

# Architecture for Actuator Health Monitoring

######### Steve Rogers

*Institute for Scientific Research*

Online health monitoring, with the ultimate objective of safe situation
and damage-tolerant control, is critically dependent on sensor
reliability and timely high-integrity on-board data. A portion of health
monitoring is data validation or crosschecking sensor data. There are 4
types of anomalies from typical analog sensors: dead, excessive noise,
drift, and offset sensor faults. Dead sensor or excessive noise
conditions can be detected and isolated using statistical analysis of
the individual sensor data stream. Drift or offset faults require
model-based approaches since changing operating conditions may cause
similar signals. Drift or offset fault detection model equations can be
based on performance criteria, heat/mass balance equations, or other
model structures. Fault detection parameters are derived from the
equations. Any change indicates an anomaly, which can then be
investigated. Kalman filters are frequently used to estimate the fault
parameters in stochastic systems. Model-based drift or offset fault
detection is usually done by state estimation or parameter estimation.
Linear Kalman filter observer banks provide a basis for state
estimation, whereas parameter estimation implementations may use more
accurate nonlinear models.

Conventional parameter estimation methods for in-line probability of
loss of control detection, noticeable dynamics changes, and response to
both stability and structural mode changes are neither sensitive nor
robust enough to investigate any but minimal damage or situational
changes. Conventional parameter estimation methods used for primarily
passive fault detection systems also do not work well in practice due
to: 1) lack of persistent excitation of relevant frequencies and 2)
inability to distinguish environmental/flight condition disturbances
from system degradations. At the least, they are expensive to produce
and even more expensive to validate. We propose a fault detection system
with active components that will detect lack of persistent excitation at
relevant frequencies and design a low power narrowband auxiliary signal
that will excite the necessary frequencies at appropriate intervals. We
will retain aspects of state-sensing and passive signal processing
components forming a comprehensive solution ready for integration into
any flight system. Our active fault detection system will be focused at
the actuator level for the purposes of this paper.

# Certifying a Structural Health Monitoring System: Characterizing Durability, Reliability and Longevity

######### Seth S. Kessler

*Metis Design Corporation*

The market for SHM has been expanding rapidly, both in the quantity of
applications and the number of technology providers. Most current
research has focused on the development of new detection methods and
optimization of sensors themselves, however an important area that has
not been sufficiently addressed is how future SHM devices will be
commercialized and regulated. This paper presents a framework for
considering how to characterize and certify SHM systems. Specifically,
the topics of durability, reliability, and longevity mechanical design
of these systems have not been sufficiently addressed. Existing
standards for commercial and military aircraft components are
identified, along with their relationship to SHM systems. While the
aircraft component manufacturing and integration industry in general is
well regulated, it is evident that there is a need for a supplemental
standard geared specifically towards SHM technologies, in order to
comprehensively address all of these regulatory concerns. The field of
SHM has progressed significantly in recent years, and it will become
critical to address these topics explicitly before SHM systems can be
successfully commercialized and subsequently utilized in prognostic
applications.

# Diagnosing Complex Systems with Software-Extended Behavior Using Constraint Optimization 

# 

######### Tsoline Mikaelian, Brian C. Williams, Martin Sachenbacher

*Massachusetts Institute of Technology*

Model-based diagnosis has traditionally operated on hardware systems.
Researchers at the other end of the spectrum have applied model-based
diagnosis to software debugging. This paper explores the middle ground
between the two, in particular the monitoring and diagnosis of systems
with combined hardware and software behavior. Motivation for this work
is the crucial role of embedded software in complex aerospace and
robotic systems, and the need to make these systems fault tolerant in
order to achieve robustness and safety of increasingly ambitious
aerospace missions. For example, consider vision-based navigation of an
autonomous rover exploring the surface of a planet. The camera within
the navigation system is an instance of a device that has
software-extended behavior: the image processing software embedded
within the camera module augments the functionality of the camera by
processing each image and determining whether it's corrupt. A diagnosis
engine that uses only models of the physical behavior of the camera will
not be able to reason about a corrupt image. However, given a
software-extended model of the camera that incorporates the behavior of
the image processing software, the quality of the image may be used to
correctly diagnose the navigation system. A diagnostic engine for
systems with software-extended behavior must therefore: 1) monitor the
behavior of both the hardware and its embedded software so that the
software state can be used for diagnosing the hardware, and 2) reason
about the system state given delayed symptoms obtained from software. An
instance of a delayed symptom is the quality of the processed image.

In this paper we present: a) a modeling formalism that captures the
behavior of embedded software, b) a novel model-based diagnostic system
that operates on software-extended behavior models to meet
requirements 1) and 2) listed above, and c) application of this
diagnostic system to aerospace scenarios. Capturing the behavior of
software is much more complex than that of hardware due to the
hierarchical structure of a program and the potentially large number of
its execution paths. We address this complexity by using probabilistic,
hierarchical, constraint-based automata (PHCA). We show how these
automata are used to uniformly and compactly model both hardware and
software behavior. Based on the PHCA modeling framework, we introduce a
diagnostic capability for systems with software-extended behavior in the
presence of delayed symptoms. While the Livingstone-2 engine handles
delayed symptoms for diagnosing hardware systems using approximate
models over an infinite horizon, our approach generalizes this
capability to software-extended systems and poses the PHCA-based
diagnosis problem over a finite time horizon to limit model replication.
We frame diagnosis as a finite-horizon (N-stage) constraint optimization
problem (COP) based on soft constraints that encode the structure and
semantics of PHCAs. This formulation enables us to solve the problem
using efficient, tree decomposition-based optimization techniques. In
contrast to previous approaches, our engine results in more
comprehensive diagnoses of a software-extended system. We demonstrate
our results on the vision-based rover navigation system introduced
above, as well as on models of the MIT SPHERES testbed and the NASA
Earth Observing One spacecraft.

