Design and Safety Analysis for System Architecture: A Breeze/ADL-Based Approach

Brake is a safety critical system for railway vehicles and brake failures have caused many catastrophic accidents in the history. Detailed accident investigation reports are available and National Transportation Safety Board (NTSB) also makes safety recommendations to Federal Railroad Administration and the industry. However, there is limited research on how to improve the brake safety from the perspective of design, system integration and safety analysis. In this paper, a framework for braking safety design and analysis is introduced, which includes four parts: failure alarming system, safety design, safety analysis and preventative maintenance. For failure alarming, according to the severity level, the failures will be notified to the operator, to Operation Control Center (OCC) or saved for the maintainer. For safety design, redundant design for fail-safe feature, automatic braking, brake release, weight control, ergonomics design for easy operation and maintenance are discussed and several application examples are illustrated. In the safety analysis section, Preliminary Hazard Analysis (PHA) as a semi-quantitative analysis, Failure Modes, Effects, and Criticality Analysis (FMECA) as a bottom-up method and Fault Tree Analysis as a top-down method are used. The hazards details, system assurance actions and closure references are recorded in the Hazard Tracking Log (HTL) to ensure all the safety related items are well tracked and documented. Preventative Maintenance (PM) which is regularly performed on the brake components to lessen the likelihood of failing is also discussed in combination with the reliability prediction and safety analysis for a balance of safety and economy. The safety design framework and principles introduced in this paper can also be applied into other railway systems, such as Propulsion, Signaling, Doors, etc. and may provide insights to similar industries such as automotive, energy and so on.

Unmanned Aerial Systems (UAS, a.k.a., drones) are a compelling technology with numerous possibilities for highly productive new airspace operations. Safety of operators and bystanders is of paramount concern, and a common, accepted, safety methodology is a pressing need to enable widespread adoption of UAS. This paper provides a methodology for safety analyses that can be conducted for multiple applications using common models and a suggested standardized architecture for small UAS. To date, in the US, safety analyses have been done on an individualized, custom basis, mainly in support of waivers for specific, limited UAS operations. For example, safety analyses have been conducted in the Federal Aviation Administration's (FAA) Pathfinder Program for use of drones in three focus areas: beyond visual line of sight for infrastructure inspections, extended visual line of sight in rural areas, and flight over people. In addition, approximately 400 waivers have been granted for multiple individual applicants [1]. The waiver process is highly specific to an individual applicant's operation and a special safety analysis must be conducted for each waiver request. This is an inefficient use of resources for both the FAA and industry. It would be more efficient if a common model for UAS safety analysis could be employed that was adaptable to varied applications. An important subclass of UAS operations which currently requires waivers are operations termed Beyond Visual Line of Sight (BVLOS). BVLOS operations allow for UAS flight operations which are out of the visual line of sight of the UAS operator. BVLOS will allow multiple economically beneficial applications, for example, infrastructure inspection and agriculture. Our approach seeks to begin providing an adaptable framework for analyses, focusing on Beyond Visual Line of Sight operations, that allows rapid assurance of operational safety. The benefits of this approach are twofold: first, in the near term, the workload involved in applying for waivers, both for the FAA and for applicants, would be significantly reduced, and second, the approach can be used to inform industry standards on key system requirements. This would give industry an important start in the development of common standards for equipment requirements, as is typically done in standards bodies such as RTCA. To provide a UAS reference model, a common small UAS architecture is proposed to conduct analyses across UAS platforms and operations. The architecture enables the safety model's inputs to be adapted to target UAS platforms and operational scenarios. This approach allows for large scale simulations that can analyze the impact of various vehicle performance configurations in differing operational scenarios. This paper also provides a fault-tree analysis model that is customizable to specific operations, and shows some initial results that help provide insights into tradeoffs and potential requirements. The paper explores these tradeoffs in the context of previous analysis conducted by Patterson et al. [2] which identifies a top-level requirement for “Loss of Controlled Flight for any Reason.” The fault-tree analysis helps to identify the various root causes (basic events) of the model's system failure condition (top event) — loss of controlled flight of the UAS vehicle. The attractiveness of the model is that it is easily adaptable to different operations, safety guidelines, reliability requirements, equipment standards, etc. The paper demonstrates a sensitivity analysis to assess the varying impact of the basic events on system failure at different error levels. The fault-tree model and sensitivity analysis results, along with the accompanying common architecture, together provide a flexible approach to UAS safety analyses.

