This thesis deals with modeling, simulation and operating limits of high-voltage direct-current (HVDC) transmission systems that employ voltage-source converters (VSCs) as their building blocks. This scheme is commonly known as the VSC-HVDC transmission. A simulation-based study is undertaken in which detailed electromagnetic transient (EMT) models are developed for a back-to-back VSC-HVDC transmission system. Different control strategies are implemented and their dynamic performances are investigated in the PSCAD/EMTDC EMT simulator. The research presented in this thesis firstly specifies the factors that limit the operating points of a VSC-HVDC system with particular emphasis on the strength of the terminating ac system. Although the EMT model shows these limits it provides little analytical reason for their presence and extent. A phasor-based quasi-steady state model of the system including the phase-locked loop firing control mechanism is proposed to determine and characterize the factors contributing to these operating limits. Stability margins and limits on the maximum available power are calculated, taking into consideration the maximum voltage rating of the VSC. The variations of ac system short-circuit ratio (SCR) and transformer impedance are proven to significantly impact the operating limits of the VSC-HVDC system. The results show how the power transfer capability reduces as the SCR decreases. The analysis shows that VSC-HVDC converters can operate into much weaker networks, and with less sensitivity, than the conventional line commutated converters (LCC-HVDC). Also for a given SCR the VSC-HVDC system has a significantly larger maximum available power in comparison with LCC-HVDC. A second research thrust of the thesis is introduction of a simplified converter model to reduce the computational intensity of its simulation. This is associated with the admittance matrix inversions required to simulate high-frequency switching of the converter valves. This simplified model is based on the concept of dynamic average-value modelling and provides the ability to generate either the full spectrum or the fundamental-frequency component of the VSC voltage. The model is validated against the detailed VSC-HVDC circuit and shows accurate matching during steady state and transient operation. Major reductions of 50-70% in CPU-time in repetitive simulation studies such as multiple runs and optimization-based controller tuning are achieved.

In this thesis, we investigate the applicability of the process algebraic formal method Communicating Sequential Processes (CSP) [Hoa85] to the development and analysis of safetycritical systems. We also investigate how these tasks might be aided by mechanical verification, which is provided in the form of the proof tool Failures-Divergences Refinement (FDR) [Ros94]. Initially, we build upon the work of [RWW94, Ros95], in which CSP treatments of the security property of non-interference are described. We use one such formulation to define a property called protection, which unifies our views of safety and security. As well as applying protection to the analysis of safety-critical systems, we develop a proof system for this property, which in conjunction with the opportunity for automated analysis provided by FDR, enables us to apply the approach to problems of a sizable complexity. We then describe how FDR can be applied to the analysis of mutual exclusion, which is a specific form of non-interference. We investigate a number of well-known solutions to the problem, and illustrate how such mutual exclusion algorithms can be interpreted as CSP processes and verified with FDR. Furthermore, we develop a means of verifying the faulttolerance of such algorithms in terms of protection. In turn, mutual exclusion is used to describe safety properties of geographic data associated with Solid State Interlocking (SSI) railway signalling systems. We show how FDR can be used to describe these properties and model interlocking databases. The CSP approach to compositionality allows us to decompose such models, thus reducing the complexity of analysing safety invariants of SSI geographic data. As such, we describe how the mechanical verification of Solid State Interlocking geographic data, which was previously considered to be an intractable problem for the current generation of mechanical verification tools, is computationally feasible using FDR. Thus, the goals of this thesis are twofold. The first goal is to establish a formal encapsulation of a theory of safety-critical systems based upon the relationship which exists between safety and security. The second goal is to establish that CSP, together with FDR, can be applied to the modelling of Solid State Interlocking geographic databases. Furthermore, we shall attempt to demonstrate that such modelling can scale up to large-scale systems.

