# Presentation: 039445

## Gathering Knowledge for Reuse in Analysis of Hazards and Failures Jane T. Malin, Dennis G. Lawler, Land Fleming, David R. Throop Managing Knowledge for Successful Mission OperationsMarch 2, 2006

## Capture Design and Analysis Knowledge

- Knowledge Capture Objectives from Early Design and Analysis:
- Capture reusable machine-readable data about a specific system
- Data for use and update during missions and mission preparation, jointly by MCC and MER, including SE&I and Safety
- Provide quick-look capability to find “unexpected” cross-subsystem impacts

## Benefits of Reuse of Data from SE&I

- Reduced data gathering and modeling labor
- Libraries, data conversion and model reuse
- Uniform naming of components and functions
- Earlier coordinated multi-disciplinary analysis
- Hazards, Risks, Reliability, Fault and Failure Analysis, Influence analysis
- Foundation for Later Life Cycle Use
- Operations analysis and procedure/rule validation
- Links and Portals: Product data, Operations data, Problem data
- Models for FDIR and Logistics in Operations

## Capture Approach in PHA Process

- Early analyses targeted are Preliminary Hazard Analysis (PHA) and Failure Modes and Effects Analysis (FMEA)
- For PHA:
- Capture model of components and connections across subsystems
- Identify _local_ hazard sources and vulnerable components, within subsystems
- Find matching pairs of components and paths in a system
- Estimate _local_ hazard impact severity and combine estimates in a system

## 
Extract and capture expertise 
On functions, failures and hazards 
Develop machine-readable standard nomenclature (ontology) and libraries
Mine SE&I text and data sources
Use ontology and text mining tool
Extract system function, component and risk data 
Develop system models
Seed with library of possible failures and controls
Apply ontology and library to functions and entities
Identify local failures, vulnerabilities and hazard conditions 
Identify controls or mitigations for risks
Estimate importance and severity of failures and hazards
In system model, analyze impacts in scenarios
Reuse collected and generated data

- Extract and capture expertise
- On functions, failures and hazards
- Develop machine-readable standard nomenclature (ontology) and libraries
- Mine SE&I text and data sources
- Use ontology and text mining tool
- Extract system function, component and risk data
- Develop system models
- Seed with library of possible failures and controls
- Apply ontology and library to functions and entities
- Identify local failures, vulnerabilities and hazard conditions
- Identify controls or mitigations for risks
- Estimate importance and severity of failures and hazards
- In system model, analyze impacts in scenarios
- Reuse collected and generated data

- Steps in Gathering the Knowledge

## 1. Capture the Nomenclature

- Taxonomies and concepts in relevant domains have been incorporated, then extended for the space domain
- Hardware, mechanical, chemical, control, software, human...
- Further refined function and entity nomenclature for the space domain
- Parsed and analyzed Space Station documents: RBDs, procedure books
- Recently refined resulting ontology and libraries with knowledge captured from propellant transfer system expert
- Presented early high-level design to critique, and the information we needed spilled out as stories and facts

