Hello, dear friend, you can consult us at any time if you have any questions, add WeChat: THEend8_
SWEN90010 Sample exam questions
Part A – Safety engineering
Question 1 [10 Marks]
Explain the purpose, the information derived from a typical analysis and the use of hazard analysis
in the safety engineering process.
Question 2 [15 Marks]
Consider the following description of a nuclear power system, which controls the temperature of
the nuclear core. The system consists of an array of sensors, three assessors, a voter, a controller,
and an actuator. A system architecture is shown in Figure 1.
• There is an array of sensors monitoring the temperature of the core. Sensors are accurate to
0.1%, but can fail by not providing a reading, or by providing a reading outside of the 0.1%
range.
• Three assessors each read the temperature signals sent from all sensors, and use a majority
vote to determine the core temperature. Two sensor readings are considered sufficiently equal
if they are within 0.4% of each other.
If any assessor detects that less than half of the sensors are sufficiently equal to the others, it
should send a shutdown signal to the voter. Otherwise, it sends its estimated temperature.
• The voter using a voting algorithm to detect any non-functioning assessor. If the voter detects
that more than one assessor has failed, or it receives a shutdown signal from any assessor, it
should send a shutdown signal to the controller. Otherwise, it sends its estimated temperature
to the controller.
• The controller controls the actuator by lowering or raising cooling rods into the core based on
the estimated temperature sent from the voter. If it receives a shutdown signal, it will lower
the rods completely and raise an alert.
• The actuator controls the rods. The level of the rods should be in correlation with the core
temperature; that is, if the temperature is high, the rods should be lowered further into the
core than if the temperature is low.
1
Figure 1: A system architecture for a nuclear reactor.
Perform a Hazard and Operability Study (HAZOP) on the assessors of this system, paying attention
to any safety concerns. You will need to tabulate consequences, potential causes, and risks.
On a closed book exam, any question about HAZOP would include the HAZOP guidewords.
Question 3 [15 Marks]
Choose one hazard from either of the previous two questions. Use fault-tree analysis to analyse
causes of this hazard.
On a closed book exam, any question on fault tree analysis will include the symbols used for fault
trees.
Part B – Model-based specification
Consider a simple scheduling module for a single processor. A set of processes are running on the
system, but the processor can execute only one at each time. Each process must be in exactly one
of the following states:
1. active: currently executing on the processor;
2. ready : not executing, but ready to be executed; or
3. waiting : waiting on some other resource, so not ready to be executed.
At any point, there must be at most one active process. There should be no ready processes if
there is no active process — that is, the processor must be in use as much as possible.
2
Question 4 [7 Marks]
Model the state and state invariant of the single processor scheduler using an Alloy signature and
predicate respectively. The signature should model all active, ready, and waiting processors, and
the invariant predicate should model the constraints between them; e.g. only one active process at
at time.
Your solution should assume the existence a signature ProcessID, which is the set of all process
IDs, declared as follows:
sig ProcessID {}
Question 5 [5 Marks]
New processes can be added into the scheduling system. A new process must not be an existing
process in the system. When a new process is added into the system, by default it is in the waiting
state.
Model an operation called NewProcess as an Alloy predicate, which takes, as input, a process ID
(ProcessID) and adds the process to the scheduling system.
Question 6 [7 Marks]
Model an operation called Ready as an Alloy predicate, which takes, as input, a process ID, and
switches this process out of the waiting state. The specified process must be a waiting process.
If there is no active process, the specified process becomes the new active process. Otherwise, it
becomes a ready process.
Question 7 [7 Marks]
Model an operation called Swap as an Alloy predicate, which models the case of an active process
switching into a waiting process; that is, the process has finished executing for now. In addition to
swapping out the active process, the scheduler should select any of the ready processes to become
the new active process. If there are no ready processes, then there is no new active process. This
operation should take no input.
Part C – Fault-tolerant design
Question 8 [7 Marks]
What is design diversity and how does it contribute to software redundancy?
Question 9 [5 Marks]
Do recovery blocks require design diversity? Justify your answer.
3
Question 10 [7 Marks]
Systems that must detect up to n non-malicious failures require 2n+1 redundant components. How
many components do systems with malicious (or Byzantine) failures require to detect n failures?
Why is this the case?
Part D – Correctness by construction
Question 11 [7 Marks]
You are working in a company that specialises in high-integrity software. SPARK is the imple-
mentation language of choice. A new manager arrives at the company and shows a preference for
switching to Ada instead of using the SPARK safe subset. The manager’s preference is based on a
study that showed that more lines of code are required in safe programming language subsets than
in the superset language to write the same program. The manager asserts that this increases the
cost of the project.
Do you agree or disagree with the manager’s assertion?