Modern offices are crowded with personal computers. While studies have shown these to be idle most of the time, they remain powered, consuming up to 60% of their peak power. Hardware based solutions engendered by PC vendors (e.g., low power states, Wake-on-LAN) have proven unsuccessful because, in spite of user inactivity, these machines often need to remain network active in support of background applications that maintain network presence. Recent solutions have been proposed that perform consolidation of idle desktop virtual machines. However, desktop VMs are often large requiring gigabytes of memory. Consolidating such VMs, creates large network transfers lasting in the order of minutes, and utilizes server memory inefficiently. When multiple VMs migrate simultaneously, each VM’s experienced migration latency grows, and this limits the use of VM consolidation to environments in which only a few daily migrations are expected per VM. This thesis introduces partial VM migration, an approach that transparently migrates only the working set of an idle VM, by migrating memory pages on-demand. It creates a partial replica of the desktop VM on the consolidation server by copying only VM metadata, and transferring pages to the server, as the VM accesses them. This approach places desktop PCs in low power state when inactive and resumes them to running state when pages are needed by the VM running on the consolidation server. Jettison, our software prototype of partial VM migration for off-the-shelf PCs, can deliver 78% to 91% energy savings during idle periods lasting more than an hour, while providing low migration latencies of about 4 seconds, and migrating minimal state that is under an order of magnitude of the VM’s memory footprint. In shorter idle periods of up to thirty minutes, Jettison delivers savings of 7% to 31%. We present two approaches that increase energy savings attained with partial VM migration, especially in short idle periods. The first, Context-Aware Selective Resume, expedites PC resume and suspend cycle times by supplying a context identifier at desktop resume, and initializing only devices and code that are relevant to the context. CAESAR, the Context-Aware Selective Resume framework, enables applications to register context vectors that are invoked when the desktop is resumed with matching context. CAESAR increases energy savings in short periods of five minutes to an hour by up to 66%. The second approach, the low power page cache, embeds network accessible low power hardware in the PC, to enable serving of pages to the consolidation server, while the PC is in low power state. We show that Oasis, our prototype page cache, addresses the shortcomings of energy-oriented on-demand page migration by increasing energy savings, especially during short idle periods. In periods of up to an hour, Oasis increases savings by up to twenty times.

Modern offices are crowded with personal computers. While studies have shown these to be idle most of the time, they remain powered, consuming up to 60% of their peak power. Hardware based solutions engendered by PC vendors (e.g., low power states, Wake-on-LAN) have proven unsuccessful because, in spite of user inactivity, these machines often need to remain network active in support of background applications that maintain network presence. Recent solutions have been proposed that perform consolidation of idle desktop virtual machines. However, desktop VMs are often large requiring gigabytes of memory. Consolidating such VMs, creates large network transfers lasting in the order of minutes, and utilizes server memory inefficiently. When multiple VMs migrate simultaneously, each VM’s experienced migration latency grows, and this limits the use of VM consolidation to environments in which only a few daily migrations are expected per VM. This thesis introduces partial VM migration, an approach that transparently migrates only the working set of an idle VM, by migrating memory pages on-demand. It creates a partial replica of the desktop VM on the consolidation server by copying only VM metadata, and transferring pages to the server, as the VM accesses them. This approach places desktop PCs in low power state when inactive and resumes them to running state when pages are needed by the VM running on the consolidation server. Jettison, our software prototype of partial VM migration for off-the-shelf PCs, can deliver 78% to 91% energy savings during idle periods lasting more than an hour, while providing low migration latencies of about 4 seconds, and migrating minimal state that is under an order of magnitude of the VM’s memory footprint. In shorter idle periods of up to thirty minutes, Jettison delivers savings of 7% to 31%. We present two approaches that increase energy savings attained with partial VM migration, especially in short idle periods. The first, Context-Aware Selective Resume, expedites PC resume and suspend cycle times by supplying a context identifier at desktop resume, and initializing only devices and code that are relevant to the context. CAESAR, the Context-Aware Selective Resume framework, enables applications to register context vectors that are invoked when the desktop is resumed with matching context. CAESAR increases energy savings in short periods of five minutes to an hour by up to 66%. The second approach, the low power page cache, embeds network accessible low power hardware in the PC, to enable serving of pages to the consolidation server, while the PC is in low power state. We show that Oasis, our prototype page cache, addresses the shortcomings of energy-oriented on-demand page migration by increasing energy savings, especially during short idle periods. In periods of up to an hour, Oasis increases savings by up to twenty times.

Kernel patches are frequently released to fix security vulnerabilities and bugs. However, users and system administrators often delay installing these updates because they require a system reboot, which results in disruption of service and the loss of application state. Unfortunately, the longer an out-of-date system remains operational, the higher is the likelihood of a system being exploited. Approaches, such as dynamic patching and hot swapping, have been proposed for updating the kernel. All of them either limit the types of updates that are supported, or require significant programming effort to manage. We have designed a system that checkpoints application-visible state, updates the kernel, and restores the application state. By checkpointing high-level state, our system no longer depends on the precise implementation of a patch and can apply all backward compatible patches. The results show that updates to major kernel releases can be applied with minimal changes.

