A Continuous Time Markov Chain (CTMC) uses probability values that represents events occurrences over time. It correspond to an exponential distribution, also called a poisson distribution. For this reason, all error event occurrence in the Error Model shall be described using the Poisson Distribution Value, as shown below.
EMV2::OccurrenceDistribution => [ ProbabilityValue => 1.05e-10 ; Distribution => Poisson;] applies to Failure;
In the following, we present how to generated CTMC model from an AADL model. It is inspired by an example from PRISM case-studies available here .
The model is divided in two files (which content is reproduced below. The graphical representation of the model is shown below.
On the model, we does not describe any fault propagation, we only describe fault for each separate component. The values of probability occurences were taken from the PRISM case-study.
Then, when using the CTMC model into PRISM, the user can use the generated model, add additional formulas and/or rewards. The following picture show the potential occurrence of having at least one transient failure for two processor. As a processor may fail each day, failure of two processor is quickly stable to a fixed probability (1.0) after one day.
-- This example is inspired from the embedded control -- example taken from the PRISM case studies. -- You can read more about this example on -- http://www.prismmodelchecker.org/casestudies/embedded.php package embedded_control public with EMV2; data temperature end temperature; data action end action; device sensor features tempval : out event data port temperature; annex EMV2 {** use types ErrorLibrary; use behavior ErrorModelLibrary::Simple; properties -- corresponds to lambda_s in the PRISM model -- lamba_s = 1/(30*24*60*60) -- from the specifications, it corresponds to 1 fault per month EMV2::OccurrenceDistribution => [ ProbabilityValue => 3.85e-7 ; Distribution => Poisson;] applies to Failure; **}; end sensor; device implementation sensor.i end sensor.i; device actuator features action : in event data port action; annex EMV2 {** use types ErrorLibrary; use behavior ErrorModelLibrary::Simple; properties -- corresponds to lambda_a in the PRISM model -- lamba_a = 1/(2*30*24*60*60) -- from the specifications, it corresponds to 1 fault per 2 months EMV2::OccurrenceDistribution => [ ProbabilityValue => 1.92e-7 ; Distribution => Poisson;] applies to Failure; **}; end actuator; device implementation actuator.i end actuator.i; bus generic_bus end generic_bus; bus implementation generic_bus.i end generic_bus.i; processor generic_processor features ba : requires bus access generic_bus.i; annex EMV2 {** use types embedded_errlib; use behavior embedded_errlib::SimpleAndTransient; properties -- corresponds to lambda_s in the PRISM model -- lamba_p = 1/(365*24*60*60) -- from the specifications, it corresponds to 1 fault per year EMV2::OccurrenceDistribution => [ ProbabilityValue => 3.17e-8 ; Distribution => Poisson;] applies to Failure; -- corresponds to delta_r in the PRISM model -- delta_r = 1/(1/30) -- from the specifications, it corresponds to 1 recovery occurence each 30 seconds EMV2::OccurrenceDistribution => [ ProbabilityValue => 0.03 ; Distribution => Poisson;] applies to ResetEvent; -- corresponds to delta_f in the PRISM model -- delta_f = 1/(1/24*60*60) -- from the specifications, it corresponds to 1 transient failure occurence each day EMV2::OccurrenceDistribution => [ ProbabilityValue => 1.15e-5 ; Distribution => Poisson;] applies to FailureTransient; **}; end generic_processor; processor output_processor extends generic_processor features action_out : out event data port action; end output_processor; processor input_processor extends generic_processor features temperature1 : in event data port temperature; temperature2 : in event data port temperature; temperature3 : in event data port temperature; end input_processor; processor main_processor extends generic_processor end main_processor; system main end main; system implementation main.i subcomponents s1 : device sensor.i; s2 : device sensor.i; s3 : device sensor.i; a1 : device actuator.i; a2 : device actuator.i; pi : processor input_processor; pm : processor main_processor; po : processor output_processor; b : bus generic_bus.i; connections port s1.tempval -> pi.temperature1; port s2.tempval -> pi.temperature2; port s3.tempval -> pi.temperature3; port po.action_out -> a1.action; port po.action_out -> a2.action; bus access b -> pi.ba; bus access b -> pm.ba; bus access b -> po.ba; properties Actual_Processor_Binding => (reference (pi)) applies to s1; Actual_Processor_Binding => (reference (pi)) applies to s2; Actual_Processor_Binding => (reference (pi)) applies to s3; Actual_Processor_Binding => (reference (po)) applies to a1; Actual_Processor_Binding => (reference (po)) applies to a2; annex EMV2 {** use behavior ErrorModelLibrary::Simple; composite error behavior states [((s1.Operational and s2.Operational ) or (s1.Operational and s3.Operational ) or (s3.Operational and s2.Operational ) ) or (a1.Operational or a2.Operational)]-> Operational; end composite; **}; end main.i; end embedded_control;
package embedded_errlib public annex EMV2 {** error types NoValue : type; BadValue : type; LateValue : type; NoService : type; end types; error behavior ThreeState states Operational: initial state; NonCriticalModeFailure: state; CriticalModeFailure: state; end behavior; error behavior ThreeErrorStates events BadValueEvent: error event; NoValueEvent: error event; LateValueEvent: error event; states Operational: initial state; BadValueState: state; NoValueState : state; LateValueState: state; transitions BadValueTransition : Operational -[BadValueEvent]-> BadValueState; NoValueTransition : Operational -[NoValueEvent]-> NoValueState; LateTransition : Operational-[LateValueEvent]->LateValueState; end behavior; error behavior Simple events Failure : error event ; states Operational : initial state ; Failed : state ; transitions BadValueTransition : Operational -[ Failure ]-> Failed ; end behavior ; error behavior SimpleAndTransient events Failure : error event; FailureTransient : error event; ResetEvent : recover event; states Operational : initial state; Failed : state; TransientFailure : state; transitions transerr: Operational -[ Failure ]-> Failed; transerr: Operational -[ FailureTransient ]-> TransientFailure; treset : TransientFailure -[ ResetEvent ]-> Operational; end behavior; **}; end embedded_errlib;