of 54 /54
Budapesti Műszaki és Gazdaságtudományi Egyetem Méréstechnika és Információs Rendszerek Kvalitatív hibaterjedési analízis Autonóm és hibatűrő információs rendszerek Kocsis Imre ikocsis @ mit.bme.hu 2013.10.14.

Kvalitatív hibaterjedési analízis

  • Author
    shana

  • View
    34

  • Download
    2

Embed Size (px)

DESCRIPTION

Kvalitatív hibaterjedési analízis. Autonóm és hibatűrő információs rendszerek Kocsis Imre ikocsis @ mit.bme.hu 2013.10.14. Hibaterjedés. Függőségek erőforráshasználat adatcsere Hibaterjedés: erőforrás-állapot adat … vagy hiánya. Hibaterjedés függő komponensek között. - PowerPoint PPT Presentation

Text of Kvalitatív hibaterjedési analízis

1. dia

Kvalitatv hibaterjedsi analzisAutonm s hibatr informcis rendszerek

Kocsis [email protected] 2013.10.14.Budapesti Mszaki s Gazdasgtudomnyi EgyetemMrstechnika s Informcis Rendszerek TanszkHibaterjeds

Fggsgekerforrshasznlatadatcsere

Hibaterjeds:erforrs-llapotadat vagy hinyaHibaterjeds fgg komponensek kztt

(Laprie et al.: Basic Concepts of and Taxonomy of Dep. And Secure Computing, 2004)Eltrs a hibamentes rendszer viselkedshez kpestEPA: az eltrs data flow-szer terjedst vizsgljukBels s kls hibkra is3nll komponensek: hibaautomata

Inputs and outputs: behaviorv0, v0, v3, v2, v0, referencev1, v0, v4, v2, v0, actualE1, E0, E2, E0, E0, Kapcsolatok: protokoll-automata sajt abc-vel

Kompozit-automata: referencia + egy adott mutci

Adathiba: referenciarendszer viselkedstl eltrsIll. hipotzise

Klasszifikci: mrnki tapasztalat

A vgeredmny egy errorokat olvas s r automata! ( / mutci)

Pontostsunk.KvetelmnymodellezsLTL & CTL

LTL

Kompozit modellekReferencia s valdi (actual) komponensValdi komponens:Lehet mutci (jobbra lent pp nem az)A bemenetek eltrhetnek a referencia-futstltlet: hasonltsuk ssze a kettt!

Kompozit modell

Kompozit modell, mint error-automata: bemeneti s kimeneti vltozkon prediktumok11

Plda: Cruise Control12

{OK, OMISSION, VALUEERR},ss3,ss2,ss1,ss0Plda: Cruise Control13

{OK, OMISSION, VALUEERR},ss3,ss2,ss1,ss0,sk3,sk2,sk1,sk0{OK, OMISSION, VALUEERR}Plda: Cruise Control14

,ssp3,ssp2,ssp1,ssp0{OK, OMISSION, ERRACTIVE, VALUEERR}Plda: Cruise ControlTemporlis absztrakci a hibaautomatnRendszerfuts: hibk sorozatai a kapcsolatokon no error error

Lehetsges hiba-futsok halmaznak particionlsa: szindrmkIdbeli absztrakciPlda: vegyk a legslyosabbat ( slyossgi relci!)

Vgeredmny: tblzat (relci) a bemeneti/kimeneti szindrmkon (+ bels hibamd)

Overabstraction: ktfbl ptkezve a tblzat akr hamis sorokat is tartalmazhatE1, E0, E2, E2, E0, S5Mirt? Dinamikus vizsglatok korltaillapottr-kezels problmiprecz modellezskompozit rendszereklsd modellellenrzs (Formlis mdszerek)Modellezsi problmk"fekete doboz" rendszerekSebessg - valsidej diagnosztika?

16Hibaterjeds statikus lersaInformlisan: dinamika elhagysallapot-absztrakcikomponensek bels hibamdjaAbsztrakci az adatfolyamontrbeli: kvalitatv hibamdokidbeli: hiba-futs klasszifiklsamellkhats: temezs, szinkronits elvesztse

17Elemtpus-szint hibaterjeds statikus lersaRelcibemeneti szindrma-vltozkkimeneti szindrma-vltozk(bels) hiballapotTopolgiadinamikus struktrk modellezse?Valdi pesszimista tlabsztrahlspessimistic overabstractionszemantika

18Hibaterjeds statikus analziseKihvsokmrnki modellezskvalitatv hibamdok kztt teljes rendezs?Szindrma-kszletek kompozicionalitsalekpezs matematikai analzisreanalzis-megolds illesztse nylt rendszertervezsi s rendszermenedzsment eszkzkhzmetamodellezs

19

Plda

21Various sensorsSpeed sensor (km/h)Plda

22Various sensorsCruise control keypad, boolean status message:Active/inactiveIncrease CC speed valueDecrease CC speed value Plda

