Master’s thesis deals with problems of maintenance of small transport aircraft with application MSG-3 methodology and maintenance plan development. It is aimed at systems and powerplant maintenance. This method is applied on L-410UVP-E20 aircraft. Other parts of this work are assessment of recent situation in maintenance of airplanes, used approaches to maintenance, methods and documentation for maintenance. Last part of this work is practical example of MSG-3 process on assign item and its interpretation.

Under de senaste årtionden har tågförseningar i järnvägen ökat allt mer i samband med en minskande driftsäkerhet. Orsaken till den låga driftsäkerheten kan kopplas till den ökade trafikmängden och eftersatta underhållsarbeten, det vill säga slitna spår som används alldeles för länge. Detta ökar därmed störningskänsligheten för fel som ger upphov av stopp i trafiken, vanligtvis benämns det som ett ”signalfel”. Ett signalfel handlar om ett fel som kan uppstå i en mängd olika komponenter inom signalanläggningen. Dessa har delats in i sex olika delar bestående av signalställverket, spårledningar, baliser, tågledningssystem, plankorsningar samt själva signalerna. Ett fel i någon av dess komponenter ger till följd att signalerna går till ett säkert läge vilket innebär ett stopp i trafiken. De orsaker och komponenter som bidrar till en låg driftsäkerhet i järnvägen lyfts fram i detta arbete för att upplysa om de problem som återfinns i järnvägen. Fokus har legat på att ta fram åtgärdsförslag på den komponent som bedöms känsligast i signalanläggningen. Resultatet visade på att fel som sker i signalanläggningen till störst del genereras av spårledningar. Inom spårledningar så är det mest förekommande felet överledningar av isolerskarvar, vilket bedöms vara den känsligaste komponenten i signalanläggningen. Detta gäller speciellt i Stockholmsområdet, där tågtrafiken är som tätast och störningar påverkar ett stort antal resenärer. Åtgärderna som utförs för spårledningsfel är främst kortsiktiga lösningar såsom rensningar, kontroller eller ingen åtgärd alls. Oftast utförs lösningarna först efter att fel har uppstått, vilket innebär att ”signalfel” och dess konsekvenser redan har påverkat trafiken. För att höja driftsäkerheten krävs ett mer aktivt och effektivt underhållsarbete. Satsningar på innovativa lösningar och åtgärdsförslag bör utföras i syfte att minska frekvensen för störningar. / During the past decades, the railway train delays have increased greatly associated with a decreasing reliability. The cause of the low reliability can be connected to the increased amount of traffic and the lagging maintenance, that is to say worn track that remains too long. This thereby increases sensitivity to disturbance of the fault that causes stop in the traffic, usually termed it as a 'signal failure'. A signal failure is an error that can occur in a variety of components within the signalling system. These have been divided into six different parts consisting of signalling control, track circuits, beacons, train control systems, level crossings and signals themselves. An error in one of its components gives the result that the signals go to a safe state, which means a halt in traffic. The causes and components that contribute to a low reliability of the railways are highlighted in this work to raise awareness of the problems found in the railway. The focus has been on developing action proposals on the component that is deemed most sensitive in the signaling system. The results showed that errors occurring in the signaling system are mostly generated by the track circuits. The most common error in track circuits is the occurrence of conduction on the insulated joints, which is judged as the most sensitive component in the signalling system. This is especially true in the Stockholm area, which is where the train traffic is as most dense and where disturbances affect a large number of travelers. Actions performed on track circuit faults are mainly short-term solutions such as cleansing, checks and no actions at all. Solutions usually performs after error has occurred, which means that signalling failure and its consequences already has affected the traffic. In order to increase the reliability it requires a more active and effective maintenance work. Investments in innovative solutions and action proposals should be performed in order to reduce the frequency of disturbances.

