Reliability study of complex physical systems using SysML

This book is a practical guide for the development and qualification of safety-critical systems, standards compliance, and use of formal methods and tools.

Basically, aircraft engines can be divided into a control embedded system and a controlled system with its environment. The behaviour of the controlled system is given a priori, while the control system still needs to be designed in a way guaranteeing the correct overall behaviour under all operational conditions depending on the flight domain. A large quantity of functions in control systems can be described by a formal system expressed in block diagrams and state-based representations. These representations can be translated to formal based tools relying on the synchronous languages Signal and Statecharts. SACRES is a tool set supporting the design of safety-critical embedded control systems. It integrates the tools and specification techniques Statemate, Sildex, and Timing Diagrams with tool components for automatic code generation, formal verification based on model checking techniques, and an innovative approach for automatic code validation for target code generated from DC+. Technical achievements are The main benefits of the SACRES approach are reduced risks for design errors and decreased design times and costs for the development of dependable (safety critical) embedded systems. SACRES is an attempt to avoid unpredictability (particularly that arising from late feedback from testing) associated with development of safety critical systems, through the use of the maximum degree of automation, especially in respect of code generation and verification. An outstanding property of SACRES is the combination of specification styles and specification tools being applied in practice with automatic tools to establish provable correctness with respect to required properties. Both dependability and productivity are increased by automatic code generation from high-level specifications such that the generated code can be validated against higher levels by rigorous proofs. These techniques allow traditional tests by sampling to be replaced by rigorous checking techniques which correspond to 100% coverage of test cases. In order to address a global innovative approach in the near future which match the whole software configuration, the SACRES tool set should be interfaced with asynchronous techniques matching the operating system development. This raises an open question in the software development future new process.

This paper provides a novel method of identifying a set of design faults in Simulink\TargetLink models and production code generation well before generating the test cases. These models can be used for development of safety critical systems. We have developed stand-alone application which transforms TargetLink model to EA compatible UML (Unified Modeling Language) model represented as packages and composite structure diagrams. The entire process makes use of dSPACE and MathWorks tools.

Verification of safety requirements is one important task during the development of safety critical systems. The increasing complexity of systems makes manual analysis almost impossible. This paper introduces a new methodology for formal verification of technical systems with smartIflow (State Machines for Automation of Reliability-related Tasks using Information FLOWs). smartIflow is a new modeling language that has been especially designed for the purpose of automating the safety analysis process in early product life cycle stages. It builds up on experience with existing approaches. As is common practice in current approaches, components are modeled as finite state machines. However, new concepts are introduced to describe component interactions. Events play a major role for internal interactions between components as well as for external (user) interactions. Our approach to the verification of formally specified safety requirements is a two-step method. First, an exhaustive simulation creates knowledge about a great variety of possible behaviors of the system, especially including reactions on suddenly occurring (possibly intermittent) faults. In the second step, safety requirements specified in CTL (Computation Tree Logic) are verified using model checking techniques, and counterexamples are generated if these are not satisfied. The practical applicability of this approach is demonstrated based on a Java implementation using a simple Two-Tank-Pump-Consumer system.

Software reviews are one of the most efficient quality assurance techniques in software engineering. They are required for the enhancement of the software quality in early phases of the development process and often used in development of safety critical systems. In the field of software engineering for Air Traffic Management (ATM) the standard DO-278/ED-109 requires the rigorous application of code reviews and fully traceable reporting of the results. This case study presents a process and an IDE-integrated tool that complies with the requirements of the standard.

Software Product Line Engineering (SPLE) is a software development paradigm that aims at reducing the development effort and shorting time-to-market through systematic software reuse. While this paradigm has been successfully applied for the development of embedded systems in various domains, new challenges have emerged from the development of safety critical systems that require certification against a specific standard. Existing SPLE approaches do not explicitly consider the various certification standards or levels that products should satisfy. In this paper, we focus on several practical issues involved in the SPLE process, establishing an infrastructure of a product line engineering for certified products. A metamodel is proposed to capture the entities involved in SPL certification and the relationships among them. ProLiCES, which is a model-driven process for the development of SPLs, was modified to serve as an example of our approach, in the context of the UAV (Unmanned Aerial Vehicle) domain.

In control theory, models of physical processes, such as systems of differential equations, are usually checked against specifications, such as stability and set invariance. In formal methods, rich specifications, such as languages and formulae of temporal logics, are checked against models of software programs and digital circuits, such as finite transition graphs. With the development and integration of cyber physical and safety critical systems, there is an increasing need for computational tools for verification and control of complex systems from rich, temporal logic specifications. The formal verification and synthesis problems have been shown to be undecidable even for very simple classes of infinitespace continuous and hybrid systems. However, provably correct but conservative approaches, in which the satisfaction of a property by a dynamical system is implied by the satisfaction of the property by a finite over-approximation (abstraction) of the system, have received a lot of attention in recent years. Some classes of systems allowing for computationally efficient verification and control from temporal logic specifications are reviewed. For continuous and discrete-time linear systems and continuous-time multi-linear systems, it is shown that finite abstractions can be constructed through polyhedral operations only. By using techniques from model checking and automata games, this allows for verification and control from specifications given as Linear Temporal Logic (LTL) formulae over linear predicates in the state variables. A connection between the existence of Lyapunov functions and finite bisimulations is established for discrete-time linear and switched linear systems. Finally, optimality and correctness requirements are combined in a model predictive approach to generate control strategies for discrete-time linear systems. The usefulness of these computational tools is illustrated with various examples such as verification and synthesis of biological circuits in synthetic biology and motion planning and control in robotics.

