Oliver Botti

TIRAN: Flexible and Portable Fault Tolerance Solutions for Cost Effective Dependable Applications

Available solutions for fault tolerance in embedded automation are often based on strong customisation, have impacts on the whole life-cycle, and require highly specialised design teams, thus making dependable embedded systems costly and difficult to develop and maintain. The TIRAN project develops a framework which provides fault tolerance capabilities to automation systems, with the goal of allowing portable, reusable and cost-effective solutions. Application developers are allowed to select, configure and integrate in their own environment a variety of software-based functions for error detection, confinement and recovery provided by the framework.

The TIRAN approach to reusing software implemented fault tolerance

Available solutions for fault tolerance in embedded automation are often based on strong customisation, have impacts on the whole life-cycle, and require highly specialised design teams, thus making dependable embedded systems costly and difficult to develop and maintain. The TIRAN project develops a framework which provides fault tolerance capabilities to automation systems, with the goal of allowing portable, reusable and cost-effective solutions. Application developers are allowed to select, configure and integrate in their own environment a variety of software-based functions for error detection, confinement and recovery provided by the framework.

An Incremental Specification of a Hydroelectric Power Plant Control Systems using a Class of Modular Algebraic Nets

In this paper, we present how the specification of a case study, the “Hydroelectric Power Plant Control System”, proposed by the ENEL S.p.A., the major italian electricity supplier, can be incrementally obtained using OBJSA nets, a class of modular algebraic high-level nets, supported by their environment ONE. OBJSA nets, which result from the integration of Superposed Automata (SA) nets and of the algebraic specification language OBJ, stress the possibility of building the system model through composition of its (sequential non-deterministic) components and encourage the incremental development of the specification and its reusability, thanks to the availability of the Redp and Redt transformations. The environment ONE supports the user in producing and executing a specification, hiding from her/him, as much as possible, the technical details of the algebraic part of the specification.

Process and resource boxes: an integrated PN performance model for applications and architectures

The work presented in this paper is part of a larger project aiming at developing a performance oriented parallel system design method based on Petri nets (PNs) and actually usable in industrial frameworks. As modularity and compositionality are crucial for usability/reusability, previous work proposed the process-box as a net-based construct for modelling concurrent applications such as Occam programs. Here we extend the approach by introducing the resource-box and we show, as an example, how the two constructs are jointly used for modelling a simple architecture and its workload. The example given also allows us to point out how the proposed approach enhances the effectiveness and usability/reusability of GSPN, the most widely used Petri net-based formalism for performance evaluation.<<ETX>>

System Fault Tolerance Specification: Proposal of a Method Combining Semi-formal and Formal Approaches

The topic of the present work is the specification of system Fault Tolerance (FT). FT is considered a valid technique for increasing the dependability of critical automation systems by adding them the ability to operate in presence of faults. Two basic considerations stimulated the development of the present work. Firstly although a considerable amount of concepts and theory have been published around FT, a full-organized method supporting their application to the FT needs of a specific system is still missing. Furthermore, the availability of a methodology oriented to the specification of system FT is especially useful in view of integrating available FT software layers according to specific system needs. Goal of the present work is therefore to develop a methodology for the FT specification, to be used as a tool supporting the configuration of the tailorable FT software layer, which is currently under development within the TIRAN Project. The presented approach to the FT specification is based on a combined use of two general-purpose specification methods: the UML (Unified Modeling Language) graphical method and the TRIO (Tempo Reale ImplicitO) temporal logic. The main novelty of the proposed method consists in the identification and organization of a sequence of specification steps, which drive the industrial user in collecting and analyzing system dependability requirements and then in designing FT solutions, possibly tailoring already existing and configurable FT mechanisms.

Separating recovery strategies from application functionality: experiences with a framework approach

Industry-oriented fault tolerance solutions for embedded distributed systems should be based on adaptable, reusable elements. Software-implemented fault tolerance can provide such flexibility via the presented framework approach. It consists of (1) a library of fault tolerance functions, (2) a backbone coordinating these functions, and (3) a language expressing configuration and recovery. This language is a sort of ancillary application layer, separating recovery aspects from functional ones. Such a framework approach allows for a flexible combination of the available hardware redundancy with software-implemented fault tolerance. This increases the availability and reliability of the application at a justifiable cost thanks to the re-usability of the library elements in different targets systems. It also increases the maintainability due to the separation of the functional behavior from the recovery strategies that are executed when an error is detected as the modifications to functional and nonfunctional behavior are, to some extent, independent and hence less complex. Practical experience is reported from the integration of this framework approach in an automation system for electricity distribution. This case study illustrates the power of software-based fault tolerance solutions and of the configuration-and-recovery language ARIEL to allow flexibility and adaptability to changes in the environment.

From basic to timed net models of Occam: an application to program placement

Starting from the Petri net model of Occam which uses 1-safe PT nets, the paper develops, on the top of it, a timed net model, using Generalized Stochastic Petri Nets (GSPN), to allow a performance analysis of Occam programs. As an example, the authors carry out the comparison of different placements of an Occam program over a given set of distributed processors.<<ETX>>

A GSPN based methodology for the evaluation of concurrent applications in distributed plant automation systems

Abstract This work is part of an investigation aiming at setting up a methodology based on Generalized Stochastic Petri Nets (GSPN) to model and to evaluate concurrent applications regarding their target parallel and distributed architectures. Experimentation concerning real case studies pointed out the need to deepen and to integrate some specific steps of model construction and analysis: (1) the choice of a suitable abstraction level in the modular modelling technique; (2) the adoption of proper parameter assignment criteria; and (3) the congruent definition of a set of quantification indices, covering the basic metrics of parallel computing, suitable to characterize an application in terms of its performance and to support its mapping over a parallel architecture.

SWN Nets as a Framework for the Specification and the Analysis of FT Techniques Adopted in Electric Plant Automation

The use of formal methods for specification and analysis of dependable systems is considered a promising opportunity to support the evaluation of critical issues since the early design phases. Stochastic Petri nets can play an important role not only for the specification of functional issues of a system, but also for the predictive evaluation of performance and dependability properties. In this paper we investigate the possibility of using Stochastic Well-formed Nets (SWN) as a framework for specifying, validating and evaluating fault tolerance mechanisms used in plant automation. A temporal redundancy technique currently adopted in several electric plants to deal with transient faults is taken as a case-study. The peculiar feature of SWNs is the capability of directly generating an aggregated state space thus allowing for efficient model analysis.

Stochastic Petri net evaluation techniques in plant automation: tuning performance indices for distributed applications

We report the results of an investigation aiming at experimenting the use of Generalized Stochastic Petri Nets (GSPN), a formal method which allows to model a concurrent application with an explicit representation of timing constraints, and to evaluate its performance over a target parallel architecture. We focus on the definition and use of a set of indices suitable to characterise an application in terms of its performance and to support its mapping over a parallel architecture, guided by the training over a case study taken from the ENEL R&D activity in real time plant automation. The effort spent to extend and to bring a relatively consolidated theory (GSPN) near to the industrial user needs, may be seen as the first original contribution of the paper.