Separation of duty (SoD) is a fundamental principle of computer security that has not been addressed sufficiently in multi-level security (MLS) mandatory access control (MAC) models, as realized through the adoption of the Bell-LaPadula (BLP) model. This is due to the lack of means at present to express SoD constraints in MAC. The primary objective of this paper is to overcome this but within a framework that allows for rigour and linguistic features to express SoD constraints, while retaining the core security properties of BLP, namely the Simple Security Property and |$\bigstar $|-Property. To this end, we propose a formal framework which bridges the BLP model with the more general hierarchical role-based access control (RBAC) model. Our framework is based on a hierarchy of permissions that is founded on a novel concept of permission capacity, determined on the basis of the security levels that characterize objects in MLS models. Such a hierarchy naturally provides a solid basis for defining role seniority and deriving a hierarchical ordering on roles within MLS models. SoD constraints are expressed by means of conflicting permissions that give rise to mutually exclusive roles.

Maliciously planted code in third-party components, as well as coding errors, design flaws and functional failures that could be subverted by malicious attackers, expose component-based systems (CBS) to potentially serious security threats. Approaches to securing CBSs fall basically into two categories: execution of untrusted components in a secure environment and secure composition of components at the design stage. Taking the former approach, this research uses logical separation instead of the physical separation. Works addressing security in this manner are limited and tend to focus on assuring security from the operating systems perspective, or the perspective of a single security objective. The latter is a limitation, particularly in modern industrial applications requiring the assurance of more than one security objective within the same application at the same time. In this respect, this paper presents an integrated multi-objective component security (ICS) model comprising Bell-LaPadula and Biba security models, for preventing security breaches in confidentiality and integrity in CBS.

Security vulnerabilities posed by third-party software components in component based development (CBD) is a serious impediment to its adoption in areas that offer great economic potential, particularly in areas such as embedded software and large-scale enterprise software. They raise questions about reliability and integrity of components, as well as the risks posed by any malicious code. This paper is a discussion of factors that affect component security and ways of assuring component security. Using a simplified model of sendmail, it also outlines a formal framework that fits in with communicating sequential processes (CSP) for modelling and analysis of component security.

Coordinated atomic (CA) action is a widely used approach to structuring concurrent activities in distributed embedded applications. Recovery from failures is one of its major concerns. Despite the intuitive simplicity, reasoning about failure recovery in CA actions is rather complex because of the interaction between various system components. This paper proposes an approach based on timed CSP for modelling CA actions and reasoning about different forms of interaction between system components, addressing issues such as failure modes, means of fault-tolerance and fail-safe mechanisms.

A typical characteristic of real-time systems is concurrent processing of tasks under strict timing requirements. These timing requirements may impose not only direct constraints, such as deadlines, but also indirect timing constraints in terms of inter-task dependencies. However scheduling policies which can deal with some of these constraints effectively are limited, especially for the on-line context, and are not widely known within the real-time community. In this context, this paper presents a technique to control execution irregularities, namely, jitter. The technique is based on the modification of task temporal parameters in the paradigm of the well known Deadline Monotonic (DM) and Earliest Deadline First (EDF) algorithms. The technique presents a way either to remove jitter completely (in the case of regularity constrained tasks) or to bound jitter releases. Moreover, the approach takes into account temporal dependencies of tasks on one another.

Safecharts (H. Dammeg and N. Nissanke, 1999) are a safety oriented variant of Statecharts (D. Harel, 1987) and have been developed especially for the use in specification and design of safety critical systems. One of the fundamental aspects of Safecharts is the explicit ordering of system states according to their risk levels. Based on this ordering, transitions are classified according to the nature of their risk and are given a priority scheme favouring the execution of safer transitions in the event of any nondeterminism. As a precaution, transitions between states with unknown relative risk levels are not permitted. As a result, many transitions, including those which might be functionally desirable, may be potentially excluded between states which are located in sparsely populated areas of risk graphs. This is an inadequacy which may be attributed to factors such as incomplete hazard analysis, the lack of information about relative risk levels of different states of the system, etc. In order to extend the permitted transition space in such circumstances and to enhance the risk ordering relation, the paper introduces the concept of risk band. Risk bands enable an unambiguous interpretation of the relevant risk level of states, thus allowing a well understood enhancement of risk graphs and an extension of the concept of safe non-determinism introduced by H. Dammeg and N. Nissanke (1999). An example drawn from the nuclear industry demonstrates the application of Safecharts.

This paper proposes a novel variant of Statecharts, called Safecharts, especially for use in the specification and the design of safety critical systems. The objective is to provide a sharper focus on safety issues and a systematic approach to deal with them. This is achieved by making a clear separation between functional and safety requirements. A novel feature of Safecharts is the safety annotation, which proposes an explicit ordering of states according to risk level. Transitions are classified according to their risk nature and given a new priority scheme for their execution in the event of any non-determinism. A railway signalling system, a well-known case study, is used as an example to demonstrate some features and semantics of Safecharts.

This paper uses Petri nets as a representation and analysis framework for automated assembly. It shows how the hierarchical nature of assembly is captured by Petri nets in representing assembly plans and lower level control plans. The tasks in a control plan correspond to assembly robot operations and can be viewed as a lower level representation of tasks at the assembly plan level. Petri nets provide a single unified framework for representing the hierarchical nature of assembly. This paper presents an approach to deriving performance and throughput measures of assembly on the basis of critical path analysis of the Petri net representation of plans.

This paper presents a boundary graph representation to handle geometric information for assembly. Boundary graphs represent the faces or surfaces of an assembly part. We show that assembly operations joining two parts together may be modeled simply as the splicing of two boundary graphs representing the two assembly parts. Subgraphs which become detached during the graph splicing process represent surfaces which become inaccessible as a consequence of an assembly operation. These subgraphs are therefore discarded. An added bonus of this approach is that in some instances the feasibility of an assembly operation can be evaluated very quickly by simply scanning the boundary graph for certain geometrical features such as radii of specific surfaces. The modeling of assembly operations and feasibility testing based on boundary graph models advocated here form the basis of a direct or forward assembly planner.

We model assembly parts as attribute graphs. An algebra to model assembly tasks is presented where a task is modelled as a merging of two attribute graphs to produce a single attribute graph representing the merged or assembled object. Different types of merging operations are defined and the associative properties of these merge operations are of particular interest in the assembly context. The above framework forms an essential component of an assembly planner which generates assembly task sequences.

An appropriate representation scheme for task plans is essential if the tasks in the plan are to be executed by intelligent robotic systems. In this paper the authors show that a Petri net representation scheme to represent assembly plans possesses desirable properties in an assembly context. The relationship between the Petri net representation scheme and other proposed representation schemes are also explored.