Este trabalho propõe o uso de Sistemas de Informação e Inteligência Empresarial visando a Análise Inteligente de Falhas para Apoiar Decisões Estratégicas em Projetos de Sistemas Críticos. Tal proposta estabelece uma correlação entre a dinâmica proveniente de recursos e ferramentas de Sistemas de Informação e Inteligência Empresarial, e a necessidade de se obter informações precisas, em intervalos de tempo aceitáveis para agregar valores tangíveis na segurança, confiabilidade, disponibilidade e mantenabilidade de Sistemas Críticos. A proposta aqui apresentada vem ao encontro da necessidade premente de disponibilizar, com maior eficácia, informações precisas para a aferição de indicadores importantes ao Projeto de Sistemas Críticos, e favorecer a implementação de ações mitigadoras de falhas que possam vir a comprometer o funcionamento desses sistemas. De forma a completar e consolidar a proposta em questão desenvolveu-se um ambiente computacional, utilizando-se dos fundamentos teóricos e das melhores práticas de Sistemas de Informação e Inteligência Empresarial, com as especificidades inerentes a Sistemas Críticos. Avaliou-se tal ambiente em um estudo de caso desenvolvido no Sistema Metroviário de São Paulo. Esse estudo de caso contribuiu, no aspecto conceitual, com a realização de ensaios de análises qualitativas e quantitativas de falhas, fornecendo informações relevantes para apoiar possíveis decisões estratégicas no sistema estudado. / This work proposes the use of Information Systems and Business Intelligence aiming an Intelligent Analysis of Failure that supports Strategic Decision Making in Critical Systems Projects. This proposition establishes a correlation between the dynamics of resources and tools from Information Systems and Business Intelligence, and the need to obtain accurate information within an acceptable time interval to add tangible value in security, reliability, availability and maintainability of Critical Systems. The proposition presented here meets the need to provide, more efficiently, accurate information to measure relevant indicators of the projects in Critical Systems, and favor the implementation of failure mitigating actions that could come to compromise the functioning of these systems. In order to complete and consolidate the proposition in question, a computational environment was developed, making use of the theoretical bases and of the best practices of Systems of Information and Business Intelligence, with the peculiarities inherent to Critical Systems. Such environment was evaluated in a case study in the Metrorail Company of São Paulo State, in which qualitative and quantitative analysis of failures were tested, providing relevant information to support possible strategic decisions in the system studied.

<p>It is not unusual that software systems are redeveloped when the systems environment changes or new requirements to functionality are found. The reason for this is that system evolution is usually not considered during the initial development of a system.</p><p>In this report we propose a development process focusing on modifiability in security-safety critical systems. The process is based on the standard IEC 61508 Functional safety of electrical/electronic/programmable electronic safety-related systems and the CORAS framework for model-based risk assessment. We focus on integrating modifiability as a non-functionality and extend the development process with an architecture and design phase. Modifiability is addressed using Architecture Tradeoff Analysis Method (ATAM) and Attribute Driven Design (ADD). An evaluation of this process is given by redeveloping a prototype for an already existing security-critical system using the approaches given by the process. The main result from the evaluation showed that we where able to obtain a higher level of modifiability than the original prototype, without compromising the functionality and safety level required.</p>

It is not unusual that software systems are redeveloped when the systems environment changes or new requirements to functionality are found. The reason for this is that system evolution is usually not considered during the initial development of a system. In this report we propose a development process focusing on modifiability in security-safety critical systems. The process is based on the standard IEC 61508 Functional safety of electrical/electronic/programmable electronic safety-related systems and the CORAS framework for model-based risk assessment. We focus on integrating modifiability as a non-functionality and extend the development process with an architecture and design phase. Modifiability is addressed using Architecture Tradeoff Analysis Method (ATAM) and Attribute Driven Design (ADD). An evaluation of this process is given by redeveloping a prototype for an already existing security-critical system using the approaches given by the process. The main result from the evaluation showed that we where able to obtain a higher level of modifiability than the original prototype, without compromising the functionality and safety level required.

