Finite Improbability Generator
487
theory [15], seldom applicable to non-Markovian models and unsupported by
FIG 1.2). rst and fe work with an effort e. fe e means e simulations are ran in
a layer S i . rst e means e − 1 clones are spawned when a simulation up-crosses
a threshold i . Omitting e makes FIG 1.2 use respectively fe 8 or rst 3 .
A res run yields a random value r ∈ [0, 1] of unknown distribution, so
FIG computes standard clt confidence intervals with Student’s t-distribution
quantiles. r has a Bernoulli distribution only for transient properties estimated
with cmc: FIG can then use Wilson score intervals [32]. Floating-point precision
loss is reduced by using the logarithm of r and of the number of runs.
FIG reads or computes importance functions. Option --adhoc takes as mandatory argument a function on the variables of the iosa modules. Instead, --amono
automatically builds f
on the parallel composition of all modules, and --acomp
builds a local f
i per iosa module—see Sec. 2. For --acomp, FIG takes an optional
argument to aggregate all local f
i into one global f
. This can be an associative binary arithmetic operator, or a custom function on the names of the iosa
modules. By default, f
is computed as the sum of all local functions. Option
--dft 0 indicates that the model is a fault tree: FIG then builds specialised local
importance functions for certain modules, e.g. basic events and pand gates.
Two algorithms in FIG 1.2 can compute the thresholds and efforts { i , e i }
M
i=1 .
Sequential Monte Carlo [8, 6] (seq, option -t hyb) is characterised by one effort
for all regions S i , set with -g e. Instead, Expected Success [4] (es, -t es) determines each effort e i per S i region. By default FIG 1.2 uses -e restart -g 3 -t hyb.
Other customisable options are the rng, its seed, the floating point precision,
and a timeout. Mandatory arguments for FIG invocation are the model and properties file, the simulation type (--flat for cmc, or --adhoc/amono/acomp for res),
and a stop criterion (either time, or confidence and precision of the ci).
Experimental demonstration. We display the capabilities of FIG via three
experiments. First, we show how isplit implemented in FIG 1.2 is as automatic
but more efficient than cmc to estimate rare properties. Second, we test the
degree to which f
in FIG can approximate optimal importance functions chosen
ad hoc for some models. Third, we compare FIG and its closest competitor: modes.
All these experiments can be reproduced via the artifact freely available in [3].
We test different configurations of engines, efforts, and thresholds. For each
configuration we run simulations until some timeout. This yields a ci with precision 2ε for confidence coefficient δ = 0.95. The smaller the ε, the narrower the ci,
and the better the performance of the configuration (and tool) that produced it.
First, we analyse repairable dfts with warm spares and exponential (fail),
normal (repair), and lognormal (dormancy) pdfs. Using cmc, fe 8,16,32 and
rst 3,4,6 we estimate the probability of a top level event after the first failure,
before all components are repaired, in trees with 6, 7, and 8 spares (the smallest iosa has 116 variables and > 2.5 e 37 states). For isplit we used seq
thresholds with --dft 0 --acomp and no arguments, i.e. as automatic as cmc.
With a 20 min timeout, each configuration was repeated 13 times in a Xeon
E5-2683v4 CPU running Linux x64 4.4.0. The height of the bars in the top plot
of Fig. 1 is the average ci precision (lower is better), using Z-score m=2 to remove
487
theory [15], seldom applicable to non-Markovian models and unsupported by
FIG 1.2). rst and fe work with an effort e. fe e means e simulations are ran in
a layer S i . rst e means e − 1 clones are spawned when a simulation up-crosses
a threshold i . Omitting e makes FIG 1.2 use respectively fe 8 or rst 3 .
A res run yields a random value r ∈ [0, 1] of unknown distribution, so
FIG computes standard clt confidence intervals with Student’s t-distribution
quantiles. r has a Bernoulli distribution only for transient properties estimated
with cmc: FIG can then use Wilson score intervals [32]. Floating-point precision
loss is reduced by using the logarithm of r and of the number of runs.
FIG reads or computes importance functions. Option --adhoc takes as mandatory argument a function on the variables of the iosa modules. Instead, --amono
automatically builds f
on the parallel composition of all modules, and --acomp
builds a local f
i per iosa module—see Sec. 2. For --acomp, FIG takes an optional
argument to aggregate all local f
i into one global f
. This can be an associative binary arithmetic operator, or a custom function on the names of the iosa
modules. By default, f
is computed as the sum of all local functions. Option
--dft 0 indicates that the model is a fault tree: FIG then builds specialised local
importance functions for certain modules, e.g. basic events and pand gates.
Two algorithms in FIG 1.2 can compute the thresholds and efforts { i , e i }
M
i=1 .
Sequential Monte Carlo [8, 6] (seq, option -t hyb) is characterised by one effort
for all regions S i , set with -g e. Instead, Expected Success [4] (es, -t es) determines each effort e i per S i region. By default FIG 1.2 uses -e restart -g 3 -t hyb.
Other customisable options are the rng, its seed, the floating point precision,
and a timeout. Mandatory arguments for FIG invocation are the model and properties file, the simulation type (--flat for cmc, or --adhoc/amono/acomp for res),
and a stop criterion (either time, or confidence and precision of the ci).
Experimental demonstration. We display the capabilities of FIG via three
experiments. First, we show how isplit implemented in FIG 1.2 is as automatic
but more efficient than cmc to estimate rare properties. Second, we test the
degree to which f
in FIG can approximate optimal importance functions chosen
ad hoc for some models. Third, we compare FIG and its closest competitor: modes.
All these experiments can be reproduced via the artifact freely available in [3].
We test different configurations of engines, efforts, and thresholds. For each
configuration we run simulations until some timeout. This yields a ci with precision 2ε for confidence coefficient δ = 0.95. The smaller the ε, the narrower the ci,
and the better the performance of the configuration (and tool) that produced it.
First, we analyse repairable dfts with warm spares and exponential (fail),
normal (repair), and lognormal (dormancy) pdfs. Using cmc, fe 8,16,32 and
rst 3,4,6 we estimate the probability of a top level event after the first failure,
before all components are repaired, in trees with 6, 7, and 8 spares (the smallest iosa has 116 variables and > 2.5 e 37 states). For isplit we used seq
thresholds with --dft 0 --acomp and no arguments, i.e. as automatic as cmc.
With a 20 min timeout, each configuration was repeated 13 times in a Xeon
E5-2683v4 CPU running Linux x64 4.4.0. The height of the bars in the top plot
of Fig. 1 is the average ci precision (lower is better), using Z-score m=2 to remove