  Most recent software related accidents have been system accidents. To
validate the absence of system hazards concerning dysfunctional interactions,
industrials call for approaches of modeling system safety requirements and
interaction constraints among components and with environments (e.g., between
humans and machines). This paper proposes a framework based on input/output
constraint meta-automata, which restricts system behavior at the meta level.
This approach can formally model safe interactions between a system and its
environment or among its components. This framework differs from the framework
of the traditional model checking. It explicitly separates the tasks of product
engineers and safety engineers, and provides a top-down technique for modeling
a system with safety constraints, and for automatically composing a safe system
that conforms to safety requirements. The contributions of this work include
formalizing system safety requirements and a way of automatically ensuring
system safety.
