The system design process needs to cope with the increasing complexity and size of systems,motivating the replacement of labor intensivemanual techniques with automated and semi-automated approaches.Recently, formal methods techniques, such as model-based verification and safety assessment, have been increasingly used to model systems under fault and to analyze them, generating artifacts such as fault trees and FMEA tables. In this paper, we show how to apply model-based techniques to a realistic case study from the avionics domain: a high integrity power distribution system, the Triple Modular Generator (TMG). The TMG is composed of a redundant and reconfigurable plant and a controller that must guarantee a high level of reliability. The case study is a significant challenge, from the modeling perspective, since it implements a complex reconfiguration policy, specified via a number of requirements in natural language, including a set of mutually dependent and potentially conflicting priority constraints. Moreover, from the verification standpoint, the controller must be able to handle an exponential number of possible faulty configurations. Our contribution is twofold. First, we formalize and validate the requirements and, using a constraint-based modeling style, we synthesize a correct by construction controller, avoiding the enumeration of all possible fault configurations, as is currently done by manual approaches. Second, we describe a comprehensive methodology and process, supported by the xSAP safety analysis platform that targets the modeling and safety assessment of faulty systems. Using xSAP, we are able to automatically extract minimal cut sets for the TMG. We demonstrate the scalability of our approach by analyzing a parametric version of the TMG case study that contains more than 700 variables and 90 faults.

中文翻译：

---

使用 xSAP 对三重模块发电机进行基于模型的安全评估

系统设计过程需要应对日益增加的复杂性和系统规模，促使劳动密集型人工技术被自动化和半自动化方法取代。最近，基于模型的验证和安全评估等形式化方法技术越来越多用于对故障系统进行建模并对其进行分析，生成故障树和 FMEA 表等工件。在本文中，我们展示了如何将基于模型的技术应用于航空电子领域的实际案例研究：高完整性配电系统，三重模块化发电机 (TMG)。TMG 由一个冗余且可重新配置的设备和一个必须保证高度可靠性的控制器组成。从建模的角度来看，案例研究是一项重大挑战，因为它实现了一个复杂的重新配置策略，通过许多自然语言的要求来指定，包括一组相互依赖和潜在冲突的优先级约束。此外，从验证的角度来看，控制器必须能够处理指数级数量的可能错误配置。我们的贡献是双重的。首先，我们形式化和验证需求，并使用基于约束的建模风格，我们通过构造控制器合成一个正确的，避免枚举所有可能的故障配置，就像目前通过手动方法完成的那样。其次，我们描述了一个全面的方法和流程，由 xSAP 安全分析平台支持，该平台针对故障系统的建模和安全评估。使用 xSAP，我们能够自动提取 TMG 的最小割集。我们通过分析包含 700 多个变量和 90 个故障的 TMG 案例研究的参数版本来展示我们方法的可扩展性。