Dependability modeling and analysis of complex control systems: An application to railway interlocking

Abstract

Abstract. This paper describes the dependability modelling and evaluation of a real complex system, made of redundant replicated hardware and redundant diverse software. It takes into account all aspects of their interactions (including correlation between the diverse software variants) and of the criticality of the several components. Our approach has been to realise the system model in a structured way. This allows to cope with complexity and to focus, where interesting, on specific behaviour for a more detailed analysis. Furthermore each level may be modelled using different methodologies and its evaluation performed with different tools without the need of modifying the general structure of the model. In order to validate the most complex sub-models, we built alternatives using different tools and methodologies; this proved to be very useful since it allowed to find small bugs and imperfections and to gain more confidence that the models represented the real system behaviour. With respect to the real system taken as the example, our analyses, which could not be reported here, allowed to establish the dependability bottlenecks of the current version and to state targets for the several subcomponents such that the system targets could be reached, thus providing hints for next releases or modifications of the system and information to assign targets to the various components of the system.

Threshold-based mechanisms to discriminate transient from intermittent faults

“…In TMR MODIAC, the architecture proposed in [8] and analysed in [9], two failures experienced in two consecutive operating cycles by the same hardware component being part of a redundant structure make the other redundant components to consider it as definitively faulty.…”

Design validation of embedded dependable systems

“…When designers use analytical models for modeling entire complex systems, 13,14 several problems occur, such as subtle interactions between hardware and software, model stiffness, and state explosion. Despite the modularity in defining the model, the analysis has to solve the model in its entirety to maintain the Markovian properties.…”

Stochastic Dependability Analysis of System Architecture Based on UML Models

“…These ideas are also widely accepted in the related literature. It is agreed that architecture evaluation based on analytical dependability modeling deserves attention in the early design phase [14], the modeling approach should be modular [22] and the model should be refined hierarchically as the design includes more and more information [4]. It is observed that the separation of architectural and service concerns allows the dependability analysis from the perspective of different users [29].…”