Complex Safety-critical Systems Research Articles

Formal modeling and verification method for Simulink-MDL requirement model

Abstract As complex safety-critical system software becomes more powerful, so does the complexity of its design requirements. Modeling and analyzing design requirements at an early stage has become an integral part of the entire development process for complex safety-critical system software. Simulink is a system modeling and simulation tool used in aviation and other fields. Its model is stored in the form of MDL files. ART (Avionics Requirement Tools) is a requirement modeling and analysis verification tool for the aviation field. It uses VRM (Variable Relation Model) as the theoretical model and can accept VRM and its extended subsets as input models and verify them in the tool. The work of this paper is oriented to the typical software requirements in the field of avionics systems and proposes a formal modeling and verification method for Simulink-MDL models. First, the composition form and structure of the MDL model are analyzed in the article. The functions and semantics of various elements in the model are given. Then a formal modeling method of the MDL model is given. Finally, a simplified version of the flight guidance control system is used for modeling and verification to demonstrate the usability and effectiveness of this method.

Collecting and Organizing the Influencing Factors of Team Communications to Handle Nuclear Power Plant Emergencies

A nuclear power plant (NPP), as a complex safety-critical system, requires qualified operators working in teams. Interactions between operators in the main control room (MCR) team are important to ensure safe operation. Since communication is the basis of the operators’ interactions, team communication is a significant factor affecting teamwork performance. Especially during NPP emergencies, poor team communication may lead to incorrect decisions and countermeasures, causing deterioration toward accidents. Moreover, in an emergency situation, emergency response teams are assembled. This multi-team and critical work condition further emphasizes the need for effective and accurate team communication. We collected the factors influencing team communication in NPP emergencies using a literature review combined with text mining. Our method for extracting the influencing factors consists of four steps; then, by applying topic modeling from text mining, we complemented the influencing factors. The resulting list of influencing factors of team communications for handling NPP emergencies is organized into five elements: individual, team, communication, NPP tasks, and external elements. Discussions on the team communication model, applicability, communication errors, and emergency response teams are also presented.

Towards Abstraction-based Probabilistic Program Analysis

Probabilistic programs that can represent both probabilistic and non-deterministic choices are useful for creating reliability models of complex safety-critical systems that interact with humans or external systems. Such models are often quite complex, so their analysis can be hindered by state-space explosion. One common approach to deal with this problem is the application of abstraction techniques. We present improvements for an abstraction-refinement scheme for the analysis of probabilistic programs, aiming to improve the scalability of the scheme by adapting modern techniques from qualitative software model checking, and make the analysis result more reliable using better convergence checks. We implemented and evaluated the improvements in our Theta model checking framework.

Coupling of adjoint-based Markov/CCMT predictive analytics with data assimilation for real-time risk scenario forecasting of industrial digital process control systems

Risk early detection and controls are critical to avoid unforeseen accidents or incidents across safety-critical industries especially in a digitalization context. Using the sequential Monte Carlo particle filter method, an adjoint-based Markov/Cell-to-Cell Mapping Technique (Markov/CCMT) predictive analytics coupling with data assimilation is proposed in the paper for dynamic risk and reliability scenario modeling of industrial digital process control systems. The particle filter-based data assimilation method is developed with a sequential importance sampling with resampling scheme for extended system state estimation and dynamic reshaping of system state-space model. Then the Markov/CCMT predictive analytics models are dynamically constructed using an equal-weight quadrature scheme for approximating the probabilistic cell-to-cell mapping relations that reflect the possible system state transitions on the discretized state-space model in real time. The adjoint-based Markov/CCMT modeling for risk scenario forecasting is demonstrated on a digital U-shaped Tube Steam Generator (UTSG) water level control system in nuclear power plants. The demonstration results show that super real-time and consistent predictions can be obtained within the adjoint-based Markov/CCMT predictive analytics framework. Multi-step time-series forecasting towards the identification of system-level degradation states and risk-significant scenarios evolution can also be envisioned when a blended state merging and pruning strategy is adopted in deep model search. The proposed Markov/CCMT predictive analytics is able to deliver proactive insights to intelligent operation and maintenance of complex safety-critical engineering systems.

