Formal Model Based Safety Assessment Marco Bozzano, Roberto Cavada, - PowerPoint PPT Presentation

NuSMV3: a framework for Formal Model Based Safety Assessment Marco Bozzano, Roberto Cavada, Alessandro Cimatti, Cristian Mattarei Fondazione Bruno Kessler, Trento (Italy)

Roadmap • Formal Model Based Safety Assessment • Formal Safety Assessment – Current approach – Automated Fault Extension • NuSMV3 formal verification framework • Next challenges

Model Based Safety Assessment System Verification and Requirements System Testing Integration Verification Architecture Integration and Testing Implementation 3

Model Based Safety Assessment System Verification and Requirements System Testing FHA System Fault Tree System SA Analysis Integration Verification Architecture Integration and Testing Architecture FTA and Preliminary SA System SA FMEA tables Implementation 4

Model Based Safety Assessment System Verification and Requirements System Testing FHA System Fault Tree System SA Analysis Integration Verification Architecture Integration and Testing Architecture FTA and Preliminary SA System SA FMEA tables Implementation 5

Model Based Safety Assessment Model the system (nominal) Check if the model satisfies the Counter examples requirements Model the system (nominal and faulty) Check if the model satisfies the Fault Trees safety requirements FMEA tables 6

Model Based Safety Assessment Model the system (nominal) Check if the model satisfies the Counter examples requirements Model the system (nominal and faulty) Check if the model satisfies the Fault Trees safety requirements FMEA tables 7

Model Based Safety Assessment Model the system (nominal) Check if the model satisfies the Counter examples requirements Model the system (nominal and faulty) Check if the model satisfies the Fault Trees safety requirements FMEA tables 8

Roadmap • Formal Model Based Safety Assessment • Formal Safety assessment – Current approach – Automated Fault Extension • NuSMV3 formal verification framework • Next challenges

Fault Extension: the idea Formal model (nominal) Faulty model (extended) 10

Manual Extension 11

Manual Extension PROS • Highly expressive • Does not need extra tools CONS • Error prone • Not traceable process • Time consuming 12

Fault Injection 13

Fault Injection Nominal behavior 14

Fault Injection Nominal behavior 0 1 Faulty behavior 15

Fault Injection Nominal behavior 0 1 Faulty behavior Mode selector 16

Fault Injection PROS • Keeps nominal and fault model disjoint • Traceable process • Automatic technique • “Once and for all” validation CONS • Needs functional modeling 17

Fault Injection (FSAP) Nominal behavior 0 1 Faulty behavior Mode selector 18

Fault Extension approaches Manual extension Fault Injection FSAP Library Based FI NuSMV3 19

Library Based Fault Injection m' m Nominal behavior 0 m' m' 1 Faulty behavior 1 2 m' n Faulty behavior 2 … m' Faulty behavior n Mode selector 20

Faults Libraries • Effects model library One effect model describes the effects on the associated nominal component when a fault occurs e.g.: stuck at a value, invert a value, a value ramps down, … • Local dynamics model library One local dynamic model describes the behavior of the fault e.g.: a permanent or transient fault, self repair after 10 seconds, … 21

Library Based Fault Injection • Support for complex behavior – hybrid and discrete semantics – multiple input support – global dynamics interaction • Easily extendable library definition – effects model and local dynamics • User friendly and aided approach – human readable files definition – guided extension via GUI 22

Flow of the Fault Extension Fault libraries Extension Nominal Extension info Manager model Model Extender Extended model 23

Flow of the Fault Extension Nom Nom Comp Effects Model em em em Comp 1 2 n Library … Local Dynamics Library ld 1 ld 2 ld n Nominal Nom Model Comp fm n fm 1 fm 2 N Extension Info fm 1 fm 2 fm n 24

Roadmap • Formal Model Based Safety Assessment • Formal Safety assessment – Current approach – Automated Fault Extension • NuSMV3 formal verification framework • Next challenges

Flow of Formal MBSA Fault Extension Formal Verification Fault Temporal libraries Extended property model Extension Nominal Extension Manager model info Model Extender Counter Fault Tree FMEA table example 26

NuSMV3: Architecture Altarica Matlab Simulink AADL Altarica2HyDI MatlabSL2HyDI AADL2SMV NuSMV3 Addons Safety Model Extender HyDI … Assessment NuSMV 2 MathSAT5 CUDD MiniSAT 27

Adder Example 28

Adder example: Nominal Model random1 bit1 adder random2 bit2 29

Adder example: components may fail random1 bit1 adder random2 bit2 Components Effect Model Local Dynamics bit1, bit2 StuckAt(0) Permanent bit1, bit2 StuckAt(1) Permanent bit1, bit2 Inverted Transient 30

Adder example: components may fail random1 bit1 adder random2 bit2 Components Effect Model Local Dynamics bit1, bit2 StuckAt(0) Permanent bit1, bit2 StuckAt(1) Permanent bit1, bit2 Inverted Transient adder StuckAt(0) Permanent adder StuckAt(1) Permanent 31

Example: bits fault model composition StuckAt(0) StuckAt(1) Inverted Permanent Permanent Transient fm 1 fm 2 fm 3 N fm 1 fm 2 fm 3 global dynamics 32

Analysis Results 33

Example: Fault Tree Analysis Top Level Event : random1 = 0 & random2 = 0 & adder.output != 0 (check when 0 + 0 != 0) 34

Example: FMEA tables FMEA TABLE ORDER 1 Id.Nr. Failure Mode Failure Effects 1 bit1.output inverted ((random1=0 & random2 = 0) & adder.output !=0) 2 bit1.output stuck_at_1 ((random1=0 & random2 = 0) & adder.output !=0) 3 bit2.output inverted ((random1=0 & random2 = 0) & adder.output !=0) 4 bit2.output stuck_at_1 ((random1=0 & random2 = 0) & adder.output !=0) 5 adder.output stuck_at_1 ((random1=0 & random2 = 0) & adder.output !=0) FMEA TABLE ORDER 2 Id.Nr. Failure Mode Failure Effects 1 bit1.output inverted ((random1=0 & random2 = 0) & adder.output !=0) 2 bit1.output stuck_at_1 ((random1=0 & random2 = 0) & adder.output !=0) 3 bit2.output inverted ((random1=0 & random2 = 0) & adder.output !=0) 4 bit2.output stuck_at_1 ((random1=0 & random2 = 0) & adder.output !=0) 5 adder.output stuck_at_1 ((random1=0 & random2 = 0) & adder.output !=0) 6 bit1.output inverted & bit1.output stuck_at_0 ((random1=0 & random2 = 0) & adder.output !=0) 7 bit1.output inverted & bit1.output stuck_at_1 ((random1=0 & random2 = 0) & adder.output !=0) 8 bit1.output inverted & bit2.output inverted ((random1=0 & random2 = 0) & adder.output !=0) 9 bit1.output inverted & bit2.output stuck_at_0 ((random1=0 & random2 = 0) & adder.output !=0) 10 bit1.output inverted & bit2.output stuck_at_1 ((random1=0 & random2 = 0) & adder.output !=0) 11 bit1.output inverted & adder.output stuck_at_1 ((random1=0 & random2 = 0) & adder.output !=0) 12 … 35

Conclusion Library based fault extension • Highly Expressive • Automated technique • Time saving • Traceable process Next challenges • Extension of expressiveness for library based fault injection • Integration with industrial design tools 36

Thank you! Cristian Mattarei FBK ES-Group mattarei@fbk.eu