2000 - Draper Laboratory

ActuatorsSensorsIntelligent SensorsIntelligentActuatorsDedicatedWiringData Acquisition andActuator ControlElectronicsSharedBusWiringMiniaturizedDataAcquisitionElectronicsMiniaturizedActuatorControlElectronicsControlComputerControlComputerTypical Data Acquisitionand Actuator Control ElectronicsNetwork I/O Data Acquisitionand Actuator Control ElectronicsFigure 1. Network I/O approach reduces wiring and connections.As illustrated in Figure 1, using the network I/O approach, theanalog sensors and actuators that interface with data acquisitionand actuator control electronic units by dedicated wiringare replaced by "intelligent" sensors and actuators that communicateover a shared digital data bus. An obvious advantageof this approach is a reduction in the amount of wiringand connectors needed. For fault- and damage-tolerant systems,the reductions are increased by the number of redundantI/O devices needed. Less obvious but of equal or greaterimportance is the ability to program these intelligent I/Odevices to perform I/O processing functions such as signalprocessing (linearization, calibration, filtering, etc.), fault detectionand self tests, self identification, and actuator commandfault masking. The later of these, actuator commandfault masking, makes it possible to ensure that an actuatorsuch as a valve will operate correctly despite any single electronicsfailure.DEPENDABILITY REQUIRED OF THE I/O NETWORKA fundamental question when designing a system to be faultand damage tolerant is "what degree of dependability isneeded?" Designing a system to recover from a few obviousfailure conditions is a far easier problem than providing thelevel of dependability needed for life-critical applications,such as a fly-by-wire aircraft. Often, the way in which a systemis allowed to fail is of as great a concern as if it can fail. Forexample, failure of a weapon system to operate is of less concernthan premature detonation of that weapon aboard theship. So in this case, we would say that we require a very lowprobability of premature operation, but can tolerate a higherprobability that the system will fail to operate. Similarly, anunexpected shutdown of a turbine engine is less of a problemthan an explosive overspeed condition of the engine. In thiscase, we can tolerate the loss of function, but must design thesystem to avoid the overspeed malfunction. Yet other functionscan have catastrophic consequences only if they fail tooperate at the proper time, such as in response to an emergencycondition like a fire or flooding casualty. Another measureof system dependability is found in the rate at which falsealarm conditions are reported. Examples of false alarmsinclude a false indication to an operator that equipment isfaulty or an automatic reconfiguration to discontinue usingequipment that is not faulty. To summarize, some of the failuremodes that must be considered when designing a faultanddamage-tolerant system include:• Loss of function while operating.• Malfunction while operating.• Premature operation.• Failure to operate at the proper time.• Failure to cease operating at the proper time.• False alarms.• Degraded operation.A useful concept is that of categories of function criticality.Borrowing from the aircraft industry, three levels of criticalitycan be established: Critical, Essential, and Nonessential. A nonrigorousdefinition of each is as follows:• Critical: malfunction or loss of function endangersthe crew or the ship.• Essential: malfunction or loss of function requiresimmediate and effective action by the crewto prevent endangerment of the crew orship.• Nonessential: malfunction or loss of function will have nodirect effect on the safety of the crew or ship.It has been established by general practice that the only typeof system suitable for critical functions are those that useTriple Modular Redundancy (TMR). A TMR system (Figure 2)makes use of three redundant channels of control and relieson a mechanism to "vote" the output of these strings and tooperate the system based on a two-out-of-three consensus ofthe channels. Dual-redundant systems can be constructedthat provide protection against malfunction or prematureoperation, but are limited in their ability to protect against aloss of function while operating.26Fault-Tolerant Input/Output (I/O) Networks Applied to Ship Control