# Distributed System Health Management in Complex Systems

######### Kagan Tumer Adrian Agogino

> *NASA Ames Research Center University of California, Santa Cruz*

Achieving true Intelligent System Health Management (ISHM) in large
complex systems is one of the great challenges facing the aerospace
community today. As both the required functionality of spacecraft (e.g.,
precision landing, digging on Mars) and their expected performance
measures (e.g., observe, reason and report safely for extended periods)
increases, there is a need for such craft to assess their health, and if
needed, take appropriate measures. Unfortunately, most current ISHM
approaches are not designed to address such complex systems. Though
useful in specific subsystems, such approaches are brittle (single
points of failure in centralized systems), rigid (predetermined
event-action sets), and slow to respond to changing conditions
(information gathering and processing often physically separated). In
this poster, we present a distributed health management paradigm that
overcomes these difficulties.

The fundamental challenge in distributed ISHM is in ensuring that the
different subsystems' health management decisions all support an overall
system-level safety criteria. In such a system, it is not sufficient
that all subsystems enforce their own safety criteria. The contribution
of this poster is in providing an approach that automatically decomposes
the full-system health criteria into subsystem health criteria. As a
consequence, when subsystems independently satisfy their own health
criteria, they collectively also satisfy the overall systems health
criteria. This derivation is based on the subsystem health criteria
having two properties: The first is a measure of the degree of
*alignedness* between the system health criteria and subsystem health
criteria. Achieving full alignedness ensures that there are no
undesirable system-level effects of a subsystem pursuing a particular
health management strategy. Intuitively, in an aligned system, any
subsystem-level health management decision that improves the subsystem
health also improves the full system health. The second is a measure of
the *sensitivity* of the subsystem health criteria to the degrees of
freedom of that subsystem. Indeed, assigning health management goals
that cannot be achieved by those subsystems will not provide the system
any benefits. Intuitively, a sensitive subsystem health criteria is one
where the impact of a subsystem level health management decision is
readily felt by that subsystem.

Deriving subsystem goals that are aligned and sensitive leads to an ISHM
architecture that (1) eliminates single points of failures, (2) reduces
response times to potential problems, (3) eliminates costly messaging,
and (4) recovers from significant damage to its components.

We demonstrate the applicability of this approach in two domains. First,
we apply it to mission health management by investigating how a set of
autonomous rovers can be reconfigured as the rovers suffer failures. The
results indicate significant improvements over traditional distributed
methods in both recovery times and subsequent mission health in the
presence of rover failures. Second, we apply it to the faulty device
subset selection problem where many noisy observational devices need to
produce the best estimate of the true phenomenon they're observing. The
results indicate significant improvement over both traditional
distributed methods and, more importantly, over centralized methods.

# Embedded Integrated System Health Management in a Closed Loop Life Cycle

######### Gerald L. Nissen

*Boeing Phantom Works*

Customers are placing greater emphasis on product life cycle processes
to meet demands for safer and more reliable products. Customers have
also demanded faster vehicle turnaround times and simplified maintenance
operations. To accomplish cost-effective operations, it is necessary to
provide an infrastructure that accommodates adaptive operations,
system-wide health assessment, and continual hardware and software
verification/validation, and is tolerant to new technology.
Traditionally, the aerospace industry has not provided such an
infrastructure.

This paper addresses the customer needs via the use of a notional
closed-loop life cycle architecture. The generic closed-loop life cycle
process provides the infrastructure for the intelligent software and
hardware tools to work in. The architecture reduces the life cycle cost
by eliminating design errors early in the process, utilizing the same
tool set throughout all phases, and embedding the health management
processes/ technologies in the system design and tool sets. The
architecture also allows for intensive context data mining to support
management and operation needs.

The process starts by establishing the purpose (mission) of the vehicle
and the system architecture definition. The set of derived and explicit
requirements is defined, using system-engineering practices, prior to
starting the risk/cost benefits analysis. Prior to design, a cost/risk
benefit analysis is performed on the system approach providing the
design goals for the vehicle and its ground support system. Vehicle and
ground subsystems testability modeling is flowed down to subcontractors
at the start of design. Vehicle health management development leverages
the various analyses and design tools to avoid unwanted inconsistencies.
Additionally, the testability analysis provides a detailed failure mode,
effects, and cause analysis (FMECA), allowing early component/ subsystem
interaction to solve design issues before they become problems.

The interactively managed Program Data Management (PDM) is an
environment where the cost/risk benefit, testability analysis, design,
configuration, and project management tools reside. The PDM accesses the
various tool sets to provide contractor/customer management with risk
and performance metrics for program control. Should a program problem
arise, the PDM recycles back through the requirements and risk/cost
benefit analysis for alternate solutions. The PDM data is also sent to
the System Life Cycle Health Trending and Logistics tools to support
system (build/operation processes and vehicle/ground components)
performance metrics.

The advanced checkout, control, and maintenance system (ACCMS) utilizes
the design tool set databases to support the assembly, integration, and
test of the vehicle and ground system prior to delivery to the customer.
ACCMS provides performance and process updates starting at assembly,
integration, and test (AIT) through operational life using the same
processes as the operational system. Once fielded, the mission/vehicle
operational changes or modifications are cycled back (via ACCMS) through
risk/cost benefit analysis to maintain safety, reliability, and design
integrity.

# Integrated Self-Diagnostic Health Management for Thermal Protection of Entry and Re-Entry Vehicles

######### Robert W. Hyers, Alaina B. Hanlon, Abhijit Deshmukh

*University of Massachusetts*

This project will provide self-diagnostic capabilities to the thermal
protection systems (TPS) of future spacecraft. Self-diagnosis is
especially important in TPS, where large numbers of parts must survive
extreme conditions after weeks or years in space. In-service inspections
of these systems are difficult or impossible, yet their reliability must
be ensured before atmospheric entry. In fact, TPS represents the
greatest risk factor after propulsion for any transatmospheric mission
(C. Smith, NASA ARC). The concepts and much of the technology would be
applicable not only to the Crew Exploration Vehicle (CEV), but also to
ablative thermal protection for aerocapture and planetary exploration.

