(De-)Composing Causality in Labeled Transition Systems

Reasoning about causes and effects naturally arises in the engineering of safety-critical systems. A classical example is Fault Tree Analysis, a deductive technique used for system safety assessment, whereby an undesired state is reduced to the set of its immediate causes. The design of fault management systems also requires reasoning on causality relationships. In particular, a fail-operational system needs to ensure timely detection and identification of faults, i.e. recognize the occurrence of run-time faults through their observable effects on the system. Even more complex scenarios arise when multiple faults are involved and may interact in subtle ways.In this work, we propose a formal approach to fault management for complex systems. We first introduce the notions of fault tree and minimal cut sets. We then present a formal framework for the specification and analysis of diagnosability, and for the design of fault detection and identification (FDI) components. Finally, we review recent advances in fault propagation analysis, based on the Timed Failure Propagation Graphs (TFPG) formalism.

Section: Discussionmentioning

confidence: 99%

Causality and Temporal Dependencies in the Design of Fault Management Systems

Bozzano¹

2017

“…Informally, (5) states that when at floor E 0 , after pressing button B 2 , only alternations of actions press B i and reach E i are possible, where i ∈ {1,2}. Note that E 2 is never reached, even if B 2 was pressed.…”

Section: Causality For General Ltl-definable Propertiesmentioning

confidence: 99%

“…In a similar spirit, [23] proposes a methodology for computing shortest counterexamples for symbolic model checking of so-called LTL with past formulae. Other "nice to have" properties of causality such as, compositionality, for instance, were addressed in [10,9,11,12,5].…”

Section: Introductionmentioning

confidence: 99%

Causality for General LTL-definable Properties

Caltais

Guetlein

Leue

2019

Self Cite

In this paper we provide a notion of causality for the violation of general Linear Temporal Logic (LTL) properties. The current work is a natural extension of the previously proposed approach handling causality in the context of LTL-definable safety properties [20,19]. The major difference is that now, counterexamples of general LTL properties are not merely finite traces, but infinite lasso-shaped traces. We analyze such infinite counterexamples and identify the relevant ordered occurrences of causal events, obtained by unfolding the looping part of the lasso shaped counterexample sufficiently many times. The focus is on LTL properties from practical considerations: the current results are to be implemented in QuantUM, a tool for causality checking, that exploits explicit state LTL model checking.

“…The seminal work in [15] has been adopted in various settings. Closely related to the explanation of failures based on adoptions of [15] are the results in [3,20,7], for instance. All these works adjust the definition of causality in [15] to the setting of system executions leading to a failure.…”

Section: Introductionmentioning

confidence: 99%

“…The approach in [3] considers one such execution at a time, and uses counterfactual causal reasoning for identifying the points in the trace that are relevant for the failure. The results in [20,7], on the other hand, aim at discovering the causal explanations for all failures in a system, and strongly rely on model-checking based techniques [2].…”

Section: Introductionmentioning

confidence: 99%

Explaining SDN Failures via Axiomatisations

Caltais

2019

Self Cite

This work introduces a concept of explanations with respect to the violation of safe behaviours within software defined networks (SDNs) expressible in NetKAT. The latter is a network programming language that is based on a well-studied mathematical structure, namely, Kleene Algebra with Tests (KAT). Amongst others, the mathematical foundation of NetKAT gave rise to a sound and complete equational theory. In our setting, a safe behaviour is characterised by a NetKAT policy which does not enable forwarding packets from ingress to an undesirable egress. Explanations for safety violations are derived in an equational fashion, based on a modification of the existing NetKAT axiomatisation.