Model Based Safety Analysis with smartIflow

Basically, aircraft engines can be divided into a control embedded system and a controlled system with its environment. The behaviour of the controlled system is given a priori, while the control system still needs to be designed in a way guaranteeing the correct overall behaviour under all operational conditions depending on the flight domain. A large quantity of functions in control systems can be described by a formal system expressed in block diagrams and state-based representations. These representations can be translated to formal based tools relying on the synchronous languages Signal and Statecharts. SACRES is a tool set supporting the design of safety-critical embedded control systems. It integrates the tools and specification techniques Statemate, Sildex, and Timing Diagrams with tool components for automatic code generation, formal verification based on model checking techniques, and an innovative approach for automatic code validation for target code generated from DC+. Technical achievements are The main benefits of the SACRES approach are reduced risks for design errors and decreased design times and costs for the development of dependable (safety critical) embedded systems. SACRES is an attempt to avoid unpredictability (particularly that arising from late feedback from testing) associated with development of safety critical systems, through the use of the maximum degree of automation, especially in respect of code generation and verification. An outstanding property of SACRES is the combination of specification styles and specification tools being applied in practice with automatic tools to establish provable correctness with respect to required properties. Both dependability and productivity are increased by automatic code generation from high-level specifications such that the generated code can be validated against higher levels by rigorous proofs. These techniques allow traditional tests by sampling to be replaced by rigorous checking techniques which correspond to 100% coverage of test cases. In order to address a global innovative approach in the near future which match the whole software configuration, the SACRES tool set should be interfaced with asynchronous techniques matching the operating system development. This raises an open question in the software development future new process.

Electronic checklist is the key guidance document that the crew of the flight can rely on, which plays an important role in the safe flight. Therefore, the safety analysis and the capture and verification of safety requirements of the electronic checklist system is very important. Traditional safety analysis methods pay less attention to the interaction between the electronic checklist system and the external environment, failing to capture the safety requirements that arise in the interaction, and there is no strict verification of safety requirements of the electronic checklist system. To this end, this paper combines the system theoretic process analysis and the lightweight formalization method, and analysis the safety of electronic checklist system and validates the safety requirement. Firstly, analyzing the risk of the electronic checklist system. Then according to the principle of the implementation of the electronic checklist, constructing the control structure of the electronic checklist system, and identifying the unsafe control behavior of each control loop which could lead to the a hazardous state, then obtaining the safety requirements, and determining how each potential hazardous control action could occur. Finally, we use the lightweight formalization method to formalize the safety requirements and use tools to automatically verify the safety requirements.

With the increase of military and civil aircraft system complexity, the shortage of traditional safety analysis technology goes distinctly, while the Model-based Safety Analysis technology attaches more and more importance. Therefore, this paper presents the background, basic concept and research and application situation of Model-based Safety Analysis technology, identifies the benefit of it. This paper also presents a framework of taking Model-based Safety Analysis into airplane safety assessment process, and a case study of performing MBSA in powerplant system is given to shown the effect of MBSA. Finally, this paper analyses the shortage and challenge of Model-based Safety Analysis considering its application in aircraft safety assessment process.

A service robot especially a care-providing robot, works in the vicinity of a human body and is sometimes even in direct contact with it. Conventional safety methods and precautions in industrial robotics are not applicable to such robots. This paper presents a safety approach for designing the safe care-providing robot FRIEND. The approach is applied in each step of design iteratively to identify and assess the potential hazards during design. The steps are explained briefly in this work. The main contribution of this paper is verification of safety requirements using the Ramadge-Wonham (RW) framework. The greater complexity of the tasks the robot will perform, the more complex is the identification of safety requirements. Use of this framework led us to analyze the requirements and verify them formally, systematically and on a modular basis. In our approach human-robot interaction (HRI) is also modeled by a set of uncontrolled events that may happen any time during operation. Subsequently the safety requirements are modified to consider these interactions. As a result the safety module behaves like a controller, running in parallel with the system, which maintains the system safe and works according to the safety requirements by enabling the admissible sequences of events.

A binary-tree-based finite state machine (BT-FSM) is a state machine with a 1-bit input signal whose state transition graph is a binary tree. BT-FSMs are useful in those application areas where searching in a binary tree is required, such as computer networks, compression, automatic control, or cryptography. This paper presents a new architecture for implementing BT-FSMs which is based on the model finite virtual state machine (FVSM). The proposed architecture has been compared with the general FVSM and conventional approaches by using both synthetic test benches and very large BT-FSMs obtained from a real application. In synthetic test benches, the average speed improvement of the proposed architecture respect to the best results of the other approaches achieves 41% (there are some cases in which the speed is more than double). In the case of the real application, the average speed improvement achieves 155%.

