Motivée par les besoins du domaine spatial en termes de diagnostic embarqué et d’autonomie, cette thèse s’intéresse aux problèmes de diagnostic, de diagnosticabilité et de diagnostic actif des systèmes hybrides. Un formalisme hybride est proposé pour représenter les deux dynamiques, continues et discrètes, du système. En s’appuyant sur ce modèle, une approche de diagnostic passif est proposée en mariant les techniques des systèmes à événements discrets et des systèmes continus. Un cadre formel pour la diagnosticabilité des systèmes hybrides a également été établi proposant des définitions et des critères pour la diagnosticabilité hybride. Suite à un diagnostic passif ambigu, le diagnostic actif est nécessaire afin de désambiguïser l’état du système. Cette thèse propose donc une approche de diagnostic actif, qui partant d’un état de croyance incertain, fait appel aux propriétés de diagnosticabilité du système pour déterminer la configuration où les fautes peuvent être discriminées. Une nouvelle machine à états finis appelée diagnostiqueur actif est introduite permettant de formaliser le diagnostic actif comme un problème de planification conditionnelle. Un algorithme d’exploration de graphes ET-OU est proposé pour calculer les plans de diagnostic actif. Finalement, l’approche de diagnostic a été testée sur le Système de Contrôle d’Attitude (SCA) d’un satellite de Thales Alenia Space. Le module de diagnostic a été intégré dans la boucle fermée de commande. Des scénarios de faute ont été testés donnant des résultats très satisfaisants. / Motivated by the requirements of the space domain in terms of on-board diagnosis and autonomy, this thesis addresses the problems of diagnosis, diagnosability and active diagnosis of hybrid systems. Supported by a hybrid modeling framework, a passive approach for model-based diagnosis mixing discrete-event and continuous techniques is proposed. The same hybrid model is used to define the diagnosability property for hybrid systems and diagnosability criteria are derived. When the diagnosis provided by the passive diagnosis approach is ambiguous, active diagnosis is needed. This work provides a method for performing such active diagnosis. Starting with an ambiguous belief state, the method calls for diagnosability analysis results to determine a new system configuration in which fault candidates can be discriminated. Based on a new finite state machine called the diagnoser, the active diagnosis is formulated as a conditional planning problem and an AND-OR graph exploration algorithm is proposed to determine active diagnosis plans. Finally, the diagnosis approach is tested on the Attitude Control System (ACS) of a satellite simulator provided by Thales Alenia Space. The diagnosis module is successfully tested on several fault scenarios and the obtained results are reported.

Panna 6 på Högdalenverket i södra Stockholm (P6) med tillhörande ångturbin producerar kraftvärme genom förbränning av utsorterat returbränsle från industri och samhälle. För att minimera underhållskostnader och öka anläggningens tillgänglighet är det viktigt att fel och oönskat processbeteende kan upptäckas i ett tidigt skede. I detta syfte testas här en metod för detektering av avvikande händelser med hjälp av principalkomponentanalys (PCA) på produktionsprocessen för kraftvärme. En PCA-modell med reducerad dimension skapas utifrån processdata från en problemfri driftperiod och används som mall för inkommande data att jämföras med i ett kontrolldigram. Avvikelser ifrån modellen bör vara en indikation på att ett onormalt drifttillstånd har uppkommit och orsaker till avvikelsen analyseras. Som avvikande händelse testas två fall av tubläckage som uppstod i ett av tubpaketen för kylning av rökgaserna under 2014 och 2015. Resultatet visar att processavvikelser ifrån normallägesmodellerna tydligt syns i kontrolldiagrammen vid båda tubläckagen och avvikelserna kan härledas till variabler som är kopplade till tubläckage. Det finns potential för att tillämpa metoden för övervakning av processen, en svårighet ligger i att skapa en modell som representerar processen när den är stabil på grund av att det finns många varierande driftfall som anses stabila, detta kräver vidare arbete. Metoden kan redan användas som analysverktyg exempelvis vid misstanke om tubläckage. / Boiler 6 at the Högdalen facility in southern Stockholm (P6) combined with a a steam turbine produces Combined Heat and Power (CHP) through combustion of treated industry waste. In order to minimise maintenance costs and increase plant availability it is of importance to detect process faults and deviations at an early state. In this study a method for outlier detection using Principal Component Analysis (PCA) is applied on the CHP production process. A PCA model with reduced dimension is created using process data from a problem free period and is used as a template for new operating data to be compared with in a control chart. Deviations from the model should be an indication of the presence of abnormal conditions and the reasons for the deviations are analysed. Two cases of tube failure in 2014 and 2015 are used to study the deviations. The result shows that process deviations from the models can be detected in the control chart in both cases of tube failure and the variables known to be associated with tube failure contributes highly to the deviating behaviour. There is potential for applying this method for process control, a difficulty lies in creating a model that represents the stable process when there are big variances within what is considererd a stable process state. The method can be used for data analysis when suspecting a tube failure.