23Various sensorsAccelerator pedal sensor (0-100 integer)Plda

24Various sensorsIgnition state sensor (on/off)Plda

25Various sensorsEngine sensor: rotation (1/min) and temperature (Celsius)Plda

26Cruise controlWhen CC is active, periodically emits simulated pedal positions to keep the speed set.Plda

Engine controlComputes necessary fuel valve position.Ignition off: valve = 0Active CC overrides real pedal position if CC >= pedalPositionEngine status influences computation (protection)Plda

28Various sensorsCruise controlEngine controlFuel valvePlda

Cruise controlPldaSimple existential partitioning of error-runsExample: simulatedPedalPosition error dictionaryOK, OMISSION, ERRACTIVE, VALUEERRFailure category nameDescriptionOKNo error in the runOMISSION{OK, OMISSION}ERRACTIVE{OK, ERRACTIVE}VALUEERR{OK, VALUEERR}MIXEDAt least two different errors that are not OKSyndromesSimple existential partitioning of error-runsExample: simulatedPedalPosition error dictionaryOK, OMISSION, ERRACTIVE, VALUEERRFailure category nameDescriptionOKNo error in the runOMISSION{OK, OMISSION}ERRACTIVE{OK, ERRACTIVE}VALUEERR{OK, VALUEERR}MIXEDAt least two different errors that are not OKPropagation relation: (speed, keyStatus, simPedalPos) (failure) syndromesSyndromesSimple existential partitioning of error-runsExample: simulatedPedalPosition error dictionaryOK, OMISSION, ERRACTIVE, VALUEERRFailure category nameDescriptionOKNo error in the runOMISSION{OK, OMISSION}ERRACTIVE{OK, ERRACTIVE}VALUEERR{OK, VALUEERR}MIXEDAt least two different errors that are not OKWill be omitted for sake of simplicitySyndromesThe question to ask: what do we know about the component?

1. Nothing: relation contains all combinations

2. No internal fault modes: for OK inputs OK output

3. Detection of input OMISSIONsResponse? e.g. fail-silent for input OMISSIONs

4. Contextual knowledge: inputs are fail-silentNo VALUEERR and therefore MIXED

Syndrome relationsThe question to ask: what do we know about the component?

1. Nothing: relation contains all combinations

2. No internal fault modes: for OK inputs OK output

3. Detection of input OMISSIONsResponse? e.g. fail-silent for input OMISSIONs

4. Contextual knowledge: inputs are fail-silentNo VALUEERR and therefore MIXED

First ruleset: assumptions 2. + 3. + 4.Second ruleset: assumptions 2. + 3.Szindrma-relcikRule IDspeedkeyStatussimSpeedPosCC_1OKOKOKCC_2OKOMISSIONOMISSIONCC_3OMISSIONOKOMISSIONCC_4OMISSIONOMISSIONOMISSIONFS szenzor s CCRule IDspeedkeyStatussimSpeedPosCC_5OKVALUEERROK, OMISSION, ERRACTIVE, VALUEERRCC_6OMISSIONVALUEERROK, OMISSION, ERRACTIVE, VALUEERRCC_7VALUEERROKOK, VALUEERRCC_8VALUEERROMISSIONOK, OMISSION, VALUEERRCC_9VALUEERRVALUEERROK, OMISSION, ERRACTIVE, VALUEERRCC FS a kihagysraRule IDspeedkeyStatussimSpeedPosCC_5OKVALUEERROK, OMISSION, ERRACTIVE, VALUEERRCC_6OMISSIONVALUEERROK, OMISSION, ERRACTIVE, VALUEERRCC_7VALUEERROKOK, VALUEERRCC_8VALUEERROMISSIONOK, OMISSION, VALUEERRCC_9VALUEERRVALUEERROK, OMISSION, ERRACTIVE, VALUEERR+ rules CC_1 CC_4CC FS a kihagysra38

