Fault tree analysis for software design

Software plays an increasing role in the safety critical systems. Increasing the quality and reliability of the software has become the major objective of software development industry. Researchers and industry practitioners, look for innovative techniques and methodologies that could be used to increase their confidence in the software reliability. Fault tree analysis (FTA) is one method under study at the Software Assurance Technology Center (SATC) of NASA's Goddard Space Flight Center to determine its relevance to increasing the quality and the reliability of software. This paper briefly reviews some of the previous research in the area of software fault tree analysis (SFTA). Next we discuss a roadmap for application of the SFTA to software, with special emphasis on object-oriented design. This is followed by a brief discussion of the paradigm for transforming a software design artifact (i.e., sequence diagram) to its corresponding software fault tree. Finally, we discuss challenges, advantages and disadvantages of SFTA.

Quantitative evaluation of safety critical software testability based on fault tree analysis and entropy

Software integrity is of prime concern in today's computerized world. Software failure makes the development of fault tolerant software system, a matter of concern. Failure Modes and Effects Analysis (FMEA) and Fault Tree Analysis (FTA) are traditional techniques that have been used to improve the reliability of mechanical systems. In this paper we propose a formalized approach to find vulnerable failure modes of software systems by synthesizing use case specifications with integrated technique of Software FMEA and Software FTA. We demonstrate the applicability of the approach further, using a case study.

This paper describes how software is in the heart of many safety critical systems in the railway sector. The development of systems that include software modules requires a correct evaluation of software Reliability, Availability, Maintainability and Safety (RAMS) to get a correct value of the overall system RAMS. In order to obtain appropriate software, the standards propose to perform a set of activities in the different phases of software development as well as tasks to control their correct accomplishment. They ensure the developed software is of adequate quality. However, it is necessary to go further and try to obtain a quantitative measure of RAMS for each software module as is usually done in hardware development. There are several techniques for the assurance of software reliability and safety that have been in use for years and must be analyzed to know their real potential: reliability growth models, artificial intelligence techniques, Markov chains, Software Fault Tree Analysis and Software Failure Mode and Effect Analysis among others. Two circumstances emphasize the strategic time the railway sector is living and the opportunity to adopt the most promising software techniques improve reliability and safety: (1) The development of high-performance railway networks that interconnect different countries and the liberalization and opening of the national markets demand new European global agreements. In this regard, the European Railway Agency has asked its Safety Unit to develop the new Common Safety Methods (CSM) and Common Safety Targets (CST) to be used in all European countries; (2) The IEC 61508-3 standard (from which some parts of CENELEC 50128 are derived) is now under revision, with the primary aim of ensuring the safety of the developed software by hardening the requirements and promoting the use of the most promising techniques.

Software is at the heart of many safety critical systems in the railway sector. The development of systems that include software modules requires the correct evaluation of software RAMS (Reliability, Availability, Maintainability and Safety) in order to obtain the correct value of the overall system RAMS. In order to obtain appropriate software, the standards propose the performance of a set of activities in the different phases of software development, as well as tasks to control their correct accomplishment. They ensure the developed software is of adequate quality. However, it is necessary to go further and try to obtain a quantitative measure of RAMS for each software module as is usually done in hardware development. There are several techniques for the assurance of software reliability and safety that have been in use for years and must be analysed to find their real potential. These techniques are: reliability growth models, artificial intelligence techniques, Markov chains, Software Fault Tree Analysis and Software Failure Mode and Effect Analysis, among others. This paper is an update of the previous one presented at the COMPRAIL XI Conference. Two circumstances emphasize the strategic time the railway sector is undergoing and the opportunity to adopt the most promising software techniques in order to improve reliability and safety. (1) The development of high-performance railway networks that interconnect different countries and the liberalization and opening of the national markets demand new European global agreements. In this regard, the European Railway Agency has asked its Safety Unit to develop the new Common Safety Methods (CSM) and Common Safety Targets (CST) to be used in all European countries. (2) The IEC 61508 standard (from which some parts of CENELEC EN 50128 are derived) is now under Advanced Train Control Systems 91 www.witpress.com, ISSN 1755-8336 (on-line) WIT Transactions on State of the Art in Science and Engineering, Vol 46, © 2010 WIT Press doi:10.2495/978-1-84564/ 494 9 11 revision, with the primary aim of ensuring the safety of the developed software by hardening the requirements and promoting the use of the most promising techniques. Moreover, the CENELEC EN 50128 standard is also under revision.

