1. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy 11. FSAP and the Model Checking Approach to FT Extraction. 174 An overview of the algorithms for fault tree generation available in FSAP. Algorithms based on model checking techniques. In this tutorial: focus on BDD-based routines. SAT-based routines exist as well.

2. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Model Checking Automated technique to verify a formal system model against a formal specification. Systems typically modeled as state transition systems. Specifications provided as temporal logic formulae. Model checking provides a formal guarantee that a specification is obeyed. (A counterexample trace is produced if the specification does not hold) Exhaustive technique compared to testing and simulation. Major breakthrough with the introduction of symbolic model checking: Idea: manipulate sets of states and transitions. Efficient symbolic representations for the characteristic functions of such sets. In the rest of this chapter: model checking techniques applied to FT generation. 175

3. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Binary Diagrams 176 BDD = Binary Decision Diagram. OBDD = Ordered BDD. (Built with a specific variable order) ROBDD = Reduced OBDD. (Canonical form: elimination of redundancies) (RO)BDDS are an efficient and compact representation for Boolean formulas. Size of the BDD depend on variable order. Set-theoretic operations as logical operators. A BDD for the formula (a 1 ↔ a 2 ) /\ (b 1 ↔ b 2 ). Dashed = false, solid = true

4. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy BDD-based Algorithms for FTA 177 Different algorithms available: Forward (FWD). Backward (BWD). Optimizations: Dynamic cone of influence (DCOI). Dynamic pruning (PRUN).

5. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Cut Sets 178

6. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Forward Algorithm 179

7. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Forward Algorithm 180

8. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Forward Algorithm 181

9. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Forward Algorithm 182 Init

10. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Forward Algorithm 183 Init

11. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Forward Algorithm 184 Init

12. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Forward Algorithm 185 Init

13. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Forward Algorithm 186 Init

14. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Forward Algorithm 187 Init Fixpoint

15. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Forward Algorithm 188 Init Fixpoint

16. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Forward Algorithm 189 Init TLE Fixpoint

17. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Forward Algorithm 190 Init TLE Fixpoint

18. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Forward Algorithm 191 CS1CS2CS3CS4CS5 O3 01101 11011 10101 10111 01100 01110 00101 00100 01111 11101 10101 S1 S2 S3 S4 S5 F1 F2 F3 O1O1 O2

19. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Forward Algorithm 192 CS1CS2CS3CS4CS5 O3 01101 11011 10101 10111 01100 01110 00101 00100 01111 11101 10101 S1 S2 S3 S4 S5 F1 F2 F3 O1O1 O2

20. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Forward Algorithm 193 CS1CS2CS3CS4CS5 O3 01111 11101 10101 S1 S2 S3 S4 S5 F1 F2 F3 O1O1 O2

21. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Forward Algorithm 194 CS1CS2CS3CS4CS5 O3 01111 11101 10101 S1 S2 S3 S4 S5 F1 F2 F3 O1O1 O2

22. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Forward Algorithm 195 CS1CS2CS3CS4CS5 O3 S1 S2 S3 S4 S5 F1 F2 F3 O1O1 O2 01 10 10

23. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Forward Algorithm 196 CS1CS2CS3CS4CS5 O3 S1 S2 S3 S4 S5 F1 F2 F3 O1O1 O2 01 10 10

24. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Forward Algorithm 197 CS1CS2CS3CS4CS5 O3 S1 S2 S3 S4 S5 F1 F2 F3 O1O1 O2 01 10 10 MCS 1 MCS 2

25. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Backward Algorithm 198

26. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Backward Algorithm 199

27. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Backward Algorithm 200

28. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Backward Algorithm 201 Tle

29. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Backward Algorithm 202 Tle

30. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Backward Algorithm 203 Tle

31. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Backward Algorithm 204 Tle

32. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Backward Algorithm 205 Tle

33. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Backward Algorithm 206 Tle Fixpoint

34. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Backward Algorithm 207 Tle Fixpoint

35. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Backward Algorithm 208 Tle Fixpoint Init

36. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Backward Algorithm 209 Tle Fixpoint Init

37. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Backward Algorithm 210 Tle Fixpoint Init And so on …

38. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Dynamic Cone of Influence 211 Tle

39. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Dynamic Cone of Influence 212 Tle Compute pre-images & restricted Kripke structures, based on dependency withTle M 0 ≤ M 1 ≤ … ≤ M n-1 ≤ M n – defer construction of the Kripke structure – hopefully M n is smaller than the global M

40. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Dynamic Cone of Influence 213 Tle M0M0 Compute pre-images & restricted Kripke structures, based on dependency withTle M 0 ≤ M 1 ≤ … ≤ M n-1 ≤ M n – defer construction of the Kripke structure – hopefully M n is smaller than the global M

41. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Dynamic Cone of Influence 214 Tle Compute pre-images & restricted Kripke structures, based on dependency withTle M 0 ≤ M 1 ≤ … ≤ M n-1 ≤ M n – defer construction of the Kripke structure – hopefully M n is smaller than the global M M0M0 M1M1

42. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Dynamic Cone of Influence 215 Tle Compute pre-images & restricted Kripke structures, based on dependency withTle M 0 ≤ M 1 ≤ … ≤ M n-1 ≤ M n – defer construction of the Kripke structure – hopefully M n is smaller than the global M M0M0 M1M1 M n-1

43. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Dynamic Cone of Influence 216 Tle Compute pre-images & restricted Kripke structures, based on dependency withTle M 0 ≤ M 1 ≤ … ≤ M n-1 ≤ M n – defer construction of the Kripke structure – hopefully M n is smaller than the global M M0M0 M1M1 M n-1 Fixpoint MnMn

44. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Dynamic Pruning 217 Init TLE

45. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Dynamic Pruning 218 Init TLE At each iteration, compute a partial set of cut sets Use the partial set to prune non-minimal config. in the search space

46. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Dynamic Pruning 219 Init TLE At each iteration, compute a partial set of cut sets Use the partial set to prune non-minimal config. in the search space

47. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Dynamic Pruning 220 Init TLE At each iteration, compute a partial set of cut sets Use the partial set to prune non-minimal config. in the search space

48. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Dynamic Pruning 221 Init TLE At each iteration, compute a partial set of cut sets Use the partial set to prune non-minimal config. in the search space

49. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Dynamic Pruning 222 Init TLE At each iteration, compute a partial set of cut sets Use the partial set to prune non-minimal config. in the search space

50. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Dynamic Pruning 223 Init TLE At each iteration, compute a partial set of cut sets Use the partial set to prune non-minimal config. in the search space

51. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Dynamic Pruning 224 Init TLE At each iteration, compute a partial set of cut sets Use the partial set to prune non-minimal config. in the search space

52. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Dynamic Pruning 225 Init TLE At each iteration, compute a partial set of cut sets Use the partial set to prune non-minimal config. in the search space

53. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Dynamic Pruning 226 Init TLE At each iteration, compute a partial set of cut sets Use the partial set to prune non-minimal config. in the search space

54. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Dynamic Pruning 227 Init TLE At each iteration, compute a partial set of cut sets Use the partial set to prune non-minimal config. in the search space

55. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Dynamic Pruning 228 Init TLE At each iteration, compute a partial set of cut sets Use the partial set to prune non-minimal config. in the search space

56. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Dynamic Pruning 229 Init TLE At each iteration, compute a partial set of cut sets Use the partial set to prune non-minimal config. in the search space

57. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Dynamic Pruning 230 Init TLE At each iteration, compute a partial set of cut sets Use the partial set to prune non-minimal config. in the search space

58. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Dynamic Pruning 231 Init TLE Fixpoint At each iteration, compute a partial set of cut sets Use the partial set to prune non-minimal config. in the search space

59. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy 12. Retrenchment and Model Checking Compared. We compare: The Retrenchment-based FT generation algorithm. The BDD-based backward FT generation algorithm. (with Dynamic Cone of Influence and Dynamic Pruning) In the general case of feedback circuits with time delays. Strong similarities: Most important: backward resolution, i.e. start from the TLE. But – several differences: Related to: system decomposition, search strategy, etc. Implementation-level but also theoretical differences. Discussion: how to reconcile retrenchment with model checking. 232

60. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy System Decomposition Retrenchment-based: decomposition based on system structure. BDD-based: decomposition based on time delays. Consequences: No difference if unit delays between every block. (e.g., adders and fanouts in the circuit example). In the purely combinational case – no delays: BDD-based flattens the system – monolithic transition relation. Reconciliation: Not a huge difference: BDD-based could be instructed to take system structure into account, or use “hybrid” strategies. 233

61. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Search Strategy Retrenchment-based: non-deterministic, data dependency driven, search. Depth-first search illustrated here, although simplified by the use of angelic non-determinism theoretically. BDD-based: breadth-first search. Each step decomposing one layer of the composition. Efficiency of breadth-first search relies on the BDD package. Dynamic pruning introducing controlled depth-first aspects in the search. Reconciliation: Not a huge difference: search strategy in BDD-based is flexible. Possibly introducing further depth-first aspects in BDD-based, e.g. descend first in branches with a lower number of faults, and then prune. Mostly an implementation detail. 234

62. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Minimisation Rules Retrenchment-based: minimisation rules to prune the search tree on the fly. BDD-based: minimisation rules mimicked by the internals of the algorithm or by the BDD package. Discarding non-needed subtrees → BDD package + DCOI reduction rules. Discarding subtrees at input-insensitive faults → BDD package. Discarding locally subsumed expressions → dynamic pruning. Subsumption checking at the subsystem level → dynamic pruning. Reconciliation: Not needed. 235

63. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Timing and Feedback Retrenchment-based: deals with time delays explicitly. Time information fully recorded. Different definitions of minimality may be used to turn a RT into a FT. BDD-based: deals with time delays tacitly. Time information is not recorded, temporal details abstracted away, same states with different time delays are identified. Directly generates the fault trees representing the minimal cut sets. (where definition of minimality abstracts away from time) Reconciliation: Soundness: we get the same results in both cases if we abstract away from time. Possibly introducing handling of timing information in BDD-based – but in practice may have an impact on performance. Need to deal with sets of traces rather than sets of states, in a controlled way. 236

64. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Initial States and Cold-Start Failures Retrenchment-based: uses appropriate truncation of the detailed FT. Minimisation performed independently of initialisation. BDD-based: truncation performed on-the-fly, reachability check built in. Tight coupling of initialisation and minimisation. Minimisation may interact with timing abstraction: It may discard states that have been identified because of timing abstraction. It may discard hot-running scenarios in favour of cold-start ones. Focus on computation of MCSs, rather than fault trees. Reconciliation: It is possible to rule out cold-start scenarios in BDD-based, if desired. Possibly introducing further guidance in BDD-based to deal with hot-running and cold-start failures. 237

65. R. Banach, School of Computer Science, University of Manchester, UK M. Bozzano, Fondazione Bruno Kessler, FBK-IRST, Trento, Italy Conclusions Retrenchment-based: an idealised specification of a FT generation algorithm. Can move it closer to the BDD-based algorithm by carefully forgetting details. BDD-based: an implementation that does not completely conform to it. Can move it closer to the Retrenchment-based ‘ideal’ by including more details … but you have to watch performance in practice. 238