1.

Petri Nets Applied to the Analysis of Algorithm For Space Vehicles Integration Tower Self Test Francisco C. P. Bizarria ? , Jose W. P. Bizarria ? , Joao M. Rosario ?

Abstract -The satellite launch vehicle currently developed in Brazil, need that their modules are integrated into an unit called by Integration Movable Tower. In the tower structure is installed: moving bridge, elevator, work platforms, doors, movement trucks and other equipment that aids the accomplishment of integration tasks, tests and vehicle launching. In order to perform the foreseen procedures in the aforementioned tasks, the equipment are submitted to several operational tests prior to utilization of integration tower control system. On that context, this work presents a proposal of model developed by means of Petri Nets to represent the algorithm steps that tests the sensors and actuators included into the main equipment installed in the mentioned integration tower. That is carried out computational simulations with the target of identifying the Petri Nets properties that are related to the confusion conflicts and dead lock. The results obtained in the simulations indicates that the proposed model is able of representing the sensors and actuator operation embedded inside a standard equipment during the self test and based upon that is evaluated the algorithm performance.

he Satellite Launch Vehicle (SLV), illustrated in the figure 1, is currently being developed in Brazil by Institute of Aeronautics and Space. To be launched that vehicle requires that their modules are integrated vertically in the rockets launch center inside a specific site called by Integration Movable Tower (IMT), indicated in the figure 2 [1]. That tower is supported by means of a metallic structure, shaped as a rectangular cubic, with the main side settled on the vertical position. Such tower is equipped with: movable bridge, elevator, work platforms (movable and fixed), doors, trucks for movement and other equipment that are dedicated to aid a group of task accomplishment specialists that are related to the integration, tests and also to the launch of the vehicle [2]. In order to comply with all procedures foreseen on these tasks is necessary to expose the people, dedicated to perform such tasks, to the risks inherent to the space segment. That scenario of risks defines a situation where is strategic, in order to increase the safety, that each one of the mentioned equipment is submitted to a several operational tests prior to being used by the tower control system.

The actuation of equipment installed in the Integration Movable Tower (IMT) is carried out by remote mode and managed by an automated system that has basically, in its physical architecture, the elements presented in the figure 3.

The block called Control, represented in the figure 3, has as main function to perform the management of activities developed by the physical architecture of the Integration Movable Tower (IMT) in order to support the procedures established to the accomplishment of integration tasks, tests and vehicle launch.The more relevant parts present on that block are:

Network Interface for Deterministic Protocol (NIDP), Central Processing Unit (CPU) and Network Interface for Probabilistic Protocol (NIPP). The Network Interface for Deterministic Protocol (NIDP), is responsible for generating and receiving signals, related to the deterministic protocol, to allow the communication between the control module and the Input and Output Remote Units (IORU) and/or Smart Actuators (SA).

The main function of the Central Processing Unit (CPU) is to generate the necessary signals to run the system management program [3].Network Interface for Probabilistic Protocol (NIPP) generates and receives signals, related to the probabilistic protocol, to allow the communication between the control module and the Host Computer (HC) of the Server (SER).

The Deterministic Communication Line (DCL) is the physical link that transfers the signals between the Network Interface for Deterministic Protocol (NIDP) and the Input and Output Remote Units (IORU) and/or Smart Actuators (SA) of bidirectional mode. Fig. 3 : Elements from physical architecture adopted for automation of the Integration Movable Tower.

The Input and Output Remote Units (IORU) are responsible for generating and receiving signals, related to the deterministic protocol, to allow the communication between the Network Interface for Deterministic Protocol (NIDP) and the sensors and/or actuators, which have no self test system, present in the equipment installed in the Integration Movable Tower (IMT). Those units are able of operating with digital and/or analog inputs and outputs, which support a large range of amplitudes and frequencies of signals [4].

The sensors and actuators present in the equipment(for instance: work platforms, doors etc) installed in the Integration Movable Tower (IMT), which have no self test system are represented respectively by: S11, S12, ... S1n, Sx1, Sx2, ... Sxz and A11, A12, ... A1m, Ax1, Ax2, ... Axw. The equipment (for instance: movable bridges,elevator, movement trucks etc) present in the Integration Movable Tower (IMT) which have smart actuators equipped with self test are represented by : SA1, ... SAy.

The Probabilistic Communication Line (PCL) is the physical link that transfers the bidirectional signals between: i) the Network Interface for Probabilistic Protocol (NIPP) and the Host Computer (HC) of the Server (SER), ii) the Host Computer (HC) of the Server (SER) and the Host Computer (HC) of the Man Machine Interface 1 (MMI1) and iii) the Host Computer (HC) of the Server (SER) and the Host Computer (HC) of the Man Machine Interface 2 (MMI2) [5].

