Download presentation

Presentation is loading. Please wait.

Published byEarl Elbon Modified about 1 year ago

1
AltaRica A Formal Language for Event Oriented Modeling A. Rauzy IML/CNRS & ARBoost Technologies Marseilles, France

2
Contents I.Introductory Examples II.Motivations III.Formal Model IV.Tools V.Examples of Use VI.Perspectives

3
Contents I.Introductory Examples II.Motivations III.Formal Model IV.Tools V.Examples of Use VI.Perspectives

4
A repairable component node component state s: {working,failed,repair}; event failure, startRepair, endRepair; trans (s=working) |- failure -> s:=failed (s=failed) |- startRepair -> s:=repair; (s=repair) |- endRepair -> s:=working; init s:=working edon

5
A Valve node valve state closed:bool; flow input:float:in; output:float:out; event open, close; trans closed |- open -> closed:=false; not closed |- close -> closed:=true; init closed := true; assert output = if closed then 0 else input; edon

6
Two Valves in Series node twoValves flow input:float:in; output:float:out; sub A:valve, B:valve; assert A.input = input, B.input = A.output, output = B.output; edon

7
A repairable component and its repairer node repairableSystem event startRepair, endRepair; sub C:component, R:repairer; sync startRepair = C.startRepair and R.startJob, endRepair = C.endRepair and R.endJob; edon

8
Contents I.Introductory Examples II.Motivations III.Formal Model IV.Tools V.Examples of Use VI.Perspectives

9
Motivations: Reliability Engineering Target systems: nuclear power plants, chemical plants, avionic systems, … Assess the risk and its consequences: what can go wrong ? what is the expectation that something goes wrong ? what are the consequences ?

10
Motivations: Reliability Enginering Analyses: Determination of failure scenarii Assessment of failure probability Ranking of components with respect to their contribution to the risk

11
Motivations: Reliability Engineering Classical formalisms (Fault Trees, Markov Graphs, Petri Nets) –Well defined semantics –Easy to handle –Textual and graphical –Good tradeoffs expressivity/efficiency … but Lack of structure (PN, MG) or Lack of expressivity (FT) Models are hard to design and to maintain

12
The AltaRica Project AltaRica: a high level formal description language based on the notion of mode automata compilation into low level formalisms (efficiency) synergy with formal methods (e.g. model checking)

13
System Analysis Dynamic Systems/Simulation: Differential Equations e.g. Modelica Code generation: Data-Flow models e.g. State Charts, Lustre Reliability Engineering: Event driven models, non-determinism e.g. Fault Trees, Petri nets, AltaRica

14
Contents I.Introductory Examples II.Motivations III.Formal Model IV.Tools V.Examples of Use VI.Perspectives

15
Mode Automata s=1 t=0 s=1 t=0 s=0 t=1 mode event : g(S,I) |- e -> S:=f(S,I) [Marininchi98, Rauzy02] A = S: state variables I: input variables O: output variables E: events : transitions : transfer function : initial state O = (S,I) IOS

16
Algebra of Mode Automata ProductConnection Synchronization of events Operations on mode automata Synchronization G1 |- e1 -> S1:=f1 G2 |- e2 -> S2:=f2 G3 |- e3 -> S2:=f3 e = e1 and (e2 or e3) G1 and (G2 or G3) |- e -> S1 := if G1 then f1 else S1 S2 := if G2 then f2 else S2 S3 := if G3 then f3 else S3 fire the fireable local transitions

17
Two Valves in Series node twoValves flow input:float:in; output:float:out; sub A:valve, B:valve; assert A.input = input, B.input = A.output, output = B.output; edon

18
A repairable component and its repairer node repairableSystem event startRepair, endRepair; sub C:component, R:repairer; sync startRepair = C.startRepair and R.startJob, endRepair = C.endRepair and R.endJob; edon

19
Mode Automata: External View View Time schedule traces mode

20
Mode Automata … generalize fault trees, Markov graphs, Petri nets (P1>0) and (P2=0) |- T -> P1:=P1-1, P3:=P3+2; P3 P1 P2 T 2 remote interactions … generalize block-diagrams … make it possible to define hierarchies, packages, …

21
Categories of Events Timed events: take a non null time Stochastic events (default) Probability distributions with parameters (exponential, Weibull,...) Dirac events Instaneous events: take no time and may have a priority Immediate events Conditional events

22
A Spare Unit

23
A Periodically Tested Component

24
The Extern Clause The role of the extern clause is: to give some interpretation to the model, e.g. priorities to transitions, probability distributions to events, to give tools a specific information, to provide some mechanism to extend the language. In AltaRica Data-Flow, the syntax of the extern clause is normalized: node … extern law = exponential(0.001) ; parameter lambda = 0.001; … edon type of the information specified element value