## 2. Mine SE&I Data Sources for Models

**[C.1]  Telecommunication Subsystem**
- [C.1.1]  The CDHC sends the TeleSub a compressed picture.  [FG.1] [TeleSub C.1.4]
- [C.1.2]  The CDHC sends the TeleSub telemetry.  [FG.2] [FR.1] [FR.5] [TeleSub C.1.5]
- [C.1.3]  The CDHC sends In View of Ground alerts to the TeleSub.  [DP.5.6] [TeleSub C.1.6]
- [C.1.4]  The CDHC receives plan files from the TeleSub.  [FR.3] [TeleSub C.1.3]
- [C.1.5]  The CDHC receives ground commands from the TeleSub.  [FR.3] [TeleSub C.1.2]
- [C.1.6]  The CDHC receives the TeleSub operating state from the TeleSub.  [DP.5.5] [TeleSub C.1.1] **...**
**[C.2]  Camera Subsystem**
- [C.2.1]  The CDHC sends the Camera a "take picture" command.  [FG.2] [FR.1] [FR.3]
- [C.2.2]  The CDHC sends the Camera x, y and z gimballing coordinates.  [FG.2] [FR.1] [FR.3]
- [C.2.3]  The CDHC sends a turn on command to the Camera.  [DP.5.3]   [H Constraint 1.1.4]
- [C.2.4]  The CDHC sends a turn off command to the Camera. [DP.5.3]
- [C.2.5]  The CDHC receives a compressed picture file from the Camera. [FG.1] [FG.2] [FR.1]
- 	**...**
**[C.4]  Attitude Determination Subsystem**
- [C.4.1]  The CDHC receives an In View of Ground alert from the ADS. [DP.5.6] [ADS]
- [C.4.2]  The CDHC  receives the ADS operating state from the ADS.  [DP.5.5] [ADS]

**HIT Functional Architecture Model**

**Requirements from SpecTRM SE&I Tool**

## Extract Models with Reconciler

- CRADLE Models (Constellation SE&I Tool)
- Requirements, Processes, Components
- Reconciler Tool: Parsing and Matching
- Reconciler is also used to parse text, to 	refine ontology
- Ontology, Library and Analysis in Hazard Identification Tool (HIT)

- CRADLE

- Reconciler

- HIT

## Reconciler Finds Functions and Objects

- The Reconciler

- Parses the Process and Requirements sentences from Cradle
- Extracts functions and objects
- Classifies the functions, with the ontology
- Formats the parsed knowledge
- In XML
- As an OWL ontology
- Passes the result to HIT

## Matched Function Type: Ontology

- Place/Locate (act to spatially shift, arrange or store equipment, systems, materials, information, or energy)
- Hold
- Store...
- Carry...
- Support/stabilize...
- Secure...
- Receive/import/collect...
- Shift
- Send or Release
- Provision: Provide, distribute, dispense....
- Export...
- Release...
- Shift in place: Circulate, stir, rotate...
- Transfer: Move, shift, relocate, translate, lift, advance, downlink, uplink, upload, download, _**send**_, transmit, return, equalize, distribute...
- Arrange ...

_**HIT Requirements Model (Shift Info) **_
** ****Function Type: Transfer (“Send”)**
** ****Agent/Contributor: Subsystem (“CDHC”)**
** ****Affected Operand: Information (“Telemetry”)**
** ****Operand Source: Subsystem (“ CDHC”)**
** ****Operand Destination/Goal: Subsystem (“ Telesub”)**
** ****Path Type: Information**
** ...**

## Produce an Architecture Model and Visualization from a Set of Requirements

**[C.1]  Telecommunication Subsystem**
- [C.1.1]  The CDHC sends the TeleSub a compressed picture.  [FG.1] [TeleSub C.1.4]
- [C.1.2]  The CDHC sends the TeleSub telemetry.  [FG.2] [FR.1] [FR.5] [TeleSub C.1.5]
- [C.1.3]  The CDHC sends In View of Ground alerts to the TeleSub.  [DP.5.6] [TeleSub C.1.6]
- [C.1.4]  The CDHC receives plan files from the TeleSub.  [FR.3] [TeleSub C.1.3]
- [C.1.5]  The CDHC receives ground commands from the TeleSub.  [FR.3] [TeleSub C.1.2]
- [C.1.6]  The CDHC receives the TeleSub operating state from the TeleSub.  [DP.5.5] [TeleSub C.1.1] **...**
**[C.2]  Camera Subsystem**
- [C.2.1]  The CDHC sends the Camera a "take picture" command.  [FG.2] [FR.1] [FR.3]
- [C.2.2]  The CDHC sends the Camera x, y and z gimballing coordinates.  [FG.2] [FR.1] [FR.3]
- [C.2.3]  The CDHC sends a turn on command to the Camera.  [DP.5.3]   [H Constraint 1.1.4]
- [C.2.4]  The CDHC sends a turn off command to the Camera. [DP.5.3]
- [C.2.5]  The CDHC receives a compressed picture file from the Camera. [FG.1] [FG.2] [FR.1]
- 	**...**
**[C.4]  Attitude Determination Subsystem**
- [C.4.1]  The CDHC receives an In View of Ground alert from the ADS. [DP.5.6] [ADS]
- [C.4.2]  The CDHC  receives the ADS operating state from the ADS.  [DP.5.5] [ADS]