Monitoring a thermal protection system on a Shuttle-sized vehicle is a
daunting task: there are more than 26,000 components whose integrity
must be verified with very low rates of both missed faults and false
positives. The large number of monitored components precludes
conventional approaches based on centralized data collection over
separate wires; a distributed approach is necessary to limit the power,
mass, and volume of the health monitoring system. Distributed
intelligence with self-diagnosis further improves capability,
scalability, robustness, and reliability of the monitoring subsystem. A
distributed system of intelligent sensors can provide an assurance of
the integrity of the system, diagnosis of faults, and condition-based
maintenance, all with provable bounds on errors.

# Meeting the Challenges of Exploration Systems: Health Management Technologies for Propulsion and Power

######### Kevin J. Melcher, William A. Maul, Shane S. Sowers

*NASA Glenn Research Center*

The constraints of future Exploration Missions will require unique
Integrated System Health Management (ISHM) capabilities throughout the
mission. An ambitious launch schedule, human-rating requirements, long
quiescent periods, limited human access for repair or replacement, and
long communication delays all require an ISHM system that can span
distinct yet interdependent vehicle subsystems, anticipate failure
states, provide autonomous remediation, and support the Exploration
Mission from cradle to grave. For almost two decades, NASA Glenn
Research Center has developed and applied health management system
technologies to space-based propulsion and power systems -- two critical
subsystems in an ISHM architecture. Lessons learned from past activities
help define the approach to proper ISHM development: • Systematic Sensor
Selection Strategy • Sensor Data Qualification and Validation •
Detection and Isolation of System Faults • Information Fusion and
Diagnostic Decision Criteria • Verification and Validation of Health
Management Software.

This poster will highlight the past research efforts that NASA Glenn has
performed and illustrate how those efforts combine to contribute to the
ISHM development process. Each of these research efforts is briefly
described below.

-   **Systematic Sensor Selection Strategy**: Generates a sensor suite
    based upon sensor type and location while optimizing the fidelity
    and response of the health diagnostic system. Critical modes
    identified through Failure Modes and Effects Analysis (FMEA) and
    risk assessments are used to target high-risk anomalies at detection
    thresholds. A quantitative value is assigned to candidate sensor
    suites based on overall risk reduction, diagnostic speed, and
    probability of correct anomaly isolation. NASA Glenn has worked in
    partnership with Christian Brothers University to develop and
    implement systematic sensor selection strategies.

-   **Sensor Data Qualification and Validation**: The Data Qualification
    Validation Studio™ (DQVS) is a commercial software package that can
    be used to implement analytical redundancy models, Bayesian belief
    networks, and statistical limit filters. DQVS uses these tools to
    qualify and validate sensor data prior to its use by a control or
    health management system. NASA Glenn partnered with Expert
    Microsystems, Inc. to develop the DQVS.

-   **Detection and Isolation of System Faults**: NASA Glenn's fault
    detection and isolation capabilities are demonstrated by a real-time
    diagnostic system called PITEX (Propulsion IVHM Technology
    Experiment). PITEX has been demonstrated on flight-like hardware in
    JPL's Integrated Vehicle Test Bed (IVTB) with test data that include
    real-world effects such as signal noise, sensor resolution,
    command/valve talkback, and system build variances. In addition to
    PITEX, the Inverse Model for Fault Detection and Isolation provides
    a model-based approach suitable for general system diagnostic
    applications. It supports real-time and post-test diagnostic
    requirements with an image model at a complexity level consistent
    with real-time diagnostic constraints.

-   **Information Fusion and Diagnostic Decision Criteria**: Focuses on
    maximizing the amount of meaningful information that can be
    extracted from disparate data sources to obtain comprehensive
    diagnostic and prognostic knowledge regarding system health. The
    basic tenet underlying the data/information fusion concept is to
    leverage all available information to enhance diagnostic visibility,
    increase diagnostic reliability, and reduce the number of diagnostic
    false alarms. NASA Glenn has worked with its industry partners to
    develop and implement information fusion technologies for the
    aerospace sector.

-   **Verification and Validation of Health Management Software**:
    Health management system performance must be verified and validated
    (V&V) to ensure its integrity in a real-time flight-critical
    environment. NASA Glenn's Data Qualification and Validation (DQV)
    Test-Bed is one way to accomplish this V&V in a simulation
    environment. The DQV Test-Bed determines the fidelity and timeliness
    of sensor fault detection and measures the ability of a data
    qualification system to discriminate between sensor faults and
    anomalous system states. It provides variable exposure to the
    diagnostic system, not only for faults detectable in hardware
    testing, but also for faults that may manifest themselves only in
    actual implementation.

# Progress in Prognostics Health Management Advanced Life Prediction System

######### Eva L. Suarez, Michael J. Duffy

*Pratt & Whitney Rocketdyne*

As military jet engine system designs become more complex and
maintenance actions gain economical and practical importance, an
optimized condition-based maintenance substituting conventional
scheduled interval process is structurally reliable and economically
beneficial. This new paradigm is an essential part of the Prognostic
Health Management (PHM) program with full support of US Air Force, US
Navy, and Marines. The Advanced Life Prediction System (ALPS) is the
foundation where the F135 engine will base their safety and maintenance
actions. The ALPS algorithms programmed for the F135 Prognostic Health
Management (PHM) support the overall JSF PHM data and fault management
structure required in the maintenance of significant functions. This
system was designed to support the automatic monitoring of measurable
wear or engine degradation characteristics. The ALPS algorithms are
implemented to prognoses impending maintenance based on the monitored
characteristics. They were designed to be data driven and to allow for
routine software updates without impacting the operational flight
program. This propulsion system was designed to provide a prediction
measurement of real-time damage indicators, metal temperature and
stress, with increased accuracy when compared to current
maintenance-tracking criteria. PHM monitors the engine during mission
execution for thermal and mechanical stresses that determine "life" of
the engine.

