For Cybersecurity Consciousness Month, we’re republishing our most learn put up during the last 4 years, Nataliya Shevchenko’s 2020 piece on model-based techniques engineering (MBSE). This put up gives an introduction to MBSE and descriptions how the methodology can be utilized to make sure that techniques are safe by design.
Mannequin-based techniques engineering (MBSE) is a formalized methodology that’s used to assist the necessities, design, evaluation, verification, and validation related to the event of complicated techniques. In distinction to document-centric engineering, MBSE places fashions on the heart of system design. The elevated adoption of digital-modeling environments through the previous few years has led to elevated adoption of MBSE. In January 2020, NASA famous this pattern by reporting that MBSE, “has been more and more embraced by each trade and authorities as a method to maintain monitor of system complexity.” On this weblog put up, I present a quick introduction to MBSE.
One space of concern inside complicated techniques is cybersecurity. The SEI CERT Division has begun researching how MBSE can be utilized to mitigate safety dangers early within the system-development course of in order that techniques are safe by design, in distinction to the widespread follow of including security measures later within the improvement course of. Capturing system attributes in fashions allows techniques engineers to carry out threat-modeling evaluation of the system early and incorporate mitigation methods into the system design, thereby decreasing the system’s total security-related dangers.
MBSE in a digital-modeling atmosphere gives benefits that document-based techniques engineering can not present. For instance, in a document-based method, many paperwork are generated by totally different authors to seize the system’s design from numerous stakeholder views, resembling system habits, software program, {hardware}, security, safety, or different disciplines. Utilizing a digital-modeling method, a single supply of reality for the system is constructed by which discipline-specific views of the system are created utilizing the identical mannequin parts.
A digital-modeling atmosphere additionally creates a standard standards-based method to documenting the system that may be programmatically validated to take away inconsistencies throughout the fashions and implement using a typical by all stakeholders. This widespread modeling atmosphere improves the evaluation of the system and reduces the variety of defects which might be generally injected in a conventional document-based method. The supply of digitalized system knowledge for evaluation throughout disciplines gives constant propagation of corrections and incorporation of recent info and design selections (i.e., state it as soon as and mechanically propagate to numerous views of the information) to all stakeholders. When MBSE is completed correctly, the result’s an total discount of improvement dangers.
MBSE brings collectively three ideas: mannequin, techniques pondering, and techniques engineering:
- A mannequin is a simplified model of something–a graphical, mathematical, or bodily illustration that abstracts actuality to remove some complexity. This definition implies formality or guidelines in simplifying, representing, or abstracting. To mannequin a system, a techniques architect should signify the system with much less element in order that its construction and habits are obvious and its complexity is manageable. In different phrases, fashions ought to sufficiently signify the system, and the system ought to verify the mannequins.
- Methods pondering is a approach of a system into account not as a self-sufficient entity, however as half of a bigger system. Methods pondering will not be the identical as a scientific adherence to following good plans, gathering statistics, or being methodical. The techniques engineer observes the system from a distance; explores its boundaries, context, and lifecycle; notes its habits; and identifies patterns. This methodology may help the engineer to establish points (e.g., lacking interplay, a lacking step in a course of, duplication of effort, missed alternative for automation) and handle a system’s complexity. Though techniques engineers should break down and analyze the system within the beginning–identify elements and describe connections between them–with techniques pondering, they later synthesize the elements again right into a coherent complete. Components usually are not simply related to different elements, they rely on one another to work correctly. Methods pondering emphasizes this interconnectedness. The habits of the system emerges from the actions of the system’s subparts. Observing the system’s interconnections, the techniques engineer identifies suggestions loops and causality patterns that will not be obvious at first. Methods pondering may help make points extra obvious and simpler to establish, stability the system, and handle the system’s complexity.
- Methods engineering is a transdisciplinary and integrative method to allow the profitable realization, use, and retirement of engineered techniques, utilizing techniques rules and ideas, and scientific, technological, and administration strategies. It brings collectively various methods to ensure that all necessities are happy by the designed system. It concentrates on structure, implementation, integration, evaluation, and administration of a system throughout its lifecycle. It additionally considers software program, {hardware}, personnel, processes, and procedural features of the system.
If a corporation has determined to undertake MBSE as an inner systems-engineering method and chosen one of many 4 or 5 current merchandise for digital modeling which might be available on the market, the group’s techniques engineers ought to take into account whether or not it’s going to observe any architectural frameworks. Though a complete dialogue of this matter is past the scope for this weblog put up, the selection of a selected architectural framework will present further steering and construction to the modeling actions, particularly if the techniques engineers are already conversant in the framework.
MBSE is a multidisciplinary and multifaceted endeavor. It requires its personal actors, processes, atmosphere, and knowledge flows. To create a profitable mannequin of a posh system or system of techniques, a corporation should assist the modeling course of. The assist wanted will not be a lot totally different from what’s required for a corporation to efficiently develop and ship a posh system or system of techniques. MBSE may be successfully built-in right into a improvement course of, however the group should decide to the trouble that will likely be required to mannequin the system.
Making use of techniques pondering, we will acknowledge that there are three techniques concerned within the modeling course of: the designed system, the designed system’s context, and the modeling group for the designed system. The designed system operates within the context of a bigger system, and the modeling group should perceive each the designed system and the designed system’s context. The group should additionally concentrate on its personal habits, successes, and failures.
Modeling
Now we have all seen, used, or created fashions all through our lives, starting from toys that signify automobiles or planes to mathematical formulation that describe and clarify bodily phenomena resembling thermodynamics or gravity. Whereas basically totally different, these fashions all join an concept to a actuality and supply ample abstraction for the aim. When modeling a system, the techniques engineer decides what features of the manufacturing system are most vital, resembling construction, power or matter circulation, inner communication, or security and safety. These sorts of features will grow to be the main focus of the mannequin. The highest goal of the modeling exercise is to mannequin the salient features on which the mannequin is targeted as carefully to the actual system as is feasible and possible.