A Contract-based Approach to Specifying and Verifying Safety Critical Systems

Model driven engineering is widely used in the development of complex and safety critical systems. Systems’ designs are specified and validated in domain specific modeling languages and software code is often produced by autocoding. Thus the correctness of the final systems depend on the correctness of those tools. We propose an approach for the formal verification of code generation from dataflow languages, such as Simulink, based on translation validation. It relies on the BlockLibrary DSL for the formal specification and verification of the structure, semantics and variability of the complex block libraries found in these languages. These specifications are then used here for deriving model and block-specific semantic contracts that will be woven into the generated C code. We present two different approaches for performing the block matching and weaving step. Finally, we rely on the Frama-C toolset and state-of-the-art SMT solvers for verifying the annotated code.

Formal verification plays an important role in development and application of safety critical systems. Formalized verification techniques to analyze the security and the safety properties of communication protocols increase and confirm the protocol confidence the advancement of mobile and wireless communication technologies in recent years introduced various adaptive protocols to adapt the need for secured communications. Security is a crucial success factor for any communication protocols, especially in mobile environment due to its ad hoc behavior. SPIN is a powerful model checker that verifies the correctness of distributed communication models in a rigorous and automated fashion. This paper presents a SPIN based formal verification approach of a security adaptive protocol suite. The protocol suite includes a neighbor discovery mechanism and routing protocol. The protocol suite is encoded into SPIN and is exhaustively checked for various temporal properties ensuring the applicability of the protocol suite in real-life applications.

Patients in the intensive care unit (ICU) are exposed to multiple potentially critical complications such as delirium, acute lung injury, acute renal failure, and sepsis. Those who suffered critical complications and survived often require costly long term care, e.g., post-hospital treatment attributed to delirium alone adds $143-152 billion per year to U.S. healthcare costs. Delirium in hospitalized patients could be reduced by 30-40% if first rate care is widely available. However, “mass production” of low cost expert physicians is impossible. In 2010, ICUs already comprised 20% of hospitals' budgets in U.S. As the population ages, ICU usages will intensify. The magnitude of challenges faced in the ICU is enormous, and complicated by the fact that critical complications in ICU mentioned above are NOT single diseases. They are syndromes with a very wide range of precipitating factors, including aging, surgery, trauma, anesthesia, compromised immunity, systemic inflammation, infection or drug side effects. For example, with disparate mechanisms of onset, patients with sepsis have highly variable presentations: one may have a fever and high white blood cell count while another has a low body temperature and low white blood cell count. This is also a complex big data challenge. A critically ill patient can generate up to a million data points per hour from monitoring devices that need to be analyzed together with medical records, genetic profile and physicians' insight. To address these challenges, it is important to create an accurate and robust model of the pathophysiological organ interactions and the effect and side effects of treatments, using physician supervised machine learning that integrates the conventional clinical data, biomarkers and genetic profile. Such a quantitative model will provide key description of characteristic patterns in critical complications, leading to early warning and timely preventive intervention. The success will open a new scientific frontier, cyber - medical systems: ushering synchronized advancement of medicine, nano-biosensors, genetics, machine learning and safety critical system integration architecture and development process. This will improve almost all aspects of medicine, creating a new industry segment, and greatly reduce costs of health care.

Context. Development of safety-critical systems is mostly governed by process-heavy paradigms, while increasing demands on flexibility and agility also reach this domain. Objectives. We wanted to explore in more detail the industrial needs and challenges when facing this trend. Method. We launched a qualitative survey, interviewing engineers from four companies in four different industry domains. Results. The survey identifies human factors (skills, experience, and attitudes) being key in safety-critical systems development, as well as good documentation. Certification cost is related to change frequency, which is limiting flexibility. Component reuse and iterative processes were found to increase adaptability to changing customer needs. Conclusions. We conclude that agile development and flexibility may co-exist with safety-critical software development, although there are specific challenges to address.

In recent years, the UK Health and Safety Executive, the Institution of Electrical Engineers and the British Computer Society have collaborated in the management of a project to produce a set of competencies for engineers working in the sensitive area of safety-critical or safety-related systems. The resulting document owed much to the existence of the international standard IEC 61508. The development of competency descriptors for those involved in the design and development of safety-critical systems has led to some consideration of the properties of these competencies and to principles that may be applied in a more general setting. This article aims to capture these thoughts.

Safety assurance and certification are amongst the most expensive and time-consuming tasks in the development of safety-critical systems. The increasing complexity and size of these systems combined with their growing market demand requires the industry to implement a coherent reuse strategy. A key difficulty appears when trying to reuse products from one application domain in another, because different domains are subject to different safety regulations. Subsequently, for a reused product, the full safety assurance and certification process has to be applied, just as for a new product. This reduces the return on investment of such reuse. Further, market trends strongly suggest that many future safety-critical systems will be comprised of heterogeneous, dynamic coalitions of systems of systems. For this type of systems, it is crucial to develop sound strategies that would allow safety assurance and certification to be done compositionally.

In this article we would like to present some recent applications of the B formal method to the development of safety critical system. These SIL3/SIL4 compliant systems have their functional specification based on a formal model. This model has been proved, guaranteeing a correct by construction behaviour of the system in absence of failure of its components. The constructive process used during system specification and design leads to a high quality system which has been qualified by French authorities.