S Charpinet
email: stephane.charpinet@irap.omp.eu

N Giammichele
email: noemi.giammichele]@irap.omp.eu

P Brassard
email: brassard@astro.umontreal.ca

G Fontaine
email: fontaine@astro.umontreal.ca

P Bergeron
email: bergeron]@astro.umontreal.ca

W Zong

V Van Grootel
email: valerie.vangrootel@uliege.be

A S Baran
email: andysbaran@gmail.com

Toward a systematic cartography of the chemical stratification inside white dwarfs from deep asteroseismic probing of ZZ Ceti stars

DA-type white dwarfs account for 80% of all white dwarfs and represent, for most of them, the ultimate outcome of the typical evolution of lowto-intermediate mass stars. Their internal chemical stratification is strongly marked by passed, often uncertain, stellar evolution processes that occurred during the helium (core and shell) burning phases, i.e., from the horizontal branch through AGB and post-AGB stages. Pulsating white dwarfs, in particular the "cool" DA-type ZZ Ceti variables, offer an outstanding opportunity to dig into these stars by fully exploiting their asteroseismic potential. With our most recent tools dedicated to that purpose, we show that a complete cartography of the stratification of the main constituents of a white dwarf can be inferred, leading in particular to strong constraints on the C/O core structure produced by the processes mentioned above. This opens up the way toward a systematic exploration of white-dwarf internal properties.

Introduction

Asteroseismology of white dwarf stars has long carried out the promise of revealing the innermost structure of low-to-intermediate mass stellar remnants in their ultimate stage of evolution. Comprehensive reviews of more than three decades of this venture can be found in, e.g., Fontaine & Brassard (2008), Winget & Kepler (2008), Althaus et al. (2010), and more recently through the critical discussion provided in Section 2.1 of Giammichele et al. (2017a). A significant breakthrough in this field has recently been triggered by the introduction of a new approach to obtain seismic model solutions for white dwarf pulsators that unravel their internal chemical stratification and match better the observed period spectra (Giammichele et al., 2017a,b). This technique was successfully applied to the pulsating DB white dwarf KIC08626021, leading to the seismic cartography of the distribution of helium, carbon, and oxygen inside the star (Giammichele et al., 2018). Unraveling the chemical stratification inside a white dwarf can have profound repercussions as it bears the signatures of all the physical processes that occurred during the evolution of stars in the helium core burning phase and beyond. Yet, one could argue that DB white dwarfs account for only 20% of the white dwarf population and may have various nontypical origins (Reindl et al. 2014;Reindl 2015; see also Giammichele et al. in these proceedings). In contrast, the dominant DA white dwarf population may be more representative of the outcome of main evolution processes affecting low-to-intermediate stars in their terminal stages. In this paper, we report on preliminary results of detailed seismic analyses conducted on five DA-type ZZ Ceti pulsators following the same approach as developed in Giammichele et al. (2018).

Seismic models for DA pulsators

The technique used in this study is based on a forward modeling strategy. The adiabatic pulsation periods of white dwarf models in hydrostatic equilibrium, whose elements of the structure such as the chemical stratification can be parameterized with some flexibility, are calculated and quantitatively evaluated (through a merit function) relative to the observed period spectrum of a given star. After a global optimization procedure in the specified parameter space, the best match seismic model(s) is (are) found. This procedure, along with the tools developed to carry out this search, have been described at length in Giammichele et al. (2016Giammichele et al. ( , 2017aGiammichele et al. ( ,b, 2018) ) and we refer the interested reader to these contributions for further detail. Of relevance here, we just point out that an updated set of DA white-dwarf models was constructed to cover the main characteristics of the chemical composition profiles expected from evolution calculations. These models incorporate the core parametrization introduced in Giammichele et al. (2017a) that allows us to construct flexible oxygen profiles. They also include the parametrized double layered helium stratification described in Giammichele et al. (2018), and, of course, a parametrization of the hydrogen-rich top layer that is present in DA white dwarfs, but not in DBs.

In order to illustrate the ability of these DA static models to reproduce various chemical stratifications, including structures predicted by stellar evolution calculations, we compare in Fig. 1, 2, and 3 the profiles of C, O, and He derived from evolution models, based on De Gerónimo et al. 2017 calculations assuming various input physics (see figure captions), with our static DA models adjusted to reproduce their evolutionary counterpart. These comparisons show that our static structures can closely mimic the predicted composition 2017), while bottom panel shows a similar -eyeball fit -reproduction of these profiles using our parametrized hydrostatic models developed for asteroseismology.

profiles, meaning that, in a context of optimizing the stratification to find the one that best reproduces the observed period spectrum, "typical" configurations predicted by evolution models are covered in the search space and could potentially be found, if optimal. Of course, the space of explored configurations is much wider as the ultimate goal of our asteroseismic analyses is to let the oscillation periods determine what the optimal composition profiles should be. The composition profiles derived this way can therefore potentially differ significantly from the expected evolution profiles, but represents seismic inversions that are essentially independent of evolution calculations.

Preliminary results for five ZZ Ceti stars

We applied our optimization technique, using the new static DA white dwarf models, to 5 ZZ Ceti stars that we estimated were promising candidates. These stars are KIC 11911480, L19-2, SDSS J1136+0409, EPIC 220258806, and EPIC 220347759. Except for L19-2 whose analysis relies on data from a former ground based multisite campaign (Sullivan & Sullivan, 2000), all these stars have high quality photometric lightcurves obtained from space with Kepler (the original mission for KIC 11911480 and K2 for the other ones). Prior to attempting the asteroseismic fits, we reanalyzed the lightcurves for all the Kepler and K2 objects. In particular, new photometry extraction from the raw K2 data was performed using a pipeline developed by one of us (A. Baran), which in some cases provided noticeable improvements on the quality of the extracted time series over published data. This process resulted in isolating 5 independent periods for the seismic fit of KIC 11911480, while L19-2, SDSS J1136+0409, EPIC 220258806, and EPIC 220347759 were analyzed based on 5, 8, 10, and 7 independent modes, respectively. These stars being close to the blue edge of the DAV instability strip, they all show low-degree and low-order g-modes, and the number of modes available for the analysis proved sufficient to obtain non-ambiguous seismic solutions in all cases (in line with Hare & Hound experiments discussed in Giammichele et al. 2017b). Detailed results from these analyses will be reported elsewhere. Here, we provide preliminary seismic estimates for the most relevant parameters derived for the 5 stars considered (see Table 1). In all cases, we find seismic solutions that show a very good consistency with independent measurements of T eff and log g from spectroscopy. The latter were derived from our most recent grids of DA model atmospheres (Bergeron et al., 1995;Gianninas et al., 2011) and by applying the 1D/3D correction from Tremblay et al. (2013). Another independent way to test seismic solution's accuracy is now available with high precision distance estimates provided by parallax measurements from the GAIA Data Release 2. These distances from par-allax are given in Table 1 and can be compared with "asteroseismic" distances computed from the optimal seismic model solutions. The uncovered seismic model, coupled with a corresponding model atmosphere, provides the absolute magnitude of the star that can be computed for any chosen filter. These absolute magnitudes can be used to estimate interstellar reddening, extinction, and ultimately the distance modulus when compared with measured apparent magnitudes. The values given in Table 1 for the asteroseismic distance are based on the Gaia Bp and Rp photometry and are corrected from extinction. In all cases, we find that the distances estimated from the seismic solutions are in remarkable agreement with those derived directly from the parallax. This result provides a very strong test validating the seismic models obtained for these stars.

