Application and research on model-based safety analysis

To handle stricter safety regulations combined with increasing complexity and shorter development cycles, it is necessary to consider safety aspects starting from the early phases of design. This paper presents an approach to link methods of safety analysis and modeling (SysML). Even though SysML and MBSE are common in the early stages of system design, there is a lack of methods integrating model-based design activities and safety analyses. Existing approaches either focus on particular tasks or build models after conducting separate safety analyses. Our presented approach, tailored to early stages of system design, introduces a "Hazard Analysis" SysML profile accompanied by a procedure for its application within a model-based safety analysis. It provides a preliminary hazard analysis and facilitates the systematic identification of safety-critical functions and components.

The effective reuse of design assets in safety-critical Software Product Lines (SPL) would require the reuse of safety analyses of those assets in the variant contexts of certification of products derived from the SPL. This in turn requires the traceability of SPL variation across design, including variation in safety analysis and safety cases. In this paper, we propose a method and tool to support the automatic generation of modular SPL safety case architectures from the information provided by SPL feature modeling and model-based safety analysis. The Goal Structuring Notation (GSN) safety case modeling notation and its modular extensions supported by the D-Case Editor were used to implement the method in an automated tool support. The tool was used to generate a modular safety case for an automotive Hybrid Braking System SPL.

Safety issues in hybrid systems increasingly result from a combination of multiple categories of hazard factors. However, current hazard analysis methods mainly focus on just one kind of system hazard. This paper presents a model-based safety analysis method for hybrid system that is based on multiple hazard factor categories. Using a Model-Based Safety Analysis framework, the functional model of a hybrid system is first established. Its logic component is modeled using a state diagram and its continuous component is modeled using a transfer function or a state equation. The safety model of the system is then constructed considering a variety of hazard factors. Improper control and logic inconsistency are established for the logic component. Component deviation and logic inconsistency are established for the continuous component. Finally, the safety of the system is then analyzed and the hazard paths are obtained. As an example, the Wheel Brake System for an aircraft is taken to analyze the safety of the aircraft landing phase. By taking into account multiple hazard factor categories, we are able to identify hazard paths that could not be found using a single hazard factor category.

SUMMARY & CONCLUSIONSMost, if not all, safety-critical systems developed are cyber-physical systems (CPS), defined by the presence of a physical component and connectedness to other systems, with a clear trend towards inclusion of over-the-air update capabilities. From a certification standpoint, every change to the system, even in software, should lead to an evaluation of its safety impact. Model-based system engineering offers the possibility of connecting domain-specific models used in the development of the CPS with relevant safety analysis models. The goal is to automate the evaluation of the impact of changes. Changes, however, can only be propagated if the dependencies of the specific model in which the change is introduced are accurately represented. These are difficult to model, as formal descriptions only exist for a subset of dependencies, and some have been completely neglected in model-based systems engineering. Our work provides an overview of the various shapes that dependencies take within model-based safety analysis. The importance of modeling these dependencies is shown in an illustrative example, in which an FMEA, SysML, and Lifecycle model are investigated.

Model-Based Safety Analysis (MBSA) is an approach in which the system and safety engineers share a common system model created using a model based development process. There are two famous approaches for the addition of fault behaviors to system models. The first one is to enclose the model of failures into the system design directly. The second approach is to develop a fault model separately from the system model; thus combining both independent models for safety analysis. This paper introduces a new Methodology of MBSA. The approach will combine various concepts such as directed graph traversal, event lists. A prototype tool is developed upon object oriented paradigm. The tool shall be tested on the famous Wheel Brake System. The results will be analyzed; advantages/disadvantages will be represented.

The complexity of safety-critical E/E-systems within the automotive domain are continuously increasing. At the same time, functional safety standards such as the ISO 26262 prescribe analysis methods like the Fault Tree Analysis (FTA) and Failure Mode and Effects Analysis (FMEA). Currently, these analysis methods are mainly performed manually and are often not consistent with an evolving system model. To tackle these challenges, we present our semi-automatic safety analysis and optimization (SASAO) process. The SASAO process extends model-based safety analysis (MBSA) approaches, which require a system model extended with component-internal error propagation information. By extracting necessary artifacts from such an extended system model, we show how safety experts can be supported when performing FTA and design FMEA that are consistent with the model. The resulting FTA and design FMEA represent mandatory arguments in the system's safety case. Furthermore, we propose a method to optimize the cost of the system with respect to the required safety level automatically.

Topology-based Safety Analysis for Safety Critical CPS

Model-based safety design and analysis uses high-fidelity models of processes and process equipment to provide accurate information for decision support in design and risk assessment of safety systems. This helps operating companies and EPCs to minimize capital expenditure while managing risk based on reliable and auditable quantification. It also provides the means to investigate many different failure scenarios within a relatively short timeframe. Until now much safety design and analysis has been done using steady-state or "pseudo-dynamic" trial-and-error modeling, looking at units in isolation, using off-the-shelf models that did not capture process complexity, or attempting to "bend" flowsheeting packages into doing something they were not designed for. It goes without saying that the models used for safety design and analysis need to be of the highest quality: It is essential that models have a high degree of predictive accuracy. This requires first-principles models with rigorous physical properties.