ERRACTIVEFixed (hypothesis or monitoring)Analzis-plda39

ERRACTIVEspeed = ?keyStatus = ?Analzis-plda40

ERRACTIVEspeed = ?keyStatus = ?We simulate Constraint Satisfaction Problem solving by handAnalzis-plda41Rule IDspeedkeyStatussimSpeedPosCC_1OKOKOKCC_2OKOMISSIONOMISSIONCC_3OMISSIONOKOMISSIONCC_4OMISSIONOMISSIONOMISSIONCC_5OKVALUEERROK, OMISSION, ERRACTIVE, VALUEERRCC_6OMISSIONVALUEERROK, OMISSION, ERRACTIVE, VALUEERRCC_7VALUEERROKOK, VALUEERRCC_8VALUEERROMISSIONOK, OMISSION, VALUEERRCC_9VALUEERRVALUEERROK, OMISSION, ERRACTIVE, VALUEERRAnalzis-pldaRule IDspeedkeyStatussimSpeedPosCC_1OKOKOKCC_2OKOMISSIONOMISSIONCC_3OMISSIONOKOMISSIONCC_4OMISSIONOMISSIONOMISSIONCC_5OKVALUEERROK, OMISSION, ERRACTIVE, VALUEERRCC_6OMISSIONVALUEERROK, OMISSION, ERRACTIVE, VALUEERRCC_7VALUEERROKOK, VALUEERRCC_8VALUEERROMISSIONOK, OMISSION, VALUEERRCC_9VALUEERRVALUEERROK, OMISSION, ERRACTIVE, VALUEERRAnalzis-pldaRule IDspeedkeyStatussimSpeedPosCC_1OKOKOKCC_2OKOMISSIONOMISSIONCC_3OMISSIONOKOMISSIONCC_4OMISSIONOMISSIONOMISSIONCC_5OKVALUEERROK, OMISSION, ERRACTIVE, VALUEERRCC_6OMISSIONVALUEERROK, OMISSION, ERRACTIVE, VALUEERRCC_7VALUEERROKOK, VALUEERRCC_8VALUEERROMISSIONOK, OMISSION, VALUEERRCC_9VALUEERRVALUEERROK, OMISSION, ERRACTIVE, VALUEERR{OK,OMISSION,VALUEERR}{VALUEERR}Analzis-pldaspeedkeyStatussimSpeedPosOK, OMISSION, VALUEERRVALUEERRERRACTIVE44Solution:

Conclusion:for a fail-silent cruise control component, we need a fail-silent keypad.

Analzis-plda45

simPedalPos = ?VALUEERROKAnalzis-plda46Rule IDspeedkeyStatussimSpeedPosCC_1OKOKOKCC_2OKOMISSIONOMISSIONCC_3OMISSIONOKOMISSIONCC_4OMISSIONOMISSIONOMISSIONCC_5OKVALUEERROK, OMISSION, ERRACTIVE, VALUEERRCC_6OMISSIONVALUEERROK, OMISSION, ERRACTIVE, VALUEERRCC_7VALUEERROKOK, VALUEERRCC_8VALUEERROMISSIONOK, OMISSION, VALUEERRCC_9VALUEERRVALUEERROK, OMISSION, ERRACTIVE, VALUEERRAnalzis-plda47Rule IDspeedkeyStatussimSpeedPosCC_1OKOKOKCC_2OKOMISSIONOMISSIONCC_3OMISSIONOKOMISSIONCC_4OMISSIONOMISSIONOMISSIONCC_5OKVALUEERROK, OMISSION, ERRACTIVE, VALUEERRCC_6OMISSIONVALUEERROK, OMISSION, ERRACTIVE, VALUEERRCC_7VALUEERROKOK, VALUEERRCC_8VALUEERROMISSIONOK, OMISSION, VALUEERRCC_9VALUEERRVALUEERROK, OMISSION, ERRACTIVE, VALUEERRConclusion: cruise control masks speed sensor value errors only sometimesActually when it is inactiveAnalzis-plda

48VALUEERROKOK, VALUEERRAnalzis-plda

49VALUEERROKOK, VALUEERROKMore involved rules.Normal op.: CC>= pedal uses CCSafe state: valve = 0Can detect OMISSION, but not CC ERRACTIVEAnalzis-plda

50VALUEERROKOK, VALUEERROK, ERROPEN, VALUEERROKAnalzis-plda

51VALUEERROKOK, VALUEERROK, ERROPEN, VALUEERROKNote: in practice this is a one-pass operation;the whole system is translated to a single CSP problemAnalzis-plda52Possible system outputs:OK, ERROPEN, VALUEERRConclusion: speed sensor value errors can compromise not only functionality, but system safety.Analzis-plda53Problem

Dependability and security: Mandated by business needs & regulatory complianceControls: technical, management, operational; checked by audits e.g. Risk Assesment of physical faultsThreatService impactHA only short Cashier outagesAt most longer service completion Cashier transactionalityMaximum business impactIT audit & compliance today

Rudimentary Computer Assisted Audit Tools & Techniques (CAATT) labour-intensive work

Complexity and system/service change rate rise

Continous auditing?

Full coverage instead of sampling?

The example was radically simplified! BPM: rapidly becoming the norm in some sectorsCMDBs: mandated by ITIL v3 (and necessity)Idea: automated dependability and security analysis on existing models5354Example

SingleFaultFaultOutageOKFailoverDELAYEDSTUCKDELAYED54Form processing

Money takeover

Record transaction

Largetransaction?

Receipt

Launderingsuspected?

Flag & report

Client checkedearlier?

Perform full check

Form processing

Money takeover

Record transaction

Largetransaction?

Receipt

Launderingsuspected?

Flag & report

Client checkedearlier?

Perform full check