Computer control software faults

A traditional approach to fault diagnosis in the wider application context is based on hardware i.e. physical) redundancy methods which use multiple lines of sensors, actuators, computers and software to measure and/or control a particular variable. Typically, a voting scheme is applied to the hardware redundant system to decide if and when a fault has occurred and its likely location amongst redundant system components. The use of multiple redundancy in this way is common, for example with digital fly-by-wire flight control... 

Early approaches to fault diagnosis were often based on the so-called physical redundancy [11], i.e., the duplication of sensors, actuators, computers, and softwares to measure and/or control a variable. Typically, a voting scheme is applied to the redundant system to detect and isolate a fault. The physical redundant methods are very reliable, but they need extra equipment and extra maintenance costs. Thus, in the last years, researchers focused their attention on techniques not requiring extra equipment. These techniques can be classified into two general categories, model-free data-driven approaches and model-based approaches. 

The fault tolerant design discussed here mainly pertains to computing systems and intelligent systems for real-time computer systems such as DCS/PLC and/or associated intelligent devices. Here, the discussion is on the basics of hardware and software fault tolerant principles in computing systems, whereas that applicable to control systems is covered in Clause 1.2. Two ways in which fault tolerant designs can be developed are hardware technique and software technique. 

What should be covered in the safety specification The initial consideration will be to identily the safety-related systems and the safety-related functions. It is of course possible for the safety of some computer-controlled plant to be adequately ensured by conventional means, but it is more usual for at least some of the safety-related systems to be also programmable. These may be either control systems or protection systems which are specifically designed to come into operation in the event of a mishap or malfunction. It is highly desirable that wherever possible, control and protection systems are separated. This has the advantage that the amount of software affecting safety is minimized and also ensures that failure of the control system does not precipitate a consequent failure of its own protection system. Leveson 6 suggests several software control faults that may adversely affect system safety ... 

The situation proves to be completely different when it comes to computer installations. Experts are by no means agreed on which faults are to be considered likely and how faults can be avoided or remedied. The software - a completely new element in computer-controlled equipment -also raised new problems in the safety issue whereby only the checkability of the system and the ease of modification are to be mentioned here. 

The hardware and software used to implement LIMS systems must be vahdated. Computers and networks need to be examined for potential impact of component failure on LIMS data. Security concerns regarding control of access to LIMS information must be addressed. Software, operating systems, and database management systems used in the implementation of LIMS systems must be vahdated to protect against data cormption and loss. Mechanisms for fault-tolerant operation and LIMS data backup and restoration should be documented and tested. One approach to vahdation of LIMS hardware and software is to choose vendors whose products are precertified however, the ultimate responsibihty for vahdation remains with the user. Vahdating the LIMS system s operation involves a substantial amount of work, and an adequate vahdation infrastmcture is a prerequisite for the constmction of a dependable and flexible LIMS system. 

RISKMAN is an integrated Microsoft Windows , personal computer software system for [H. i forming quantitative risk analysis. Used for PSAs for aerospace, nuclear power, and chemical [iroccsses, it has five main modules Data Analysis, Systems Analysis, External Events Analysis, Event Tree Analysis, and Important Sequences. There are also modules for software system maintenance, backup, restoration, software updates, printer font, and page control. PEG has also integrated the fault tree programs CAFTA, SETS, NRCCUT, and IRRAS into RISKMAN. 

Live plant measurements will be fed to the model via the plant control computer. The model will then use the measurements and the target minimum gap to predict the alarm trigger point which will be communicated back to the control computer. This control computer is a conventional distributed control system (DCS), which has all the necessary software and displays for alarm handling and recording. The model itself will reside on a separate PC. Communications between the PC and the DCS will be subject to error checking and the system will default to the old fixed alarm value if a fault is detected. 

Software hazard analysis (SWHA) is a system safety analytical technique whose primary function is to systematically evaluate any potential faults in operating system and applications software requirements, codes, and programs as they may affect overall system operation. The purpose of the SWHA is to ensure that safety specifications and related operational requirements are accurately and consistently translated into computer software programs. In this regard, the analysis will verify that specific operational safety criteria, such as failsafe or fail-passive, have been properly assimilated into operational software. The SWHA will also identify and analyze those computer software programs, routines, or functions that may have direct control over or indirect influence on the safe operation of a given system. Also, in the operation of the computer software command function, there is a potential that the actual coded software may cause identified hazardous conditions to occur or inhibit a desired function, thereby creating additional hazard potential. 

Various types of ship-control systems are used in submarines. The ship-control system used in the Seawolf submarine represents the state of the art for such sysfems. This sysfem incorporates various features, including a fault-tolerant computer, automatic modes of control for steering, and flat-panel operator displays [23]. High-speed data buses permit the ship control to interface effectively with the data distrihution system, gyrocompass inertial sensors, and the combat system. Furthermore, hardware redundancy and performance-monitoring software permit the system to function after experiencing malfunctions of ship sensors, control electronics, and the actuation systems it controls. 

---