Comparison of Fault-Tree Models for Fault Detection, Isolation, and Recovery Algorithms

T HIS Note examines methods for modeling fault detection, isolation, and recovery (FDIR) systems in a risk analysis, such as in a static fault tree [1], with a particular focus on unmanned aircraft system (UAS) applications [2–6]. Static fault trees are widely used in the aerospace industry as preliminary design tools for the decomposition of responsibilities across multiple collaborating organizations. However, standard fault-treemethods no longer provide ameaningfulway to decompose safety-critical risks across subsystems for increasingly autonomous aircraft, such as UASs equipped with FDIR. The central issue is that, although FDIR systems function primarily to mitigate overall system risk, they nonetheless introduce new fault modes that must be considered in system safety analysis. In sensor-focused FDIR algorithms, such as receiver autonomous integrity monitoring (RAIM), false alarms are merely an annoyance [7,8]. In recovery algorithms that adapt control [9–11], FDIR false alarms present a significant safety risk, as a correct adaptation in response to a false alarm can potentially cause system failure. This Note compares several alternative logic gates as models for a representative FDIR system in order to identify a fault-tree model that is both easy to use and reasonably precise in capturing the impact of false alarms on system safety.