AltaRica

The design of AltaRica started at the end of the nineties at the computer science department of Bordeaux University (LaBRI).

The rationale for the creation of a new modeling language was to overcome difficulties encountered by safety analysts (in avionic, nuclear, automotive and oil and gas industries) with "classical" modeling formalisms such as fault trees, Markov chains or stochastic Petri nets.

[5][6][7] The original version of the language relied of three technologies: finite-state automata that were extensively studied by the LaBRI's team working of the formal methods for software verification,[8] structured programming taking inspiration of the modeling language Lustre, and constraint programming.

The LaBRI team went on working however on this original version, mainly for educational purposes, improving tools over the years.

Integrated modeling environments have been developed for the language: Cecilia OCAS by Dassault Aviation, Simfia v2 by Airbus-Apsys and Safety Designer by Dassault Systèmes (this latter tool was initially a clone of Cecilia OCAS, but evolved separately afterward).

[16][17][18][19] For example, AltaRica Data-Flow was used to certify the flight control system of the aircraft Falcon 7X (Dassault Aviation).

Experience showed however that AltaRica Data-Flow could be improved in several ways, hence justifying to seriously rework the language.

Moreover, AltaRica 3.0 semantics has been reinforced, via GTS (for Guarded Transition Systems), which opens new opportunities in terms of assessment of models.

Guarded transition systems belong to the family of mathematical models of computation gathered under the generic term of (stochastic) finite-state automata.

In the framework on reliability studies, the behavior of systems must be abstracted out to avoid the combinatorial explosion of situations to look at.

A fundamental abstraction made by finite-state automata consists in considering that the system under study can change of state only under the occurrence of an event.

The event "start" can occur if the pump is in the state "STANDBY" and if the input flow "demand" is true.

For instance, a failure takes a certain time before occurring, while the pump is started as soon as needed (at least at the level of abstraction of reliability models).

This competition is however not a real one as the transition "stop" is immediately fired (performed) when the input flow "demand" ceases to be true.

Events are associated with delays and possibly expectations (which are used to calculate probabilities of occurrence of transitions in competition).

In general, systems under study are not made of a single, simple components as the above motor operated pump.

[33][34] As of today, S2ML gathers in a coherent way a versatile set of structuring constructs stemmed from object-oriented and prototype-oriented programming.

Adding S2ML on top of a mathematical framework (GTS in the case of AltaRica), makes it possible to pass automatically and at no cost from the model as designed, which reflects the architecture of the system under study, to the model as assessed from which calculations of indicators and simulations can be performed efficiently.

Model of a motor operated pump
Model of a motor operated pump