The ALPS objectives were to develop real-time onboard methods for
tracking cumulative damage on critical engine components and incorporate
technology in the electronic engine control unit with an increase in
portability and execution speed. A process was developed for deriving
reduced-order models for transient metal temperature and stress from
complex finite-element design codes. Durability-related fatigue failure
mechanisms tracked by PHM consist of Low Cycle Fatigue, Fracture
Mechanics, Thermal Mechanical Fatigue, and Buried Flaw. Other damage
indicators are activated directly by environmental engine conditions.
Failure modes such as Oxidation and Erosion, Wear, Corrosion, Creep, and
a pseudo-probabilistic High Cycle Fatigue fall in that category. ALPS
evaluates the temporal excursions caused by specific causal elements in
the engine system, and will determine in real time the state of a
component and assess the accumulated damage, based on current Engine
Operating Conditions (EOC). The real-time ALPS algorithms had been
correlated to the design code. The Advanced Life Prediction System
provides a comprehensive, accurate, and timely diagnostic assessment of
engine health for safety- or mission-critical engine components.

# Real Time Anomaly Detection for Expendable Launch Vehicles

######### Stephen Jeffress

*NASA Kennedy Space Center*

An advanced anomaly detection tool has been developed for NASA's
Expendable Launch Vehicle program. Launch vehicles can experience
out-of-family events that do not necessarily violate a redline limit.
Currently, this unfamiliar behavior is recognized only by a cognizant
system expert. The newly developed tool has been designed to
automatically detect these events by defining a measure of
unfamiliarity. With standard data mining algorithms, the tool uses
historical examples of system behaviors to generate dynamic redline
limits that continuously adjust for the current conditions and
environment of the vehicle. The result is a tighter-fitting bounding
function which provides significantly earlier detection of anomalous
events as well as added insight into problem diagnosis.

The data mining approach used to generate the bounding function is not
an uncommon practice. These techniques are used in a variety of
applications from stock market prediction programs to spacecraft
diagnostic tools. Wall Street brokers run programs that use combinations
of various market indicators to define the market's current condition.
Using historical data, the programs have learned to associate market
conditions with the performance of individual stocks, bonds, funds, etc.
Thus predictions are made based on current conditions as well as
historical precedents.

Similarly, JPL's Beacon Monitoring system incorporates their ELMER
(Envelope Learning and Monitoring using Error Relaxation) algorithm to
detect anomalous spacecraft conditions. Since spacecraft missions span
several years, the system has adequate time to learn the behavior of the
craft's components under nominal conditions. More specifically, the
system learns to associate sensors that have been found to have a
consistent relationship to one another. In this regard, the tool
developed for launch vehicles is quite similar to ELMER. The concept of
basing anomaly detection on historically precedented sensor-to-sensor
correlations is used in a way that is modified to fit the special
considerations of launch vehicles.

The relationships that exist between sensors turn out to be powerful
indicators of anomalous events. Consider the relationship between a
car's gas pedal and engine output. If sensor A measures the movement of
the gas pedal and sensor B measures the RPM of the engine, a strong
correlation would most likely be found between sensors A and B.
Violations of this correlation (floored gas pedal and zero RPM) would
raise a flag. On a complex system such as a launch vehicle, thousands of
these information-revealing relationships exist.

Modeling these relationships is accomplished by data mining. The
algorithms are executed on historical data, which will ideally contain
sufficient examples of the various relationships. The relational
information is captured in a parametric equation that will act as a
predictive model. Using the equation, a prediction can be made for any
sensor based on readings from the other related sensors. This prediction
-- plus or minus a specified error margin -- defines the upper and lower
limits of the bounding function. Readings from the targeted sensor that
violate these limits will therefore indicate that the associated sensors
are not experiencing the same relationships that they normally do.

In addition to early detection of anomalous conditions, this tool
provides added insight into problem diagnosis. By analyzing the
relationships between sensors instead of the sensor alone, more
deterministic cause-and-effect information is revealed. The diagnostic
analysis, combined with the real-time anomaly detection, will make this
tool highly beneficial to an integrated health management system.

# SIPS, A Structural Integrity Prognosis System\*

######### John M. Papazian, Elias L. Anagnostou, Stephen Engel, John Madsen, Daniel Fridline, Jerrell Nardiello, Robert P. Silberstein, Greg Welsh, James B. Whiteside

*Northrop Grumman*

The Structural Integrity Prognosis System (SIPS) is being designed to
provide prompt, informed predictions of the structural viability of
individual assets based on tracking of their actual use and modeling of
anticipated usage. The prognosis system is founded on a collaboration
between sensor systems, advanced reasoning methods for data fusion and
signal interpretation, and modeling and simulation systems.

The modeling and simulation technology employs a three-pronged approach.
In the first instance, detailed physics-based models are being developed
to faithfully capture the microstructural basis of fatigue and corrosion
damage. These models are geometrically explicit, and employ a digital
description of the material microstructure. The second approach relies
on multi-scale analysis whereby the local mechanisms of deformation and
damage are accounted for by an internal-state-variable constitutive
model. This approach permits the incorporation of detailed materials
behavior information in a faster-running damage prediction code. In the
final approach, simpler models for damage prediction are being employed
for rapid-response scenarios. These models include closed- form
approaches to prediction of corrosion pit damage, simpler finite element
strip-yield models, and response surfaces constructed from the more
elaborate models.

