Search

Dependability and performance analysis of modern systems is facing great challenges: their scale is growing, they are becoming massively distributed, interconnected, and evolving. Such complexity makes model-based assessment a difficult and time-consuming task. For the evaluation of large systems, reusable submodels are typically adopted as an effective way to address the complexity and to improve the maintainability of models. When using state-based models, a common approach is to define libraries of generic submodels, and then compose concrete instances by state sharing, following predefined “patterns” that depend on the class of systems being modeled. However, such composition patterns are rarely formalized, or not even documented at all. In this paper, we address this problem using a model-driven approach, which combines a language to specify reusable submodels and composition patterns, and an automated composition algorithm. Clearly defining libraries of reusable submodels, together with patterns for their composition, allows complex models to be automatically assembled, based on a high-level description of the scenario to be evaluated. This paper provides a solution to this problem focusing on: formally defining the concept of model templates, defining a specification language for model templates, defining an automated instantiation and composition algorithm, and applying the approach to a case study of a large-scale distributed system.

Model-based evaluation is extensively used to estimate performance and reliability of dependable systems. Traditionally, those systems were small and self-contained, and the main challenge for model-based evaluation has been the efficiency of the solution process. Recently, the problem of specifying and maintaining complex models has increasingly gained attention, as modern systems are characterized by many components and complex interactions. Components share similarities, but also exhibit variations in their behavior due to different configurations or roles in the system. From the modeling perspective, variations lead to replicating and altering a small set of base models multiple times. Variability is taken into account only informally, by defining a sample model and explaining its possible variations. In this paper we address the problem of including variability in performability models, focusing on Stochastic Activity Networks (SANs). We introduce the formal definition of Stochastic Activity Networks Templates (SAN-T), a formalism based on SANs with the addition of variability aspects. Differently from other approaches, parameters can also affect the structure of the model, like the number of cases of activities. We apply the SAN-T formalism to the modeling of the backbone network of an environmental monitoring infrastructure. In particular, we show how existing SAN models from the literature can be generalized using the newly introduced formalism.

Mathematical models are an effective tool for studying the properties of complex systems. Constructing such models is a challenging task that often uses repeated patterns or templates. The Template Models Description Language (TMDL) has been developed to clearly define model templates that are used to generate model instances from the template specification. This paper describes the tool support that is being developed for applying the TDML approach with Stochastic Activity Networks (SANs) models. In particular, this paper details a graphical editor for SAN templates, which assists users in creating template-level models based on SANs. From these specifications, it will be possible to generate by model-transformation the subsequent instance-level models, which can be studied by simulation or analytical tools.

Because of the substances they process and the conditions of operation, chemical plants are systems prone to the occurrence of undesirable and potentially dangerous events. Major accidents may occur when a triggering event produces a cascading accident that propagates to other units, a scenario known as domino effect. Assessing the probability of experiencing a domino effect and estimating the magnitude of its consequences is a complex task, as it depends on the nature of the substances being processed, the operating conditions, the failure proneness of equipment units, the execution of preventive maintenance activities, and of course the plant layout. In this work, we propose a stochastic modeling methodology to perform a probabilistic analysis of the likelihood of domino effects caused by propagating vapor cloud explosions. Our methodology combines mathematical models of the physical characteristics of the explosion, with stochastic state-based models representing the actual propagation among equipment units and the effect of maintenance activities. Altogether, the models allow predicting the likelihood of major events occurrence and the associated costs. A case study is analyzed, where various layouts of atmospheric gasoline tanks are assessed in terms of the predicted consequences of domino effects occurrence. The results of the analyses show that our approach can provide precious insights to support decision-making for safety and cost management.

Knowledge-intensive processes (KiPs) cannot be fully specified at design time because not all information about the process is available prior to its execution. At runtime, new information emerges reflecting environment changes or unexpected outcomes. The structure of this kind of processes varies from case to case and it is defined step-by-step based on knowledge worker's decisions made after analyzing the current situation. These decisions rely on the knowledge worker's experience and available information. Current process management approaches still need to adequately address the complex characteristics of knowledge-intensive processes, such as their unpredictability, emergency, non-repeatability, and dynamism. This paper proposes a metamodel for representing KiPs aiming to help knowledge workers during the decision-making process. Domain and organizational knowledge are modeled by objectives and tactics. The metamodel supports the definition of objectives, metrics, tactics, goals and strategies at runtime according to a specific situation. Also, it includes concepts related to context and environment elements, business artifacts, roles and rules. The feasibility of our model was evaluated via a proof of concept in the medical domain.