Depuis l'introduction au début des années 2000 du standard ARINC 661 (définissant les interfaces graphiques dans les cockpits), les avions modernes, tels que l'A380, l'A350 ou le B787, intègrent des systèmes interactifs permettant à l'équipage d'interagir avec des applications interactives. Ces applications sont affichées sur des écrans à travers l'utilisation d'un dispositif similaire à un clavier et une souris. Pour des raisons d'exigences de sûreté de fonctionnement, l'utilisation de ces systèmes est limitée, à l'heure actuelle, à la commande et au contrôle de fonctions avioniques non critiques. Cependant, l'utilisation de ces systèmes dans les cockpits d'avions civils apporte de nombreux avantages (tels qu'une amélioration de l'évolutivité du cockpit) qui amènent les industriels à chercher comment l'étendre à la commande et le contrôle de systèmes avioniques critiques. Dans cette optique, nous proposons une approche duale et homogène de prévention et de tolérance aux fautes pour concevoir et développer des systèmes interactifs tolérants aux fautes. Celle-ci repose, dans un premier temps, sur une approche à base de modèles permettant de décrire de manière complète et non ambiguë les composants logiciels des systèmes interactifs et de prévenir les fautes logicielles de développement. Dans un second temps, elle repose sur une approche de tolérance aux fautes naturelles et certaines fautes logicielles résiduelles en opération, grâce à la mise en œuvre d'une solution architecturale fondée sur le principe des composants autotestables. Les contributions de la thèse sont illustrées sur une étude de cas de taille industrielle : une application interactive inspirée du système de commande et contrôle de l'autopilote de l'A380. / Since the introduction of the ARINC 661 standard (that defines graphical interfaces in the cockpits) in the early 2000, modern aircrafts such as the A380, the A350 or the B787 possess interactive systems. The crew interacts, through physical devices similar to keyboard and mouse, with interactive applications displayed on screens. For dependability reasons, only non-critical avionics systems are managed using such interactive systems. However, their use brings several advantages (such as a better upgradability), leading aircraft manufacturers to generalize the use of such interactive systems to the management of critical avionics functions. To reach this goal, we propose a dual and homogeneous fault prevention and fault tolerance approach. Firstly, we propose a model-based approach to describe in a complete and unambiguous way interactive software components to prevent as much as possible development software faults. Secondly, we propose a fault tolerant approach to deal with operational natural faults and some residual software faults. This is achieved through the implementation of a fault tolerant architecture based on the principle of self-checking components. Our approach is illustrated on a real size case study: an interactive application based on the command and control system of the A380 autopilot.

The doctoral thesis deals with reliability (dependability) analyses of operation and testing data of the Airplanes. Requirements of airworthiness regulations on aircraft hydraulic systems (with a focus on US FAR-23 and European CS-23 regulations) are taken into account. Mentioned regulations include requirements for the structural design, design of systems, etc. They cover wide range of airplanes from small sport airplanes to 19-seats transport aircraft. Also options for predictive reliability analyses (resources) and reliability tests are discussed in the doctoral thesis. Practical application is done on small transport airplane (currently in the development). The failure report is designed. Expected major contribution of the work is selection and practical application of the most suitable procedures for safety assessment on the field of aircraft hydraulic systems, with a focus on the small transport aircraft. Also the comparison to different data source is shown.

