Formal Design and Safety Analysis of AIR6110 Wheel Brake System

Abstract

SAE Aerospace Information Report 6110, "Contiguous Aircraft/System Development Process Example," follows the development of a complex wheel brake system (WBS) using processes in the industry standards Arp4754A, "Guidelines for Development of Civil Aircraft and Systems," and Arp4761, "Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment."Air6110 employs informal methods to examine several WBS architectures which meet the same requirements with different degrees of reliability.In this case study, we analyze the Air6110 with formal methods. First, WBS architectures in Air6110 formerly using informal steps are recreated in a formal manner. Second, methods to automatically analyze and compare the behaviors of various architectures with additional, complementary information not included in the Air6110 are presented. Third, we provide an assessment of distinct formal methods ranging from contract-based design, to model checking, to model based safety analysis.

Tightening the contract refinements of a system architecture

“…The general development process for the contracts specification and refinement has been successfully applied in several frameworks [2,8] and on realistic case studies like in [6]. However, the process is quite expensive because the requirements are formalized into formal properties, where part of the complexity is delegated to the designer, who has the burden of specifying the contracts.…”

“…Some examples are: different versions of the Redundant Sensor described in Sect. 3.1, different variants of a Wheel Brake System [6,15], and an Airbag system [1]. Particularly, an interesting case study is taken from [6], where the authors presented a complete formal analysis of the different architectures described in the AIR6110 [30], a document describing the informal design of a Wheel Brake System (WBS), covering all the phases of the process, and modeled the case study by means of a combination of formal methods including contract-based design using OCRA, model checking and safety analysis.…”

“…We take the most complex architecture, arch4, defined in [6] and we apply tightening on the contract refinements from the system component to the leaf components in a top-down fashion. A simplified version of the system architecture of arch4 4 is depicted in Fig.…”

“…For example, in the FoReVer [2,20] and AutoFocus [8] framework, the OCRA approach was adopted to formalize requirements into contracts and to specify their refinements along the architecture decomposition in a top-down fashion during the development process. Moreover, a significant case study is presented in [6], where different variants of an industrial-size architectural model of a wheel braking system are analyzed, following the example outlined in the avionic AIR6110 standard.…”

“…We cast this approach in the OCRA framework and we evaluate its performance and effectiveness on a number of benchmarks, including the industrial-size architectures described in [6]. Outline The remainder of the paper is structured as follows.…”