Combining Formal Methods and Safety Analysis – The ForMoSA Approach

Reliability analysis of ensemble fault tolerance for soft error mitigation against complex radiation effect

Toward Formal Safety and Performance Evaluation of GNSS-based Railway Localisation Function

With the growing scale of high performance computing platforms and the increasing scientific computing demands, fault tolerance in MPI programs has become a major issue. This paper proposed an analytical performance model to help check pointing mechanisms to get better performance. In this paper, after the introduction of different fault tolerant mechanisms, we focus on the segment-level and variable-level check pointing approaches and analyze how the fault tolerant mechanisms affect the performance of current MPI systems, then we introduced the analytical performance model we proposed. Last we evaluated and analyzed the performance of two classic fault tolerant approaches and propose what should be done to advance variable-level check pointing mechanisms.

This paper is mainly focused on the study of the techniques available for the safety analysis of critical systems. It is never possible to build a completely safe system. There is a possibility to bring the behavior of these systems within acceptable limits. For safety evaluation of such systems both formal and informal techniques are available. Both techniques have their own prospects and consequences. Informal techniques are simpler to learn and easier to interpret and have more space for creativity and imagination of the analyst. Formal techniques due to their rigorousness ensure completeness. In this paper, we have analyzed both techniques after defining few parameters. Our study found it that formal techniques are better but usage of informal techniques can never be overlooked. Some approaches combine formal and informal techniques to reap the benefits of both. In some cases, informal techniques can be used as pre-requisite to narrow down the input of minimal critical set for formal techniques and reduce the effort required for formalization of the entire system.

Software fault tolerance makes system complicated by means of diverse fault-tolerant mechanisms. Aspect-oriented programming has been confirmed as a well suited candidate to ease the problem. However, most of the existing works only focus on implementation level. This paper proposes an AOFTM model for aspect-oriented fault tolerance modeling with Coloured Petri nets at design level. Moreover, the weaving mechanism formally defined conducts the way to derive a woven net from AOFTM. A case study presents how AOFTM works, and its properties are analyzed using the CPN Tools.

Traffic safety issues often impede bicyclist and pedestrian trips, preventing potential users from realizing the benefits of active transport. Traditional active transportation safety analyses, however, take a reactive approach to traffic safety, only accounting for people currently walking or bicycling by analyzing crashes, injuries, and fatalities. This begs the question: which populations are most affected by traffic safety issues neglected by traditional crash analyses? To answer this, we developed a tool to proactively measure perceived traffic safety issues. We focused on child pedestrian and bicycle trips to and from schools in Denver, Colorado by measuring the number of children that would encounter roads perceived as unsafe. We converted these perceptions into barriers in a geographic information system network analysis to estimate trip suppression and used that as a proactive indicator of traffic safety. We finally examined—reactively and proactively—the socio-demographics of those affected via linear regression models and bivariate choropleth mapping. Results of both analyses suggest that negative impacts are borne disproportionately by low-income, low-education, Hispanic, and black neighborhoods. Proactive analyses results identified perceived safety issues in north and northeast Denver neighborhoods neglected by reactive analyses results. Findings suggest the inequitable distribution of traffic safety issues identified in past crash-based literature is graver than conventional reactive analysis would lead one to believe. By incorporating the proactive tool into traditional traffic safety analyses, we hope to better define the places and people that could most benefit from traffic safety improvements, thereby more effectively facilitating the benefits of walking and biking.

Various well-established techniques exist for functional safety analysis of safety-critical avionics systems. Most of these techniques are based on informal models and due to this, analysis is often subjective and success is dependent on the skill of the practitioner. Various standards like DO-178B, IEC 61508 etc. that provide guidelines to perform safety analysis also propose formal verification methods as one of the techniques for functional safety analysis. This technique is based on formal models of the system under development and can be applied on requirements, design and code to get assurance of the respective artifact satisfying a wide variety of functional requirements. In this paper, we present a case study of applying formal verification methods for doing safety analysis of requirements of a generic aircraft flight control system. Flight control system is broadly specified in two parts: mode transition logic part specifies which mode the system is in and represents the function performed by the flight control system. In each mode, certain control laws are executed to implement the various flight control functions. We used a particular technique in formal verification namely that of model checking for analysis. The mode transition logic of a generic auto pilot was modeled and verified using three different open source model checking tools-SPIN, NuSMV and SAL.

Architectural design modeling has emerged as a discipline in a complex system development. To implement early safety analysis, techniques for architectural design have been extended to concern the safety property. Various safety standard profiles, quantitative and qualitative analysis methods are proposed for assessment. However, few of them focuses on the feedback of the safety properties or analysis results on the adjustment to improve original architecture. In this paper, we present an approach to combine safety analysis with architecture modeling. First, we extend the meta-model of our architecture description language - Breeze/ADL with safety elements for design. Second, safety specifications are generated from Breeze/ADL, and then to be converted into Open FTA for FTA (Fault Tree Analysis). Our Breeze/ADL also supports rule definitions to adjust the architecture, to cope with safety problems. Moreover, model checking will be applied to verify the correctness of the adjustment. Finally, the tool Breeze/SA demonstrates the feasibility of our approach.

