650 likes | 812 Views
11. FSAP and the Model Checking Approach to FT Extraction. An overview of the algorithms for fault tree generation available in FSAP. Algorithms based on model checking techniques. In this tutorial: focus on BDD-based routines. SAT-based routines exist as well. Model Checking.
E N D
11. FSAP and the Model Checking Approachto FT Extraction. • An overview of the algorithms for fault tree generation available in FSAP. • Algorithms based on model checking techniques. • In this tutorial: focus on BDD-based routines. • SAT-based routines exist as well.
Model Checking • Automated technique to verify a formal system model against a formal specification. • Systems typically modeled as state transition systems. • Specifications provided as temporal logic formulae. • Model checking provides a formal guarantee that a specification is obeyed. • (A counterexample trace is produced if the specification does not hold) • Exhaustive technique compared to testing and simulation. • Major breakthrough with the introduction of symbolic model checking: • Idea: manipulate sets of states and transitions. • Efficient symbolic representations for the characteristic functions of such sets. • In the rest of this chapter: model checking techniques applied to FT generation.
Binary Diagrams BDD = Binary Decision Diagram. OBDD = Ordered BDD. (Built with a specific variable order) ROBDD = Reduced OBDD. (Canonical form: elimination of redundancies) (RO)BDDS are an efficient and compact representation for Boolean formulas. Size of the BDD depend on variable order. Set-theoretic operations as logical operators. A BDD for the formula (a1 ↔ a2) /\ (b1 ↔ b2) . Dashed = false, solid = true
BDD-based Algorithms for FTA • Different algorithms available: • •Forward (FWD). • •Backward (BWD). • Optimizations: • •Dynamic cone of influence (DCOI). • •Dynamic pruning (PRUN).
Cut Sets Top Level Event Tle fired Tle State variables Execution Trace S1 S2 S3 History variables remember past failure events (Oi is true if and only if Fi is true at some point in the past) Oi →next(Oi) ¬ Oi →(next(Oi) ↔next(Fi)) Failure Mode variables F1 fails Permanent fault F1 F2 fails Sporadic fault F2 F3 No fault Once F1 Dual concept in the future: prophecy variables O1 History variables Once F2 O2 Once F3 O3 F1 ∧ F2 CUT SET Ro
Forward Algorithm Init
Forward Algorithm Init
Forward Algorithm Init
Forward Algorithm Init
Forward Algorithm Init
Forward Algorithm Fixpoint Init
Forward Algorithm Fixpoint Init
Forward Algorithm Fixpoint TLE Init
Forward Algorithm Fixpoint TLE Init
Forward Algorithm • • • • • S1 • S2 • S3 • S4 S5 • F1 • F2 F3 O1 O2 O3
Forward Algorithm • • • • • S1 • S2 • S3 • S4 S5 • F1 • F2 F3 O1 O2 O3
Forward Algorithm • • • • • S1 • S2 • S3 • S4 S5 • F1 • F2 F3 O1 O2 O3
Forward Algorithm • • • • • S1 • S2 • S3 • S4 S5 • F1 • F2 F3 O1 O2 O3
Forward Algorithm • • • • • S1 • S2 • S3 • S4 S5 • F1 • F2 F3 O1 O2 O3
Forward Algorithm • • • • • S1 • S2 • S3 • S4 S5 • F1 • F2 F3 O1 O2 O3
Forward Algorithm • • • • • S1 • S2 • S3 • S4 S5 • F1 • F2 F3 MCS 2 O1 MCS 1 O2 O3
Backward Algorithm Tle Fixpoint
Backward Algorithm Tle Fixpoint
Backward Algorithm Init Tle Fixpoint
Backward Algorithm Init Tle Fixpoint
Backward Algorithm Init And so on … Tle Fixpoint
Dynamic Cone of Influence • Compute pre-images & restricted Kripke structures, • based on dependency withTle • M0 ≤ M1 ≤ … ≤ Mn-1 ≤ Mn • defer construction of the Kripke structure • hopefully Mn is smaller than the global M Tle
Dynamic Cone of Influence M0 • Compute pre-images & restricted Kripke structures, • based on dependency withTle • M0 ≤ M1 ≤ … ≤ Mn-1 ≤ Mn • defer construction of the Kripke structure • hopefully Mn is smaller than the global M Tle
Dynamic Cone of Influence M0 M1 • Compute pre-images & restricted Kripke structures, • based on dependency withTle • M0 ≤ M1 ≤ … ≤ Mn-1 ≤ Mn • defer construction of the Kripke structure • hopefully Mn is smaller than the global M Tle
Dynamic Cone of Influence M0 M1 Mn-1 • Compute pre-images & restricted Kripke structures, • based on dependency withTle • M0 ≤ M1 ≤ … ≤ Mn-1 ≤ Mn • defer construction of the Kripke structure • hopefully Mn is smaller than the global M Tle
Dynamic Cone of Influence M0 M1 Mn-1 Mn Fixpoint • Compute pre-images & restricted Kripke structures, • based on dependency withTle • M0 ≤ M1 ≤ … ≤ Mn-1 ≤ Mn • defer construction of the Kripke structure • hopefully Mn is smaller than the global M Tle
Dynamic Pruning TLE Init
Dynamic Pruning TLE Init At each iteration, compute a partial set of cut sets Use the partial set to prune non-minimal config. in the search space
Dynamic Pruning TLE Init At each iteration, compute a partial set of cut sets Use the partial set to prune non-minimal config. in the search space
Dynamic Pruning TLE Init At each iteration, compute a partial set of cut sets Use the partial set to prune non-minimal config. in the search space
Dynamic Pruning TLE Init At each iteration, compute a partial set of cut sets Use the partial set to prune non-minimal config. in the search space
Dynamic Pruning TLE Init At each iteration, compute a partial set of cut sets Use the partial set to prune non-minimal config. in the search space • •
Dynamic Pruning TLE Init At each iteration, compute a partial set of cut sets Use the partial set to prune non-minimal config. in the search space • •