The seismic solutions uncovered also lead to a complete mapping of the chemical stratification inside these stars. These will be disclosed in detail in forthcoming papers (Giammichele et al. 2019, in preparation) and we restrict this report to the preliminary values summarized in Table 1. In this table, we provide the estimated masses for the hydrogen-rich envelope (log q(H) = log[1 -M(H)/M * ]), the helium mantle, log q(He), and the central homogeneous C/O core, log q(core). We also indicate the oxygen mass fraction in that central region, O(core).

Our results show a rather large scatter of values for the hydrogen envelope masses, while the derived helium layer mass fractions are in a relatively narrow range. Remarkably, the derived central core extent is found to be quite similar for four of these stars (out of five; see below), ranging from log q(core) ∼ -0.66 to -0.80. We emphasize that a similar core size has also been obtained from the seismic analysis of the DB white dwarf KIC 08626021, with log q(core) = -0.72 ± 0.03 (Giammichele et al., 2018). These values lead to a mass for the central homogeneous C/O core -mainly produced by the former helium burning core -that is ∼ 40% larger than predicted by standard stellar evolution calculations. This remarkable consistency obtained for 5 white dwarfs so far strongly strengthen the conclusion that the helium burning phase generally produces much bigger cores than currently expected. Similarly, we find a convergence from all the white dwarfs we have analyzed toward a larger (by ∼ 15%) mass fraction of oxygen produced in the core compared to current model predictions.

Finally, we emphasize the cases of EPIC 220258806 and EPIC 220347759. These stars turn out to be spectroscopic twins, but are clearly not seismic twins. Hence, while they look very similar externally, there must be important differences in their interior structure to cause significant variations in their oscillation period spectra. Our detailed analyses show that the Table 1: Preliminary estimates of some parameters derived from asteroseismology for the 5 ZZ Ceti pulsators considered. When relevant, values are compared with available estimates from other independent methods : T eff (in K) and log g (in cgs) from spectroscopy, and the distance d (in parsec) from Gaia DR2 parallax measurements.

Conclusion

In this study, we have applied our newly developed approach to cartography the internal chemical stratification inside white dwarfs to 5 DA pulsators. The optimal seismic solutions inferred, although still at a preliminary stage, show reproducible patterns emerging from the comparison of the chemical stratifications determined for these objects. In particular, the size and composition of the innermost homogeneously mixed core are found to be similar for 4 stars of this sample. These are also comparable to the inner core structure uncovered for the DB white dwarf KIC 08626021 (Giammichele et al., 2018). This finding adds strength to the claim that the inner part of the C/O core, produced mainly during the helium core burning phase when a low-to-intermediate mass star evolves through the Horizontal Branch, is much larger than presently predicted by stellar evolution calculations. This points toward shortcomings in the treatment of mixing processes in the core during this intermediate phase of the evolution of stars. Yet, we found an outlier of this picture with the star EPIC 220258806, that seems to have a reduced homogeneously mixed core compared to the other pulsating white dwarfs analyzed thus far. Which physical process could account for this singularity is not clear at this stage. Overall, these results demonstrate the high potential of white dwarf asteroseismology to shed light on still uncertain aspects of stellar structure and evolution. With the space telescopes K2 and TESS, which have already observed or will monitor many more pulsating white dwarfs, we expect to extend further this type of analysis and achieve a systematic cartography of the chemical stratification inside white dwarfs. This journey to the center of white dwarf stars should enlighten our understanding of these objects and have repercussions in many connected fields.

Acknowledgment

We acknowledge support from the Agence Nationale de la Recherche (ANR, France) under grant ANR-17-CE31-0018, funding the INSIDE project. This work was granted access to the high-performance computing resources of the CALMIP computing centre under allocation number 2018-p0205. G.F. acknowledges the contribution of the Canada Research Chair Program, and W.Z. the LAMOST fellowship as a young researcher, supported by the Special Funding for Advanced Users, budgeted and administrated by the Center for Astronomical Mega-Science, Chinese Academy of Sciences. V.V.G. is an F.R.S.-FNRS Research Associate. The authors acknowledge the Kepler team and everyone who has contributed to making this mission possible. Funding for the Kepler mission is provided by NASA's Science Mission Directorate.

Figure 1 :

 1 Figure 1: Composition profiles of Helium, Carbon, and Oxygen as functions of the fractional mass depth in a typical DA white dwarf produced by assuming different nuclear reaction rates in evolution calculations. Top panel is from Figure 7 of De Gerónimo et al. (2017), while bottom panel shows a similar -eyeball fit -reproduction of these profiles using our parametrized hydrostatic models developed for asteroseismology.

Figure 2 :

 2 Figure 2: Composition profiles of Helium, Carbon, and Oxygen as functions of the fractional mass depth in a typical DA white dwarf produced when no thermal pulses or 3 thermal pulses occur during the post-AGB phase. Top panel is from Figure 1 of De Gerónimo et al. (2017), while bottom panel shows a similar -eyeball fit -reproduction of these profiles using our parametrized hydrostatic models developed for asteroseismology.

Figure 3 :

 3 Figure 3: Composition profiles of Helium, Carbon, and Oxygen as functions of the fractional mass depth in a typical DA white dwarf produced with and without overshoot in evolution calculations. Top panel is from Figure 4 of De Gerónimo et al. (2017), while bottom panel shows a similar -eyeball fit -reproduction of these profiles using our parametrized hydrostatic models developed for asteroseismology.