Various sensors are being used to provide input for the predictive
models. The sensor systems employ ultrasonic, eddy current,
electrochemical, and other technologies to provide information about the
current state of the structural components of the vehicle. In some
cases, virtual sensors are used to obtain state information by judicious
combination of tracking data that is already available on the vehicle
(e.g., accelerations, stores weight, altitude, etc.).

The sensor and modeling data will be evaluated and codified by the
reasoning and prediction (RAP) system. The RAP system employs various
schemes for combining uncertain knowledge from the models and the
sensors into a prediction of remaining useful life (RUL) and the single
flight probability of failure (SFPOF). Uncertainties in each of the
inputs will be evaluated and combined into a measure of overall risk.
Because the anticipated future mission loads are a major source of
uncertainty, various anticipated mission mixes can be examined by the
model.

\* This work is partially sponsored by the Defense Advanced Research
Projects Agency under contract HR0011-04-C-0003. Dr. Leo Christodoulou
is the DARPA Program Manager.

#  SQL-based Approach for Compiling Ordered Decision Diagrams from Device Models

######### Yousri El Fattah

*Rockwell Scientific Company*

Future Moon and Mars explorations will depend on cooperative space
systems that operate largely autonomously without ground support for
extended periods of time. In order to enable this capability, such a
system of systems will require a new generation of robust,
fault-tolerant software that supports autonomous operation. The use of
such intelligent software would lead to improved sustainability of
exploration missions by enhanced effectiveness and efficiency through
appropriate responses to anomalous events, increased safety and
reliability through quick and autonomous responses to faults, increased
affordability through reduced cost of ground operations, and increased
flexibility through applicability to a wide variety of mission systems
and platforms.

To enable autonomy and fault tolerance, intelligent software is needed
that takes a device model and compiles it into structure that
facilitates computing in real time a system's operating mode and how to
reconfigure to a desired target mode. The traditional approach relies on
hand crafting rule-based diagnosis and recovery systems that require
intensive human effort and expertise at highly increasing cost. As
complexity spirally increases there is the inevitability that humans
will overlook subtle interactions of how components can interact and
fail, producing rule-based systems with limited coverage of the space of
possible faults. Furthermore, the hand-crafted rule-based systems are
hard to revise for consistency with change in device models; and the
rule-based inference engine may be ad hoc, making it hard to provide
guarantees on soundness and on computational complexity.

To address the need for automated approaches to compiling diagnostic
rules from device models, few approaches have been proposed that rely on
formulating device models in propositional logic and the computing of a
compiled representation in the form of prime implicates or decomposable
negative normal form.

In this work, we present a novel approach that exploits the ubiquitous
relational database technology and the SQL language to compile device
models into ordered decision diagrams. The approach consists of an
elimination algorithm that takes as input a relational schema
representation of a device model and a set of observed variables. The
output of the algorithm is an ordering of the model variables and set of
queries that compute the value of each non-observed variable as a
function of the values of other variables ordered lower in the ordering.
When executed in order, the queries produce the set of all minimal
solutions conditioned on the observed values. We provide a method for
translating the ordered query execution to an ordered decision diagram
which is a directed acyclic graph. The task of computing the queries
requires knowledge of only the structure of the device and can be
computed in a preprocessing phase prior to diagnosis.

Our approach can be used in two modes: interpreted and compiled. The
interpreted mode first computes the diagnostic queries and then uses the
queries and the relational model to compute the diagnosis at observation
time. The compiled mode replaces the relational model and the queries by
an ordered decision diagram that efficiently computes the diagnosis at
observation time.

By separating the generation of queries from their execution we can
reuse parts of the diagnostic inference from one observation instance to
another. Also, by formulating the elimination algorithm in terms of SQL
queries we are leveraging all the query-processing capabilities and
query-optimization techniques readily available in relational database
management systems. For example, we can improve efficiency by exploiting
known indexing techniques for query optimization and we can take
advantage of the methods for computing the join of relational tables
which are part of the SQL query engine.

# Strider - An Enhanced Caution and Warning System That Uses Model-Based Reasoning

######### Peter Robinson, Charles Lee, Daryl Fletcher

*SAIC / NASA Ames Research Center*

######### Rick Alena, Bill McDermott, Mark Shirley

*NASA Ames Research Center*

######### Tom Cochrane Dan Duncavage

*Raytheon / NASA Ames Research Center NASA Johnson Space Center*

Caution and Warning (CW) systems provide a first line of defense in
assuring safe operations in a variety of complex systems, including
chemical plants, ships, submarines, aircraft, and spacecraft. So long as
CW events are well defined and limited in number, trained operators can
often use standard CW systems to rapidly take appropriate corrective
actions. But in extreme emergency situations in which novel combinations
or large cascades of adverse events occur, operator overload may prevent
effective and timely responses to those events.

We have designed Strider, a plug-in enhancement to standard CW systems,
to help improve response times in emergency situations. Designed for use
in the Space Shuttle (STS) and International Space Station (ISS), the
concepts can be adapted to future spacecraft such as the Crew
Exploration Vehicle (CEV). Strider uses model-based reasoning to enhance
safe operations of such systems in three ways: 1) by providing 3D
visualizations of all major subsystems to aid in the rapid location of
all CW events; 2) by using model-based reasoning to help isolate the
root causes of those events, develop 'what if' scenarios, and suggest
appropriate corrective actions; and 3) by providing immediate access in
emergencies to documents relevant to all CW events.

Strider's reasoning abilities operate on a 'common model' comprised of a
number of system elements, including the system's underlying schematics,
associated CW event logic, and built-in recovery procedures. Each
feature in the model is linked to a 3D display of all of the system's
major components and sensors, allowing operators to efficiently locate
CW events and associated system failures. The same 3D or topographical
structure helps Strider infer proximity relations that help identify the
root causes of those failures.