No description available.

As natural resources are decreasing and environmental pollution is increasing, the buildings that play an important role in this problem should be constructed sustainably so their affects are kept to a minimum. Hospitals operate 24 hours a day and 7 days a week, therefore they are one of the largest energy consumers. Hence designers have started to design healthcare facilities according to the Leadership in Energy and Environmental Design (LEED) criteria, believing that it will reduce waste production, energy consumption and increase patient satisfaction by creating brighter and less stressful facilities. To understand if the claims are correct or not, this thesis first studied the results of the patient survey, Hospital Consumer Assessment of Healthcare Providers and System (HCAHPS), undertaken at most of the hospitals in the U.S., and compares the results to LEED and non-LEED certified hospitals. To find answers for the claims related to the financial benefits, this thesis compared three financial indicators; cost of operation of plant, profitability, and inpatient revenue. In the cases where there is a large enough sample size, a t-test is used to compare two groups, however when the sample size was not large enough, two groups are compared based on their means. For the cost of operation of plant and profitability, non-LEED certified hospitals are performing better. However, the patient satisfaction and inpatient revenues are significantly higher at the LEED-certified hospitals.

In selected patients, surgical treatments such as cytoreductive surgery (CRS) and hyperthermic intraperitoneal chemotherapy (HIPEC) have enabled curative treatment options for previously incurable diseases, such as peritoneal carcinomatosis (PC). The introduction of resource demanding surgery could affect the work process, efficiency, and productivity within a surgical department and factors influencing patient postoperative recovery processes may have an impact on the efficiency of patient care after major surgery. The aim of this thesis was to investigate operating room efficiency from the perspective of both staff and leaders’ in two different settings (Papers I and II) and the early postoperative recovery of patients with peritoneal carcinomatosis (Papers III and IV). Interviews were held with 21 people in a county hospital and 11 members of the PC team in a university hospital, and a phenomenographic approach was used to analysis the data (Papers I and II). The patients’ postoperative recovery and pulmonary adverse events (AE) were determined from data retrieved from the electronic health records of 76 patients (Papers III and IV). The concept of efficiency was understood in different ways by staff members and their leaders (Paper I). However, when working in a team, the team members had both organisation-oriented and individual-oriented understanding of efficiency at work that focused on the patients and the quality of care (Paper II). The patients with PC regained gastrointestinal functions and could be mobilised during early postoperative recovery phase, although many patients suffered from psychological disturbances, sleep deprivation, and nausea (Paper III). Postoperative clinical and radiological pulmonary AE were common, but did not affect the early recovery process (Paper IV). In conclusion, leaders who are aware of the variation in understanding the concept of efficiency are better able to create the same platform for staff members by defining the concept of efficiency within the organisation. In a team organisation, the team members have a wider understanding of the concept of efficiency with more focus on the patients. The factors affecting postoperative recovery and pulmonary AE should be considered when designing individualised patient care plans in order to attain a more efficient recovery.