**HIT Functional Architecture Model**

## Extract Objectives, Risks, Mitigations

-  Operation/Function: Transfer (“**Downlink**”)
-  Agent/contributor: ?
-  Affected Operand: **Information**
-  Operand Source: ?
-  Operand Destination/Goal: ?
-  Path Type: **Information**
-  Effect value/measures: “**Successful**”
-  ...

_**Problem Model **__**(Failure of**__** **__**Function**__**)**__ _
-  Problem: **Failure of function **(“**Failure**”)
- Agents/contributors: “**Transmission   Subsystem, Transmitter...”**
-  Impacted Entity: “**Telecom Subsystem**”
-  Impacted Objective (link to):  “**Downlink Successful**”
-  ...

**RAP or ARM Risk Analysis ****	****and Matrix**

**DDP Analysis and Visualization of Risks, Mitigations and Costs**

_**Counteraction Model (**__**Replace**__**) **_
-  Function Type: **Replace** (“**Redundancy**”)
-  Replaced: “**Transmitter**”
-  Replacement: “**Transmitter Spare**”
-  Counteraction Type: **Recover**
-  Counteracted Problem (link to): **“Telecom Sub... Failure... Transmitter**”
-  ...

**Objective: “Downlink successful”**
**Risk: “Telecom Subsystem Failure: Transmission: Transmitter”**
**Mitigation: “Redundant Systems: Transmitter”**

**Transmitter Failure**
**    ****Counteraction: Redundant Transmitter**

- Telesub: Failure
- (Transmission sub: Transmitter)

## Matched Problem Type

**Contributors/Causes**
**Exposure Conditions** (loads, shocks, accumulations)
- Electrical or electromagnetic
- Thermal
- Radiation
- ...
**Deviations from Performance Conditions**
- Devices....
- Materials...
- Energy...
- Control...
- Environment...
**Consequences/Effects **
**Damage**: to equipment, materials, life forms, environment, energy, information...
_**Failure of Function **_
- Omission
- Bad timing: forbidden, early, late
- Bad quantity: more/less; rate slow/fast/intermittent...
- Bad quality: wrong, opposite/reversed, out-of-bounds...

_**Problem Model **__**(Failure of**__** **__**Function**__**)**__ _
-  Problem Type: **Failure of function **(“**Failure**”)
- Agents/contributors: “**Transmission   Subsystem, Transmitter...”**
-  Impacted Entity: “**Telecom Subsystem**”
-  Impacted Objective (link to):  “**Downlink Successful**”
-  ...

## 3. Seed with Library of Problems and Controls

- * From Methodology for Conduct of Project Constellation Hazard Analyses (0000028585)

-  Build on the Hazards Checklist*

## Get Problems from Library

- Generic problems for Functions
- Deviations-from-desired-performance
- Problems-with-performing-function
- Default: Omission/Failure to Perform
- Generic problems for Entities
- Exposure-or-deprivation
- Problematic-internal-state
- Specific problems for Function types
- Uses gathered domain expertise
- Specific problems for Entity types
- Uses gathered domain expertise
- Controls/countermeasures for problem types

