This
package defines the classes that support failure detection management. Failure
detection is based on the Failure Detection Management design pattern.
The AOCS framework recognizes
two major categories of software faults: failures and configuration
errors. The term configuration error is used to designate any fault
that is detected by a component while it is being configured. Configuration
errors would typically occur during application initialization when the
application components are configured but they could also occur as a result of
a telecommand or some other action attempting to reconfigure a component
dynamically. The term failure is used to designate any fault that is detected
during the normal operation of a component and that affects its ability to
perform its allotted task. Failures would normally occur only during normal
operations. Both failures and configuration errors are recorded through the
creation of dedicated events (the failure events and the configuration
error events). This package only covers the detection of failures.
The AOCS framework regards
failure detection and failure recovery as separate functionalities allocated to
distinct components. The failure detection component performs failure checks
and, when it detects a failure, it creates an event that describes it and
stores it in an event repository. The failure recovery component inspects the
failure event repository to check whether any failures have been identified and
then uses the information stored in the failure events to decide on the
appropriate recovery action.
The objective of the failure
detection functionality is to perform failure detection tests on individual
components. A failure is declared when a failure detection test fails. The
failure detection functionality is implemented by a failure detection
manager that is based on the manager meta-pattern. The general principle
adopted in the framework is that the knowledge required to perform the failure
detection test should be confined to the tested component. The task of the
failure detection manager is simply to ask for the test to be performed, to
record the results and to pass them on to other interested components. The
actual test is performed by the tested component.
Two types of failure detection
tests are foreseen: consistency checks and monitoring of property
values.
A consistency check test
verifies that the internal state of the object is consistent. For instance, a
consistency check on a quaternion object verifies that the squared sum of the
quaternion components is equal to 1 (within a certain tolerance band). In
another example, a consistency check on a sensor object verifies that the
sensor’s outputs are in the range of physically possible values.
The mechanisms for monitoring
property values are covered by the ObjectMonitoring package. This
package offers an interface Property to encapsulate the
property to be monitored and ChangeObject to encapsulate the
change profile with respect to which the monitoring is to be performed. The failure
detection framelet defines an additional object, the monitoring check,
that encapsulates a failure detection check based on property monitoring. A
monitoring check object packages in a single object the property to be checked,
the change type and the recovery action to be performed in case the change is
found to have occurred.
More details on the failure
detection concept of the AOCS Framework can be found in the failure detection
management technical note but note that this document was written for the
C++ version of the framework and it may therefore be not applicable in its
entirety.