Due to the usage of complicated platforms and current high-performance space computing technology, onboard processing in small satellites is expanding. Space-cloud payload processors with Commercial Off-The-Shelf (COTS) components, that are required to be radiation-tolerant, are used to perform the onboard processing. In this thesis, the research will aim to increase the dependability of a generic space-cloud payload processor through its Solid State Drive (SSD) storage unit. To achieve this, a more dependable NAND-flash-based SSD Redundant Array of Independent Disc (RAID) storage system is designed and tested. The reliability of NAND-flash-based SSDs can suffer wear-outs due to increased Program/Erase (P/E) cycles, making them more prone to radiation effects. These radiation effects are considered non-destructive events in the form of bit errors (both single bit-flip and multiple bit-flips). Therefore, making the storage system more dependable involves increasing its reliability against non-destructive events and developing analytical models that account for the considered dynamic of the SSD RAID. The challenge that comes with achieving the aim of this thesis is twofold. First, to explore different RAID levels such that a combination of RAID levels can be incorporated into one SSD for better reliability than a RAID-1 setup. Hence, in this thesis, a RAID array of several SSDs is not considered. Furthermore, the combinations of RAID levels need to account for mixed-critical data. Second, to demonstrate, via simulation and analytical models, the impact on the reliability of the storage system. A comparison study is also undertaken due to the support that the Fourth Extended (Ext4) file system or Zettabyte File System (ZFS) may give to enhance the storage system, and since little research exists that compares the file systems in some feature categories. The solution is a RAID-5 + 6 storage system that is Error Detection And Correction (EDAC) protected by Hamming codes and Reed Solomon (RS) codes. Low-critical data is stored using RAID-5 whereas high-critical data is stored using RAID-6. The simulation of the storage system proves that low-critical stripes of data achieve single fault tolerance whereas high-critical stripes of data tolerate a maximum of 5-bit burst errors. In parallel, several Continuous Time Markov Chain (CTMC) models are analysed, which show that the proposed solution is indeed highly reliable. The comparison study is carried out in a systematic way, and the findings are established as substantial,i.e., ZFS provides greater storage system support. In summary, the results of creating the storage system and analysing it suggest that incorporating RAID-5 and RAID-6 offers better SSD RAID reliability than RAID-1. / Användningen av komplicerade plattformar och aktuell högpresterande rymdberäkningsteknik expanderar onboard-processing i små satelliter. Space-Cloud lösningar med kommersiellt tillgängliga komponenter som är toleranta mot strålningar i rymden används för att utföra onboard-processing. I detta examensarbete syftar forskningen till att förbättra tillförlitligheten hos en generisk rymd dator genom dess SSD-lagringsenhet. För att uppnå detta har ett mer tillförlitligt lagringssystem bestående av NAND-flash och RAID designats och testats. Tillförlitligheten hos NAND-flash-baserade SSD:er kan försämras då dessa kan drabbas av slitage på grund av ökade P/E cykler, vilket gör dem mer benägna för strålningseffekter. Dessa strålningseffekter anses vara icke-destruktiva i form av bit-fel (både enskilda bit-flippar och flera bit-flippar). Med denna anledning görs lagringssystemet mer tillförlitligt för att tolerera icke-destruktiva händelser. Utöver detta, utvecklas analytiska modeller som tar hänsyn till den betraktade dynamiken i SSD RAID. Utmaningen som följer med att uppnå syftet med denna avhandling är tvådelad. För det första, för att utforska olika RAID-nivåer så att en kombination av RAID-nivåer kan inkorporeras i en SSD för bättre tillförlitlighet än RAID-1. Således övervägs inte en RAID-array av flera SSD:er i denna avhandling. Dessutom måste kombinationerna av RAID-nivåer ta hänsyn till data av olika kritikalitet. För det andra, för att genom simulering och analytiska modeller indikera påverkan på lagringssystemets tillförlitlighet. En jämförelsestudie genomförs också på grund av stödet som filsystemen Ext4 eller ZFS kan ge för att förbättra lagringssystemet och eftersom det finns lite forskning som jämför filsystemen i några funktionella kategorier. Lösningen baseras på ett RAID-5+6 lagringssystem som är skyddat av Hamming-koder och RS koder för att upptäcka fel och korrigera dem. Lågkritisk data lagras med RAID-5 medan högkritisk data lagras med RAID-6. Simuleringen av lagringssystemet visar att lågkritiska datasektioner uppnår en fel tolerans mot enskilda bit-flippar medan högkritiska datasektioner kan tåla maximalt 5 bit-flippar. Samtidigt analyseras flera CTMC modeller som visar att den föreslagna lösningen verkligen är mycket tillförlitlig. Jämförelsestudien utförs på ett systematiskt sätt och resultaten fastställs som betydande, det vill säga att ZFS ger större stöd för lagringssystemet. Sammanfattningsvis antyder resultaten av att skapa lagringssystemet och analysera det att inkorporering av RAID-5 och RAID-6 erbjuder bättre tillförlitlighet för SSD RAID än RAID-1.

No description available.

Military Strategy is defined as a plan at the military strategic level of war that consists of a set of military strategic ends, ways and means and the relationships between them. This definition leads to the following research questions: 1. How can the extent of the many-to-many relationships that exist between a military strategy, its ends, ways and means be quantified? 2. If the relationships between a military strategy, its ends, ways and means are quantified and if the effectiveness of the force design elements is known, how shall that enable the quantification of the state’s ability to execute its military strategy? 3. If the relationships between a military strategy, its ends, ways and means are quantified and if the effectiveness of the force design elements is known, how will it aid decision-making about the acquisition of the future force design? The first research question is answered by mapping a military strategy complete with its ends, ways and means to a ranked tree where the entities in the strategy corresponds with the vertices of different rank in the tree. The tree representation is used to define and determine the contribution of entities in a military strategy to entities at the next higher level. It is explained how analytical, heuristic and judgement methods can be employed to find the relative and real contribution values. Also, a military strategy for South Africa is developed to demonstrate the concept. The second research question is answered by developing measures of effectiveness taking the interdependence of entities at the terminal vertices of the ranked tree into account. Thereafter, the degree to which the force design would support the higher order entities inclusive of a military strategy could be calculated. The third research question is answered by developing a cost-benefit analysis method and a distance indicator from an optimal point to aid in deciding between supplier options for acquisition. Thereafter the knapsack problem is amended to allow for scheduling acquisition projects whilst optimising the force design's support of a military strategy. Finally, the model is validated and put into a contextual framework for use in the military. / Quantitative management / D.Phil.