The US rail industry is charged with developing and implementing interoperable Positive Train Control (PTC) on many lines by 2015. It will be a challenge to assure the overall design safety of this next generation of train control, and there are significant issues with accommodating varying operating methods and different territories. The Federal Railroad Administration (FRA) will also require the railroads to meet the processor-based train control standards in FRA Rule 49CFR236 Sub-Part H (hereinafter FRA Rule 236H) [1], including the requirement for a comparative risk assessment, preferably quantitative. This paper provides an overview of the safety assurance process mandated by the FRA and discusses a cost-effective approach to performing risk assessments on large PTC systems. The paper also recognizes the current FRA and Railroad Safety Advisory Committee (RSAC) effort in developing the new PTC-specific FRA Rule 49CFR236 Sub-Part I to meet the recent PTC legislation requirements. The FRA Rule 236H requires railroads to use a comprehensive approach to generating a risk based, safety case for all PTC-type systems. Following the FRA Rule 236H guidelines helps ensure that all aspects of system safety are addressed, and that a safety conclusion can be successfully drawn from the documented evidence. The FRA requirements for building a safety case are based on time-tested traditional safety analyses which are enhanced to address system-wide safety. A critical new requirement of this standard is the development of a quantitative comparative risk assessment for the system as the formal mechanism for summarizing the safety argument. The FRA Rule 236H requires the comparison of the risk of the new PTC system with the historical risk of the existing system, which will be extremely challenging for the nationwide implementation of interoperable PTC where differing operating methods may be employed on multiple railroads with differing levels of appropriate historical data to reference. These factors must be carefully considered in the risk assessment approach and in the formulation of the overall system safety case argument for this Federally-mandated implementation. The risk assessment process described in this paper is uniquely different from existing quantitative safety assessment approaches that have primarily concentrated on producing a Mean Time Between Hazardous Events (MTBHE) for the various train control components in the system. In contrast to an MTBHE method, FRA rule-compliant comparative risk assessment approaches must evaluate PTC safety in the context of the overall comprehensive system operation, considering the effects of human errors, operating rules/procedures, training practices, system maintenance, equipment failures including any time/sequence dependencies, and the movement of trains and their exposure to potentially hazardous conditions. These considerations have prompted the development of a comprehensive FRA Rule 236H-compliant risk assessment methodology that goes far beyond traditional safety analyses and is well-suited for the assessment of interoperable PTC systems.

The limiting blowdown event for the design of an advanced boiling water reactor (ABWR) containment shifts from a conventional recirculation line break to a feedwater line break (FWLB) by implementing reactor internal pumps. As a result, coupled blowdown from both the reactor pressure vessel (RPV) and the balance of plant (BOP) is involved in the limiting FWLB. Coupled blowdown from both RPV and BOP for the FWLB of the Lungmen ABWR has been successfully analyzed using the advanced RELAP5-3D/K code. To simulate adequately both the RPV and BOP blowdown, the essential simulation scope of an ABWR includes the reactor system, the main steam and turbine systems, the condensate and feedwater systems, the protection system, and the emergency core cooling system. As compared to what was presented in the preliminary safety analysis report of the Lungmen ABWR, unexpected prolonged decays of BOP blowdown flow and enthalpy were calculated. The revised blowdown flow and enthalpy calculated by RELAP5-3D/K from both RPV and BOP breaks provide a new and solid basis for the final safety analysis of ABWR containment for the Lungmen plant, which is scheduled for commercial operation in 2011. The successful modeling of the entire RPV and BOP with RELAP5-3D/K and associated application to the FWLB licensing blowdown analysis indicate that the advanced RELAP5 code can extend its traditional reactor safety analysis to the simulation and analysis of the entire power generation and conversion systems.