Castanheira

Campos

N Giammichele

S Charpinet

G Fontaine

P Brassard

P Bergeron

N Reindl

A S Baran

21 st European Workshop on White Dwarfs

We present the results of the asteroseismic analysis of the hydrogen-deficient white dwarf PG 0112+104 from the Kepler-2 field. Our seismic procedure using the forward method based on physically sound, static models, includes the new core parameterization leading us to reproduce the periods of this star near the precision of the observations. This new fit outperforms current state-ofthe-art standards by order of magnitudes. We precisely establish the internal structure and unravel the inner C/O stratification of its core. This opens up interesting perspectives on better constraining key processes in stellar physics such as nuclear burning, convection, and mixing, that shape this stratification over time.

introduction

Hydrogen-deficient DB stars constitute approximately 20% of the white dwarf population. Most are believed to be produced by the so-called born-again scenario involving a late thermal pulse that consumes the last "drops" of hydrogen possibly remaining in the star at that pre-white-dwarf stage. Yet, alternative channels may also contribute significantly to this population, as proposed by Reindl et al. (2014); Reindl (2015). Exploiting pulsating DB (V777 Her) white dwarfs with asteroseismology to probe their inner properties may therefore reveal valuable clues about their possible formation channels. Asteroseismology of white dwarf stars has been developed for more than three decades, comprehensively summarized in, e.g., the reviews of Fontaine & Brassard (2008), Winget & Kepler (2008), and Althaus et al. (2010), or more recently through the critical discussion provided in Section 2.1 of Giammichele et al. (2017a). The introduction of a new approach to obtain seismic model solutions for white dwarf pulsators that unravel their internal chemical stratification and match better the observed period spectra is our latest improvement on this front (Giammichele et al., 2017a,b). This technique led to the first seismic cartography of the distribution of helium, carbon, and oxygen inside the DB white dwarf star KIC 08626021 (Giammichele et al., 2018). The chemical stratification inside a white dwarf bears the signature of all the processes that occurred during its past history, in particular from the helium core burning phase and beyond. Measuring it is therefore an important milestone toward understanding better the physics of stars in their ultimate stages. In the present paper, we report on preliminary results obtained from the seismic cartography of another pulsating DB white dwarf, PG 0112+104.

Asteroseismic analysis

PG 0112+104 is one of the pulsating DB white dwarfs monitored continuously with the Kepler-2 spacecraft during more than two months. This star exhibits a quite rich oscillation spectrum composed of gravity modes, probing the deep interior of the star. We exploit here the twelve extracted independent modes, with periods ranging from 150.7 to 543.9 s (see Table 1), to perform a complete seismic analysis to unravel the internal structure of this star. As independent validations, we have in our possession, our most recent spectroscopic determination of the atmospheric parameters, T eff = 31,040 ± 1,056K, and log g =7.83 ± 0.06 (see Bergeron et al. 1995;Gianninas et al. 2011;Tremblay et al. 2013), as well as the estimated distance of d = 111 ± 1 pc, obtained from the Gaia parallax measurement. We can also rely on the presence of a low-frequency spot modulation that would correspond to a surface rotation period of 10.17404 ± 0.00067 hr, if interpreted correctly by Hermes et al. (2017). These three entirely independent measurements should be used to confront the soundness of solutions found for any seismic analysis of PG 0112+104.

We rely on a forward-modeling technique using parameterized static, physically-sound stellar models, independent of stellar evolution calculations. With the help of the code LUCY (Charpinet et al., 2008), the genetic algorithm designed to explore in depth the entire parameter space, we can isolate the optimal seismic model that best reproduces the oscillation properties by minimizing a merit function defined by the sum of the squared differences between theoretical and observed periods. We take advantage of our most recent developments in the definition of parameterized white dwarf models for asteroseismology (e.g., Giammichele et al., 2017aGiammichele et al., , 2018)). The carbon-oxygen core profile (chemical composition and shape) is optimized simultaneously with the other parameters that define the full hydrostatic structure and the still settling helium in the envelope of the star. Let's recall that this approach has the great advantage of testing countless plausible configurations of chemical stratification as well as global parameters, to better find and assess the uniqueness of the optimal model uncovered. With this flexible technique, we can recover the optimal chemical stratification able to best reproduce the seismic observables, as hare-and-hounds experiments have demonstrated (see Giammichele et al. 2017b).

The seismic solution that best matches the pulsation properties of PG 0112+104 is uniquely determined around a well-defined minimum of the fitted merit function in parameter space. By inspecting Table 1, we find that the seismic fit reproduces very well the measured frequencies with a frequency dispersion of ∆ν = 0.007 µHz, at least four orders of magnitude better than what is currently available for this star ( (Hermes et al., 2017)).

Some parameters defining the optimal model uncovered are provided in Table 2. This model has T eff = 30,787 ± 231 K and log g = 7.81 ± 0.01, which Mass (M ) 0.524 log q(He) -2.33 log q(core) -0.53 O(core) 75.6 matches perfectly the independent measurements obtained from spectroscopy (within 0.25σ for the effective temperature and 0.35σ for the surface gravity), as can be seen in Fig. 1. The second validity check that we can perform is to estimate the seismic distance obtained from the parameters of our optimal stellar model coupled with available photometry in a specific bandpass. From our results, we find an estimate of seismic distance of 117.8 ± 8.2 pc, which is in excellent agreement of the estimate of the distance from the Gaia parallax of 111 ± 1 pc. The flexibility of our new parameterization coupled with an efficient search algorithm allows for a precise derivation of the internal stratification. The oxygen mass fraction distribution in the core of the star can now be unambiguously derived, along with other profiles for the main chemical species. Details about the derived profiles will be given in a forthcoming paper (Giammichele et al. 2019, in preparation). We limit the discussion here to the findings described below.

We obtain that the central abundance of oxygen rises up to 76%, higher than predicted by evolutionary calculations by 10-20%. The extent of the homogeneous central part of the core is almost doubled, reaching a mass fraction of log q ≈ -0.5, instead of log q ≈ -0.3. This suggests that the extent of the progenitor convective core during the core-helium-burning phase should have encompassed some 0.35 M * larger by a factor of 1.4 from expected. On the other hand, the behavior of the two descents in the oxygen mass stratification that bear the imprint of helium shell burning processes from earlier stages of evolution does not differ notably from the predictions of standard evolutionary calculations. Moreover, we find a oxygen-carbon-helium triple transition at log q ≈ -2.5, a feature predicted from evolutionary theory calculations.

The resulting helium envelope found in the optimized model is quite unexpected. PG 0112+104 only shows a rather thick layer, implying a different evolutionary path than the expected born-again scenario. The structure derived for PG 0112+104 could be best explained if the star is instead a descendant of the very hot, helium-dominated star O(He) star, before turning into a hydrogen-deficient white dwarf, confirming the finding of Reindl et al. (2014).