The need for efficiency, reliability and continuous operation has lead over the years to the development of fault-tolerant electrical drives for various industrial purposes and for transport applications. Permanent-magnet synchronous machines have also been gaining interest due to their high torque-to-mass ratio and high efficiency, which make them a very good candidate to reduce the weight and volume of the equipment.<p><p>In this work, a multidisciplinary approach for the design of fault-tolerant permanent-magnet synchronous machine drives is presented. <p><p>The drive components are described, including the electrical machine, the IGBT-based two-level inverter, the capacitors, the sensors, the controller, the electrical source and interfaces. A literature review of the failure mechanisms and of the reliability model of most of these components is performed. This allows understanding how to take benefit of the redundancy generally introduced in fault-tolerant systems.<p><p>A necessary step towards fault tolerance is the modelling of the electrical drive, both in healthy and faulty operations. A general model of multi-phase machines (with a number of phases equal to or larger than three) and associated converters is proposed. Next, control algorithms for multi-phase machines are derived. The impact of a closed-loop controller upon the occurrence of faults is also examined through simulation analysis and verified by experimental results.<p><p>Condition monitoring of electrical machines has expanded these last decades. New techniques relying on various measurements have emerged, which allow a better planning of maintenance operations and an optimization of the uptime of electrical machines. Regarding drives, a number of sensors are inherently present for control and basic protection functions. The utilization of these sensors for advanced condition monitoring is thus particularly interesting since they are available at no cost. <p><p>A novel fault detection and isolation scheme based on the available measurements (phase currents, DC-link voltage and mechanical position) is developed and validated experimentally. Change-detection algorithms are used for this purpose. Special attention is paid to sensor faults as well, what avoids diagnosis errors.<p><p>Fault-tolerant control can be implemented with passive and active approaches. The former consists in deriving a control scheme that gives acceptable performance for all operating conditions, including faulty conditions. The latter consists in applying dedicated solutions upon the occurrence of faults, i.e. by reconfiguring the control. Both approaches are investigated and implemented. <p><p>Finally, design considerations are discussed throughout the thesis. The advantages and drawbacks of various topologies are analyzed, which eventually leads to the design of a five-phase fault-tolerant permanent-magnet synchronous machine. / Doctorat en Sciences de l'ingénieur / info:eu-repo/semantics/nonPublished

Cette thèse a pour objectif de démontrer l'intérêt des outils de diagnostic "intelligents" pour application sur les moteurs de fusée. En Europe beaucoup d'efforts ont été faits pour développer quelques techniques innovantes comme les réseaux neuronaux, les méthodes de suivi de raie vibratoire, ou l'identification paramétrique mais peu de résultats sont disponibles quant à la comparaison des performances de différents algorithmes. Un deuxième objectif de la thèse a été celui d'améliorer le système de diagnostic du banc d'essai Mascotte (ONERA/CNES). Il s'agit d'un banc de démonstration pour les moteurs de fusée de type cryogénique représentatif des conditions d'utilisation d'un vrai moteur. Les étapes de la thèse ont été en premier lieu de choisir et d'évaluer des méthodes de diagnostic à base de modèles, en particulier l'identification paramétrique et le filtre de Kalman, et de les appliquer pour le