Redundant threading architectures duplicate all instructions to detect and possibly recover from transient faults. Several lighter weight Partial Redundant Threading (PRT) architectures have been proposed recently. (i) Opportunistic Fault Tolerance duplicates instructions only during periods of poor single-thread performance. (ii) ReStore does not explicitly duplicate instructions and instead exploits mispredictions among highly confident branch predictions as symptoms of faults. (iii) Slipstream creates a reduced alternate thread by replacing many instructions with highly confident predictions. We explore PRT as a possible direction for achieving the fault tolerance of full duplication with the performance of single-thread execution. Opportunistic and ReStore yield partial coverage since they are restricted to using only partial duplication or only confident predictions, respectively. Previous analysis of Slipstream fault tolerance was cursory and concluded that only duplicated instructions are covered. In this paper, we attempt to better understand Slipstream's fault tolerance, conjecturing that the mixture of partial duplication and confident predictions actually closely approximates the coverage of full duplication. A thorough dissection of prediction scenarios confirms that faults in nearly 100% of instructions are detectable. Fewer than 0.1% of faulty instructions are not detectable due to coincident faults and mispredictions. Next we show that the current recovery implementation fails to leverage excellent detection capability, since recovery sometimes initiates belatedly, after already retiring a detected faulty instruction. We propose and evaluate a suite of simple microarchitectural alterations to recovery and checking. Using the best alterations, Slipstream can recover from faults in 99% of instructions, compared to only 78% of instructions without alterations. Both results are much higher than predicted by past research, which claims coverage for only duplicated instructions, or 65% of instructions. On an 8-issue SMT processor, Slipstream performs within 1.3% of single-thread execution whereas full duplication slows performance by 14%.A key byproduct of this paper is a novel analysis framework in which every dynamic instruction is considered to be hypothetically faulty, thus not requiring explicit fault injection. Fault coverage is measured in terms of the fraction of candidate faulty instructions that are directly or indirectly detectable before.

Summary form only given. Modern circuits contain up to several hundred million transistors and this number grows exponentially over time. Thus, the state-of-the-art design flows have to be improved continuously. In the meantime ensuring correctness becomes a major bottleneck. Up to 80% of the overall design costs are due to verification and even more problems are foreseeable - shrinking feature sizes lead to large process variations, increased susceptibility to radiation, etc. As a result even a correct design may contain faulty components. Thus, robustness is required, i.e. correct operation in presence of faults. Formal verification techniques have gained large attention, since they allow proving the correctness of a circuit and thereby ensure 100% functional correctness. Moreover, the underlying techniques can also be used to prove robustness of a design. Besides being more reliable, formal verification approaches have also shown to be more cost effective in many cases, since test bench creation - usually a very time consuming and error prone task - becomes superfluous. Therefore these techniques allow unveiling faulty behaviour automatically. Proving robustness in the sense of fault tolerance is important. As in any implementation step, faults may tamper the behaviour. In particular, fault tolerance may hide flaws during the standard verification step. Therefore instead of relying on the design's architectural precautions against faults, the implementation has to be proven to be fault tolerant. In this tutorial, after a brief motivation of the overall topic and definition of the problem domain, the alternative verification approaches are explained. Next, the application of the underlying formal techniques for robustness checking is considered. The standard approaches for verification are simulation, emulation and formal methods. Details are discussed related to formal verification, symbolic simulation and assertion based verification. The verification scenarios for equivalence checking (EC) and property checking (PC) are presented and the underlying proof techniques are explained. Robustness checking then also builds on the underlying formal methods. This allows analyzing the robustness of a design fully automatically. Practical scenarios covered by this model for robustness of a circuit are discussed. The model not only yields a measure for the robustness of a circuit but also shows critical parts of the implementation that should be reengineered. In comparison alternative approaches, e.g. using statistical measures, are outlined. Further references are given for all topics are given (see below). Directions for future work and research challenges are discussed.

In this paper we describe initial ideas about modeling and analyzing fault tolerance mechanisms in self managed/self healing systems. Specifications are component based, with coordination mechanisms for building systems from components. A modal action logic is augmented with deontic operators to describe normal vs abnormal behaviours. Fault tolerance mechanisms can be specified in terms of the kind of abnormality encountered and the desired recovery route. Abstract programming models can be systematically constructed from the specifications in LTSA, a finite state, process algebra based modeling tool. LTSA then enables us to check that various properties do or do not hold for the specified fault tolerance mechanisms.

The need to develop an integrated dynamic safety and risk analysis model for decommissioning offshore jacket structures is driven by the risky, expensive and complex nature of the operation. Many of the existing risk analysis techniques applicable to offshore assets failed to recognise and capture evolving risks during different stages of the decommissioning operation. This paper describes risk-based safety model to conduct quantitative risk analysis for offshore jacket decommissioning failure. First, a bow-tie technique is developed to model the accident cause-consequence relationship. Subsequently, a Bayesian belief network is used to update the failure probabilities of the contributing elements and thus, provides a more case-specific and realistic safety analysis when compared to the static nature of a bow-tie. This paper also presents the application of experiential learning in the dynamic safety analysis. The proposed technique is tested using a real-life case study from the Shell Brent Alpha platform. An algorithm to limit the effect of generic failure data was also developed. It is observed that the proposed technique helps to identify hazards shortly before they occur and sensitivity analysis revealed the most critical elements of the operation that must be managed to prevent catastrophe and consequently, reduce associated costs of remediation.

Performance evaluation of the augmented data vortex switch fabric: An all-optical packet switched interconnection network