Internal rotation

Given the seismic model we have obtained for PG 0112+104, we can exploit the fine structure uncovered by Kepler-2 in seven of the eleven main structures detected in this star. Interpreted as rotational splitting, the different multiplet structures found in the Fourier spectrum of PG 0112+104 can be used to infer the internal rotation profile. The actual rotation profile as a function of depth can be tested following the method developed by (Charpinet et al., 2009)). In the present case, we find that the outer 70% of the radius can be sounded for rotation and that PG 0112+104 rotates rigidly over this region with a period of Prot = 10.18 ± 0.27 hr. Additionally, PG 0112+104 has a photometric signal corresponding to the surface rotation period, inferred to correspond to 10.17404 ± 0.00067 hr. Our derived rotation period is therefore in perfect agreement with this independent observational constraint.

Conclusions

The seismically inverted C-O stratifications in white dwarf cores offer the opportunity to test stellar evolution models and their constitutive physics. The next step is to explore post-AGB stellar evolution with the goal to reproduce the seismically-derived chemical stratification. This approach is bound to provide extremely valuable hints on which parts of the input physics (convection, overshooting, and semi-convection treatments, nuclear physics) need to be revised in order to conform with the seismic measurements.

In this analysis, the DB white dwarf PG 0112+104 reveals a homogeneous C/O central core that extend further than predicted by standard evolution calculations. An atypical structure above the core is also exposed, suggesting that this DB star may have followed a different evolutionary path than the standard born-again scenario. Finally, we have shown that PG 0112+104 rotates as a solid body over 70% of its radius with a period of 10.18±0.27 h. 2009)). The best-fit solution is illustrated by the nearly vertical white curve above the solid-body solution (vertical dot-dashed white line). The dotted white curves on both sides of the solution depict its associated 1σ, 2σ, and 3σ uncertainty contours.

Figure 1 :

 1 Figure 1: Map of the merit function projected onto the T efflog g plane for models of PG 0112+104 (on a logarithmic scale). The white dotted curve delimits the 1σ confidence level relative to the best-fit solution. The black cross surrounded by the black box indicates the independent spectroscopic solution and its 1σ uncertainties.

Figure 2 :

 2 Figure 2: Result of the optimization procedure under the hypothesis that PG 0112+104 rotates slowly and rigidly.This shows the behavior of the merit function in terms of the assumed rotation period. The merit function exhibits a very well defined minimum, corresponding to a rotation period of Prot = 10.18 ± 0.27 hr. The dotted horizontal lines correspond, from bottom to top, to the 1σ, 2σ, and 3σ limits.

Figure 3 :

 3 Figure 3: Contour map of the 2D merit function that optimizes the match between the observed spacings in the seven multiplets with computed spacings on the basis of our seismic model (in terms of depth and local rotation period of the inner region in the two-zone approach of Charpinet et al. (2009)). The best-fit solution is illustrated by the nearly vertical white curve above the solid-body solution (vertical dot-dashed white line). The dotted white curves on both sides of the solution depict its associated 1σ, 2σ, and 3σ uncertainty contours.

Table 1 :

 1 Observed, theoretical periods, and mode identification from the optimal model obtained for PG 0112+104.

	Observed Per. Theoretical Per.	Mode Id.
	(s)	(s)
	159.29938	159.29976	=1, k=2
	197.20771	197.20739	=1, k=3
	245.72301	245.72298	=1, k=4
	275.55884	275.55825	=1, k=5
	319.51790	319.51756	=1, k=6
	356.98212	356.98165	=1, k=7
	543.95290	543.95210	=1, k=12
	150.75042	150.75012	=2, k=4
	168.31880	168.31825	=2, k=5
	194.85912	194.85886	=2, k=6
	215.34986	215.35002	=2, k=7
	497.17680	497.17720	=2, k=20

Table 2 :

 2 Preliminary estimates of some parameters derived from asteroseismology for PG 0112+104. When relevant, values are compared with available estimates from other independent methods : T eff (in K) and log g (in cgs) from spectroscopy, and the distance d (in parsec) from Gaia DR2 parallax measurements.

		PG 0112+104
	T eff (spectro)	31,040 ± 1056
	T eff (astero)	30,787 ± 231
	log g (spectro) 7.83 ± 0.06
	log g (astero)	7.81 ± 0.01
	d (astero)	117.8 ± 8.2
	d (parallax)	111.0 ± 1.0
	Other relevant parameters (see text)

Acknowledgment

We acknowledge support from the Agence Nationale de la Recherche (ANR, France) under grant ANR-17-CE31-0018, funding the INSIDE project. This work was granted access to the high-performance computing resources of the CALMIP computing center under allocation number 2018-p0205. G.F. acknowledges the contribution of the Canada Research Chair Program. The authors acknowledge the Kepler team and everyone who has contributed to making this mission possible. Funding for the Kepler mission is provided by NASA's Science Mission Directorate.


Weikai Zong

Stéphane Charpinet

Typeset using

Keywords: technique, photometric -stars, frequency -stars, modulations

We present a simulation showing that super-Nyquist frequencies may have periodic amplitude and frequency modulations, even if actually stable, in time series sampled like the Kepler data. These modulations are caused by the barycentric time correction, which destroys the evenly spaced time measurements, making the Nyquist frequency variable over the spacecraft orbit around the Sun. These modulations can easily be identified in pulsating stars from Kepler's photometric data.

INTRODUCTION

Pulsating stars, exhibiting periodic luminosity variations, offer the unique opportunity to probe their interiors with the technique of asteroseismology. Their intrinsic frequencies can be measured with high precision from high-quality fast photometry over long time baselines, usually achieved from spaceborne observations. The Kepler spacecraft monitored stars in the 105 • region near the Cygnus and Lyrae constellations during its prime mission, leading to significant breakthroughs for many types of pulsating stars across the Hertzsprung-Russell diagram (Aerts 2021). Notably, the 4yr time baseline achieved for various pulsators allowed us to resolve the variability of oscillation modes, providing observations to further develop nonlinear theory of stellar oscillations (see, e.g., Zong et al. 2016a).