At runtime, Strider operates as a feedback controller, playing the role
served by state estimators and regulators in modern control theory.
Using current sensory data and records of all system commands that
preceded the CW events, Strider computes current state and control
vectors for the system being monitored. One key feature of the common
model is that it contains all sensory and command information associated
with all possible CW events, allowing global system consistency to be
measured against local consistency defined by individual CW events.

Past experience suggests that model-based reasoning operating on the
schematics of complex systems can enhance the reliability of CW systems
in addressing system failures. Our efforts to create a 'common model'
that links CW to system schematics have shown that if all system data
products are encoded in machine-readable form, model creation need not
be labor intensive; in the case of STS and ISS, in which this is not the
case, more effort has been required in model building.

# Technology Readiness of Structural Health Monitoring Systems

######### Amrita Kumar, Shawn Beard, Peter Qing, Roy Ikegami

*Acellent Technologies, Inc.*

Monitoring the continued health of structures and identifying problems
before they affect safety and performance has been a long-term goal of
both the military and commercial industries. Structural health
monitoring offers the promise of a paradigm shift from schedule-driven
maintenance to condition-based maintenance of assets. Built-in sensor
networks on the structure can provide crucial information regarding the
condition, damage state, and/or service environment of the structure.
Diagnostic information from sensor data can be used for prognosis of the
health of the structure and facilitate informed decision processes with
respect to inspection and repair, e.g., repair vs. no repair. Asset
management can be performed based on the actual health and performance
of the structure, thereby minimizing failures and maintenance costs,
while maximizing reliability and readiness. This presentation will focus
on the technology readiness of Structural Health Monitoring when used in
several applications including aircraft, spacecraft, and civil
infrastructures.

# Unsupervised Anomaly Detection for

# Rocket Propulsion Health Monitoring

######### Mark Schwabacher

*NASA Ames Research Center*

This poster describes the initial results of applying two
machine-learning-based unsupervised anomaly detection algorithms, Orca
and GritBot, to data from two rocket propulsion testbeds. The first
testbed uses historical data from the Space Shuttle Main Engine. The
second testbed uses data from an experimental rocket engine test stand
located at NASA Stennis Space Center. The poster describes four
candidate anomalies detected by the two algorithms.

The ability to detect anomalies in sensor data from a complex engineered
system such as a spacecraft is important for at least three reasons.
First, detecting anomalies in near-real-time during flight can be
helpful in making crucial decisions such as the decision of whether to
abort the launch of a spacecraft prior to reaching the intended
altitude. Second, for a reusable spacecraft such as the Space Shuttle,
detecting anomalies in recorded sensor data after a flight can help to
determine what maintenance is or is not needed before the next flight.
Third, the detection of recurring anomalies in historical data covering
a series of flights can produce engineering knowledge that can lead to
design improvements.

The current approach to detecting anomalies in spacecraft sensor data is
to use large numbers of human experts. Flight controllers watch the data
in near-real time during each flight. Engineers study the data after
each flight. These experts are aided by limit checks that signal when a
particular variable goes outside of a predetermined range. The current
approach is very labor intensive. Also, humans may not be able to
recognize faults that involve the relationships among large numbers of
variables. Further, some potential faults could happen too quickly for
humans to detect them and react before they become catastrophic.

One approach to automating anomaly detection is the model-based
approach. This approach encodes human knowledge into a model, which is
then used to automatically detect faults. Examples of systems that use
the model-based approach include Livingstone, TEAMS-RT, and SHINE.
Building the models is very labor intensive; it therefore may not be
feasible to model every part of a highly complex system such as a
spacecraft. It also may not be possible to model all possible failure
modes. We therefore consider supplementing the model-based approach with
the data-driven approach. The data-driven approach seeks to build a
model for detecting anomalies directly from the data, rather than
building it based on human expertise. In this poster, we explore a
particular data-driven approach, which is based on anomaly detection
algorithms from the machine learning community.

The first unsupervised anomaly detection algorithm that we used is Orca,
which was developed by Bay and Schwabacher. Orca uses a distance-based
approach to defining anomalies, and uses a novel pruning rule to run in
nearly linear time. The second algorithm we used is GritBot, which is a
commercial product from RuleQuest Research. Some of the anomalies we
detected were detected by both algorithms, while others were only
detected by one of the two algorithms. This discrepancy occurs because
different algorithms use different definitions of what it means to be an
anomaly. We therefore believe that it is useful to run multiple anomaly
detection algorithms on any data set.

# Validation of a COTS EHM Solution for the JSF Program

######### Somnath Deb, Venkata N. Malepati, Michel D. Paquet, Baban Baliga

*Qualtech Systems, Inc.*

This paper presents results from a recent study conducted under the JSF
program to evaluate and validate the COTS reasoner, TEAMS-RT, selected
by Pratt and Whitney for onboard diagnosis of the JSF F135 engine. The
JSF Program Office suggested evaluating the performance and accuracy of
the TEAMS-RT solution by comparing it against the engine diagnosis
solution developed by Pratt and Whitney (P&W) for a recent Air Force
fighter jet. P&W provided high-quality information regarding the failure
modes and rates of the LRC/modules of the engines from FMECA data, and
also the mapping between the failure modes and built-in fault codes or
Health Resolution Codes (HRC) from its PHM database. The data provided
by P&W contained fault-test dependency and failure rate data in a
spreadsheet format, which was used to generate the TEAMS--RT model. P&W
also supplied a rich set of test cases which were used to exercise the
TEAMS-RT EHM solution, and generate diagnosis.

The objectives of the study were two-fold:

1.  Use the test cases to validate the automatic model generation
    process and the diagnostic accuracy of a COTS reasoner (TEAMS-RT)
    against a proven legacy diagnosis system currently in use by the Air
    Force. It was, therefore, important to demonstrate that for the same
    test cases, the TEAMS-RT results were nearly identical to the ones
    produced by the reference reasoner. Thus, a secondary goal was to
    tweak the TEAMS-RT algorithm, to mimic the performance of the
    reference reasoner.