Fusing physics-based and deep learning models for prognostics

Physics-based and data-driven models for remaining useful lifetime (RUL) prediction typically suffer from two major challenges that limit their applicability to complex real-world domains: (1) the incompleteness of physics-based models and (2) the limited representativeness of the training dataset for data-driven models. Combining the advantages of these two approaches while overcoming some of their limitations, we propose a novel hybrid framework for fusing the information from physics-based performance models with deep learning algorithms for prognostics of complex safety-critical systems. In the proposed framework, we use physics-based performance models to infer unobservable model parameters related to a system’s components health by solving a calibration problem. These parameters are subsequently combined with sensor readings and used as input to a deep neural network, thereby generating a data-driven prognostics model with physics-augmented features. The performance of the hybrid framework is evaluated on an extensive case study comprising run-to-failure degradation trajectories from a fleet of nine turbofan engines under real flight conditions. The experimental results show that the hybrid framework outperforms purely data-driven approaches by extending the prediction horizon by nearly 127%. Furthermore, it requires less training data and is less sensitive to the limited representativeness of the dataset as compared to purely data-driven approaches. Furthermore, we demonstrated the feasibility of the proposed framework on the original CMAPSS dataset, thereby confirming its superior performance.

Contrastive Learning for Fault Detection and Diagnostics in the Context of Changing Operating Conditions and Novel Fault Types.

Reliable fault detection and diagnostics are crucial in order to ensure efficient operations in industrial assets. Data-driven solutions have shown great potential in various fields but pose many challenges in Prognostics and Health Management (PHM) applications: Changing external in-service factors and operating conditions cause variations in the condition monitoring (CM) data resulting in false alarms. Furthermore, novel types of faults can also cause variations in CM data. Since faults occur rarely in complex safety critical systems, a training dataset typically does not cover all possible fault types. To enable the detection of novel fault types, the models need to be sensitive to novel variations. Simultaneously, to decrease the false alarm rate, invariance to variations in CM data caused by changing operating conditions is required. We propose contrastive learning for the task of fault detection and diagnostics in the context of changing operating conditions and novel fault types. In particular, we evaluate how a feature representation trained by the triplet loss is suited to fault detection and diagnostics under the aforementioned conditions. We showcase that classification and clustering based on the learned feature representations are (1) invariant to changing operating conditions while also being (2) suited to the detection of novel fault types. Our evaluation is conducted on the bearing benchmark dataset provided by the Case Western Reserve University (CWRU).

Healthcare workers’ perspectives on participatory system dynamics modelling and simulation: designing safe and efficient hospital pharmacy dispensing systems together

With increasingly complex safety-critical systems like healthcare being developed and managed, there is a need for a tool that permits decision-makers to better understand the complexity, test various strategies and guide effective changes. System Dynamics (SD) modelling is an effective approach that can aid strategic decision-making in healthcare systems but has been underutilised partly due to the challenge of engaging healthcare stakeholders in the modelling process. This paper, therefore, investigates the applicability of a participatory SD approach based on healthcare workers’ perspectives on ease of use (usability) and usefulness (utility). The study developed an interactive simulation dashboard platform which facilitated participatory simulation for exploring various hospital pharmacy staffing level arrangements and their impacts on interruptions, fatigue, workload, rework, productivity and safety. The findings reveal that participatory SD approach can enhance team learning by converging on a shared mental model, aid decision-making and identifying trade-offs. The implications of these findings are discussed as well as experience and lessons learned on modelling facilitation. Practitioner Summary: This paper reports the perspectives of healthcare workers, who were engaged with a participatory system dynamics modelling and simulation process for hospital pharmacy staffing level management. Evaluative feedback revealed that the participatory SD approach can be a valuable tool for participatory ergonomics by helping the participants gain a deeper understanding of the complex dynamic interactions between workload, rework, safety and efficiency. Abbreviations: SD: system dynamics; ETTO: efficiency-thoroughness trade-off