Software Product Line Engineering (SPLE) has been proven to reduce development and maintenance costs, improving the time-to-market, and increasing the quality of product variants developed from a product family via systematic reuse of its core assets. SPLE has been successfully used in the development of safety-critical systems, especially in automotive and aerospace domains. Safety-critical systems have to be developed according to safety standards, which demands safety analysis, Fault Tree Analysis (FTA), and assurance cases safety engineering artefacts. However, performing safety analysis, FTA, and assurance case construction activities from scratch and manually for each product variant is time-consuming and error-prone, whereas variability in safety engineering artefacts can be automatically managed with the support of variant management techniques. As safety is context-dependent, context and design variation directly impact in the safety properties changing hazards, their causes, the risks posed by these hazards to system safety, risk mitigation measures, and FTA results. Therefore, managing variability in safety artefacts from different levels of abstraction increases the complexity of the variability model, even with the support of variant management techniques. To achieve an effective balance between benefits and complexity in adopting an SPLE approach for safety-critical systems it is necessary to distinguish between reusable safety artefacts, whose variability should be managed, and those that should be generated from the reused safety artefacts. On the other hand, both industry and safety standards have recognized the use of model-based techniques to support safety analysis and assurance cases. Compositional safety analysis, design optimization, and model-based assurance cases are examples of techniques that have been used to support the generation of safety artefacts required to achieve safety certification. This thesis aims to propose a model-based approach that integrates modelbased development, compositional safety analysis, and variant management techniques to support the systematic reuse and generation of safety artefacts in safety-critical software product line engineering. The approach contributes to reduce the effort and costs of performing safety analysis and assessment for a particular product variant, since such analysis is performed from the reused safety artefacts. Thus, variant-specific fault trees, Failure Modes and Effects Analysis (FMEA), and assurance case artefacts required to achieve safety certification can be automatically generated with the support the model-based safety analysis and assurance case construction techniques.

Software and System Product Lines (SSPL) are the state-of-the-art for systematically reusing a common set of core assets in the development of similar products in a product family. A large number of SSPL success stories have been published in the last decade and commercial tool support is also available. SSPLs promise to reduce cost, to shorten time-to-market for new features, and to increase product quality by systematically reusing core assets in the development of three or more systems. However, an open challenge is SSPL engineering for safety-relevant systems such as automotive, avionic, or industrial automation systems. Safety-relevant systems have to be developed, analyzed, and certified according to safety standards such as IEC 61508. These standards demand the application of safety analyses such as Fault Tree Analysis and Failure Mode and Effect Analysis. Starting the safety analysis of each product variant of a SSPL from scratch is complex and very time-consuming. However, there are only few convincing cases, where SSPL approaches have been followed in safety engineering. To pave the way for a broader adoption of SSPL approaches, this paper reports practical experiences with industrial-strength methods and tools along an adaptive cruise control SSPL. The paper demonstrates how commercial tools can be used (i) to analyze safety-related aspects already in the architectural design, (ii) to model the results as component integrated component fault trees (C2FT), and (iii) to systematically reuse C2FT in the safety analysis of a concrete product. The results of the case study show that C2FT (i) can be easily integrated into a feature-oriented development process of SSPL, (ii) facilitate early consideration of safety in domain engineering, and (iii) reduce effort and complexity of safety analyses in application engineering.

Although fault tree analysis is well established in the industry and its application is proposed by the international standard for functional safety for road vehicles — ISO 26262 — it is often time intensive to perform. Tool chains are long, the line of action is not straightforward, annotations in data models are complex and traceability is not self-evident. To overcome these inconveniences, this paper presents an approach for graphically notated failure modeling, based on an integrated data model for electric and electronic architectures and rapidly performing of fault tree analysis during concept phase of system design. We demonstrate the utilization of existing concepts in the domain of electric and electronic architecture modeling to enrich existing architectures with concepts of fault tree analysis. Also, we demonstrate the model-based specification of failure models, their relation to modeling artifacts of electric and electronic architectures and the automated processing of failure expressions without the necessity to leave the development environment for electric and electronic architecture modeling. The presented methodology supports closer links between the development of architectures for safety-critical systems and failure analysis by facilitating traceability between failure and system modeling based on a common data structure and well-established modeling approaches.