Utilization of Constraint Satisfaction Problem Algorithms in Model-Based Safety Analysis [MBSA

Verification of safety requirements is one important task during the development of safety critical systems. The increasing complexity of systems makes manual analysis almost impossible. This paper introduces a new methodology for formal verification of technical systems with smartIflow (State Machines for Automation of Reliability-related Tasks using Information FLOWs). smartIflow is a new modeling language that has been especially designed for the purpose of automating the safety analysis process in early product life cycle stages. It builds up on experience with existing approaches. As is common practice in current approaches, components are modeled as finite state machines. However, new concepts are introduced to describe component interactions. Events play a major role for internal interactions between components as well as for external (user) interactions. Our approach to the verification of formally specified safety requirements is a two-step method. First, an exhaustive simulation creates knowledge about a great variety of possible behaviors of the system, especially including reactions on suddenly occurring (possibly intermittent) faults. In the second step, safety requirements specified in CTL (Computation Tree Logic) are verified using model checking techniques, and counterexamples are generated if these are not satisfied. The practical applicability of this approach is demonstrated based on a Java implementation using a simple Two-Tank-Pump-Consumer system.

Software Product Line Engineering (SPLE) has been proven to reduce development and maintenance costs, improving the time-to-market, and increasing the quality of product variants developed from a product family via systematic reuse of its core assets. SPLE has been successfully used in the development of safety-critical systems, especially in automotive and aerospace domains. Safety-critical systems have to be developed according to safety standards, which demands safety analysis, Fault Tree Analysis (FTA), and assurance cases safety engineering artefacts. However, performing safety analysis, FTA, and assurance case construction activities from scratch and manually for each product variant is time-consuming and error-prone, whereas variability in safety engineering artefacts can be automatically managed with the support of variant management techniques. As safety is context-dependent, context and design variation directly impact in the safety properties changing hazards, their causes, the risks posed by these hazards to system safety, risk mitigation measures, and FTA results. Therefore, managing variability in safety artefacts from different levels of abstraction increases the complexity of the variability model, even with the support of variant management techniques. To achieve an effective balance between benefits and complexity in adopting an SPLE approach for safety-critical systems it is necessary to distinguish between reusable safety artefacts, whose variability should be managed, and those that should be generated from the reused safety artefacts. On the other hand, both industry and safety standards have recognized the use of model-based techniques to support safety analysis and assurance cases. Compositional safety analysis, design optimization, and model-based assurance cases are examples of techniques that have been used to support the generation of safety artefacts required to achieve safety certification. This thesis aims to propose a model-based approach that integrates modelbased development, compositional safety analysis, and variant management techniques to support the systematic reuse and generation of safety artefacts in safety-critical software product line engineering. The approach contributes to reduce the effort and costs of performing safety analysis and assessment for a particular product variant, since such analysis is performed from the reused safety artefacts. Thus, variant-specific fault trees, Failure Modes and Effects Analysis (FMEA), and assurance case artefacts required to achieve safety certification can be automatically generated with the support the model-based safety analysis and assurance case construction techniques.

In the ForMoSA project [18] an integrated approach for safety analysis of critical, embedded systems has been developed. The approach brings together the best of engineering practice, formal methods and mathematics: traditional safety analysis, temporal logics and verification, and statistics and optimization.These three orthogonal techniques cover three different aspects of safety: fault tolerance, functional correctness and quantitative analysis. The ForMoSA approach combines these techniques to answer the safety relevant questions in a structured and formal way. Furthermore, the tight combination of methods from different analysis domains yields results which can not be produced by any single technique.The methodology was applied in form of case studies to different industrial domains. One of them is the height control of the Elbtunnel in Hamburg [17] from the domain of electronic traffic control, which we present as an illustrating example.

New aircraft certification includes Systems Safety Assessment and Flight Testing for verifying compliance to various certification standards, noise testing, reliability testing, human factors analysis and qualitative assessments of flying qualities. The Model-Based Systems Engineering methodology has demonstrated its usefulness and practicality for performance validation of aircraft critical systems like the flight control systems prior to the start of actual qualification testing or flight testing. Use of model based methodology can be applied to failure and safety assessment tasks and certification process. Initial adaptation of MBSE was limited to aircraft systems related to electronics, avionics and software based components. There are some challenges in implementing Model-Based Safety Analysis to mechanical and electro-mechanical based systems like aircraft wheel braking system and nose steering system. MBSA promotes and supports virtual flight testing and is a powerful tool for verifying design and safety related malfunctions particularly for those failures conditions where it may not be possible to test these during the regular flight test regime.

Qualitative and quantitative formal model-based safety analysis - push the safety button

A comprehensive DEMATEL-ISM model-based safety analysis of the Lianghekou earth-rock dam