2.  Improve on the reasoning accuracy beyond that of the reference
    reasoner, if possible. The results show a slight improvement in
    diagnostic accuracy and performance by the TEAMS-RT reasoner.
    Simulation results and implementation details will be presented in
    this paper.

# Verification of Model-based Software Systems for Space Applications

######### Guillaume Brat

*NASA Ames Research Center*

Model-based software can play an important role in future space
applications. For example, it can help streamline ground operations or
assist in autonomous rendezvous and docking operations. Moreover,
model-based software, especially planning and scheduling systems, is
well suited to finding solutions to recovery problems. For example,
planners can be used to explore the space of recovery actions for a
power subsystem and implement a solution without (or with minimal) human
intervention. In general, the exploration capabilities of model-based
systems give them great flexibility. Unfortunately, it also makes them
unpredictable to our human eyes, both in terms of their execution and
their verification. The traditional verification techniques are
inadequate for these systems since they are mostly based on testing,
which implies a very limited exploration of their behavioral space. In
our work, we explore how advanced V&V techniques, such as static
analysis, model checking, and compositional verification, can be used to
gain trust in model-based systems.

Planning systems are made of two parts: the domain model describes the
domain on which the planner can reason and the planning engine performs
the reasoning (usually in the form of a systematic exploration of the
state space induced by the planning goals and the domain model). These
two parts yield different V&V challenges. On one hand, the planning
engine can be verified in terms of its mechanisms, i.e., check that
forward propagation is done correctly, check that constraints are
elaborated correctly, and so on. We believe this can be done using
automatic proving techniques. The use of these techniques comes with a
high cost, but the planning engine only needs to be validated once. In
some sense, it is a bit similar to validating a compiler. On the other
hand, domain models change depending on the applications. This is where
knowledge specific to a given problem is captured. Each new domain model
needs to be validated. In our presentation we will focus on the
verification of domain models for model-based systems and describe what
type of properties we can check on these models. We will also discuss
how concepts used in static analysis, such as abstractions, can help
decompose the verification process, hence making it more scalable.

# What is the value proposition for wire integrity management using sensors on-board manned aerospacecraft? - exploring the business case for ground processing operations

######### Philip Wysocki

*ASCR Aerospace Corp.\
NASA Ames Research Center*

######### James Cockrell

*NASA Ames Research Center*

######### Ralph Hodgson

*TopQuadrant, Inc.*

A few seconds after liftoff of Shuttle flight STS-93, a short circuit in
a main power bus caused a primary main engine controller and a backup
controller in another engine to drop out. Subsequently, detailed
inspections of the Shuttle fleet revealed many latent wire defects. On
the most recent Shuttle flight, STS-114, an intermittent wire caused
loss of an inaccessible external tank fuel level sensor, costing days of
launch delays. Automated vehicle wiring sensors could have located these
wiring problems, saving substantial time and costs in diagnosis, repair,
and risk.

Wire integrity management using on-board sensors seems a natural fit for
future Vehicle Health Management. Government and private enterprises are
presently developing in-situ wire integrity sensors. Is there a value
proposition for wire integrity management in manned aero-spacecraft? How
would risk be reduced, or other benefits gained, from isolating failure
to wiring, or a particular wire?

Knowing that a wire is faulty in flight is not necessarily going to
improve a crew's ability to take effective action. However, does wire
integrity sensing for IVHM ground operations provide benefits to risk,
cost, schedule, or reliability? If so, to what degree will they be
realized? And does the ROI justify the costs?

In this paper we assume that in-situ wire sensors will be incorporated
into IVHM systems. We focus on the business case for the inclusion of
Wire Integrity Management in future vehicle design. We explore
ground-processing rather than in-flight scenarios. Our expectations are
that the greatest value of in-situ wire integrity management will be in
savings of cost, scheduling, invasiveness, and risks. Ground processing
includes: vehicle recovery, fault diagnosis, access, closeout and
safing, tooling, repairs, spares provisioning, testing and validation,
and preflight/postflight preparations.

We expect wire integrity information will be of lesser value in flight,
where the provision of subsystem redundancy mitigates the risk effect of
wire damage. However, in a future effort, benefits of wire IVHM should
be explored. This is especially true for long-duration space missions or
habitats where the crew might be expected to repair or replace wiring as
part of long-range risk mitigation.

We are developing models to explore the possible benefits of inserting
wire sensors that provide information to ground operations in order to
pre-plan maintenance work. Our approach uses quantified measures
referred to as Measures Of Effectiveness (MOE). MOEs for
ground-processing activities will include cost, schedule, time duration,
and risk. MOEs will be computed by procedural models of
ground-processing scenarios. An existing generic reference model will be
adapted for exploring the MOE trade space. We justify a generic approach
because we expect FOM trends in maintenance scenarios to be independent
of specific vehicle implementations.

We expect the main benefits to be reduction of invasiveness and
pre-planning of maintenance. Invasiveness benefits result from less
instances of unnecessary removal of structures and equipment. We expect
less inadvertent damage to other elements during access and less
unnecessary compromising of spare parts when faulty wiring is
misdiagnosed as faulty Line Replaceable Units (LRUs). Pre-planning
benefits will come from early identification of faulty wires, repair
requirements, and necessary skills to aid pre-planning of scheduling
ground maintenance operations. Batching of related work provides economy
of operations such as preparation for work in areas with access
difficulty, and operations affected by closeout. These latter operations
include safing, powering down, storage, and inspection.

Our study is directed toward future reusable manned spacecraft, such as
the Crew Exploration Vehicle (CEV). However the results can be
generalized and the principles can be extended to other manned
spacecraft, aircraft, or perhaps other complex vehicles, habitats, or
ground support infrastructure where wire functions are critical.