O desenvolvimento de sistemas críticos é atualmente um dos problemas mais desafiadores enfrentados pela Engenharia. Há frequentemente uma pressão para se reduzir o tempo total de desenvolvimento, o que dificulta a entrega de sistemas com um mínimo aceitável de defeitos. Nos últimos anos, houve um aumento no tráfego aéreo, o que demanda uma modernização dos sistemas de tráfego aéreo atuais, muito dependentes na figura do controlador. Sistemas de tráfego aéreo são sistemas considerados críticos em segurança e de tempo real. O objetivo do presente trabalho é estabelecer um método de modelagem e verificação formal para sistemas críticos, com aplicação no domínio de tráfego aéreo. Com a adoção de técnicas de modelagem e verificação formal, pretende-se garantir a corretude dos sistemas frente aos requisitos inicialmente especificados e a detecção de erros em fases mais iniciais do projeto, o que resultaria em menores custos envolvidos na sua correção. São fornecidas diretivas para a aplicação do método através de um estudo de caso, baseado em três módulos de um sistema ATC em baixo nível de abstração, para a validação do funcionamento de módulos de software. Para verificação formal, é utilizada a ferramenta NuSMV e as propriedades a serem verificadas são descritas na lógica computacional de árvore (CTL) para garantir que o sistema satisfaça requisitos dos tipos vivacidade e segurança. / Developing safety critical systems is one of the most challenging problems in Engineering nowadays. There is usually a pressure to reduce the total time of the development, what makes it difficult to deliver systems with an acceptable low level of defects. In the recent years, there has been an increase in air trffic, what demands a modernization in the current air traffic systems, which are very dependent on the human controller. Air traffic systems are considered safety critical and real time systems. The objective of the present work is to establish a modeling and formal verification method for critical systems, applicable to the air traffic domain. By adopting modeling and formal verification techniques, it is expected to ensure the systems\' correctness compared with the initially specified requirements and the error detection in the initial phases of the project. Guidelines are provided for applying the method by means of a case study, based in three modules of and ATC system in a low abstraction level, for the validation of the operation of software modules. For the formal verification, it is used the NuSMV tool and the properties to be checked are described in the computational tree logic (CTL) to ensure that the system satisfies requirements of liveness and safety types.

Component-based software development has emerged as a promising approach for developing complex software systems by composing smaller independently developed components into larger component assemblies. This approach offers means to increase software reuse, achieve higher flexibility and shorter time-to-market by the use of off-the-shelf components (COTS). However, the use of COTS in safety-critical system is highly unexplored. This thesis addresses the problems appearing in component-based development of safety-critical systems. We aim at efficient reasoning about safety at system level while adding or replacing components. For safety-related reasoning it does not suffice to consider functioning components in their intended environments but also the behaviour of components in presence of single or multiple faults. Our contribution is a formal component model that includes the notion of a safety interface. It describes how the component behaves with respect to violation of a given system-level property in presence of faults in its environment. This approach also provides a link between formal analysis of components in safety-critical systems and the traditional engineering processes supported by model-based development. We also present an algorithm for deriving safety interfaces given a particular safety property and fault modes for the component. The safety interface is then used in a method proposed for compositional reasoning about component assemblies. Instead of reasoning about the effect of faults on the composed system, we suggest analysis of fault tolerance through pair wise analysis based on safety interfaces. The framework is demonstrated as a proof-of-concept in two case studies; a hydraulic system from the aerospace industry and an adaptive cruise controller from the automotive industry. The case studies have shown that a more efficient system-level safety analysis can be performed using the safety interfaces.

No description available.