Dans le transport ferroviaire, le coût et la disponibilité du matériel roulant sont des questions majeures. Pour optimiser le coût de maintenance du système de transport ferroviaire, une solution consiste à mieux détecter et diagnostiquer les défaillances. Actuellement, les architectures de surveillance/diagnostic centralisées atteignent leurs limites et imposent d'innover. Cette innovation technologique peut se matérialiser par la mise en oeuvre d’architectures embarquées de surveillance/diagnostic distribuées et communicantes afin de détecter et localiser plus rapidement les défaillances et de les valider dans le contexte opérationnel du train. Les présents travaux de doctorat, menés dans le cadre du FUI SURFER (SURveillance active Ferroviaire) coordonné par Bombardier, visent à proposer une démarche méthodologique d’évaluation de la sûreté de fonctionnement d’architectures de surveillance/diagnostic. Pour ce faire, une caractérisation et une modélisation génériques des architectures de surveillance/diagnostic basée sur le formalisme des Réseaux de Petri stochastiques ont été proposées. Ces modèles génériques intègrent les réseaux de communication (et les modes de défaillances associés) qui constituent un point dur des architectures de surveillance/diagnostic retenues. Les modèles proposés ont été implantés et validés théoriquement par simulation et une étude de sensibilité de ces architectures de surveillance/diagnostic à certains paramètres influents a été menée. Enfin, ces modèles génériques sont appliqués sur un cas réel du domaine ferroviaire, les systèmes accès voyageurs des trains, qui sont critiques en matière de disponibilité et diagnosticabilité. / In the railway transport, rolling stock cost and availability are major concern. To optimise the maintenance cost of the railway transport system, one solution consists in better detecting and diagnosing failures. Today, centralized monitoring/diagnosis architectures reach their limits. Innovation is therefore necessary. This technological innovation may be implemented with embedded distributed and communicating monitoring/diagnosis architectures in order to faster detect and localize failures and to make a validation with respect to the train operational context.The present research work, carried out as part of the SURFER FUI project (french acronym standing for railway active monitoring) lead by Bombardier, aim to propose a methodology to assess dependability of monitoring/diagnosis architectures. To this end, a caracterisation et une modélisation génériques des monitoring/diagnosis architectures based on the stochastic Petri Nets have been proposed. These generic models take into account communication networks (and the associated failure modes), which constitutes a central point of the studied monitoring/diagnosis architectures. The proposed models have been edited and theoretically validated by simulation. A sensitiveness of the monitoring/diagnosis architectures to parameters has been studied. Finally, these generic models have applied to a real case of the railway transport, train passenger access systems, which are critical in term of availability and diagnosability.

La recherche de solutions analytiques pour l’évaluation de la fiabilité en contexte dynamique n’est pas résolue dans le cas général. Un état de l’art présenté dans le chapitre 1 montre que des approches partielles relatives à des hypothèses particulières existent. La simulation de Monte Carlo serait le seul recours, mais il n’existait pas d’outils performants permettant la simulation simultanée de l’évolution discrète du système et de son évolution continue prenant en compte les aspects probabilistes. Dans ce contexte, dans le chapitre 2, nous introduisons le concept d’automate stochastique hybride capable de prendre en compte tous les problèmes posés par la fiabilité dynamique et d’accéder à l’évaluation des grandeurs de la sûreté de fonctionnement par une simulation de Monte Carlo implémentée dans l’environnement Scilab-Scicos. Dans le chapitre 3, nous montrons l’efficacité de notre approche de simulation pour l’évaluation de la sûreté de fonctionnement en contexte dynamique sur deux cas test dont un est un benchmark de la communauté de la Sûreté de Fonctionnement. Notre approche permet de répondre aux problèmes posés, notamment celui de la prise en compte de l’influence de l’état discret, de l’état continu et de leur interaction dans l’évaluation probabiliste des performances d’un système dans lequel en outre, les caractéristiques fiabilistes des composants dépendent eux-mêmes des états continu et discret. Dans le chapitre 4, nous donnons une idée de l’intérêt du contrôle par supervision comme moyen de la sûreté de fonctionnement. Les concepts d’automate observateur et de contrôleur ont été introduits et illustrés sur notre cas test afin de montrer leur potentialité / The research of analytical solutions for reliability assessment in dynamic context is not solved in the general case. A state of the art presented in chapter 1 shows that partial approaches exist in the case of particular hypothesis. The Monte Carlo simulation would be the only recourse, but there were no tools allowing the simultaneous simulation of the discrete evolution of the system and its continuous evolution taking into account the probabilistic aspects. In this context, in chapter 2, we introduce the concept of hybrid stochastic automaton capable of taking into account all the problems posed by dynamic reliability and to accede to the assessment of dependability parameters by a Monte Carlo simulation implemented in Scicos-Scilab environment. In chapter 3, we show the effectiveness of our approach of simulation for dependability assessment in dynamic context through two test cases of which case one is a benchmark of dependability community. Our approach responds to the posed problems, notably the consideration of the influence of the discrete state, of the continuous state and their interaction, in the probabilistic assessment of the performances of a system in which besides, the reliability characteristics of components depend themselves of the continuous and discrete states. In chapter 4, we give an idea of the interest of control by supervision as a means of dependability. The concepts of observer automaton and of controller have been introduced and illustrated on our test case in order to show their potential