This paper considers the problems of assessing software reliability when the reliability requirements are high. A number of possible approaches to the problem are discussed and evaluated. These include correctness proofs, software fault tree analysis, software testing, and assessment of the development process. The need for and value of software fault tolerance are also discussed.

As accidents frequently occurred in aerospace applications, traditional reliability analysis methods are not enough for modern flight control software. To find a comprehensive, effective and intelligent method for software fault diagnosis is urgent for airborne software engineering. Consequently, in this paper, a novel knowledge-based diagnosis system is constructed for flight control software, by combining the knowledge-based system with software fault tree analysis. The application of the method proves that the system is able to diagnose software fault, analysis the reasons and give some reasonable solutions like a human expert. Additionally, diagnosis effects and efficiency for flight control system could be improved by the method.

Tomorrow marks 5 years since the Curiosity rover’s dramatic landing on the red planet! The rover’s Sample Analysis at Mars (SAM) instrument suite onboard Curiosity is the most complicated instrument NASA has ever sent to another planet. SAM is designed to measure the composition of the atmosphere and solid samples inside Gale Crater on Mars, and help scientists assess the habitability (could a certain place support life?) of environments recorded in in rocks in Gale Crater. The SAM team has made many amazing discoveries, including finding evidence of a habitable environment – a place that life (think tiny microorganisms, not dinosaurs) could have survived if it had been in that spot on Mars, millions of years ago. SAM also detected the first organics (building blocks of life) on Mars, known to have originated on this planet. We’re a group of scientists and engineers from the SAM team, ready to answer your questions about Mars and SAM. We’ll be online from 1:00 to 2:00 pm EST and we will sign our answers. Ask us anything! Paul Mahaffy, SAM Principle Investigator, Director of Solar System Exploration Division, NASA Goddard Space Flight Center Charles Malespin, SAM Deputy Principle Investigator, NASA Goddard Space Flight Center Jen Stern, Planetary Scientist, NASA Goddard Space Flight Center James Lewis, Postdoctoral Fellow, NASA Goddard Space Flight Center Brad Sutter, Planetary Scientist, NASA Johnson Space Flight Center Greg Flesch, Instrument Engineer, NASA Jet Propulsion Laboratory Peter Martin, PhD student, CalTech/NASA Jet Propulsion Laboratory Doug Archer, Planetary Scientist/NASA Johnson Space Center We have now been on Mars for 5 years - WOW. The first year after landing we actually played the Happy Birthday song using our SSIT (solid sample inlet tube). You may find this link interesting https://www.youtube.com/watch?v=uxVVgBAosqg EDIT It has been great answering your questions, we are signing off now!

Software and System Product Lines (SSPL) are the state-of-the-art for systematically reusing a common set of core assets in the development of similar products in a product family. A large number of SSPL success stories have been published in the last decade and commercial tool support is also available. SSPLs promise to reduce cost, to shorten time-to-market for new features, and to increase product quality by systematically reusing core assets in the development of three or more systems. However, an open challenge is SSPL engineering for safety-relevant systems such as automotive, avionic, or industrial automation systems. Safety-relevant systems have to be developed, analyzed, and certified according to safety standards such as IEC 61508. These standards demand the application of safety analyses such as Fault Tree Analysis and Failure Mode and Effect Analysis. Starting the safety analysis of each product variant of a SSPL from scratch is complex and very time-consuming. However, there are only few convincing cases, where SSPL approaches have been followed in safety engineering. To pave the way for a broader adoption of SSPL approaches, this paper reports practical experiences with industrial-strength methods and tools along an adaptive cruise control SSPL. The paper demonstrates how commercial tools can be used (i) to analyze safety-related aspects already in the architectural design, (ii) to model the results as component integrated component fault trees (C2FT), and (iii) to systematically reuse C2FT in the safety analysis of a concrete product. The results of the case study show that C2FT (i) can be easily integrated into a feature-oriented development process of SSPL, (ii) facilitate early consideration of safety in domain engineering, and (iii) reduce effort and complexity of safety analyses in application engineering.