Nevertheless, the delivery of Kepler data was limited by downlink bandwidth, which could only provide high cadence (∆t ∼ 58.85 s) light curves for about 500 stars and long cadence (∆t ∼ 29.4 min) light curves for about 200,000 stars. Using Fourier transforms, these photometric data are usually transposed into frequency space up to the Nyquist frequency f Ny = 1/(2∆t), where the pulsation signals can easily be identified. However, mode frequencies may sometimes be over the Nyquist limit when fast pulsators are involved. These are called super-Nyquist frequencies. For instance, p-modes in hot B subdwarfs can reach frequencies up to ten thousands weikai.zong@bnu.edu.cn µHz, which is beyond the Nyquist limit of Kepler's high cadence. Super-Nyquist frequencies can still be detected as a result of a reflection relative to the Nyquist frequency. However, the profile of those super-Nyquist peaks turns out to be complex (see, e.g., Baran et al. 2012;Murphy et al. 2013), thus contaminating measurements of intrinsic amplitude and frequency modulation patterns. In this context, we report a simple simulation of stable signals beyond the Nyquist frequency that clearly show periodic amplitude and frequency modulations as a consequence of the frequency reflection relative to f Ny .

RESULTS AND DISCUSSION

The simulations are performed with the following steps:

(1) To reproduce Kepler's sampling, we take the time array from one Kepler target with long cadence data from Quarter 1 to 17. (2) The flux array is constructed with a process similar to the one described in Zong et al. (2016b, see details in Section 2.3), but with injection of three frequencies f 0 = 14.6880 c/d, f 1 = f 0 /0.77 and f 2 = f 0 + f 1 , where f 2 > f Ny ∼ 24.5 c/d. To make the measurements significant, their intrinsic amplitudes are stable and of the order of 0.1 mag. (3) Amplitude and frequency modulations are measured with the same method described in Zong et al. (2018, see details in Section 3), but using a time step and a window of 45 days and 135 days, respectively.

Figure 1 shows the observed modulation patterns for the three injected frequencies. We note that the extracted frequency f 2 = 2 f Ny -f 0 + f 1 is a mirror reflection relative to the Nyquist frequency, which clearly shows amplitude and frequency modulations with a periodic pattern of about 370 days, i.e., a time scale similar to Kepler's orbital period around the Sun. The amplitude and frequency of f 2 varies by about 1% and 10 -3 c/d, respectively. In contrast, the frequencies f 0 and f 1 show no variation in amplitude and frequency. We note that the amplitude and frequency scatter for f 0 and f 1 are both of the order of 100 ppm and 10 -6 c/d, respectively, which is smaller than measurement errors. The frequencies f 0 , f 1 , and f 2 were all injected with stable amplitudes and frequencies, but they show different modulating characters after extraction. This finding suggests that super-Nyquist frequencies can be identified by amplitude and frequency modulations with a variation of about 1-yr period. This pseudo modulation is induced by the barycentric time correction, which introduces an unevenly spaced time sampling, with tiny time shifts, in Kepler's data. The Nyquist frequency is the upper limit for equally-spaced data in Fourier transform, beyond which the frequency patterns will repeat again. With barycentric time corrections inducing a vari-ation in the time sampling, the Nyquist frequency changes periodically. Thus the reflection of super-Nyquist signals in the lower frequency range also change following the variation of f Ny . We note that amplitude modulations can also be triggered by frequency variations (Zong et al. 2018, see Section 2 for details of mathematical expression). This kind of variations could therefore easily be used to identify super-Nyquist frequencies in a periodogram. We finally note that these modulations could also generate symmetrical multiplets (Murphy et al. 2013) or complex profiles (Baran et al. 2012) in Fourier space.

Figure 1 .

 1 Figure1. Measured amplitude (left panels) and frequency (right panels) variations for the three injected frequencies f 0 , f 1 and f 2 .

ACKNOWLEDGMENTS

We acknowledge support from the National Natural Science Foundation of China through grants 11903005, the Fundamental Research Funds for the Central Universities, and the Agence Nationale de la Recherche (ANR, France) under grant ANR-17-CE31-0018.


Michael Pock

Hicham Belhadaoui

Olaf Malassé

Max Walter

Efficient generation and representation of failure lists out of an information

Efficient Generation and Representation of Failure Lists out of an Information Flux Model for Modeling Safety Critical Systems Michael Pock 1,2,4 , Hicham Belhadaoui 1,3,4 , Olaf Malassé 1 & Max Walter 2 1) Arts et Métiers Paristech, Metz 2) Technische Universität München 3) ENSEM Casablanca 4) Centre de Recherche en Automatique de Nancy ABSTRACT: This article presents a novel way to model safety critical systems hierarchically. An information flow diagram as high level and finite automatons as low level model are combined. With these models, scenarios leading to dangerous failures as well as spurious shutdowns can be generated. Furthermore, we will show how to extract the different scenarios out of the model in a very efficient way using different BDD-techniques. Finally, we will present some related work.

INTRODUCTION

A serious problem for the design and evaluation of safety critical systems, for example used in the automation domain, is to forecast the safety of the system. It's not possible to measure it for two reasons. At first, normally these accidents should occur very rarely, so that a system has to run for a very long time to get reasonable results. Furthermore, it is very questionable to run a safety-critical system which can cause a lot of harm without knowing anything about its dependability. So the only solution is to use a model to evaluate the safety of the system. Another problem are unspecificated activations of safety functions, the so called spurious trips. They can lead to the unavailability of the system and cause extra costs. Furthermore, too many spurious trips can be dangerous as well. If there are too many false alarms or shutdowns, the operators and surrounding people could start to ignore the alarms or try to prevent the shutdowns, even if there is a dangerous situation this time. There are in general two problems for the evaluation. The first one is to get all scenarios leading to failures of the System. Such a qualitive analysis is normally done with methods like FEMA. For complex systems, this can be quite difficult as there are a lot of failure propagations and common causes possible which have to be included in the result. Often these are not obvious, a very detailed analysis of the whole system is necessary to find them.

The second problem is the quantitive solution. Currently, mainly standard models like fault trees (FTs) [START_REF] Lee | Fault tree analysis, methods, and applications -A review[END_REF] and Petri nets (PNs) [START_REF] Leveson | Safety Analysis Using Petri Nets[END_REF] are used. Fault trees are easy to use, but they have several limitations. At first, components in safety critical systems often have more than one failure mode. They can create dangerous failures or spurious trips itself and propagate these to other components. They even can prevent specific failures of other components. For example, an unwanted shutdown will prevent any accident. But Fault Trees are just boolean models, every event or component can only have two modes. Furthermore they cannot model dependencies directly which will occur between different kind of failures. The only possibility to use fault trees for safety-critical systems is by defining several basic events for single components. As these events are stochastically dependent, extensions of fault trees like non-monotonous FTs have to be used. In general, the trees can get very complicated and very large for complex systems. There are also at least two unwanted events for safety-critical systems, whereas fault trees are just capable to model single events. So it would be necessary to create multiple models with a lot of common components and events. Petri Nets in contrary are more powerful. There is no limitation to the number of states of a component, and it is possible to calculate several events in one PN. But they are not very intuitive. They also cannot be created hierarchically, as a small change in one com-ponent will affect the whole PN. This is the reason that we will present a powerful high-level model which can handle all these specific problems for safety-critical systems, based on the theoretical work of Karim Hamidi [START_REF] Hamidi | Contribution à un modèle dévaluation quantitative des performances fiabilistes de fonctions électroniques et programmables dédiées à la sécurité[END_REF]) in section 3. With this model it is much easier to find all scenarios leading to a failure of the system. An efficient solution method will follow in section 4. At the moment, there is no implementation of the presented algorithms, though. So it is not possible to present measurements yet.