Service Oriented Architecture (SOA) is a common design pattern that allows building applications composed of several services. It promotes features as interoperability, scalability, and software reuse. Services composing a SOA system may evolve and change during runtime, often outside the control of the owner of the application, which makes the verification and validation processes complex. Among all the automated techniques to validate the behavior of an SOA application, is Model-Based Testing (MBT). MBT requires an accurate model of the application in order to generate suitable test cases. However, the intrinsic of a SOA application sets significant challenges to MBT effectiveness. In this paper we discuss the challenges in the testing of SOA applications, and we propose the use of Model-Driven Engineering (MDE) to improve the flexibility of testing tools. Finally, we outline our plan for realizing MDE-driven MBT within an existing online testing framework.

Coding conventions are a means to improve the reliability of software systems. They can be established for many reasons, ranging from improving the readability of code to avoiding the introduction of security flaws. However, coding conventions often come in the form of textual documents in natural language, which makes them hard to manage and to enforce. Following model-driven engineering principles, in this paper we propose an approach and language for specifying coding conventions using structured models. We ran a feasibility study, in which we applied our language for specifying 215 coding rules from two popular rulesets. The obtained results are promising and suggest that the proposed approach is feasible. However, they also highlight that many challenges still need to be overcome. We conclude with an overview on the ongoing work for generating automated checkers from such models, and we discuss directions for an objective evaluation of the methodology.

Chemical process plants are subject to risk caused by the handling and storage of hazardous substances. Major accidents may occur, particularly in those unfortunate circumstances when a triggering event produces a cascading accident that propagates to other units, a failure propagation scenario known as domino effect. An important aspect of designing such industrial plants is to properly arrange hazardous equipment such that, in the event of failures, cascading effects are minimized. In this work, we present a modeling approach to perform a probabilistic analysis of the likelihood of domino effects caused by propagating vapor cloud explosions. The approach combines the modeling of accident propagation based on physical properties of gas clouds, such as released mass and explosion distance, with the probabilistic modeling of cascading effects based on Stochastic Petri Nets. The proposed methodology is subsequently applied to a case study where different layouts of atmospheric gasoline tanks are analyzed, in order to evaluate the likelihood of domino effect occurrence.

CHESS is an open source methodology and toolset for the development of safety-critical systems. More specifically, CHESS is a model-based methodology, which supports the design, dependability analysis, and code generation for critical systems. Despite its rather mature level in terms of technology readiness, systematic guidance needs to be developed to promote its usage for certification purposes. In this paper, we present a systematic process to guide designers and analysts in the usage of the CHESS toolset for model-based dependability analysis of safety-critical systems in compliance with ISO 26262 Parts 3 and 4, SAE ARP 4754A safety process, and DO-331 model-based development principles. We also have applied our process to a real world automotive hybrid braking system. The proposed process can be used to guide analysts in using CHESS methodology to support both system design and dependability analysis. Finally, we draw our conclusion and sketch future work.

A dramatic shift in system complexity is occurring, bringing monolithic system designs to be progressively replaced by modular approaches. In the latest years, this trend has been emphasized by the system of systems (SoS) concept, in which a complex system or application is the result of the integration of many independent, autonomous constituent systems (CS), brought together in order to satisfy a global goal under certain rules of engagement. The overall behavior of the SoS, emerging from such complex interactions and dependencies, poses several threats in terms of dependability, timeliness, and security, due to the challenging operating and environmental conditions caused by mobility, wireless connectivity, and the use of off-the-shelf components. Referring to our experience in mobile safety-critical applications gained from three different research projects, in this paper, we illustrate the challenges and benefits posed by the adoption of an SoS approach in designing, developing, and maintaining mobile safety-critical applications, and we report on some possible solutions.

The shape of Critical Infrastructures (CIs) has changed drastically in recent years, leading them to become interconnected systems with complex interactions. This will be especially true for future power grids, known as "Smart Grids". In such complex systems, one of the main challenges consists in understanding the possible impact of failures on the overall system, and avoiding cascading or escalading effects. In this paper we present an extensible framework for the analysis of failures propagation in power networks, based on model templates developed using the Stochastic Activity Networks formalism. The approach is applied to a case study of a power network, derived from a real system. The obtained results demonstrate the effectiveness of the approach in assessing the impact of failures on the network, both when considering random failures and when performing what-if analyses on specific nodes.

Socio-technical systems are characterized by the interplay of heterogeneous entities i.e., humans, organizations, and technologies. Application domains such as petroleum, e-health, and many others rely on solutions based on safety-critical socio-technical systems. To ensure a safe operation of these interacting heterogeneous entities, multifaceted and integrated modeling and analysis capabilities are needed. Currently, such capabilities are not at disposal. To contribute to the provision of such capabilities, in this paper we propose SafeConcert, a metamodel that offers constructs to model socio-technical entities and their safety-related properties. SafeConcert also represents a unified and harmonized language that supports the integrated application of qualitative as well as quantitative safety analyses techniques. To support our claims we briefly report about the evaluation that was conducted and documented in the context of the EU CONCERTO project.