The main functions of the Server (SER) Host Computer (HC) are focused on: i) managing the system supervision layer, ii) storing and becoming available information related to the database and iii) supporting the requests from Man Machine Interface 1 (MMI1) and Man Machine Interface 2 (MMI 2). Those interfaces are the means that operator uses to supervise and command the actuation of the equipment installed in the Integration Movable Tower. On that context, this work presents a proposal of model created to evaluate the steps of the algorithm that was developed to perform self test of the actuators and sensors that are present in the main equipment installed in the space vehicle integration tower, by means of Petri Nets [6]. Computational simulations are performed on that model, with the goal of identifying the Petri Nets properties that are related mainly with the confusion conflicts and dead lock.

II.

The main target of this work is to present a proposal of model, created by means of Petri Nets, to evaluate the algorithm that performs the self test in actuators and sensors which are present in the main equipment installed in the Integration Movable Tower (IMT). To present the most relevant results that were obtained in the simulations performed with that model within the context of the confusion conflicts and dead lock.

In the model proposed in the figure 4 are represented the main status that are determined by the algorithm that performs the evaluation of actuators and sensors which are present in the equipment installed in the Integration Movable Tower (IMT), that have no self test incorporated, by means of Petri Nets.

During the development of those nets was used the gathering procedure [7] and considered the components foreseen in the architecture presented in the figure 3.

That model indicates separately the Petri Nets that were developed to represent: i) Control (CONTROLLER), ii) the actuator and sensors which are present in the equipment (EQUIPMENT) and have no self test, iii) the Man Machine Interface (SELF TEST INTERFACE) and iv) the system to generate faults in the actuator and/or sensors of equipment (FAULTS GENERATOR).

That way of modeling has as main target to allow observing the operational behavior of each part involved in the process during the program simulation that includes the steps foreseen in the self test algorithm. The distribution of positions, transitions, arcs and the quantity of tokens, showed in the figure 4, aims to establish the initial condition of operation of an equipment, that have no self test, present in the physical architecture adopted for the automation of the Integration Movable Tower (IMT).

In the model developed for the CONTROLLER are foreseen specified positions to represent the inputs (I1, I2, I3, I4, I5, I6 and I7) and outputs (O1, O2, O3, O4, O5, O6, O7, O8 and O9) which perform the connections with the models of EQUIPMENT and SELF TEST INTEFACE.

The model operation presented in the figure 4 must comply with the steps foreseen in the analytic flowchart that represents a typical sequence of actions that are performed by the program that runs the actuator and sensors self test, present in a typical equipment (one actuator with two sensors) installed in the Integration Movable Tower (IMT), which is presented in the figure 5.

In the flowchart presented in the figure 5 is foreseen the necessary steps to: i) generate the command of activation and deactivation of the actuators present in the equipment that have no self test and ii) check the faults during operation of actuators and/or sensors [8].

The main status determined by the actuators and sensors present in the equipment installed in the Integration Movable Tower (IMT) are: i) Actuator Off, ii) Actuator On, iii) Sensor Off and iv) Sensor On. Based on that it is important to highlight that the actuator is able of attributing status to the sensors, nonetheless the reciprocal is not true.

The FAULTS GENERATOR was developed to interact directly with the EQUIPMENT model in order to establish the following status possibilities: i) Actuator Off with Sensor Indicating Off, ii) Actuator Off with sensor Indicating On, iii) Actuator Off with one Sensor Indicating Off and other Sensor Indicating On, iv) Actuator Off, v) Actuator On with Sensor Indicating On, vi) Actuator On with Sensor Indicating Off, vii) Actuator On with one Sensor Indicating Off and other Sensor Indicating On and viii) Actuator On. The aforementioned status shall be identified and indicated by the self test algorithm during the equipment test.

The computational simulation of the model proposed in this work aims to represent the algorithm that performs evaluation of the actuators and sensors present in the equipment installed in the Integrated Movable Tower (IMT), that have no self test, by means of Petri Nets. Such simulation was performed exploring all status foreseen in the networks, specially those included in the analytic flowchart presented in the figure 5, employing software Visual Object Net [9].

The confusion conflicts were observed in simulations performed in this work and they were solved inserting restrictions in the transitions involved with the same conflict. The dead lock was not observed in the simulations of the self test algorithm. In the simulation of the proposed model all positions and transitions were respectively achieved and trigged. The quantities of tokens varied during the Petri Nets simulations, nevertheless that situation did not create neither an overflow nor lack of tokens in positions that could degrade the accomplishment of the self test algorithm.

V.

The method adopted to model the system, employing Petri Nets, was able of showing details of CONTROLLER operation, EQUIPMENT, SELF TEST INTEFACE and the phases foreseen in the self test algorithm. These elements are included in the physical and logical architecture of the Integration Movable Tower (IMT). That method allowed the individual operational analysis of each part foreseen in the system architecture and that fact facilitates the evaluation of the algorithm performance, which was developed to perform the self test of actuators and sensors that are present in the equipment installed in the mentioned tower.

Regarding to the properties evaluated in this work, only confusion conflict was identified in the system simulation with characteristics for causing undesired consequences. The solution for that situation was obtained inserting restrictions in the transitions involved with the mentioned conflict. Furthermore, that is quite important to emphasize that the installation of sensors in strategic points of the architecture is one possibility of physical solution to limit the effects of the confusion conflict.