AN EMERGENCY STOP SYSTEM Figure 1: A emergency stop system of the chemical reactor

To illustrate the presented model, the emergency stop system of a chemical reactor (Figure 1) will be used which is described in this section. This system should stop the reaction if the temperature in the reactor is getting too high by stopping the inflow of the chemicals. The sensors S1 and S2 measure the current temperature of the chemicals in the tank and transport their results to the controller. The controller reads this result via his inputs In1 and In2 and will store these values for synchronization in its memory. (St1, St2).

To avoid a loss of information, the watchdogs W d1 and W d2 supervise the inputs. If an input is lost or arrives to late, the watchdog will pass a default value to the V oter. Afterwards, the V oter decides, if there is a dangerous situation. If after the voting process the control unit CU decides to shut down the system, this information is proceeded to the output modules Out1 and Out2 and passed to the motors M1 and M2 which get the order to close the valves V 1 and V 2. If at least one of these valves is closed, the shutdown was successful. For this system, there are two possible kinds of failures in general. Either the emergency system is not available (dangerous failure), or it shuts down the system in a safe state leading to a unneccessary unavailability of the whole reactor (spurious shutdown). A failure of the whole emergency system can be caused by several different failures of its components.

We will classify these failures as dangerous (D), nondangerous (S) or omission (I), which means that the component does not have an output. The sensors can either measure a value which is too high (S), too low (D), or return no value at all (I). The input modules can either lose the data of the sensors (I) or change it to a higher (S) or lower (D) value. In the memory the stored data can be distorted by a bitflip in either a dangerous (D) or nondangerous (S) way. It can happen that the watchdogs do not detect a missing input (D), or that they report such a missing input although there was one (S). The control unit can decide to start a shutdown in a safe state (S) or to not start a shutdown in a dangerous state (D). The output modules can fail to give the orders to their motors to close the valves (D), while the motors can fail to start (D). Finally, the valves can be blocked in an open (D) or closed (S) position. It is possible to discriminate the single components further, but in this section we will limit our explanation on the general outline of the system. A fault tree for the dangerous failure is shown in Figure 2. The names of the basic events are composed of the failed component and the kind of failure. For a more detailed analysis, the basic events could be replaced with subtrees. This fault tree has some problems though. At first, some basic events for the same components, but for different failure modes are stochastically dependent, for example S1 D and S1 I . Furthermore, some component failures will prevent a dangerous failure of the whole system, for example a blocked valve in its closed state. These effects can not be included directly in the fault tree. Finally, creating several fault trees to model different disjunct failure modes of one system can lead to inconsestencies. If the system is large, it is very probable that there are combinations of faults which will lead to a failure in two or more fault trees.

THE INFORMATION FLOW MODEL

We are mainly interested in two different events of the system:

• Dangerous incidents which could lead to accidents

• Non-dangerous spurious trips

We want to extract all scenarios leading to one of these two undesired events of the whole system. Especially interessant are single point of failures, common cause failures and failure propagation. These kind of failures are often not obvious, so they can be easily forgotten in a direct attempt to create a fault tree. This problem will be solved by a hierarchical approach.

We use a directed block diagram representing the information flow through the system for high level and

Information Flow Diagram

For the IFD, we use different kinds of blocks which represent different functional entities. We distinguish:

• WD-blocks for watch dogs

• SRC-blocks as sources of information

• DEC-blocks for logical decisions

• ST-blocks for all other functions (storage of information, transformation of information, selftests etc.)

Blocks of the type WD are used specially for control units with a watch dog. They have one input and one output and can detect the absence of sensible information in order to react accordingly afterwards by forwarding default or special error values. SRC-blocks create the information which flows through the diagram. They represent the sensors in the system and have only one output. ST-blocks (standard blocks) are the most versatile blocks. They have one in-and one output, and they are used for all functional entities which cannot be represented by the other blocks, e.g. the storage or the transformation of information. The last type of blocks are DEC-blocks. They represent logical decision entities. They have several inputs and one output, and describe the behavior of multiple interconnected sources of information. They do not describe any physical entities. The components which make this decision have to be included by adding a successing ST-block.

One block in the diagram, normally a ST-or DECblock, can be marked as final block. This block has no output and is used to generate the failure scenarios which will be described in Section 3.4. An example of an IFD for the given example in section 2 is shown in Figure 3. There are blocks for the different modules of the system, and some extra decision blocks. Lost1 and Lost2 decide, if the signal of the sensor is lost, CD decides if the voter will get the necessary inputs for a correct voting and Saf e is used for the final decision if there is a dangerous failure or a spurious trip. The information flows from the source blocks to the final block in one general time step t. In the source blocks, the sensors create the information which will flow through our diagram. This information proceeds to the successing blocks where it is processed and proceeded further. The exchange between the blocks al-Figure 3: The IFD for the emergency stop system ways works faultless. While processing the data in the blocks, faults can occur or be detected. This means, that the state of signal can change within a block. We distinguish three different erreonous states for the signals:

• A non-existent failure has been detected. (Safe failure state S)

• An existent failure has not been detected. (Dangerous failure state D)

• The signal is lost. (Inhabitant failure state I).

Finite automatons

After modeling the information flow it is necessary to specify the state changes of the information. For non-DEC-blocks finite, acyclic state automatons are used to represent a mapping function. A deterministic finite automaton [START_REF] Brookshear | Theory of Computation: Formal Languages, Automata, and Complexity[END_REF]) is a quintuple (S, Σ, δ, x 0 , F ) with

• a finite set of states S

• an input alphabet Σ

• a transition function δ : S × Σ → S

• an initial state x 0 ∈ S

• a set of final states F ⊂ S

For our example, we have one predefined initial state x 0 and three predefined final states x S , x D , and x I which represent the three faulty states of information.