Diversity of graph models and graph generators in mutation testing

When custom modeling tools are used for designing complex safety-critical systems (e.g., critical cyber-physical systems), the tools themselves need to be validated by systematic testing to prevent tool-specific bugs reaching the system. Testing of such modeling tools relies upon an automatically generated set of models as a test suite. While many software testing practices recommend that this test suite should be diverse, model diversity has not been studied systematically for graph models. In the paper, we propose different diversity metrics for models by generalizing and exploiting neighborhood and predicate shapes as abstraction. We evaluate such shape-based diversity metrics using various distance functions in the context of mutation testing of graph constraints and access policies for two separate industrial DSLs. Furthermore, we evaluate the quality (i.e., bug detection capability) of different (random and consistent) model generation techniques for mutation testing purposes.

Performance evaluation of safety-critical systems of nuclear power plant systems

Abstract The complexity of safety critical systems of Nuclear Power Plant continues to increase rapidly due its transition from analog to digital systems. It has thus become progressively more imperative to model these systems prior to their implementation in order to meet the high performance, safety and reliability requirements. Timed Petri Nets (TPNs) have been widely used to model such systems for non-functional analysis. The paper presents a novel methodology for the analysis of the performance metrics using PN modeling. The paper uses the isomorphism property of the TPNs and the Markov chains for the performance analysis of the safety critical systems. The presented methodology has been validated on a Shutdown System of a Nuclear Power Plant.

Критерии, предъявляемые к программному обеспечению для разработки сложных сертифицируемых систем, критичных по безопасности

Nowadays there is an actual problem in aviation industry - how to make the development of complex safety-critical systems certifiable according to international and domestic standards and regulations like DO-178C, DO-254, ARP 4754A, ARP 4761 etc. In the article configuration management process from the development lifecycle of DO-178C is considered as the main source of criteria for the development tool selection. Selected criteria can be applied to software tool, which supports entire development lifecycle of aviation software, as well as to software tools supporting some individual lifecycle processes. The activities of configuration management process provide work with all project lifecycle data, its storage, integrity, security, manageability and information support for data exchange between the remaining lifecycle processes, maintenance of the history of changes etc. Compliance with the principles of the configuration management process allows project managers to control development, ensure the required quality and reliability of the product; also, its certifiability and the necessary level of confidence in security, reduce financial and time development costs. As example of using criteria one of the most widely known in industry software tool for requirements development and management was analyzed for compliance with the chosen criteria.

Enhance GO methodology for reliability analysis of the closed-loop system using Cyclic Bayesian Networks

Abstract GO methodology is a success-oriented method for reliability analysis of complex safety critical system, which existing in various fields, such as aircraft carrier, nuclear plant, petrochemical plant, etc. However, the traditional GO methodology is insufficient in modeling the system with feedback signals, which are common in those systems. The challenge lies in modeling the closed-loop feedback process and its algorithms. To address this issue, an approach based on Cyclic Bayesian Networks (CBNs) is presented in this paper to enhance its capability of feedback modeling. In the approach, Type 9 operator is the key element to be introduced to simulate a component with feedback signal, and then the GO model can be cyclic to represent a system with feedback loops; furthermore, we compare the decision capability of the GO and BN methodologies in dynamic structure and uncertainty handling. Considering the complexity of the analysis of the GO method, the cyclic GO model is mapped to its corresponding CBNs according to some mapping rules. And leveraging matured algorithms and toolkit of BNs, we can not only obtain the probability of each node in each state via failure propagation, but also identify critical events given the event occurrence via backward reasoning. Eventually, a case of chemical treatment tank liquid level controlling minus-feedback system is analyzed to demonstrate the approach’s feasibility, and by enhancing the capability with loop structured system modeling, the approach makes GO methodology more practical in more modern complex engineering systems with feedback loops.

