1. 4 Inputs input_a (double) input_b (double) input_c (double) monitor_state (uint32) 4 Outputs –fail_code (uint32) –monitor_id (uint32) –persistence_count (uint32) –totalizer_count (uint32) Copyright © 2010 by Lockheed Martin CorporationPage 1 of 2

2. triple_monitor block violates RM- 002 requirement Copyright © 2010 by Lockheed Martin CorporationPage 2 of 2

3. ExampleThe following simple problem clarifies this exponentially large challenge problem. Apply the following transition conditions to the state diagram (Figure below): C1: Sensors A & B differ by more than a threshold value. C2: Sensors B & C differ by more than a threshold value. C3: Sensors A & C differ by more than a threshold value. C4: One of the above persists more than one interval. C5: One of the above persists longer than the tolerable limit.

4. Figure 1. Clarifying Simplified Example Problem (see text previous slide). A1: No Failure Monitor No Pending Failures persistent_count 0 A2: Failure Pending But No Differences persistent_count-- A3: Single Failure Monitor Only One Difference A4: Failure Pending persistent_count++ totalizer_count++ A5: Failure Latched (Branch B) fail_code 2 persistent_count 0 monitor_id 0 A6: Failure Latched (Branch A) fail_code 4 persistent_count 0 monitor_id 0 A7: Failure Latched (Branch C) fail_code 1 persistent_count 0 monitor_id 0 A8: All Branches Different totalizer_count++ Conditions C1 C2 C3 C4 C5 F F F F Φ F F F T Φ T F F Φ Φ F T F Φ Φ F F T Φ Φ F T T Φ F T F T Φ F T T F Φ F T T F Φ T T F T Φ T F T T Φ T T T T Φ Φ