Modeling as a way makes use of 4 devices:
- language
- construction
- argumentation
- presentation
A modeling language is a standard terminology for clearly speaking an summary concept that the mannequin captures. The modeling language may be formal, with strict syntax and guidelines. Just a few system-modeling languages exist, together with general-purpose languages such because the Methods Modeling Language (SysML) and Unified Modeling Language (UML), in addition to specialised languages resembling Structure Evaluation Design Language (AADL). Though SysML and UML usually are not mathematically formal, a sound mannequin requires that the modeling language’s guidelines for entities and relationships be adopted. SysML has strict syntax and guidelines for relationships and connections between parts, which helps to keep away from ambiguity. If a mannequin is effectively constructed, a number of sorts of commonplace SysML diagrams may be dynamically simulated, and not less than one sort of SysML diagram may be mathematically simulated. UML is semi-formal; SysML is much like UML, however extra formal.
A mannequin will need to have a construction. A well-structured mannequin could make the mannequin comprehensible, usable, and maintainable, which is especially vital for complicated techniques. The aim of a mannequin is to indicate stakeholders that the introduced design satisfies the system’s necessities. The mannequin ought to reveal, in an simply understandable approach, how the system have to be constructed to achieve success. Visualization is a key approach to make sure comprehensibility. Visualizing summary concepts allows folks to take the leap of creativeness that’s wanted to “see” the system.
Modeling Domains
Although MBSE doesn’t dictate any particular course of, primarily any course of chosen ought to cowl 4 systems-engineering domains:
- necessities/capabilities
- habits
- structure/construction
- verification and validation
Descriptions of those domains are effectively documented and mentioned by, amongst others, Protection Acquisition College (DAU), NASA, and Avi Sharma. The distinction that MBSE makes is that these basic systems-engineering domains are outlined not as a set of paperwork, however within the mannequin itself, i.e., in a proper approach utilizing a modeling language. The mannequin represents an argument for a way the system have to be designed for it to achieve success.
MBSE additionally fosters communication amongst stakeholders, techniques engineers, and builders. Since system design is carried out within the built-in modeling atmosphere, all techniques engineers, managers, and different stakeholders can have entry to the generated information–such as necessities, habits flows, and architecture–as quickly as obligatory.
The most typical modeling exercise is the creation of diagrams representing some a part of the system–a view. This exercise is so widespread that some engineers mistakenly equate making a view with making a mannequin. This error is so pervasive that there’s even an rising time period for it: zombie mannequin. This time period refers to a mannequin that is filled with diagrams, however with no interconnectivity and dependencies recognized among the many parts.
Anybody who’s about to begin modeling should notice {that a} set of views will not be a mannequin. Though a view or perhaps a set of views can signify part of the system’s design and may be helpful for documenting and speaking some features of the system, views are solely aspects or parts of the true system mannequin. An actual mannequin can produce many views and matrices, carry out analyses, and run simulations.
Language of System Modeling
Whereas a system-modeling language resembling SysML is a proper syntactic language, it’s nonetheless based mostly on parts of human language. Its formality provides readability and self-discipline which might be essential for describing the design of a system. Such a language is simple to learn and perceive. Phrases of MBSE’s language merely map to elements of speech:
- noun: actors, blocks, parts, necessities
- verb: operational actions, features, use circumstances
- adjective: attributes
- adverb: relationships, needlines, exchanges, interfaces
This view of the modeling language helps its customers to mentally map real-life ideas to summary concepts, and eases the formalization of the modeling course of.
4 Quadrants of the MBSE Mannequin
Now that I’ve described the fundamentals of a mannequin’s language and domains, I’ll describe the modeling method. A mannequin should describe each an issue that the designed system solves, and the designed system itself (the answer). The mannequin will need to have these two sides, the issue facet and the answer facet. These are generally known as the operational and system factors of view.
The operational standpoint is the angle of customers, operators, and enterprise folks. It ought to signify enterprise processes, aims, organizational construction, use circumstances, and knowledge flows. The operational facet of the mannequin can include the outline of “the world as-is” and the longer term state.
The system standpoint is the answer, the structure of the system that solves the issue posed within the operational facet of the mannequin. It ought to describe the habits of the system, its construction, dataflows between parts, and allocation of performance. It ought to describe how the system will likely be deployed in the actual world. It might include resolution alternate options and analyses of them.
Every of those factors of view has two elements, logical and bodily. Separating logical and bodily features of the mannequin is a strategy to handle a system’s complexity. Logical elements of the mannequin often change little over time, whereas bodily adjustments are sometimes initiated by know-how advances.
If the mannequin is constructed correctly, all 4 quadrants ought to be tightly related, as proven in Determine 1 under. Statements of the issue ought to be traced to parts of the answer, and logical parts allotted to bodily buildings. The person of the mannequin ought to be capable to see clearly how the top-level ideas and parts decompose to the decrease degree options. Customers ought to be capable to carry out system evaluation, create dependency matrices, run simulations, and produce a view of the system for each stakeholder. If the bodily a part of the system should change, the logical facet of the mannequin identifies precisely what performance will likely be affected. If a requirement or enterprise course of have to be modified, the mannequin will simply uncover the impression on the options.
Determine 1: Elements of A Mannequin
Wrapping Up and Trying Forward
On this put up, I defined what MBSE is, confirmed the way it pertains to techniques engineering, and mentioned the basics of mannequin and modeling. My subsequent put up will take a extra sensible method and focus on necessities and necessities fashions.