Michele Minichino

Improving the analysis of dependable systems by mapping fault trees into Bayesian networks

Abstract Bayesian Networks (BN) provide a robust probabilistic method of reasoning under uncertainty. They have been successfully applied in a variety of real-world tasks but they have received little attention in the area of dependability. The present paper is aimed at exploring the capabilities of the BN formalism in the analysis of dependable systems. To this end, the paper compares BN with one of the most popular techniques for dependability analysis of large, safety critical systems, namely Fault Trees (FT). The paper shows that any FT can be directly mapped into a BN and that basic inference techniques on the latter may be used to obtain classical parameters computed from the former (i.e. reliability of the Top Event or of any sub-system, criticality of components, etc). Moreover, by using BN, some additional power can be obtained, both at the modeling and at the analysis level. At the modeling level, several restrictive assumptions implicit in the FT methodology can be removed and various kinds of dependencies among components can be accommodated. At the analysis level, a general diagnostic analysis can be performed. The comparison of the two methodologies is carried out by means of a running example, taken from the literature, that consists of a redundant multiprocessor system.

Unavailability of critical SCADA communication links interconnecting a power grid and a Telco network

The availability of power supply to power grid customers depends upon the availability of services of supervision, control and data acquisition (SCADA) system, which constitutes the nervous system of a power grid. In turn, SCADA services depend on the availability of the interconnected networks supporting such services. We propose a service oriented stochastic modelling methodology to investigate the availability of large interconnected networks, based on the hierarchical application of different modelling formalisms to different parts of the networks. Interconnected networks are decomposed according to the specific services delivered until the failure and repair mechanisms of the decomposed elementary blocks can be identified. We represent each network by a convenient stochastic modelling formalism, able to capture the main technological issues and to cope with realistic assumptions about failure and recovery mechanisms. This procedure confines the application of the more intensive computational techniques to those subsystems that actually require it. The paper concentrates on an actual failure scenario, occurred in Rome in January 2004 that involved the outage of critical SCADA communication links, interconnecting a power grid and a Telco network.

Comparing Fault Trees and Bayesian Networks for Dependability Analysis

Bayesian Networks (BN) provide a robust probabilistic method of reasoning under uncertainty. They have been successfully applied in a variety of real-world tasks and their suitability for dependability analysis is now considered by several researchers. In the present paper, we aim at defining a formal comparison between BN and one of the most popular techniques for dependability analysis: Fault Trees (FT). We will show that any FT can be easily mapped into a BN and that basic inference techniques on the latter may be used to obtain classical parameters computed using the former (i.e. reliability of the Top Event or of any sub-system, criticality of components, etc...). Moreover, we will discuss how, by using BN, some additional power can be obtained, both at the modeling and at the analysis level. In particular, dependency among components and noisy gates can be easily accommodated in the BN framework, together with the possibility of performing general diagnostic analysis. The comparison of the two methodologies is carried on through the analysis of an example that consists of a redundant multiprocessor system, with local and shared memories, local mirrored disks and a single bus.

Improving Resilience of Interdependent Critical Infrastructures via an On-Line Alerting System

This paper illustrates the activities under development within the FP7 EU MICIE project. The project is devotedto design and implement an on-line alerting system, able toevaluate, in real time, the level of risk of interdependent Critical Infrastructures (CIs). Such a risk is generated by undesired events and by the high level of interconnection of the different infrastructures. Heterogeneous models are under development to perform short term predictions of the Quality of Service (QoS) of each CI according to the QoS of the others, to the level of interdependency among the Infrastructures, and according to the undesired events identified in the reference scenario.