SEU emulation in industrial SoCs combining microprocessor and FPGA

FPGAs (Field-Programmable Gate Array) and FPGA-based SoCs (System-on-chip) are electronic devices which offer high computational performance and low time-to-market for low and medium production volumes. They are gaining popularity in critical sectors, such as automotive, aerospace, avionics and railway, making their reliability evaluation mandatory. FPGAs are notoriously sensitive to SEUs (Single Event Upsets), which are random memory errors provoked by radiation particles. The failure rate of an FPGA varies with the implemented design, depending on the amount of used resources and the implemented redundancy schemes among others. FPGA-based circuits are being used in complex safety-critical engineering systems that are designed in compliance with dependability regulations. This work presents an emulation-based methodology for estimating the failure rate of designs implemented in FPGA SoCs, which is a key data in this scenario.

A methodological approach for checking safety-critical systems software

The complexity of modern safety-critical systems together with the absence of appropriate software verification tools is one reason for the large number of errors in the design and implementation of these systems. A methodological approach named formal compositional verification approach that uses model checking techniques to verify safety-critical systems software is presented. This approach facilitates decomposition of complex safety-critical systems software into independently verified individual software components, and establishes a compositional method to verify these systems using state-of-the-art model checkers. Our objective in this paper is to facilitate the description of a safety-critical system software as a collection of verified software components, allowing the software verification of complex safety-critical systems. An application on a real-life software project in the field of mobile phone communication is discussed to demonstrate the applicability of the proposed approach.

A methodological approach for checking safety-critical systems software

The complexity of modern safety-critical systems together with the absence of appropriate software verification tools is one reason for the large number of errors in the design and implementation of these systems. A methodological approach named formal compositional verification approach that uses model checking techniques to verify safety-critical systems software is presented. This approach facilitates decomposition of complex safety-critical systems software into independently verified individual software components, and establishes a compositional method to verify these systems using state-of-the-art model checkers. Our objective in this paper is to facilitate the description of a safety-critical system software as a collection of verified software components, allowing the software verification of complex safety-critical systems. An application on a real-life software project in the field of mobile phone communication is discussed to demonstrate the applicability of the proposed approach.

Applying Automated Model Extraction for Simulation and Verification of Real-Life SDL Specification With Spin

Formally defined Specification and Description Language (SDL) is used for the design and specification of complex safety-critical systems. Each change in the specification of the product should be immediately checked formally against the requirements’ specification. This paper presents semi-automated system abstraction, automated model extraction, simulation, and formal verification of real-life complex SDL specification. Sound algorithms implemented in our sdl2pml automated model extraction tool preserve all properties of the SDL system. Sdl2pml includes our model of discrete time, abstraction, and support for all relevant SDL functionality and constructs such as dynamic process creation, rational data types, and communication with more than one process instance. To the best of our knowledge, most of them are not supported by any other known approach. We use our SpinRCP tool for simulation and formal verification of the extracted model with the Spin model checker. We demonstrate the applicability of our approach on ISDN User adaptation protocol from SI3000 Softswitch. The extracted Promela model is the largest one ever processed by Spin. We have shown that Spin simulation and model checking can be applied successfully to such huge models.

Formal specification and analysis of take-off procedure using VDM-SL

Abstract Purpose Air traffic management system is a complex adaptive and safety critical system which requires considerable attention for its modelling and verification. Currently Air traffic control (ATC) systems are heavily dependent upon human intervention at airport causing accidents and delays because of failure of communication. The purpose of this study is to develop, plan, manage and verify aircrafts movement procedures at the airport surface that prevent delays and collisions. Methods The airport surface is decomposed into blocks and represented by the graph relation. The state space of the system is described by identifying all the possible components of the system. The ground and local controls monitor queues of the aircrafts moving from taxiway to take-off. It is insured that once an aircraft is inserted into a queue, it is eventually removed from it after the next queue has become available. The take-off procedure is provided using graph theory and Vienna Development Method Specification Language (VDM-SL) and analyzed using VDM-SL toolbox. Results Formal specification of graph-based model, taxiways, aircrafts, runways and controllers is provided in static part of the model. The state space analysis describing take-off algorithms is provided by defining optimal paths and possible operations in dynamic model expediting the departure procedure. The model is developed by a series of refinements following the stepwise development approach. Conclusions The delays at airport surface require effective safety and guidance protocols to control air traffic at the airport. In static model, the safety criteria are described in terms of invariants over the data types carrying critical information. The safety is insured by defining pre/post conditions in description of operations for changing state space of the system. Although the proposed study is focussed more on the safety component, however, the efficiency is not ignored.