## Index of Authors

### A {#a .Index-Letter}

Aaseng, Gordon, 63

Agogino, Adrian, 98

Alena, Rick, 107

Altman, Scott, 9

Anagnostou, Elias L., 105

Augustin, Michael, 47

### B {#b .Index-Letter}

Baakalini, G., 79

Baliga, Baban, 110

Baroth, Edmund C., 85

Barszcz, Eric, 93

Beard, Shawn, 108

Binkley, Jonathan F., 29

Bird, Gary, 37

Biswas, Gautam, 63, 87

Brat, Guillaume, 111

Brinza, David, 73

Brown, Edward N., 41

Burns, Dylan, 92

Button, Robert M., 83

Byington, Carl S., 65, 85

### C {#c .Index-Letter}

Calvello, Giulio, 45

Chang, Fu-Kuo, 81

Chau, Savio, 85

Cheng, Paul G., 29

Chung, Seung H., 90

Chicatelli, Amy K., 83

Christensen, Michael, 37

Cochrane, Tom, 107

Cockrell, James, 112

Crocker, Alan, 33

Crow, Ed, 61

### D {#d .Index-Letter}

Deb, Somnath, 110

Decker, Harry, 47

Dempsey, Paula, 47

Deshmukh, Abhijit, 100

Duffy, Michael J., 103

Duke, Alan, 47

Duncavage, Dan, 107

### E {#e .Index-Letter}

El Fattah, Yousri, 106

Engel, Stephen, 105

Ephraim, Piet, 47

Esser, Brian, 92

### F {#f .Index-Letter}

Feather, Martin, 73

Figueroa, Fernando, 73

Fletcher, Daryl, 107

Fridline, Daniel, 105

Frith, Peter, 45

Fulton, C.E., 79

### G {#g .Index-Letter}

Gilbert, John A., 49

Goforth, Andre, 93

Grabill, Paul, 47

### H {#h .Index-Letter}

Hanlon, Alaina B., 100

Hess, Andy, 11, 45

Hobday, Michael, 25

Hodgson, Ralph, 112

Hong, T., 79

Horvath, Gregory A., 90

Huff, Edward, 47

Hughitt, Brian, 51

Hunter, G.W., 79

Huston, Dryver R., 92

Hyers, Robert W., 100

### I {#i .Index-Letter}

Ikegami, Roy, 108

Ingham, Michel D., 90

### J {#j .Index-Letter}

Jata, Kumar V., 67

Jeffress, Stephen, 104

Johnson, Stephen B., 15

### K {#k .Index-Letter}

Kacprzynski, Gregory J., 65

Kelley, Anthony R., 77

Kessler, Seth S., 96

Koehler, Andrew, 27

Kortenkamp, David, 87

Kudiya, Abdul, 49

Kumar, Amrita, 108

### L {#l .Index-Letter}

Langwost, Patricia E., 35

Larkin, James, 75

Lee, Charles, 107

Leveson, Nancy, 69

Lutz, Daniel, 37

Lutz, Robyn R., 53

### M {#m .Index-Letter}

Mackey, Ryan, 21

MacLise, Dougal, 93

Madsen, John, 105

Malepati, Venkata N., 110

Manders, Eric Jan, 87

Markosian, Lawrence, 73

Marrotta, Stephen A., 49

Martin, Oliver B., 90

Maul, William A., 79, 101

McCann, Robert S., 31

McDermott, Bill, 107

Melcher, Kevin. J., 101

Mikaelian, Tsoline, 97

Morgan, Paula S., 39

Mott, Charles, 19

### N {#n .Index-Letter}

Narasimhan, Priya, 71

Narasimhan, Sriram, 63

Nardiello, Jerrell, 105

Nikora, Allen P., 53

Nishikawa, David, 93

Nissen, Gerald L., 99

### O {#o .Index-Letter}

O'Hagan, Brian, 33

O'Neill, Gary, 57

Oberle, L.G., 79

Ooi, Teng K., 49

### P {#p .Index-Letter}

Papazian, John M., 105

Paquet, Michel D., 110

Parthasarathy, T.A., 67

Patrick, Clint, 85

Patterson-Hine, Ann, 63

Pattipati, Krishna, 63

Perotti, J., 79

Powers, W.T., 77

Prencipe, Andrea, 25

### Q  {#q .Index-Letter}

Qing, Peter, 108

### R {#r .Index-Letter}

Reichard, Karl, 61

Robinson, Peter, 107

Roemer, Michael J., 65

Rogan, Chris, 61

Rogers, Edward W., 23

Rogers, Steve, 95

Ruderman, Gregory A., 43

### S {#s .Index-Letter}

Sachenbacher, Martin, 97

Safa-Bakhsh, Robab, 47

Sanderfer, Dwight, 93

Scandura, Jr., Philip A., 37

Schwabacher, Mark, 109

Shirley, Mark, 107

Siewiorek, Daniel P., 71

Silberstein, Robert P., 105

Smith, Patrick L., 29

Sowers, Shane S., 101

Spencer, Graham, 92

Spirkovska, Lilly, 31

Suarez, Eva L., 103

### T {#t .Index-Letter}

Tolmie, Bernard, 92

Tosney, William F., 29

Toutanji, Houssam, 49

Tumer, Irem Y. , 59

Tumer, Kagan, 98

### U {#u .Index-Letter}

Uckun, Serdar, 17

### V {#v .Index-Letter}

Vachtsevanos, George, 65

Varnavas, Kosta, 85

Vesely, William, 55

Volponi, Al, 75

### W {#w .Index-Letter}

Waterman, Robert D., 35

Waterman, Susan J., 35

Watson, Emily, 94

Watson, Michael D., 85

Weiss, Lora, 61

Welsh, Greg, 105

Whiteside, James B., 105

Williams, Brian C., 90, 97

Wood, Bruce, 75

Wysocki, Philip, 112

### Z {#z .Index-Letter}

Zakrajsek, James, 47

##