The used alphabet in these automatons are symbols which represent different kind of failures. They are denoted as follows:

• init(i) with i ∈ {S, D, I} (For ST-and WDblocks)

• d(x, y) with x as a hardware resource and y ∈ {0, S, D, I}

• bf (e) with e as bitflip resource

• tf (f ) with f as testing resource • The empty word ǫ

The advantage of the automatons for our purpose is that they are able to include different kinds of failures and several failure modes. Furthermore they are very intuitive and can be deduced quite easily for small subsystems.

An example, the automaton for the block Store1, is shown in Figure 4. While storing the results, different failures can occur. At first, the memory mem can be damaged physically, so that there are several bits which are locked to one (S), locked to zero (S) or the memory is not available at all (I). There is also the possibility of a bitflip in the memory, changing the value of the stored data. init(i) is used for the fault propagation of the predecessor block. It only occurs at the initial state x 0 . The possible values for i depend on the type of the current block. In ST-blocks, i can only be S or D as ST-blocks aren't capable of handling lost information. By contrast, WD-blocks only contain init(I).

For hardware failures, the symbol d(x, y) is used. y indicates the state of the hardware resource x: working correctly (0), non-dangerous failure (S), potential dangerous failure (D) or no output (I). bf (e) represents environmental errors like bit flips of a resource e. f t(f ) indicates that a testing resource f has not detected an error. To simplify the calculation, we assume that the state of a hardware-, bit flip-or fault test-resource is always the same in one time step.

Note that all three final states are not always needed.

Only final states which can be detected by the inits of the successor blocks have an influence on the result and are necessary. This will be explained in more detail in the next subsection. The automatons define a language which describes all scenarios leading to the different failures of the block. We can distinguish three different sub languages for non-dangerous failures, potential dangerous failures and failures with no output. These languages can be extracted and are saved in the three lists

S : V 1 = S ∨ V 2 = S D : V 1 = D ∧ V 2 = D I : f alse
So, the final block will create a spurious trip if at least one of the two valves will create one. A dangerous failure will only occur if both valves will fail dangerously. As we are searching a complete list, we have to define how to extract it. Disjunctions in the rules will be handled by unifying two lists, Conjunctions will be handled by set products. For the given example we can conclude:

L S (Safe) = L S (V 1) ∪ L S (V 2) L D (Safe) = L D (V 1) × L D (V 2) L I (Safe) = {}

Generation of the global lists

The main interest is to generate all scenarios for dangerous failures and spurious trips of a final block.

They will be stored in the lists L D and L S . To get these lists, the lists L D (B f ) and L S (B f ) of the final block B f are created in order to connect them with the local lists of the other blocks. It's necessary to distinguish two cases: DEC-blocks and non-DEC-blocks.

For DEC-blocks, the method presented in the previous subsection to connect the blocks is used. For non-DEC-blocks, all init(i) in the list are substituted recursively. The sequence after an init(i) is combined with all sequences of a local list L i (B) of the predecessing block B by a set product. To illustrate this, the It is quite obvious that using this method directly will lead to an exponential growth of the list. This is a severe problem as it will limit the usability of the proposed model. Therefore the size of the created list has to be reduced. In order to reach this aim Binary Decision Diagrams (BDDs) are used to control the combinatorial explosion.

THE BINARY DECISION DIAGRAM

In this section we will show how BDD-techniques can be adapted to this problem. BDDs in general were introduced by Bryant. [START_REF] Brace | Efficient Implementation of a BDD Package[END_REF]) For this special problem, two extensions of BDDs are used: Zerosuppressed Binary Decision Diagrams (ZBDDs) (Minato 1993) will be combined with Binary Expression Diagrams (BEDs) [START_REF] Andersen | Boolean Expression Diagrams[END_REF]. The combination will be called Zero-surpressed Binary Expression Diagrams (ZBEDs). These ZBEDs can be reduced to normal ZBDDs by applying the reduction rules of BEDs.

In zero-suppressed BDDs, all 1-edges leading to the terminal 0-node will be deleted while nodes with the same 1-and 0-successor will remain. For this application, the usage of ZBDDs will reduce the size of the diagram significantly as there are many edges like this.

BEDs are similar to BDDs, but they also contain nodes for the boolean operators ∨ and ∧. They can be reduced to a regular BDDs with a complexity equivalent to the creation of a normal BDD by pushing down the operator nodes until they reach the leaves of the BED. The two reduction rules specially for ZBEDs are illustrated in Figure 5. While the first rule is the same as for standard BEDs, the second one had to be modified to be compatible with ZBDDs. But first, a boolean interpretation of the lists is given which is necessary to use BDDs in general. Afterwards we will explain how to create a ZBED for single blocks, simple serial IFDs, and general IFDs.

Boolean interpretation of the lists

As BDDs are an alternative representation of boolean expressions, the lists have to be interpreted as the latter. Bit flip-and fault test-resources can have two states, so it is no problem to see them as simple boolean variables. Hardware resources have four states, though. But this is not such a big problem as three different boolean variables (For example x S , x D , and x 0 ) can be defined for every resource x. Note that three variables are enough, a variable x I is not necessary. As x can be in one state at one time, the value of x I can be deduced from the values of the other three variables.

Sequences can be interpreted as conjunctions of their comprised resources. For example, d(x, S)bf (e) is interpreted as x S ∧ e. A whole list is seen as a disjunction of all sequences. {d(x, S)bf (e); d(x, D)d(y, 0)} is interpreted as (x S ∧ e) ∨ (x D ∧ y 0 ). Init(i) is used as abbreviation to the whole expression of the list L i of the predecessor block and will be used like any other variable.

ZBEDs for non-DEC-blocks

At first, we have to create a ZBED for each local list L S (B), L D (B) and L I (B) of every non-DEC-block B. The ZBED is created by a simple decomposition of the list. As example the list L S (Store1) is used. The original list is:

L S (Store1) = {init(S)d(mem, 0); d(mem, S); init(D)d(mem, 0)bf (m)} This is interpreted as: (init(S) ∧ mem 0 ) ∨ mem S ∨ (init(D) ∧ mem 0 ∧ m)
Now we can take one of the variables and set its value. We will begin with mem. For example, its value is set to 0 which means mem 0 is set to true and mem D and mem S are set to false. This leads to the following re-duced list: init(S) ∨ (init(D) ∧ m) There are similar results for setting mem to 0, I or D.

