The system design process needs to cope with the increasing complexity and size of systems, motivating the
replacement of labor intensive manual techniques with automated and semi-automated approaches. Recently, formal
methods techniques, such as model-based verification and safety assessment, have been increasingly used to model
systems under fault and to analyze them, generating artifacts such as fault trees and FMEA tables.
In this paper, we show how to apply model-based techniques to a realistic case study from the avionics domain: a
high integrity power distribution system, the Triple Modular Generator (TMG). The TMG is composed of a redundant
and reconfigurable plant and a controller that must guarantee a high level of reliability. The case study is a significant
challenge, from the modeling perspective, since it implements a complex reconfiguration policy, specified via a
number of requirements in natural language, including a set of mutually dependent and potentially conflicting priority
constraints. Moreover, from the verification standpoint, the controller must be able to handle an exponential number
of possible faulty configurations.
Our contribution is twofold. First, we formalize and validate the requirements and, using a constraint-based modeling
style, we synthesize a correct by construction controller, avoiding the enumeration of all possible fault configurations,
as is currently done by manual approaches. Second, we describe a comprehensive methodology and process,
supported by the XSAP safety analysis platform that targets the modeling and safety assessment of faulty systems.
Using XSAP, we are able to automatically extract minimal cut sets for the TMG. We demonstrate the scalability of
our approach by analyzing a parametric version of the TMG case study that contains more than 700 variables and 90
faults