Fluid Petri Nets and hybrid model-checking: a comparative case study

The modeling and analysis of hybrid systems is a recent and challenging research area which is actually dominated by two main lines: a functional analysis based on the description of the system in terms of discrete state (hybrid) automata (whose goal is to ascertain conformity and reachability properties), and a stochastic analysis (whose aim is to provide performance and dependability measures). This paper investigates a unifying view between formal methods and stochastic methods by proposing an analysis methodology of hybrid systems based on Fluid Petri Nets (FPNs). FPNs can be analyzed directly using appropriate tools. Our paper shows that the same FPN model can be fed to different functional analyzers for model checking. In order to extensively explore the capability of the technique, we have converted the original FPN into languages for discrete as well as hybrid as well as stochastic model checkers. In this way, a first comparison among the modeling power of well known tools can be carried out. Our approach is illustrated by means of a ‘real world’ hybrid system: the temperature control system of a co-generative plant. q 2003 Elsevier Ltd. All rights reserved.

Automatic verification of a turbogas control system with the murϕ verifier

Automatic analysis of Hybrid Systems poses formidable challenges both from a modeling as well as from a verification point of view. We present a case study on automatic verification of a Turbogas Control System (TCS) using an extended version of the Murφv; verifier. TCS is the heart of ICARO, a 2MW Co-generative Electric Power Plant. For large hybrid systems, as TCS is, the modeling effort accounts for a significant part of the whole verification activity. In order to ease our modeling effort we extended the Murφv; verifier by importing the C language long double type (finite precision real numbers) into it. We give experimental results on running our extended Murφv; on our TCS model. For example using Murφv; we were able to compute an admissible range of values for the variation speed of the user demand of electric power to the turbogas.

Discrete Event Simulation of QoS of a SCADA System Interconnecting a Power Grid and a Telco Network

Indicators of Quality of Service (QoS) of Fault Isolation and System Restoration (FISR) service, delivered by SCADA system are computed, discussed and correlated to quality indicators of power supplied to customers. In delivering FISR service, SCADA system, Telco network and Power grid act as a whole heterogeneous network. While SCADA system and Telco network can be well represented by means of discrete event simulators. To represent a Power grid a continuous simulator is typically required. In the paper, to compute QoS of FISR, SCADA system, Telco network and Power grid have been represented by a unique model by means of a discrete event simulator.

Risk analysis via heterogeneous models of SCADA interconnecting Power Grids and Telco networks

The automation of Power Grids by means of Supervisory Control and Data Acquisition (SCADA) systems has led to an improvement of Power Grid operations and functionalities but also to pervasive cyber interde-pendencies between Power Grids and Telecommunication Networks. Many power grid services are increasingly depending upon the adequate functionality of SCADA system which in turn strictly depends on the adequate functionality of its Communication infrastructure. We propose to tackle the SCADA risk analysis by means of different and heterogeneous modeling techniques and software tools. We demonstrate the applicability of our approach through a case study on an actual SCADA system for an electrical power distribution grid. The modeling techniques we discuss aim at providing a probabilistic dependability analysis, followed by a worst case analysis in presence of malicious attacks and a real-time performance evaluation.

A tool for network reliability analysis

A network is a structure where any couple of nodes is normally connected by different independent paths, thus making the structure intrinsically reliable. For this reason, many natural, social and technological systems organize in the form of networks. A tool for network reliability analysis, where different approaches are tested and compared, is in progress. The paper presents some preliminary results of a scalable benchmark, that includes different network structures.

Methods of Increasing Modelling Power for Safety Analysis, Applied to a Turbine Digital Control System

The paper describes a probabilistic approach based on methods of increasing modelling power and different analytical tractability, to analyse safety of turbine digital control system. First, a Fault-Tree (FT) has been built to model the system, assuming independent failures and binary states of its components. To include multi-states and sequentially dependent failures of the system components and to perform diagnoses, FT has been converted into a Bayesian Net. Moreover, to accommodate repair activity, FT has been converted into a Stochastic Petri Net. Due to the very large space of states of the resulting model, a coloured Petri Net model have been built to alleviate the state explosion problem. Safety measures have been computed, referring to the emergent standard IEC 61508. The applicability, the limits and the main selection criteria of the investigated methods are provided.