diagnostic d'un système critique du banc Mascotte: le circuit de refroidissement. Après une première validation des nouveaux algorithmes sur des données d'essais disponibles, un benchmark fonctionnel a été mis en place pour pouvoir comparer les performances des algorithmes sur différents types de cas de panne simulés. La dernière étape consiste à intégrer les algorithmes sur les ordinateurs du banc de contrôle de Mascotte pour pouvoir effectuer une évaluation applicative des performances et de leur intégrabilité à l'environnement informatique déjà en place. Un exemple simple de boucle de régulation intégrant l’information du diagnostic est aussi étudié pour analyser l’importance de telles méthodes dans le contexte plus large d’une régulation « intelligente » du banc. / The main objective of this work is to demonstrate and analyze the potential benefits of advanced real time algorithms for rocket engines monitoring and diagnosis. In the last two decades in Europe many research efforts have been devoted to the development of specific diagnostic technics such as neural networks, vibration analysis or parameter identification but few results are available concerning algorithms comparison and diagnosis performances analysis.Another major objective of this work has been the improvement of the monitoring system of the Mascotte test bench (ONERA/CNES). This is a cryogenic test facility based in ONERA Palaiseau used to perform analysis of cryogenic combustion and nozzle expansion behavior representative of real rocket engine operations.The first step of the work was the selection of a critical system of the bench, the water cooling circuit, and then the analysis of the possible model based technics for diagnostic such as parameter identification and Kalman filters.Three new algorithms were developed, after a preliminary validation based on real test data, they were thoroughly analyzed via a functional benchmark with representative failure cases.The last part of the work consisted in the integration of the diagnosis algorithms on the bench computer environment in order to prepare a set-up for a future real time application.A simple closed loop architecture based on the new diagnostic tools has been studied in order to assess the potential of the new methods for future application in the context of intelligent bench control strategies.

The deals of thesis were described methods for designing safety applications, made analysis of possible microcontroller faults of long-run system, described software and hardware methods for fault detection in microcontroller and applied some March test to microcontroller. To application were chosen MATS+, PMOVI and March SS tests. These tests were modified to word-oriented memory. Further it was made analysis of modified tests to determination fault coverage, testing times and program memory requirement. To determination of fault coverage was created virtual memory with fault function models. March tests were compared with each other and with another pattern test (checkboard test).

Diplomová práce je zaměřena na problematiku analýzy signálů za účelem detekce poruchového oblouku, přičemž analýza signálů je prováděna v časové, frekvenční a smíšené časově-frekvenční oblasti. Práce stručně shrnuje existující normy pro zařízení pro detekci poruchového oblouku. Práce dokumentuje testy a měření, které byly realizovány v souladu s normami IEC 62606:2013 a UL 1699B. Z důvodu nedostatečnosti stávajících norem je v práci popsána nová metoda iniciace poruchového oblouku. naměřená data byla analyzována s využitím rychlé Fourierovy transformace, krátkodobé Fourierovy transformace a vlnkové transformace. Na základě provedeného literárního průzkumu a s využitím výsledků provedených analýz signálu je v práci proveden návrh nové detekční metody pro účely detekce poruchového oblouku v systémech napájených střídavým i stejnosměrným napětím.