Multifragmentation Markov Modeling of a Reactor Trip System

Markov models (MM) are widely used in dependability assessment of complex safety-critical systems. The main computational difficulties in using MMs are model size and stiffness. Selection of the solution approach (SA) and tools based on analysis of MM stiffness and complexity increases the assessment accuracy. This paper presents the safety assessment of nuclear power plan instrumentation and control system (NPP I&Cs): a two-channel FPGA-based reactor trip system with three parallel tracks on “2-out-of-3” logic. The MM was built using a multifragmentation approach and solved with several SAs and tools. The analysis of results shows few application problems: the importance of usability-oriented tool selection, achieving an accurate result, and supporting the results verification.

Hybrid Uncertainty and Sensitivity Analysis of the Model of a Twin-Jet Aircraft

The mathematical models employed in the risk assessment of complex safety-critical engineering systems cannot capture all the characteristics of the system under analysis due to 1) the intrinsically random nature of several of the phenomena occurring during system operation (aleatory uncertainty) and 2) the incomplete knowledge about some of the phenomena (epistemic uncertainty). In this work, the model of a twin-jet aircraft is considered, which includes 21 inputs and 8 outputs. The inputs are affected by mixed aleatory and epistemic uncertainties represented by probability distributions and intervals, respectively. Within this context, the following issues are addressed: 1) improvement of the input uncertainty models (that is, reduction of the corresponding epistemic uncertainties) based on experimental data; 2) sensitivity analysis to rank the importance of the inputs in contributing to output uncertainties; 3) propagation of the input uncertainties to the outputs; and 4) extreme case analysis to identify those system configurations that prescribe extreme values of some system performance metrics of interest (for example, the failure probability). All the tasks are tackled and solved by means of an efficient combination of 1) Monte Carlo simulation to propagate the aleatory uncertainty described by probability distributions, 2) genetic algorithms to solve the numerous optimization problems related to the propagation of epistemic uncertainty by interval analysis, and 3) fast-running artificial neural network regression models to reduce the computational time related to the repeated model evaluations required by uncertainty and sensitivity analyses.

BAYESIAN SOFTWARE HEALTH MANAGEMENT FOR AIRCRAFT GUIDANCE, NAVIGATION, AND CONTROL

Modern aircraft—both piloted fly-by-wire commercial aircraft as well as UAVs—more and more depend on highly complex safety critical software systems with many sensors and computer-controlled actuators. Despite careful design and V&V of the software, severe incidents have happened due to malfunctioning software. In this paper, we discuss the use of Bayesian networks to monitor the health of the on-board software and sensor system, and to perform advanced on-board diagnostic reasoning. We focus on the development of reliable and robust health models for combined software and sensor systems, with application to guidance, navigation, and control (GN&C). Our Bayesian network-based approach is illustrated for a simplified GN&C system implemented using the open source real-time operating system OSEK/Trampoline. We show, using scenarios with injected faults, that our approach is able to detect and diagnose faults in software and sensor systems.

Towards generation of efficient test cases from UML/OCL models for complex safety-critical systems

This paper describes a new approach for model-based test case generation (MBTCG) for large systems, which not only supports the expression of complex requirements (constraints) using OCL, but also lays ground for improving the efficiency (i.e. maximum coverage with minimal number of test cases) of the generated test case set. For that purpose, UML/OCL models are transformed to (object-oriented) action systems, where test cases are generated by means of mutation. The resulting "abstract" test cases represent input/output sequences with possible branches according to valid alternatives in system responses. They have finally to be transformed to "concrete" test cases which can be applied to the target application. The described work is part of the European project MOGENTES.