Several formalisms and techniques have been introduced in the literature for the purpose of modeling and evaluation of complex systems. Each of them has its strengths and weaknesses, which also depend on the purpose of the evaluation. In this paper we propose the integration of two different formalisms in a single framework for the modeling, validation, and optimization of production-supply problems. In particular, the proposed framework combines Process Graphs (P-Graphs) as the modeling formalism, and Stochastic Activity Networks (SAN) for the analysis and optimization. The integration proposed in this paper extends the capabilities of the P-Graph formalism to include performance and dependability metrics in the optimization process, without hampering the modeling convenience of P-Graphs. The proposed approach is applied to a case study of the optimization of a power supply network.

Agile software development methodologies use an iterative and incremental development in order to handle evolving systems. Consolidated techniques in the field of testing have been applied to these techniques with the main purpose of aiding in the test creation stage. An example is Model-Based Test Driven Development (MBTDD) which joins the concepts of Model-Based Testing (MBT) and Test Driven Development (TDD). However, when iterative and incremental processes are used, problems appear as the consequence of the evolution of the system, such as: how to reuse the test artefacts, and how to select the relevant tests for implementing the new version of the system. In this context, this work proposes a process called D-MBTDD in which the agile development of a system is guided by model-based tests, focusing on helping with the reuse of test artefacts and on the process of identifying tests relevant to development. The information about the modifications between two versions of the test model are used in this approach, which was compared to the Regenerate-All approach, which regenerates test cases along the iterations and does not reuse any of them.

Accidents on petroleum installations can have huge consequences; to mitigate the risk, a number of safety barriers are devised. Faults and unexpected events may cause barriers to temporarily deviate from their nominal state. For safety reasons, a work permit process is in place: decision makers accept or reject work permits based on the current state of barriers. However, this is difficult to estimate, as it depends on a multitude of physical, technical and human factors. Information obtained from different sources needs to be aggregated by humans, typically within a limited amount of time. In this paper we propose an approach to provide an automated decision support to the work permit system, which consists in the evaluation of quantitative measures of the risk associated with the execution of work. The approach relies on state-based stochastic models, which can be automatically composed based on the work permit to be examined.

With the advent of recent technological advances, more demanding tele-immersive applications have started to emerge. In the World Opera application, artists from different opera houses across the globe can participate in a single united performance, and interact almost as if they were co-located. One of the main design challenges in this application domain is to assess to what extent the inevitable failures of some of the numerous and complex hardware, software, and network components affect the quality of experience for the user. This challenge cannot be addressed by traditional system-centric methods for dependability evaluation, which do not take personalized user perspective into account when considering meaningful and acceptable degradation of services. In this paper, we propose a novel method to assess the quality of experience in presence of failures, based on a new metric called perceived reliability . The method takes the human perspective into account and allows considering factors such as human perception of video and audio, characteristics of the audience, as well as performance elements and artistic content. This method can help system designers and engineers compare architectural variants and determine the dependability budget. We show the feasibility of our method by applying it to a World Opera performance. To this end, we construct a SAN-based model and run simulations in the Mobius framework. The obtained results provide useful guidelines for system engineers towards improving the quality of experience of World Opera performances despite the presence of failures.

The injection of software faults in source code requires accurate knowledge of the programming language, both to craft faults and to identify injection locations. As such, fault injection and code mutation tools are typically tailored for a specific language and have limited extensibility. In this paper we present a model-driven approach to craft and inject software faults in source code. While its concrete application is presented for Java, the workflow we propose does not depend on a specific programming language. Following Model-Driven Engineering principles, the faults and the criteria to select injection locations are described using structured, machine-readable specifications based on a domain-specific language. Then, automated transformations craft artifacts based on OCL and Java, which represent the faults to be injected and are able to select the candidate injection locations. Finally, artifacts are executed against the target source code, performing the injection in the desired locations. We devise a supporting tool and exercise the approach injecting 13 different kinds of software faults in the Java source code of six different projects.

Cyber-physical systems are characterized by strong interactions between their physical and computation parts. The increasing complexity of such systems, now used in numerous application domains (e.g., aeronautics, healthcare), in conjunction with hard to predict surrounding environments or the use of non-traditional middleware and with the presence of non-deterministic or non-explainable software outputs, tend to make traditional Verification and Validation (V&V) techniques ineffective. This paper presents the H2020 ADVANCE project, which aims precisely at addressing the Verification and Validation challenges that the next-generation of cyber-physical systems bring, by exploring techniques, methods and tools for achieving the technical objective of improving the overall efficiency and effectiveness of the V&V process. From a strategic perspective, the goal of the project is to create an international network of expertise on the topic of V&V of cyber-physical systems.