It is a fact that software has bugs. These bugs can lead to failures. Especially dependability and security failures are a great threat to software users. This thesis introduces four novel approaches that can be used to automatically harden software at the user's site. Automatic hardening removes bugs from already deployed software. All four approaches are automated, i.e., they require little support from the end-user. However, some support from the software developer is needed for two of these approaches. The presented approaches can be grouped into error toleration and bug removal. The two error toleration approaches are focused primarily on fast detection of security errors. When an error is detected it can be tolerated with well-known existing approaches. The other two approaches are bug removal approaches. They remove dependability bugs from already deployed software. We tested all approaches with existing benchmarks and applications, like the Apache web-server.:1 Introduction 1 1.1 Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 1.2 Automatic Hardening . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1.3 Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 1.4 Theses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 2 Enforcing Dynamic Personalized System Call Models 9 2.1 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 2.2 SwitchBlade Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 2.3 System Call Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 2.3.1 Personalization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 2.3.2 Randomization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 2.4 Model Learner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 2.4.1 Problem: False Positives . . . . . . . . . . . . . . . . . . . . . . . . 22 2.4.2 Data- ow-Based Learner . . . . . . . . . . . . . . . . . . . . . . . . 26 2.5 Taint Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 2.5.1 TaintCheck . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 2.5.2 Escaping Valgrind . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 2.5.3 Replay of Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 2.6 Model Enforcement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 2.6.1 Loading the System Call Model . . . . . . . . . . . . . . . . . . . . 31 2.6.2 Checking System Calls . . . . . . . . . . . . . . . . . . . . . . . . . 31 2.7 Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 2.7.1 Synthetic Exploits . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 2.7.2 Apache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 2.7.3 Exploits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 2.7.4 Micro Benchmarks . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 2.7.5 Model Size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 2.7.6 Stateful Application . . . . . . . . . . . . . . . . . . . . . . . . . . 39 2.8 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 3 Speculation for Parallelizing Runtime Checks 43 3.1 Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 3.1.1 Compiler Infrastructure . . . . . . . . . . . . . . . . . . . . . . . . 47 3.1.2 Runtime Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 3.2 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 3.3 Deterministic Replay and Speculation . . . . . . . . . . . . . . . . . . . . . 52 3.3.1 Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 3.3.2 Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 3.4 Switching Code Bases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 3.4.1 Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 3.4.2 Integration with parexc chkpnt . . . . . . . . . . . . . . . . . . 58 3.4.3 Code Transformations . . . . . . . . . . . . . . . . . . . . . . . . . 59 3.4.4 Stack-local Variables . . . . . . . . . . . . . . . . . . . . . . . . . . 67 3.5 Speculative Variables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 3.5.1 Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 3.5.2 Deadlock Avoidance . . . . . . . . . . . . . . . . . . . . . . . . . . 69 3.5.3 Storage Back-ends . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 3.6 Parallelized Checkers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 3.6.1 Out-of-Bounds Checks . . . . . . . . . . . . . . . . . . . . . . . . . 70 3.6.2 Data Flow Integrity Checks . . . . . . . . . . . . . . . . . . . . . . 71 3.6.3 FastAssert Checker . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 3.6.4 Runtime Checking in STM-Based Applications . . . . . . . . . . . . 72 3.7 Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 3.7.1 Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 3.7.2 Checking Already Parallelized Applications . . . . . . . . . . . . . . 77 3.7.3 ParExC Overhead . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 3.8 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 4 Automatically Finding and Patching Bad Error Handling 83 4.1 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 4.2 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 4.3 Learning Library-Level Error Return Values from System Call Error Injection 89 4.3.1 Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 4.3.2 E cient Error Injection . . . . . . . . . . . . . . . . . . . . . . . . 91 4.3.3 Obtain OS Error Specification . . . . . . . . . . . . . . . . . . . . . 92 4.4 Finding Bad Error Handling . . . . . . . . . . . . . . . . . . . . . . . . . . 92 4.4.1 Argument Recording . . . . . . . . . . . . . . . . . . . . . . . . . . 93 4.4.2 Systematic Error Injection . . . . . . . . . . . . . . . . . . . . . . . 94 4.4.3 Static Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 4.5 Fast Error Injection using Virtual Machines . . . . . . . . . . . . . . . . . 99 4.5.1 The fork Approach . . . . . . . . . . . . . . . . . . . . . . . . . . 100 4.5.2 Virtual Machines for Fault Injection . . . . . . . . . . . . . . . . . . 101 4.6 Patching Bad Error Handling . . . . . . . . . . . . . . . . . . . . . . . . . 102 4.6.1 Error Value Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . 