1. Coral: a tool for Compositional Reliability and Availability analysis † Hichem Boudali 1, Pepijn Crouzen 2, and Mari ë lle Stoelinga 1. 1 Formal Methods and Tools group CS, University of Twente, NL. 2 Dependable Systems and Software group, CS, Saarland University, Germany

2. Context & Motivation  Systems do fail  Reliability Engineering: - Analyze system reliability  Many formalisms: Petri nets, RBDs, DFTs, AADL,  DFTs: - Graphical, popular formalism - Unreliabilty = P[failure during mission time]

3. Dynamic Fault trees  Graphical, intuitive formalism  Specify system failures in terms of component failure  Tree/DAG  leaves: basic events = component failures  gates: failure propagation  CORAL methodology  formal semantics using IOIMCs  Compositional modeling + verification  state space reduction techniques phone engine road trip car tire 1 tire 2 tire 3 tire 4 spare

4. Tool Chain DFT SVLbcg_labels DFT repository dft2bcg SVL IOIMC model dft2bcg dft_eval IOIMC models CTMC + goal state bcg_trans mission time Unrealiability C O R A L = P[failure during mission time]

5. What is deep compositionality? Failure 2/3 S CBA  Semantics of a DFT arises naturally as composition of the semantics of its building blocks  But: This may lead to huge models. f(G1) f(NE1)f(NE4)… f(G1) Translation each gate gets IOIMC Composition

6. Prototype tool chain Coral – DFT analysis dft2bcg: Translation composer: Composition composer: minimization composer: Repeat CTMC Result: unreliability dft_eval: Analysis dft_eval: MC generation User-given ordering 1325 states instead of 32757 states Composition order matters

7. Tool Chain DFT SVLbcg_labels DFT repository dft2bcg SVL IOIMC model dft2bcg dft_eval IOIMC models CTMC + goal state bcg_trans composition script mission time Unrealiability C O R A L

8. Case studies Analysis method Max number of states Max number of transitions Unreliability MDCSMonolithic25313832.00 · 10 -9 Compositional1907232.00 · 10 -9 HCPSMonolithic4113246081.35 · 10 -3 Compositional1334651.35 · 10 -3 CASMonolithic8100.657 Compositional321160.657 FTPPMonolithic327574268262.55479 · 10 -8 Compositional1325141532.55479 · 10 -8

9. CORAL: lifting previous drawbacks of DFTs  Lack of formal semantics  semantics in terms of IOIMCs  Each gate & BE has corresp. IOIMC  DFT semantics = composition of gate semantics  Lack of modularity  severe restrictions on reuse of sub- models in larger models  CORAL is much more liberal  State space explosion problem  use bisimulation to combate state space explosion phone engine road trip car tire 1 tire 2 tire 3 tire 4 spare

10. Future work  Fully automated tool  Get rid of composition script  Order of composition matters  heuristics  More aggressive state reduction  Weaker equivalence, interface constraints, Phase-type minimization  Further extensions to DFT modeling capabilities  Extension to non-exponential distributions  New DFT building blocks  Simulation for DFTs  Apply deep compositionality to other engineering formalisms!  E.g. Architectural description languages like AADL

11. References  H. Boudali, P. Crouzen, M. Stoelinga. “Dynamic Fault Tree analysis using Input/Output Interactive Markov Chains”, DSN 2007 proceedings.  H. Boudali, P. Crouzen, M. Stoelinga. “A compositional semantics for Dynamic Fault Trees in terms of Interactive Markov Chains”, ATVA 2007.  More info:  crouzen@alan.cs.uni-sb.de  hboudali@cs.utwente.nl hboudali@cs.utwente.nl  marielle@cs.utwente.nl