25
Commutation of the syntax and the semantics node System sub A:Component, B.Component, R:RepairMen … edon node S state A.s, B.s, R.s; … edond syntactic composition reachability graphs reachability graph synchronized product

26
Contents I.Introductory Examples II.Motivations III.Formal Model IV.Tools V.Examples of Use VI.Perspectives

27
Tools Workbenches Powerful graphical user interfaces for the design of models Graphical simulators OCAS (Dassault Aviation), SimFia (EADS-APSYS), Saraa (Airbus) Assessment tools Compilers to Fault Trees Compilers to Markov Graphs Stochastic simulators Generators of sequences Compilers to formal languages (Lustre, SMV) Model-Checkers AltaTools, Mec V (LaBRI), Combava (ARBoost Technologies)

28
Combava: an AltaRica Data-Flow Toolbox node Cmp state s: … edon AltaRica Data-Flow Fault Trees alta-a2b Aralia Markov Graphs alta-mrk Mark-XPR Monte-Carlo simulation alta-sto Generation of sequences, model checking alta-seq Stepwise simulation alta-sim

29
Contents I.Introductory Examples II.Motivations III.Tools IV.Formal Model V.Examples of Use VI.Perspectives

30
Models Designed So Far 3 categories of models Functional models Mainly academic (Bordeaux) -> model checking Simple and huge dysfunctional models (~ bloc diagrams), e.g. Dassault F7X, … Compilation into fault trees Treatment chain validated by certification authorities Complex but (relatively) small models, e.g. Total, Production availability, High integrity protection systems Markov analyses, Monte-Carlo simulation

31
Production Availability HPS-A HPS-B HPS-C DEH-A DEH-B CMP-A CMP-B MUP 45% 65% 52% 100% HPS DEH CMP MUP0.001 well tank

32
Markov Analyses AltaRica model alta-a2g Multi Phase Markov models with rewards command fileMark-XPR Steady state probability Transient probability Mean sojourn time Expectation of any quantity defined on states

33
Generation of (relevant) sequences AltaRica Automaton Sequence automaton alta-seqsequences automaton mySequences s1: #l not failed : s1; s1: #l failed : s2; init s1 : #l := 1; accept s2; end Model-checking: same automata with a Büchi acceptance criterion

34
Contents I.Introductory Examples II.Motivations III.Tools IV.Formal Model V.Examples of Use VI.Perspectives

35
Perspectives Find the “good” states/events formalism for reliability studies sound mathematical basis graphical representation generalization of currently used formalisms looped systems hierarchy algorithmic & complexity issues (tradeoff) connection with functional models hybrid systems higher level modeling

36
Motivations Find the “good” states/events formalism for reliability studies sound mathematical basis graphical representation generalization of currently used formalisms looped systems hierarchy algorithmic & complexity issues (tradeoff) connection with functional models hybrid systems higher level modeling These issues are well addressed by current version(s) of AltaRica

37
Motivations sound mathematical basis graphical representation generalization of currently used formalisms looped systems hierarchy algorithmic & complexity issues (tradeoff) connection with functional models hybrid systems higher level modeling Find the “good” states/events formalism for reliability studies

38
Higher Level Modeling Need for Connection to external routines Structured types Parametric descriptions High level operations … and even object oriented modeling Extension of the language

39
Motivations Find the “good” states/events formalism for reliability studies sound mathematical basis graphical representation generalization of currently used formalisms looped systems hierarchy algorithmic & complexity issues (tradeoff) connection with functional models hybrid systems higher level modeling

40
Normalized Graphics Simple mode automata Petri nets Hierarchical descriptions Interaction diagrams

41
Motivations Find the “good” states/events formalism for reliability studies sound mathematical basis graphical representation generalization of currently used formalisms looped systems hierarchy algorithmic & complexity issues (tradeoff) connection with functional models hybrid systems higher level modeling

42
Electric Nets

43
Motivations Find the “good” states/events formalism for reliability studies sound mathematical basis graphical representation generalization of currently used formalisms looped systems hierarchy algorithmic & complexity issues (tradeoff) connection with functional models hybrid systems higher level modeling

44
Hybrid Systems Mixing discrete events and continuous variation, e.g. temperature controller

45
Motivations sound mathematical basis graphical representation generalization of currently used formalisms looped systems hierarchy algorithmic & complexity issues (tradeoff) hybrid systems higher level modeling connection with functional models Find the “good” states/events formalism for reliability studies

46
From functional to dysfunctional analyses Sensors Command automaton [e.g. state chart] Sensors may be subject to different failure modes How failures of sensors impact the command? How to derive the dysfunctional model from the functional model? Don’t expect a silver bullet !

47
Architecture

48
Industrial Perspectives Airbus (Rosas, A350) Dassault Systems (Catia System) ClearSy (Atelier B)

Similar presentations

© 2016 SlidePlayer.com Inc.

All rights reserved.

Ads by Google