Les logiciels s'orientent de plus en plus vers des architectures évolutives, capables de s'adapter facilement aux changements et d'intégrer de nouvelles fonctionnalités. Ceci est important pour plusieurs classes d'applications qui ont besoin d‘évoluer sans que cela implique d'interrompre leur exécution. Des plateformes dynamiques à composants autorisent ce type d'évolution à l'exécution, en permettant aux composants d'être chargés et exécutés sans requérir le redémarrage complet de l'application en service. Toutefois, la flexibilité d'un tel mécanisme introduit de nouveaux défis qui exigent de gérer les possibles erreurs dues à des incohérences dans le processus de mise à jour, ou en raison du comportement défectueux de composants survenant pendant l'exécution de l'application. Des composants tiers dont l'origine ou la qualité sont inconnus peuvent être considérées à priori comme peu fiables, car ils peuvent potentiellement introduire des défauts d'applications lorsqu'il est combiné avec d'autres composants. Nous sommes intéressés à la réduction de l'impact de ces composants considérés comme non fiables et qui sont susceptibles de compromettre la fiabilité de l'application en cours d'exécution. Cette thèse porte sur l'application de techniques pour améliorer la fiabilité des applications dynamiques à composants. Pour cela, nous proposons l'utilisation des frontières d'isolation pouvant fournir du contingentement de fautes. Le composant ainsi isolé ne perturbe pas le reste de l'application quand il est défaillant. Une telle approche peut être vu sous trois perspectives présentées: (i) l'isolement des composants dynamiques, régi par une politique d'exécution reconfigurable, (ii) l'autoréparation de conteneurs d‘isolement, et (iii) l'utilisation des aspects pour séparer les préoccupations de fiabilité à partir du code fonctionnel. / Software is moving towards evolutionary architectures that are able to easily accommodate changes and integrate new functionality. This is important in a wide range of applications, from plugin-based end user applications to critical applications with high availability requirements. Dynamic component-based platforms allow software to evolve at runtime, by allowing components to be loaded, and executed without forcing applications to be restarted. However, the flexibility of such mechanism demands applications to cope with errors due to inconsistencies in the update process, or due to faulty behavior from components introduced during execution. This is mainly true when dealing with third-party components, making it harder to predict the impacts (e.g., runtime incompatibilities, application crashes) and to maintain application dependability when integrating such third-party code into the application. Components whose origin or quality attributes are unknown could be considered as untrustworthy since they can potentially introduce faults to applications when combined with other components, even if unintentionally. The quality of components is harder to evaluate when components are combined together, especially if it happens on-the-fly. We are interested in reducing the impact that can be brought by untrustworthy components deployed at runtime and that would potentially compromise application dependability. This thesis focuses on applying techniques for moving a step forward towards dependable dynamic component-based applications by addressing different dependability attributes namely reliability, maintainability and availability. We propose the utilization of strong component isolation boundaries, by providing a fault-contained environment for separately running untrustworthy components. Our solution combines three approaches: (i) the dynamic isolation of components, governed by a runtime reconfigurable policy; (ii) a self-healing component isolation container; and (iii) the usage of aspects for separating dependability concerns from functional code.