103 4.6.2 Preallocation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 4.6.3 Patch Generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 4.7 Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 4.7.1 Measurements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 4.8 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 5 Robustness and Security Hardening of COTS Software Libraries 117 5.1 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 5.2 Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 5.3 Test Values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 5.3.1 Ballista Type System . . . . . . . . . . . . . . . . . . . . . . . . . . 123 5.3.2 Meta Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 5.3.3 Feedback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 5.3.4 Type Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 5.3.5 Type Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . 128 5.3.6 Reducing the Number of Test Cases . . . . . . . . . . . . . . . . . . 128 5.3.7 Other Sources of Test Values . . . . . . . . . . . . . . . . . . . . . . 130 5.4 Checks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 5.4.1 Check Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 5.4.2 Parameterized Check Templates . . . . . . . . . . . . . . . . . . . . 133 5.5 Protection Hypotheses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 5.5.1 Minimizing the Truth Table . . . . . . . . . . . . . . . . . . . . . . 134 5.5.2 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 5.6 Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 5.6.1 Coverage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 5.6.2 Autocannon as Dependability Benchmark . . . . . . . . . . . . . . 138 5.6.3 Protection Hypotheses . . . . . . . . . . . . . . . . . . . . . . . . . 139 5.7 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 6 Conclusion 143 6.1 Publications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 References 147 List of Figures 159 List of Tables 163 Listings 165

Unmanned, as well as manned space missions have seen a high failure rate in the early era of space technology. However, this decreased a lot since technology advanced and engineers learnt from previous experiences and improved critical real time systems with fault detection mechanisms. Fault detection, isolation and recovery, nowadays, is generally available in every flying device. However, the cost of hardware can bottleneck the process of creating such a system that is both robust and responsive. This thesis analyses the possibility of implementing a fault detection, isolation and recovery system inside of a single-threaded, cooperative scheduling operating system. The thesis suggests a cooperative implementation of such a system, where every task is responsible for parts of the fault detection. The analysis is done from both the integration layer, across the operating system and its tasks, as well as from the inside of the detection system, where two key components are implemented and analyzed: debug telemetry and operation modes. Results show that it is possible to implement a fault detection system that is spread across all the components of the satellite and acts cooperatively. Furthermore, the comparison with a traditional, dedicated fault detection system proves that errors can be caught faster with a cooperative mechanism. / Obemannade såväl som bemannade rymduppdrag har sett ett högt misslyckande i rymdteknikens tidiga era. Detta har dock förbättrats mycket sedan ingenjörer började lära sig av sina tidigare erfarenheter och utrustade kritiska realtidssystem med feldetekteringsmekanismer. Idag är alla flygande enheter utrustade med feldetekterings-, isolerings- och återställningsmekanismer. Däremot kan kostnaden för hårdvara vara ett problem för processen att skapa ett sådant system som är både robust och mottagligt. Denna uppsats analyserar möjligheten att implementera ett feldetekterings-, isolerings- och återställningssystem inuti ett enkelgängat samarbetsplaneringssystem. Denna uppsats föreslår ett samarbete för implementering av ett sådant system, där varje uppgift ansvarar för delar av feldetekteringen. Analysen görs från både integrationsskiktet, över operativsystemet och dess uppgifter, samt från insidan av detekteringssystemet, där två nyckelkomponenter implementeras och analyseras. Resultaten visar att det är möjligt att implementera ett feldetekteringssystem som täcker alla satellitkomponenter och som är mottaglig. Dessutom visar jämförelsen med ett traditionellt, dedikerat feldetekteringssystem att fel kan fångas snabbare med en mottagligmekanism. / Misiunile spat,iale cu oameni, atât cât s, i fara oameni, au avut o rata a es, ecurilor destul de ridicata în perioada init,iala a erei tehnologiei spat,iale. În schimb, aceasta a scazut semnificativ odata cu dezvoltarea tehnologiei, dar s, i datorita faptului ca inginerii au învat,at din experient,ele precendente s, i au îmbunatat, it sistemele critice în timp real cu mecanisme de detect,ie a erorilor. Sisteme de detect,ie, izolare s, i recuperare din erori sunt disponibile astazi în aproape toate sistemele spat,iale. Însa, costul echipamentelor poate împiedica crearea unor astfel de sisteme de detect,ie, care sa fie robuste s, i responsive. Aceasta teza analizeaza posibilitatea implementarii unui sistem de detect,ie, izolare s, i recuperare de la erori într-un satelit care este echipat cu un procesor cu un singur fir de execut,ie, care are un sistem de planificare cooperativ în sistemul de operare. Aceasta teza sugereaza o implementare cooperativa a unui astfel de sistem, unde fiecare proces este responsabil de câte o parte din detectarea erorilor. Analiza este realizata atât din perspectiva integrarii în sistemul de operare s, i procesele acestuia, cât s, i din interiorul acestui sistem de detect,ie, unde doua elemente importante sunt implementate s, i analizate: telemetria de depanare s, i modurile de operare. Rezultatele arata faptul ca este posibila implementarea unui sistem de detect,ie care este împart, it în toate componentele sistemului unui satelit s, i se comporta cooperativ. Mai departe, comparat,ia cu un sistem tradit,ional, dedicat, de detect,ie a erorilor arata ca erorile pot fi detectate mai rapid cu un sistem cooperativ.

