The mechanical generation of fault trees for reactive systems via retrenchment II: clocked and feedback circuits

Banach, Richard; Bozzano, Marco

doi:10.1007/s00165-011-0203-6

Cited by 9 publications

(7 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Our work is similar in spirit to [5], which presents a methodology based on retrenchment (an extension of classical refinement), to generate hierarchical FTs from systems represented as circuits, exploiting the system dataflow. A major difference is that retrenchment does not focus on top-down development, but rather on the relation between nominal and faulty behaviors.…”

Section: Related Workmentioning

confidence: 96%

Formal Safety Assessment via Contract-Based Design

Bozzano

Cimatti

Mattarei

et al. 2014

Automated Technology for Verification and Analysis

Self Cite

View full text Add to dashboard Cite

Abstract. Safety Assessment (SA) is an engineering discipline aiming at the analysis of systems under faults. According to industrial practice and standards, SA is based on the construction of complex artifacts such as Fault Trees, which describe how certain faults may cause some top-level events. SA is intended to mirror the hierarchical design of the system focusing on the safety aspects.In this paper, we propose a formal approach where the nominal specification of a hierarchically decomposed system is automatically extended to encompass faults. The approach is based on a contract-based design paradigm, where components at different levels of abstraction are characterized in terms of the properties that they have to guarantee and the assumptions that must be satisfied by their environment. The framework has several distinguishing features. First, the extension is fully automated, and requires no human intervention, based on the idea that intermediate events are failures to fulfill the contracts. Second, it can be applied stepwise, and provides feedback in the early phases of the design process. Finally, it efficiently produces hierarchically organized fault trees.

show abstract

Section: Related Workmentioning

confidence: 96%

Formal Safety Assessment via Contract-Based Design

Bozzano

Cimatti

Mattarei

et al. 2014

Automated Technology for Verification and Analysis

Self Cite

View full text Add to dashboard Cite

show abstract

“…If there had been, the second occurrence of GearStartMoving_S would have been disabled in the pilot machine, causing problems. 8 We have discussed this point with some care because the same issue arises every time the computers issue commands to any of the remaining equipment, e.g. to the analogical switch, or to the hydraulic apparatus.…”

Section: The Nominal Regimementioning

confidence: 99%

“…For this to work, the pilot's handle events are further synchronised with analogical switch events that reset clk_AnSw to the appro- 7 Dealing with this properly in the Conf development caused the majority of the excessive verbosity. 8 It may be argued that the phenomenon being discussed is absent at level 00, so the guard could have been included there, and removed at level 01, but in Event-B refinement, guards are strengthened, so this would have prevented the 00 to 01 development step from being an Event-B refinement. priate value, depending on its value at the occurrence of the handle event (N. B.…”

Section: The Nominal Regimementioning

confidence: 99%

See 1 more Smart Citation

The landing gear system in multi-machine Hybrid Event-B

Banach

2015

Int J Softw Tools Technol Transfer

Self Cite

View full text Add to dashboard Cite

A system development case study problem based on a set of aircraft landing gear is examined in Hybrid Event-B (an extension of Event-B that includes provision for continuously varying behaviour as well as the usual discrete changes of state). Although tool support for Hybrid Event-B is currently lacking, the complexity of the case study provides a valuable challenge for the expressivity and modelling capabilities of the Hybrid Event-B formalism. The size of the case study, and in particular, the number of overtly independent subcomponents that the problem domain contains, both significantly exercise the multi-machine and coordination capabilities of the modelling formalism. These aspects of the case study, vital in the development of realistic cyberphysical systems in general, have contributed significant improvements in the theoretical formulation of multi-machine Hybrid Event-B itself.

show abstract

“…Even at this stage in the design process, systems may exhibit a high degree of complexity (Roy et al 2013), and formal modelling of the system typically captures the ideal, fault-free, conception of the system. Subsequently, the resultant FTA is based on an informal description of the underlying system (Ericson 2005), or requires modelling the system in an separate FTA specific modelling language (Liggesmeyer & Rothfelder 1998, Banach & Bozzano 2011. This makes it difficult to check the consistency of the analysis, because it is possible that causes are noted in the tree which do not lead to the failure (incorrectness) or that some causes of failure are overlooked (incompleteness).…”

Section: Introductionmentioning

confidence: 99%

A second chance for risk assessment in IT system analysis?

Herbert¹,

Sharp²

2013

Safety, Reliability and Risk Analysis

View full text Add to dashboard Cite

We present a framework for the automated generation of fault trees from models of real-world process workflows, expressed in a formalised subset of the popular Business Process Modelling and Notation (BPMN) language. To capture uncertainty and unreliability in workflows, we extend this formalism with probabilistic non-deterministic branching. We present an algorithm that allows for exhaustive generation of possible error states that could arise in execution of the model, where the generated error states allow for both fail-stop behaviour and continued system execution. We employ stochastic model checking to calculate the probabilities of reaching each non-error system state. Each generated error state is assigned a variable indicating its individual probability of occurrence. Our method can determine the probability of combined faults occurring, while accounting for the basic probabilistic structure of the system being modelled. From these calculations, a comprehensive fault tree is generated. Further, we show that annotating the model with rewards (data) allows the expected mean values of reward structures to be calculated at points of failure.

show abstract

The mechanical generation of fault trees for reactive systems via retrenchment II: clocked and feedback circuits

Cited by 9 publications

References 26 publications

Formal Safety Assessment via Contract-Based Design

Formal Safety Assessment via Contract-Based Design

The landing gear system in multi-machine Hybrid Event-B

A second chance for risk assessment in IT system analysis?

Contact Info

Product

Resources

About