<div class="htmlview paragraph">Fault tree analysis (FTA) evolved from the aerospace industry in the 1960’s. A fault tree is deductive logic model that is generated with a top undesired event in mind. FTA answers the question, “how can something occur?” as opposed to failure modes and effects analysis (FMEA) that is inductive and answers the question, “what if?” FTA is used in risk, reliability and safety assessments. FTA is currently being used by several industries such as nuclear power and chemical processing. Typically the automotive industries uses failure modes and effects analysis (FMEA) such as design FMEAs and process FMEAs. The use of FTA has spread to the automotive industry. This paper discusses the use of FTA for automotive applications. With the addition automotive electronics for various applications in systems such as engine/power control, cruise control and braking/traction, FTA is well suited to address failure modes within these systems. FTA can determine the importance of these failure modes from various perspectives such as cost, reliability and safety. A fault tree analysis of a car starting system is presented as an example.</div>

The Software Engineering track received 63 papers from which 7 papers were selected after an intensive reviewing and selection process. Many good papers could not be selected due to lack of space in the program. The selected papers cover a diverse range of topics within software engineering: from software reliability prediction to middle-ware for component management to runtime validation and code generation. The paper by Roychoudhury, Negi and Mitra analyzes programs loops for estimating program execution time. They use constraint propagation techniques to detect infeasible paths followed by timing analysis that employ memoization techniques. The paper by Sengupta and Cleaveland presents the operational semantics of timed message sequence charts to help detect errors and inconsistencies in specifications. Tripathi and Mall present a method for making predictions about reliability of software during the software development process itself when the failure data from the field cannot be available. The paper by Wang presents a logic programming framework for integrating architecture description languages (ADLs) which allows tools developed for one ADL to be used even though the architectural specification is written in another ADL. In a similar vain, the paper by Stevenson, Fu and Dong presents a framework for automated and validated realization of software architecture designs. The paper by Bhattarcharjee and Shyamsundar presents a method for validated code generation for activity diagrams which are useful in model driven design of software. Finally, the paper by Mousavi et al presents techniques that exploit symmetry for tackling the state-space explosion problem that arises in model checking.

Fault tree analysis (FTA) is one of the most prominent techniques used in risk analysis, this method aimed to identify how component failures lead to system failure using logical gates (i.e. AND, OR gates). However, some limitations appear on FTA due to its static structure. Bayesian networks (BNs) have become a popular technique used in reliability analysis; it represents a set of random variables and their conditional dependencies. This paper discusses the advantages of Bayesian networks over fault tree in reliability and safety analysis. Also, it shows the ability of BN to update probabilities, to represent multi-state variables, dependent failures, and common cause failure. An example taken from the literature is used to illustrate the application and compare the results of both fault tree and bayesian networks techniques.

Most of the functions of civil aircraft are achieved through software at present. Therefore, the safety of airborne software has become an important part of safety analysis. However, to achieve complex functions, the onboard software becomes very complicated, and it is usually difficult to guarantee safety. ARP4761(Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment) is an important safety assessment guideline for civil aircraft, but it believes that software development can satisfy safety as long as the software development process complies with the software development standards, instead of incorporating the software into the safety analysis process. To improve airborne software safety, this paper proposes a safety analysis method based on the ARP4761 process which is tailored to adapt to the software. In the software requirements and design, the method uses FHA(Functional Hazard Assessment) to analyze the hazards of the software and define the hazard levels, then use FTA(Fault Tree Analysis) to build a software fault tree, and carry out CCA(Common Cause Analysis) analysis based on the fault tree; after the software development is completed, the method uses FMEA(Failure Modes and Effects Analysis) and FMES(Failure Modes and Effects Summary) to summarize the failures of the software and return these failures to the fault tree to determine whether the software can meet the defined requirements. At the end of the article, an anti-icing software is used as an example to explain the process and effectiveness of the method.