In recent years there has been continuous increase of axle loads, tonnage, train speed, and train length which has increased both the productivity in the rail sector and the risk of rail breaks and derailments. Rail operating risks have been increasing due to the increased number of axle passes, sharper curves, wear-out of rails and wheels, inadequate rail-wheel grinding and poor lubrication and maintenance. Rolling contact fatigue (RCF) and wear are significant problems for railway companies. In 2000, the Hatfield accident in the UK killed 4 people, injured 34 people and led to the cost of £ 733 million (AUD$ 1.73 billion) for repairs and compensation. In 1977, the Granville train disaster in Australia killed 83 people and injured 213 people. These accidents were related to rolling contact fatigue, wear and poor maintenance. Studies on rail wear and lubrication, rolling contact fatigue and inspection and rail grinding analyse and assess the asset condition to take corrective and preventive measures for maintaining reliability and safety of rail track. Such measures can reduce the operational risks and the costs by early detection and prevention of rail failures, rail breaks and derailments. Studies have so far been carried out in isolation and have failed to provide a practical solution to a complex problem such as rail-wheel wearfatigue-lubrication-grinding-inspection for cost effective maintenance decisions. Therefore, there is a need to develop integrated economic models to predict expected total cost and operational risks and to make informed decisions on rail track maintenance. The major challenges to rail infrastructure and rolling stock operators are to: 1. keep rolling contact fatigue and rail-wheel wear under controllable limits, 2. strike a balance between rail grinding and rail lubrication, and 3. take commercial decisions on grinding intervals, inspection intervals, lubrication placements, preventive maintenance and rail replacements. This research addresses the development and analysis of an integrated model for assessment of operational risks in rail track. Most significantly, it deals with problems associated with higher axle loads; wear; rolling contact fatigue; rail defects leading to early rail replacements; and rail breaks and derailments. The contribution of this research includes the development of: failure models with non-homogenous Poisson process and estimation of parameters. economic models and analysis of costs due to grinding, risks, downtime, inspection and replacement of rails for 23, 12, 18 and 9 Million Gross Tonnes (MGT) of traffic through curve radius 0-300, 300-450, 450-600 and 600-800 m; and application of results from this investigation to maintenance and replacement decisions of rails. Cost savings per meter per year are: * 4.58% with 12 MGT intervals compared to 23 MGT intervals for 0-300 m * 9.63% with 12 MGT intervals compared to 23 MGT intervals for 300-450 m * 15.80% with 12 MGT intervals compared to 23 MGT intervals for 450-600 m * 12.29% with 12 MGT intervals compared to 23 MGT intervals for 600-800 m. a lubrication model for optimal lubrication strategies. It includes modelling and economic analysis of rail wear, rail-wheel lubrication for various types of lubricators. Cost effectiveness of the lubricator is modelled, considering the number of curves and the total length of curves it lubricates. Cost saving per lubricator per year for the same curve length and under the same curve radius is: * 17% for solar wayside lubricators compared to standard wayside lubricators. simulation model for analysis of lubrication effectiveness. Cost savings per meter per year for: * 12 MGT grinding interval is 3 times for 0-450 m and 2 times for 450-600 m curve radius with lubrication compared to without lubrication. * 23 MGT grinding interval is 7 times for 0-450 m and 4 times for 450-600 m curve radius with lubrication compared to without lubrication. a relative performance model, total curve and segment model. an inspection model for cost effective rail inspection intervals. Cost savings per year for same track length, curves and MGT of traffic: * 27% of total maintenance costs with two inspections, compared to one inspection considering risk due to rail breaks and derailments. a risk priority number by combining probability of occurrence, probability of detection and consequences due to rail defects, rail breaks and derailments. integrated model combining decisions on grinding interval, lubrication strategies, inspection intervals, rectification strategies and replacement of rails. Cost saving per meter per year for 12 MGT is: * 5.41% of total maintenance costs with two inspections, compared to one inspection considering risk due to rail breaks and derailments. * 45.06% of total maintenance costs with lubrication for two inspections, compared to without lubrication. Cost saving per meter per year for 23 MGT is: * 5.61% of total maintenance costs with two inspections, compared to one inspection considering risk due to rail breaks and derailments. * 68.68% of total maintenance costs with lubrication for two inspections, per year compared to no lubrication. The thesis concludes with a brief summary of the contributions that it makes to this field and the scope for future research in wear-fatigue-lubrication-grinding-inspection for maintenance of rail infrastructure.

Patches to modern operating systems, including bug fixes and security updates, and the reboots and downtime they require, cause tremendous problems for system users and administrators. The aim of this research is to develop a model for dynamic update of operating systems, allowing a system to be patched without the need for a reboot or other service interruption. In this work, a model for dynamic update based on operating system modularity is developed and evaluated using a prototype implementation for the K42 operating system. The prototype is able to update kernel code and data structures, even when the interfaces between kernel modules change. When applying an update, at no point is the system's entire execution blocked, and there is no additional overhead after an update has been applied. The base runtime overhead is also very low. An analysis of the K42 revision history shows that approximately 79% of past performance and bug-fix changes to K42 could be converted to dynamic updates, and the proportion would be even higher if the changes were being developed for dynamic update. The model also extends to other systems such as Linux and BSD, that although structured modularly, are not strictly object-oriented like K42. The experience with this approach shows that dynamic update for operating systems is feasible given a sufficiently-modular system structure, allows maintenance patches and updates to be applied without disruption, and need not constrain system performance.