Topology-based Safety Analysis for Safety Critical CPS

The finite state machine (FSM) needed for the low power system pulse frequency modulated (PFM) mode in a buck converter is usually asynchronous because the fast clock needed for a synchronous FSM consumes too much power, or is maybe even not available. However, the implementation, verification and testing of a asynchronous FSM is complicated compared to an synchronous one. This paper presents a concept of a semi-synchronous FSM that combines the benefits of both synchronous and asynchronous state machines. The result is a FSM which runs at high clock frequency, consumes very little power and can be implemented, verified and tested as a synchronous FSM. This concept has been used to design a PFM FSM in a field programmable gate array (FPGA) and in a 65 nm CMOS technology.

To handle stricter safety regulations combined with increasing complexity and shorter development cycles, it is necessary to consider safety aspects starting from the early phases of design. This paper presents an approach to link methods of safety analysis and modeling (SysML). Even though SysML and MBSE are common in the early stages of system design, there is a lack of methods integrating model-based design activities and safety analyses. Existing approaches either focus on particular tasks or build models after conducting separate safety analyses. Our presented approach, tailored to early stages of system design, introduces a "Hazard Analysis" SysML profile accompanied by a procedure for its application within a model-based safety analysis. It provides a preliminary hazard analysis and facilitates the systematic identification of safety-critical functions and components.

Software reviews are one of the most efficient quality assurance techniques in software engineering. They are required for the enhancement of the software quality in early phases of the development process and often used in development of safety critical systems. In the field of software engineering for Air Traffic Management (ATM) the standard DO-278/ED-109 requires the rigorous application of code reviews and fully traceable reporting of the results. This case study presents a process and an IDE-integrated tool that complies with the requirements of the standard.

This paper provides a novel method of identifying a set of design faults in Simulink\TargetLink models and production code generation well before generating the test cases. These models can be used for development of safety critical systems. We have developed stand-alone application which transforms TargetLink model to EA compatible UML (Unified Modeling Language) model represented as packages and composite structure diagrams. The entire process makes use of dSPACE and MathWorks tools.

Reliability study of complex physical systems using SysML

Software Product Line Engineering (SPLE) is a software development paradigm that aims at reducing the development effort and shorting time-to-market through systematic software reuse. While this paradigm has been successfully applied for the development of embedded systems in various domains, new challenges have emerged from the development of safety critical systems that require certification against a specific standard. Existing SPLE approaches do not explicitly consider the various certification standards or levels that products should satisfy. In this paper, we focus on several practical issues involved in the SPLE process, establishing an infrastructure of a product line engineering for certified products. A metamodel is proposed to capture the entities involved in SPL certification and the relationships among them. ProLiCES, which is a model-driven process for the development of SPLs, was modified to serve as an example of our approach, in the context of the UAV (Unmanned Aerial Vehicle) domain.

IEC 61508 is widely viewed as the best available international generic standard for the management of functional safety in the development, operation and support of electrical, electronic and programmable electronic systems (EEPES). There is a danger, of course, that the existence of IEC 61508 will be seen as the solution to a wider range of problems in the development of safety-critical systems than such a standard could be capable of addressing. The suitability of IEC 61508 for the specification of relatively simple protection systems is not in doubt. However, in considering how effectively IEC 61508 could be used in the more complex environment of transport-infrastructure systems, the paper discusses the fundamental nature of, and means of deriving, safety requirements and considers how effectively compliance to the Standard may be used to provide assurance that a system is safe. From these discussions, the paper concludes on the feasibility and value of system certification against IEC 61508.

This paper presents details of a model checker for security protocols, called ASM-SPV (Abstract State Machines-Security Protocols Verifier), which employs the on-the-fly model checking technique as the convenient verification method and directly supports the whole Core- ASM language. Security protocol is modeled as distributed abstract state machines and the property to be verified is specified in form of the CTL (Computation Tree Logic) formula in the model checker. This paper also introduces the features of the model checker in detail and shows the efficiency and usability by taking the verification of the authentication of Helsinki protocol as an example. Then advantages over FDR are presented and the runtime performance and memory consumption are also given compared with that of [mc]square.

The effective reuse of design assets in safety-critical Software Product Lines (SPL) would require the reuse of safety analyses of those assets in the variant contexts of certification of products derived from the SPL. This in turn requires the traceability of SPL variation across design, including variation in safety analysis and safety cases. In this paper, we propose a method and tool to support the automatic generation of modular SPL safety case architectures from the information provided by SPL feature modeling and model-based safety analysis. The Goal Structuring Notation (GSN) safety case modeling notation and its modular extensions supported by the D-Case Editor were used to implement the method in an automated tool support. The tool was used to generate a modular safety case for an automotive Hybrid Braking System SPL.