An Augmented Framework for Formal Analysis of Safety Critical Systems

We present a semantics for fault tree analysis, a technique used for the analysis of safety critical systems, in the real-time interval logic Duration Calculus with Liveness and show how properties of fault trees can be checked automatically. We apply this technique in two examples and show how it can be connected to other verification techniques.

The two most critical phases of SDLC are the specification and the designing phase as they involve the transformation of the semantics from real world domain to computer software systems. Unified Modelling Language (UML) has been accepted as blue print for design and specification of software critical systems. But, UML structures have the weakness in preciously defining the semantics of a system. Any misinterpretation in safety critical system’s specification may risks loss of lives. Formal methods are mathematical tools and techniques which are proven very adequate, principally, at requirement specification and design level. However, formal methods are not welcomed because of rigorous use of mathematics. Therefore, a bridge is required between UML and formal methods to overcome the above insufficiencies. The endeavour of this paper is to propose a new approach by integrating UML and Z notation, a formal specification language. The main focus of this paper is on transforming the UML diagram: use case diagram, class diagram and sequence diagram to Z Schema for capturing both the syntax and semantics, particularly for safety critical system. The resultant formal model of the approach are analyzed and verified by using Z/Eves tool.

The failure of such systems leads to the catastrophic effects, including injury or death to humans, and harm to the environment. Petri nets (PNs) have been widely used for verification and validation of real-time systems. However, the existing approaches do not consider the critical aspects of reliability and safety that include nonliveness, deadlock, stability, and throughput. In this paper, we introduce these as metrics of reliability and safety for safety critical real-time systems. This paper also proposes an innovative methodology for analysis of nonliveness, deadlock, stability, and throughput metrics by linear programming using PN modeling. The application of the proposed techniques has been validated by applying it on four different safety critical systems, running in six nuclear power plants and shown for reactor protection system.

Being rich in the graphical notation, Unified Modeling Language (UML) is regarded as a de facto standard for visualizing, constructing and analyzing the software artifacts in both the domain i.e. in industries as well as in academia. Although UML has numerous good attributes yet not accepted for designing the safety critical system alone. One of the reasons is lack of preciousness in semantic used in graphical model. Consequently, ambiguities are introduced. In case of safety critical system, even a minor ambiguity may cause serious hazards or even loss of life. Therefore there is an utter need of improvement in informality of software models especially in safety critical domain. This paper proposed a framework for verification and validating the dynamic aspect of safety critical system. The proposed framework takes UML sequence diagram of safety critical system as input and refashions this by incorporating Z notation; a formal method. Moreover, this formal model is validated by one of the theorem prover Z notation tool i.e.by Z/EVES.

Condition monitoring or safety monitor is a cost-effective safety protection technique which is widely used in safety-critical industries, such as nuclear plants and aerospace operation. The adoption of safety monitor offers continuous or real-time safety protection at a high level of diversity and its implementation is relatively simple and thus cost-effective for safety verification and validation. In practice, the safety monitors are practical to improve the overall system safety because: 1) Safety monitors are generally small and do not normally have complex algorithms; 2) Safety monitors normally involve checking the essential safety features/properties of the large safety-critical railway systems during their operations; 3) Safety monitors are often independent of existing systems. It can be taken as an add-on safety feature and it is physically and functionally separated from the existing systems, which boosts the reliability of the system. In general, the safety monitors of safety-critical railway systems must achieve the same level or higher level of the integrity and safety required by the monitored systems. Formal method approach provides a traceable and accountable approach to understand, plan and manage safety of safety-critical railway systems, and is an effective technique to improve the overall system safety and reliability. Safety monitors normally have many safety properties in logic condition forms need to be satisfied, and it is the domain that formal methods are good at and should be applied to. This paper discusses a development process to utilise the formal methods to improve the safety and quality of safety critical railway systems. A simple example on railway signalling is then given to demonstrate the application of formal methods in safety-critical transport system.

The industrial use of formal methods

As a powerful and object-oriented graphical modeling language, Unified Modeling Language (UML) has been introduced into the design and development of safety-critical computer systems. However, UML model is difficult to reflect the concurrency and consistency of constraint rules between objects and impossible to completely demonstrate the dynamic behavior characteristics of a system. Further, it cannot be directly expressed and analyzed by mathematical tools. Petri net modeling technology uses graphical element place and transition to clearly describe the internal interactions of a system. Meanwhile, Petri net has mature mathematical analysis methods. We have proposed to combine these two tools for designing and analyzing a system with a set of transformation rules from UML statecharts to Petri net. In this paper, an automatic conversion tool is introduced. The tool performs the transformation with three steps as follows: (1) Transforming UML model into XML document, which makes information extraction of the UML model become easier. (2) Analyzing semantics of UML model and Petri net model, then designing data structure for transformation, and completing the transformation based on the transformation rules. (3) Analyzing the transformed Petri net model to verify the characteristics of the UML model. The transformation rules and the tools are developed based on a new railway interlocking system.

In Punjab Pakistan, a river flood event is the most important natural disasters that every year causes high human casualties as well as heavy economic losses. A safety-critical system should be correct, reliable, complete, consistent, and unambiguous for accurate and precise flood monitoring, prediction, as well as emergency and rescue services during or after a flood event. System correctness must be ensured in every phase of the development of a safety-critical Flood Monitoring, Prediction, and Rescue (FMPR) system. Correctness is a functional property related to the behavior of the system having sub-properties of safety and liveness. These sub-properties must also be correct, complete, consistent, and unambiguous. Rigorous mathematical based software engineering methods like formal methods are suitable for the specification, design, modeling, verification, and validation of an FMPR safety-critical system. The proposed safety-critical system for FMPR is distributed as it is based on multi-agents. This system is specified, analyzed and designed by using Gaia multi-agent methodology, which is based on organizational abstractions. Gaia role model-based agent roles are specified, regular expression based liveness properties are specified, and first-order predicate calculus based safety properties are specified. Thus, safety and liveness properties are formally specified. After the detailed design phase, the system is formally modeled and verified by Hierarchical Coloured-Petri Nets (CP-Nets). As a result, a novel formal system for the specification, analysis, design, modeling, and verification of the FMPR system is proposed. This safety-critical system is distributed based on multi-agents.

