Deviation Analysis: A New Use of Model Checking

Abstract

Inaccuracies, or deviations, in the measurements of monitored variables in a control system are facts of life that control software must accommodate. Deviation analysis can be used to determine how a software specification will behave in the face of such deviations. Deviation analysis is intended to answer questions such as "What is the effect on output O if input I is off by 0 to 100?". This property is best checked with some form of symbolic execution approach. In this report we wish to propose a new approach to deviation analysis using model checking techniques. The key observation that allows us to use model checkers is that the property can be restated as "Will there be an effect on output O if input I is off by 0 to 100?"-this restatement of the property changes the analysis from an exploratory analysis to a verification task suitable for model checking.

Capture and reuse of composable failure patterns

“…On the other hand, in behavioural fault simulation, system failure models equivalent to an FMEA are produced by injecting faults into executable formal or semi-formal specifications of a system, thereby establishing the system-level effects of faults. Techniques that follow this approach include safety analysis using Altarica (Bieber et al, 2002), FSAP-NuSMV (Bozzano et al, 2003), software deviation analysis (Heimdahl et al, 2005) and DCCA (Güdemann et al, 2007).…”

Timed Behavior Trees for Failure Mode and Effects Analysis of time-critical systems

“…The complexity of today's systems consequently becomes a major challenge for safety engineers. To overcome this problem, the application of model checking techniques has been proposed to support the FMEA process Cichocki and Górski, 2000;Grunske et al, 2005;Heimdahl et al, 2005). The system model, incorporating the failure mode under investigation, is given in a formal notation for input to a model checker.…”

“…In current untimed FMEA analysis techniques that use model checking (Heimdahl et al, 2005;Górski, 2000, 2001;Grunske et al, 2005), an experiment is run of every failure mode of every component against every safety condition in order to allow identifying the effect of single-mode failures on the safety conditions. For example, if there are five components in a system with a combined total of fifteen failure modes and four safety conditions, then sixty experiments are performed.…”

“…We review some of these approaches below. Heimdahl et al (2005) use the language RSML Àe to model the system. This model including its injected faults is then translated into NuSMV code (Cimatti et al, 1999) in order to perform a Software Deviation Analysis (SDA) (Reese and Leveson, 1997), which is closely related to FMEA.…”

“…FMEA is an established safety analysis technique used in industry, in which a team of safety engineers identifies failure modes of system components and explores their hazardous effects. This process can be supported using a model checker to automatically detect the occurrence of a hazard in the behaviour of a faulty system (Grunske et al, 2005;Heimdahl et al, 2005;Cichocki and Górski, 2000). However, all suggested techniques consider only untimed system models and as such are not capable of investigating timing failures.…”