In order to carry out a comprehensive design description of the specific architectural model of AI, the auxiliary model of AI and architectural spatial intelligence is deeply integrated, and flexible design is carried out according to the actual situation. AI assists in the generation of architectural intention and architectural form, mainly supporting academic and working theoretical models, promoting technological innovation, and thus improving the design efficiency of the architectural design industry. AI-aided architectural design enables every designer to achieve design freedom. At the same time, with the help of AI, architectural design can complete the corresponding work faster and more efficiently. With the help of AI technology, through the adjustment and optimization of keywords, AI automatically generates a batch of architectural space design schemes. Against this background, the auxiliary model of architectural space design is established through the literature research of the AI model, the architectural space intelligent auxiliary model, and the semantic network and the internal structure analysis of architectural space. Secondly, to ensure compliance with the three-dimensional characteristics of the architectural space from the data source, based on the analysis of the overall function and structure of space design, the intelligent design of the architectural space auxiliary by Deep Learning is carried out. Finally, it takes the 3D model selected in the UrbanScene3D data set as the research object, and the auxiliary performance of AI’s architectural space intelligent model is tested. The research results show that with the increasing number of network nodes, the model fitting degree on the test data set and training data set is decreasing. The fitting curve of the comprehensive model shows that the intelligent design scheme of architectural space based on AI is superior to the traditional architectural design scheme. As the number of nodes in the network connection layer increases, the intelligent score of space temperature and humidity will continue to rise. The model can achieve the optimal intelligent auxiliary effect of architectural space. The research has practical application value for promoting the intelligent and digital transformation of architectural space design.

The growing size and complexity of software in embedded systems poses new challenges to the safety assessment of embedded control systems. In industrial practice, the control software is mostly treated as a black box during the system's safety analysis. The appropriate representation of the failure propagation of the software is a pressing need in order to increase the accuracy of safety analyses. However, it also increase the effort for creating and maintaining the safety analysis models (such as fault trees) significantly. In this work, we present a method to automatically generate Component Fault Trees from Continuous Function Charts. This method aims at generating the failure propagation model of the detailed software specification. Hence, control software can be included into safety analyses without additional manual effort required to construct the safety analysis models of the software. Moreover, safety analyses created during early system specification phases can be verified by comparing it with the automatically generated one in the detailed specification phased.

Architecture description languages such as AADL allow systems engineers to specify the structure of system architectures and perform several analyses over them, including schedulability, resource analysis, and information flow. In addition, they permit system-level requirements to be specified and analyzed early in the development process of airborne and ground-based systems. These tools can also be used to perform safety analysis based on the system architecture and initial functional decomposition.

Software Architecture plays an essential role in the high level description of a system design. Despite its importance in the software engineering practice, the lack of formal description and verification support hinders the development of quality architectural models. In this paper, we present an automated approach to the modeling and verification of software architecture designs using the Process Analysis Toolkit (PAT). We present the formal syntax of the Wright# architecture description language together with its operational semantics in Labeled Transition System (LTS). A dedicated model checking module for Wright# is implemented in the PAT verification framework based on the proposed formalism. The module - ADL supports verification and simulation of software architecture models in PAT. We advance our work via defining an architecture style library that embodies commonly used architecture patterns to facilitate the modeling process. Finally, a case study of the Teleservices and Remote Medical Care System (TRMCS) modeling and verification is presented to evaluate the effectiveness and scalability of our approach.

Currently a new tunnel tube crossing the river Elbe is built in Hamburg. Therefore a new height control system is required. A computer examines the signals from light barriers and overhead sensors to detect vehicles, which try to drive into a tube with insufficient height. If necessary, it raises an alarm that blocks the road.This paper describes the application of two safety analysis techniques on this embedded system: model checking has been used to prove functional correctness with respect to a formal model. Fault tree analysis has validated the model and considered technical defects. Their combination has uncovered a safety flaw, led to a precise requirement specification for the software, and showed various ways to improve system safety.

Based on an analysis of the existing problems in packaging safety of railway dangerous goods transportation, the authors divided the potential source of packaging failure accidents into three categories: the unsafe behavior of people, unsafe state of matter, and deficient management. Qualitative analysis based on hazard identification and fault tree analysis are discussed for the sake of a more comprehensive discovery of crucial dangerous factors. Finally, some improvement measures are put forward to increase the packaging safety of railway dangerous goods transportation.