## Example: Top of Problem Effects Hierarchy

- Damaged (loss of integrity, health)
- Distorted, Breached, Dislocated, Converted, Destroyed, Uncomfortable, Deprived
- Impaired: Functionally disabled, degraded (lacking capability to function as needed)
- Weak, Leaking, Blocked, Stuck/Sticky, Loose/Slippery, Unperceptive, Unclear, Ineffective, Uncontrollable, Uncoordinated
- Made a hazardous source of damage/impairment
- Obscuring, Thermally extreme, Electrified, Sharp, Vibrating, Accelerated, Emitting/Excreting, Toxic/Infectious, Irritating, Caustic, Fire Hazard, Reactive, Pressurized, Depressurized

## 
Extract and capture expertise 
On functions, failures and hazards from text and interviews 
To develop machine-readable standard nomenclature (ontology) and libraries
Mine SE&I text and data sources
Use ontology and text mining tool
Extract system function, component and risk data 
Develop system models
Seed with library of possible failures and controls
Apply ontology and library to functions and entities
Identify local failures, vulnerabilities and hazard conditions 
Identify controls or mitigations for risks
Estimate importance and severity of failures and hazards
In system model, analyze impacts in scenarios
Reuse collected and generated data

- Extract and capture expertise
- On functions, failures and hazards from text and interviews
- To develop machine-readable standard nomenclature (ontology) and libraries
- Mine SE&I text and data sources
- Use ontology and text mining tool
- Extract system function, component and risk data
- Develop system models
- Seed with library of possible failures and controls
- Apply ontology and library to functions and entities
- Identify local failures, vulnerabilities and hazard conditions
- Identify controls or mitigations for risks
- Estimate importance and severity of failures and hazards
- In system model, analyze impacts in scenarios
- Reuse collected and generated data

- Steps in Gathering the Knowledge

## 4. Locally ID Vulnerabilities & Hazards

- Goal: Extract local data for cross-subsystem analysis
- Define vulnerabilities _locally_, with And-Or trees of disablers
- Identify components that _local_ produce potential hazards
- Vulnerability of an entity: Sensitivity to local problematic input conditions
- Disable or degrade a function
- Make the entity a hazard source
- Damage the entity
- Hazard: Condition or entity that a vulnerable entity could be exposed to or deprived of

**Hazardous Entity or Condition**

**Vulnerable Entity or Function**

**Path Across Subsystem Interfaces**

## 5. Estimate Hazard Impact Severity

- Make Local Estimates (or keep it T-F Boolean)
- Effectiveness of Source components at producing hazards
- Effectiveness of hazard transmission by components on the path
- Degree of vulnerability of Target components to hazards
- Find the path with maximum degree of hazard transmission effectiveness in an operational configuration
- Estimate effects on the vulnerable components
- Decreases in function or health or increase in producing hazards

## 6. Reuse Collected Data

- HIT Output is machine-readable data in XML or OWL
- Have demonstrated conversion of HIT model data to state model in CONFIG hybrid dynamic simulation for:
- Quick-look investigation of fault cascades and impacts
- Interactive validation of FDIR software and requirements

## Reusing Model Data from HIT

**Model data**

- Hazard Identification Tool Model

- Derived CONFIG Simulation Model

**Log/Report Specifications**

**Scripts**

## Reuse Ontology or Nomenclature

- Goal: Standard terminology for multiple groups, designed to bridge culture gaps
**Designer ********Hazards analyst ********Software Engineer ********Test Engineer ******** Operations analyst**
- Hierarchies of classes, attributes for classes
- Mappings of classes to words used in the space domain
- Libraries of standard class definitions to help the engineer
- Terminology to help the users capture detailed types of failures, hazards and risks
- Encourages making distinctions among types
- Promotes thinking about wide array of possible problems and safeguard/mitigation strategies

## Project Status

- Extensive Ontology and Prototypes
- Project lost funding as Exploration turned off funding to “Engineering for Complex Systems” R&D project
- We’re looking for funding to continue the work for a customer user group
- Maturing or converting the prototypes or their content
- Collecting design and analysis data
- Collecting expertise about functions, failures and hazards
- Developing capabilities to reuse, expand and upgrade collected data