The decomposition process can be continued recursively with the other variables until only init-values or boolean constants remain. We can represent this decomposition process graphically. For this example, we receive the diagram in Figure 6. Equivalent subexpressions are shared to reduce the combinatorial explosion. Furthermore, there are at most three nontrivial leaves (init(S), init(D), init(S) ∧ init(D))

for standard blocks and one non-trivial (init(I)) leaf for WD-blocks possible. These leaves are also called temporal leaves as they will be replaced later on.

ZBEDs for DEC-blocks

As DEC-blocks are defined by boolean expressions, it would be possible to use a normal decomposition to create the ZBED. The only problem is that the expressions use the lists of several predecessor blocks and that these lists can be combined with set products, too. This leads too much more possible permutations of init-values than for serial diagrams. The solution to this problem is to use ZBEDs as they can represent the rules directly. The creation of a ZBED for a DEC-block is demonstrated with the list L D (Safe) of the final block of the example. It is defined by the following expression: {d(head 1 , D)}, a ZBED for all three blocks can be created by replacing the init-nodes with the roots of the ZBEDs of In1, where the init-nodes are substituted with the ZBEDs of S1. The result is shown in Figure 8. An interesting result is that after replacing the temporal leaves of one block, there are still at most three new temporal leaves from the predecessor block.

(V 1 = D) ∧ (V 2 = D).

ZBEDs for general IFDs

In the previous section we assumed that each hardware-, bit flip-and fault test-resources occurs only in one block. This was necessary as the algorithm just looks at one block at a time. With shared resources, this could lead to inconsistent lists in which one resource can be in two or more states at the same time. But to forbid shared resources is a quite strong limitation for the presented model, so a solution for more general IFDs is presented in this section. The first step is to create the local lists L S , L D , and L I of all non-DEC-blocks. Furthermore a look-up-table will be established which maps resources to blocks, in which they appear. After that, the creation of the whole ZBED can start. In general, we use the same aggregation rules for the blocks like in section 4.3 and 4.4. There are only two differences. At first, every node gets another attribute, a list of pointers to the local lists which have to be used later. Furthermore, the decomposition of a variable is started in every local list in which it occurs. This can be easily checked by using the look-up-table. If there are other blocks which use the same resource, the pointers to the three local lists are changed to the modified ones. So it will be ensured that there are no inconsistent sequences without having to create the whole ZBDD in one single go.

There is an important change to the structure of the ZBED for the case in 4.4, though. For every shared resource, the number of non-trivial leaves can quadruple (for HW-resources) or double (for bitflipor faulttest-resources) as there can be four respective two different settings for the state of the resource which have to be taken into account in each of the leaves.

RELATED WORK

There are already several approaches for the automatic generation of boolean models, especially fault trees with the help of a high level model. In this section, some of them will be presented.

5.1 Generation of fault trees with Little-JIL models In [START_REF] Chen | Automatic Fault Tree Derivation from Little-JIL Process Definitions[END_REF] the authors present a method for automatic fault tree generation based on Little-JIL models. These models are based on the single steps of a process, which is quite similar to the idea of the information flow. This method was tested in the domain of medical treatment which includes also saftey critical aspects. But this approach does not support several failure modes for single components or steps, though.

Generation of fault trees out of FBDs

In [START_REF] Oha | Software safety analysis of function block diagrams using fault trees[END_REF], a method to create fault trees out of function block diagrams (FBDs) is discussed. FBDs are used for programming programmable logic controllers (PLCs) especially in the domain of safety critical systems. This method has the advantage that the fault trees can be generated without creating extra models which minmizes potential error sources in the process of the fault tree generation. It is limited on the software of PLCs, though and can not be used for more general systems.

5.3

The FSAP/NuSMV-SA platform This powerful platform described in [START_REF] Bozzano | Improving System Reliability via Model Checking: The FSAP/NuSMV-SA Safety Analysis Platform[END_REF] is capable to create monoton or non-monoton fault trees out of a formal system model. There are plenty of possibilities like fault injection and different failure modes. The system and its requirements are modelled with a formal language. This approach is very powerful and can be used in different domains, although it is not as intuitive as the other approaches.

CONCLUSIONS AND OUTLOOK

The main advantage of the presented model is that it is capable to model two undesired events in one diagram. With other high-level models like fault-trees it would be necessary to create two different models with a lot of similarities. So our approach can save a much time for the modeler. Another big advantage is that the model is hierarchic. The system in general can be modeled with the IFD, the smaller entities of it with finite automatons. This gives the modeller the possibility to create a detailed but understandable model. Furthermore, we have a very efficient algorithm for creating the scenarios based on BDD-techniques. By using local properties, we can create a ZBED even for very general Diagrams in a very efficient way, which can be used as compact representation for the failure scenarios as well as a base for a quantitative solution.

Currently, this approach does not take real-time properties into account. As these can be very important in many safety critical systems, we have to do further research here. Furthermore, we plan to add inter-component dependencies and the event ordering into the model to make it more powerful. We also will implement the presented algorithm and a modeling environment to make measurements in order to check our theoretical results and to offer a powerful modeling tool.

ACKNOWLEDGMENT

We want to thank the French-Bavarian center for cooperation of universities (BFHZ-CCUFB) and the region Lorraine for their support of this work.

Figure 2 :

 2 Figure 2: The fault tree for the dangerous failure of the emergency stop system

Figure 4 :

 4 Figure 4: The Automaton for the block Store1

  L S (B), L D (B), and L I (B) for the block B. The automaton in Figure 4 defines the following languages: L S (Store1) = {d(mem, S); init(S)d(mem, 0); init(D)d(mem, 0)bf (m)} L D (Store1) = {d(mem, D); init(D)d(mem, 0); init(S)d(mem, 0)bf (m)} L I (Store1) = {d(mem, I)} 3.3 Rules of DEC-blocks Decision blocks use another low level model to describe their behavior. For this purpose, boolean rules are introduced. These rules use the state of the signals (either S, I or D) of each input. There are three rules, they represents the lists L S , L D and L I . If we take a look at the final block of the IFD shown in 3, the following rules are chosen:

Figure 5 :

 5 Figure 5: The reduction rules for ZBEDs

Figure 6 :

 6 Figure 6: The ZBED for the list L S (Store1)

Figure 7 :

 7 Figure 7: The ZBED for the list L D (Safe) in its original (left) and in its reduced (right) stage

Michael Pock, Hicham Belhadaoui, Olaf Malassé, Max Walter. Efficient generation and representation of failure lists out of an information flux model for modeling safety critical systems. The European Safety and Reliability Conference,ESREL 2008, Sep 2008, Valencia, Spain. pp.1829-1837. hal-