Safety-critical systems are systems in which failure may lead to serious harm for humans or the environment. Due to the nature of these systems, there exist regulatory standards that recommend a set of safety mechanisms that should be included in these systems, e.g., IEC 61508. However, these standards offer little to no implementation assistance for these mechanisms. This thesis provides such development assistance, by proposing an approach for the automatic generation of safety mechanisms via Model-Driven Development (MDD). Such an automation of previously manual activities has been known to increase developer productivity and to reduce the number of bugs in the implementation. In the context of safety-critical systems, the latter also means an improvement in safety. The approach introduces a novel way to define safety requirements as structured sentences. This structure allows for the automatic parsing of these requirements in order to subsequently generate software-implemented safety mechanisms, as well as to initially configure hardware-implemented safety mechanisms. The generation approach for software-implemented safety mechanisms uses Unified Modeling Language (UML) stereotypes to represent these mechanisms in the application model. Automated model-to-model transformations parse this model representation and realize the safety mechanisms within an intermediate model. From this intermediate model, code may be generated with simple 1:1 mappings. For the generation of hardware-implemented safety mechanisms, this thesis introduces a novel Graphical User Interface (GUI) tool for representing the configuration of hardware interfaces. A template-based code snippet repository is used for generating the code responsible for the configuration of the hardware-implemented safety mechanisms. The presented approach is validated by applying it to the development of a safety-critical fire detection application example. Furthermore, the runtime overhead of the respective transformation steps of the code generation process is measured. The results indicate a linear scalability and a runtime that is no impediment to the workflow of the developer. Furthermore, the memory and runtime overhead of the generated code is evaluated. The results show that the inclusion of a single safety mechanism for a single system element has a negligible overhead. However, the relative overhead indicates that the application of safety mechanisms should be limited to those system elements that are strictly safety-critical, as their arbitrary application to all system elements would have large effects on the runtime and memory usage of the application.

<p>Formal methods such as Event-B are a widely used approach for developing critical systems. This thesis demonstrates that creating models and proving the consistency of the models at the requirements level during software (system) development is an effective way to reduce the occurrence of faults and errors in a practical application. An insulin infusion pump (IIP) is a complicated and time critical system. This thesis uses Event-B to specify models for an IIP, based on a draft requirements document developed by the US Food and Drug Administration (FDA). Consequently it demonstrates Event-B can be used effectively to detect the missing properties, the missing quantities, the faults and the errors at the requirements level of a system development. The IIP is an active and reactive time control system. To achieve the goal of handling timing issues in the IIP system, we made extensions of an existing time pattern specified using Event-B to enrich the semantics of the Event-B language. We created several sets to model the activation times of different events and the union of these time sets defines a global time activation set. The tick of global time is specified as a progress tick event. All the actions in an event are triggered only when the global time in the time tick event matches the time specified in the event. Time is deleted from the corresponding time set, but not the corresponding global time set while the event is triggered. A time point is deleted from the global time set only when there are no pending actions for that time point. Through discharging proof obligations using Event-B, we achieved our goal of improving the requirements document.</p> / Master of Computer Science (MCS)

Cette thèse présente une nouvelle approche pour la modélisation des systèmes de sécurité fonctionnelle qui prend en compte plusieurs modes de défaillance pour les composants et le système global. Les diagrammes de flux d'information (IFDs) ont été initialement développé dans un thèse précédent. Dans ce travail, l'évaluation si l'approche flux d'information être rendue plus efficace par utiliser les diagrammes de décision binaires (BDD).Cette thèse sera d'expliquer pourquoi ce modèle est nécessaire et pratique, suivie d'une explication détaillée des IFDs. Cela inclut sa structure hiérarchique et comment ce modèle peut être appliqué.La prochaine étape est la formalisation du modèle IFD original pour permettre l'utilisation des techniques d'évaluation plus efficaces. Il sera expliqué pourquoi ces étapes de formalisation ont été prises et les avantages de leur utilisation.Ensuite une explication détaillée des algorithmes développés est présenté. Ces algorithmes sont basés sur une combinaison de différentes techniques de BDD. Zero Suppressed BDDs (ZBDDs) sont combinées avec des Boolean Expression Diagrams (BEDs). En outre, la structure des IFD est utilisé pour construire un BDD global sur plusieurs petits BDDs. Cela augmente l'efficacité du processus d'évaluation.Les techniques présentées sont évaluées par l'analyse de plusieurs cas d'utilisation qui sont expliqués dans ce travail / This thesis presents a novel approach for modelling safety critical systems which takes into account several failure modes both for components and the global system. The so called Information Flow Diagrams (IFDs) were originally developed in a previous PhD-thesis. In this work, the evaluation if the IFD-approach should be made more efficient by using Binary Decision Diagrams (BDDs).This thesis will explain why such a model is necessary and practical, followed by a detailed explanation of the IFD-model. This includes its hierarchical structure and how this model can be applied. The next step is to formalise the original IFD-model in order to enable more efficient evaluation techniques. It will be explained why these formalisation steps were taken and what was gained by using them. Afterwards a detailed explanation of the developed algorithms is presented. These algorithms are based on a combination of different BDD-techniques. Zero Suppressed BDDs (ZBDDs) are combined with Boolean Expression Diagrams (BEDs). Furthermore, the structure of the IFDs is used in order to construct a large BDD out of several smaller BDDs. This increases the efficiency of the evaluation process.The presented techniques are evaluated by analysing several use cases which are explained in this work