For quite some time, the Unified Modeling Language (UML) has been adopted by designers of safety critical control systems such as automotive and aviation control. This has led to an increased emphasis on setting up a validation flow over UML that can be used to guarantee the correctness of UML models. In this paper, we propose a dynamic Assertion-based verification (ABV) framework for validation of UML Statecharts over the Rhapsody platform of I-logix. We present an extension of Linear Temporal Logic (LTL), named Action-LTL that allows assertions to be specified over data attributes and events of UML models. We present a methodology for automatic generation of Rhapsody Statecharts from Action-LTL specifications. These generated Statecharts are added as simulation observers to an existing UML model to detect specification violations during simulation. In view of the capacity limitations of existing formal assertion-based verification tools, we believe that our methods are of immediate practical value to the UML-based design community.

In this paper we present a novel analysis for complex safety-critical real-time systems involving component-based design and abstraction models. The analysis combines deterministic and probabilistic models for component interfaces; based on the bounded curves (deter-ministically or probabilistically). These results, through the usage of probabilities, can offer different degrees of realtime guarantees (hard or soft), given the system the safety-requirement, and specification. This analysis framework has the flexibility to cope with the different levels of safety-requirement; by acting on the probabilistic bounds and exploring the trade-off between the accuracy of the model and system over-provisioning. Through a case-study we intend to show how the probabilistic abstraction can efficiently and effectively address different degrees of safety requirements in the safety-critical real-time systems.

Considering diverse scenarios in urban traffic, the safety assessment of the decision-making process in automated driving is of great concern for years. And the difficulties of assessing safety lies in the computation of massive spatio-temporal data, the classification of scenarios, and the representation of the uncertainty in the environment with mixed traffic of manned and automated driving. Formal methods are often advocated as the way of increasing confidence in the safety-critical systems via its rigorous mathematical logic. Thus, we propose an assessment scheme which involves: i) the abstract model for decision-making, ii) characterization of composable scenarios, and iii) a corresponding formal verification method to assess safety. The abstract model captures features from the real-time observation and the estimation of the feasible driving alternatives of the surrounding vehicles, as the scenario is regarded as the dynamic evolution of the spatio-temporal data in the static road geometry over time. These features enable the specification and reasoning of the spatial guard conditions and safety properties, and also contribute to the connection and composability of the scenarios. Due to our scenario-based model verification method, we can assess the safety of decisions in scenario transitions by quantitative verification on the probability of the satisfaction of safety property through mapping from our approach to UPPAAL SMC. For illustration, case studies in the fundamental scene structures and the multi-lane roundabout are introduced.

The pacemaker challenge proposed by Software Quality Research Laboratory is looking for formal methods to produce precise and reliable systems. Safety critical systems like pacemaker need to guarantee important properties (like deadlock-free, safety, etc.), which concern human lives. Formal methods have been applied in designing safety critical systems with verified desirable properties. In this paper, we propose a formal model of pacemaker, modeling its behaviors and its communication with the external environment, using a real-time formalism. Critical properties, such as deadlock freeness and heart rate limits are then verified using the model checker PAT(Process Analysis Toolkit). This work yields a verified formal model of pacemaker systems, which can serve as specification for real pacemaker implementations.

A modeling and verification methodology is presented for railway interlocking system which is regarded as a safety-critical system. The methodology utilizes UML (Unified Modeling Language) to model the function requirement and FSM (Finite State Machine) to verify the safety requirements of the specification. The device specifications of railway interlocking system are modeled with UML, and dynamic behaviors of the device and whole system are modeled with FSM, the safety specification is translated LTL (Linear Temporal Logic) and analyzed with NuSMV. We try to show the feasibility of improving the reliability and reducing revalidation efforts when designing and developing a decentralized railway signaling system.

This paper describes our work exploring the suitability of formal specification methods for independent verification and validation (IV&V) of software specifications for large, safety critical systems. An IV&V contractor often has to perform rapid analysis on incomplete specifications, with no control over how those specifications are represented. Lightweight formal methods show significant promise in this context, as they offer a way of uncovering major errors, without the burden of full proofs of correctness. We describe an experiment in the application of the method SCR to testing for consistency properties of a partial model of the requirements for fault detection isolation and recovery on the space station. We conclude that the insights gained from formalizing a specification is valuable, and it is the process of formalization, rather than the end product that is important. It was only necessary to build enough of the formal model to test the properties in which we were interested. Maintenance of fidelity between multiple representations of the same requirements (as they evolve) is still a problem, and deserves further study.

Electronic computing systems are integrating modern multicore processors and GPUs aiming to perform complex software stacks in different life-critical systems, including health devices and emerging self-driving cars. Such systems are expected to experience at least one soft error per day in the near future [1], which may lead to life-threatening failures. This paper presents four novel non-intrusive fault injection techniques that enable full fault injection control and inspection of multicore systems behavior in the presence of faults. Proposed techniques were integrated into a fault injection framework and verified through a real automotive case study with up to 43 billions instructions. Results show that isolating critical application functions can lead to a more efficient soft error analysis with a reduction of masked faults in up to 28%.