Most of the functions of civil aircraft are achieved through software at present. Therefore, the safety of airborne software has become an important part of safety analysis. However, to achieve complex functions, the onboard software becomes very complicated, and it is usually difficult to guarantee safety. ARP4761(Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment) is an important safety assessment guideline for civil aircraft, but it believes that software development can satisfy safety as long as the software development process complies with the software development standards, instead of incorporating the software into the safety analysis process. To improve airborne software safety, this paper proposes a safety analysis method based on the ARP4761 process which is tailored to adapt to the software. In the software requirements and design, the method uses FHA(Functional Hazard Assessment) to analyze the hazards of the software and define the hazard levels, then use FTA(Fault Tree Analysis) to build a software fault tree, and carry out CCA(Common Cause Analysis) analysis based on the fault tree; after the software development is completed, the method uses FMEA(Failure Modes and Effects Analysis) and FMES(Failure Modes and Effects Summary) to summarize the failures of the software and return these failures to the fault tree to determine whether the software can meet the defined requirements. At the end of the article, an anti-icing software is used as an example to explain the process and effectiveness of the method.

A software production model is developed that integrates process and product and is designed to identify bottlenecks in the production process. Choke points can occur either from process deficiencies or failure to identify and correct extant software defects. NASA Goddard Space Flight Center satellite defect data is used in the analysis because the primary aim is to apply the model to safety critical software. The model applies feedback control to correct anomalies in process and product that may occur. Both predictions and actual defect data are used to identify process and product behavior that do not meet expectations. I. Introduction A CCORDING to, 1 software systems come and go through a series of passages that account for their inception, initial development, productive operation, upkeep, and retirement from one generation to another. We focus on the development and production phases and introduce something different in this research compared with articles about software development process that correctly relate the effectiveness of the process to the quality of the product. We go a step further and introduce the concept of the reliability of the process, both current and future. We perform this analysis by using software defect data from the NASA Goddard Space Flight Center satellite project known as JM1. These data are shown in Table 1. Our goal, recognizing the importance of integrating process and product, 2 is to identify production bottlenecks in the process that cause product delivery to be delayed. In addition, we identify deficiencies in the defect removal process that can lead to product unreliability and delivery schedule delay. The principal features of the production system are defined using process flow charts illustrated in Fig. 1 for a software production and quality control operation. The flow of software modules is from left to right. Each phase has a processing time measured in days and a defect rate. Our model assumes that defects introduced by a process step may pass through downstream steps undetected until an inspection is performed. 3

n/a

This thesis presents a new theory of fault trees for complex systems, and a method for their generation. The theory treats faults as behaviours, and fault-tree gates as operations on those behaviours. Fault tree analysis is an important and widely used technique for understanding the behaviour of safety-critical systems. The development of new technologies with more sophisticated interactions between components, and hence more complicated causal relationships between failure modes, has made traditional methods of fault tree synthesis difficult if not obsolete. Consequently, this thesis addresses a matter of ongoing concern in the safety analysis community. The thesis argues that it is feasible and effective to automate the generation of fault trees by describing systems using hierarchically structured models, with component interactions described in terms of behaviours. A detailed methodology for generating fault trees is presented. The methodology includes consideration of design faults, hardware failures, and operator errors. A prototype tool called Eucalypt is used to demonstrate the methodology on four realistic case studies. Eucalypt provides semi-automated support for system modelling and fault generation, and fully automatic fault tree synthesis.

Fault trees are a key technique in safety and reliability engineering. Their application includes aerospace, nuclear power, car, and process engineering industries. Various fault tree extensions exist that increase expressiveness while yielding succinct models. Their analysis is a main bottleneck: techniques do not scale and require manual effort. Formal methods have an enormous potential to solve these issues. We discuss a mixture of formal method techniques resulting in a fully automated and scalable approach to analyze Dugan’s dynamic fault trees.

Autonomic computing for spacecraft ground systems increases the system reliability and reduces the cost of spacecraft operations and software maintenance. In this paper, we present an autonomic computing solution for spacecraft ground systems at NASA Goddard Space Flight Center (GSFC), which consists of an open standard for the message oriented architecture referred to as GMSEC architecture, the GSFC Mission Services Evolution Center, and an autonomic computing tool, Criteria Action Table (CAT). This solution has been used in many upgraded ground systems for NASA's missions, and provides a framework for developing solutions with higher autonomic maturity.