In the aviation industry, safety and robustness are the number one priorities, which is why they use well-tested systems such as hydraulic actuators. However, drawbacks such as high weight and maintenance have pushed the industry toward newer, electrical, actuators that are more efficient and lighter. Electrical actuators, on the other hand, have some reliability issues. In particular, short circuits in the stator windings of Permanent-Magnet SynchronousMotors (PMSMs), referred to as Inter-Turn Short Faults (ITSFs), are the dominating faults, and is the focus of this thesis. ITSFs are usually challenging to detect and often do not become noticeable until the fault has propagated, and the motor is on the verge of being destroyed. This thesis investigates the possibility of detecting ITSFs in a PMSM, at an early stage when only one turn is shorted. The method is limited to finding the faults using ML algorithms. Both an experiential PMSM and a simulated model of the experimental PMSM, with the ability to induce an ITSF, were used to collect the data. Several Machine Learning (ML) models were developed, and then trained and tested with the collected data. The results show that four of the tested ML models, being: Random Forest, Gaussian SVM, KNN, and the CNN, all achieve an accuracy exceeding 95%, and that the fault can be found at an early stage in a PMSM with three coils connected in parallel in each phase. The results also show that the ML models are able to identify the ITSF when the simulated data is downsampled to the same frequency as the experimental data. We conclude that the ML models, provided in this study, can be used to detect an ITSF in a simulated PMSM, at an early stage when only one turn is shorted, and that there is great potential for them to detect ITSFs in a physical motor as well.

Indiana University-Purdue University Indianapolis (IUPUI) / In a wide-area power system, detecting dynamic events is critical to maintaining system stability. Large events, such as the loss of a generator or fault on a transmission line, can compromise the stability of the system by causing the generator rotor angles to diverge and lose synchronism with the rest of the system. If these events can be detected as they happen, controls can be applied to the system to prevent it from losing synchronous stability. In order to detect these events, pattern recognition tools can be applied to system measurements. In this thesis, the pattern recognition tool decision trees (DTs) were used for event detection. A single DT produced rules distinguishing between and the event and no event cases by learning on a training set of simulations of a power system model. The rules were then applied to test cases to determine the accuracy of the event detection. To use a DT to detect events, the variables used to produce the rules must be chosen. These variables can be direct system measurements, such as the phase angle of bus voltages, or indices created by a combination of system measurements. One index used in this thesis was the integral square bus angle (ISBA) index, which provided a measure of the overall activity of the bus angles in the system. Other indices used were the variance and rate of change of the ISBA. Fitting a polynomial curve to a sliding window of these indices and then taking the difference between the polynomial and the actual index was found to produce a new index that was non-zero during the event and zero all other times for most simulations. After the index to detect events was chosen to be the error between the curve and the ISBA indices, a set of power system cases were created to be used as the training data set for the DT. All of these cases contained one event, either a small or large power injection at a load bus in the system model. The DT was then trained to detect the large power injection but not the small one. This was done so that the rules produced would detect large events on the system that could potentially cause the system to lose synchronous stability but ignore small events that have no effect on the overall system. This DT was then combined with a second DT that predicted instability such that the second DT made the decision whether or not to apply controls only for a short time after the end of every event, when controls would be most effective in stabilizing the system.