O transporte aéreo e a indústria de sistemas de defesa foram setores pioneiros na utilização de sistemas computacionais críticos, incrementando os níveis de automação nas atividades de controle do espaço aéreo. Com o crescimento desses setores, verificado pela expansão dos números de vôos, volumes de cargas e usuários, assim como pela ampliação e diversidade das operações militares, os sistemas de controle têm assumido maior complexidade técnica, introduzindo novos recursos de automação ou facilidades adicionais de apoio para funções exercidas manualmente. Essa situação tem ampliado a dependência dos serviços prestados, relativamente à disponibilidade dos sistemas computacionais. Diretrizes de projeto e procedimentos operacionais são estabelecidos para manter os níveis de segurança nos casos de falha, no entanto a disponibilidade torna-se parâmetro crítico, na medida em que algumas falhas podem afetar a eficiência nominal da prestação dos serviços. Nesse cenário, este trabalho propõe um modelo para avaliação da disponibilidade de sistemas de controle do espaço aéreo, a partir de recursos de análises da teoria de filas. Inicialmente é citado um modelo geral para análise de disponibilidade de data centers. Em seguida, é apresentada uma extensão do modelo geral para análise da disponibilidade em sistemas de controle do espaço aéreo. Para isso, considerou-se a intervenção humana existente nessa atividade, cujas decisões de controle são exercidas por operadores qualificados (controladores), tanto nas atividades inerentes ao serviço de controle, quanto nos casos de degradação, nos quais os operadores ou técnicos de manutenção assumem alguma tarefa de reparo, decorrente da eventual indisponibilidade de funções do sistema. / Due to the growth in airspace utilization, which can be verified both in terms of the expansions in aerial movements, airports and volumes of transported passengers and cargo, as well as in terms of the expansion of military operations demands and diversity, airspace control activities have been increasing their technical complexity, introducing new features into the existent automation systems or creating additional resources for the automation of some functions previously performed by human operators. This situation has increased the dependence on the availability of the computer systems involved in the services provided by control centers. Project directives and operational procedures are established in order to maintain the safety integrity levels of the systems, in case any failure occurs. However, the availability becomes a critical parameter, once failure events can force an undesirable state of degraded operation, jeopardizing the nominal capacity of the services being performed through any controlled airspace. In this scenario, this work presents an availability model for the computer systems used in airspace control centers, based on analysis from queuing theory. A general model is first presented, referencing a case study that describes the use of queuing models to access the availability of generic data centers. Further considerations are introduced to extend this general model in order to propose its application for the specific computer systems used in airspace control centers, where operational control relies on human activities. In this case, system operation involves intensive use of human-machine interfaces (HMI), for the regular control services provided, and additional technical or operational maintenance activities, occasionally imposed to repair a momentary loss of any function of the system.