Improving System Reliability via Model Checking: The FSAP/NuSMV-SA Safety Analysis Platform

Software Product Line Engineering (SPLE) has been proven to reduce development and maintenance costs, improving the time-to-market, and increasing the quality of product variants developed from a product family via systematic reuse of its core assets. SPLE has been successfully used in the development of safety-critical systems, especially in automotive and aerospace domains. Safety-critical systems have to be developed according to safety standards, which demands safety analysis, Fault Tree Analysis (FTA), and assurance cases safety engineering artefacts. However, performing safety analysis, FTA, and assurance case construction activities from scratch and manually for each product variant is time-consuming and error-prone, whereas variability in safety engineering artefacts can be automatically managed with the support of variant management techniques. As safety is context-dependent, context and design variation directly impact in the safety properties changing hazards, their causes, the risks posed by these hazards to system safety, risk mitigation measures, and FTA results. Therefore, managing variability in safety artefacts from different levels of abstraction increases the complexity of the variability model, even with the support of variant management techniques. To achieve an effective balance between benefits and complexity in adopting an SPLE approach for safety-critical systems it is necessary to distinguish between reusable safety artefacts, whose variability should be managed, and those that should be generated from the reused safety artefacts. On the other hand, both industry and safety standards have recognized the use of model-based techniques to support safety analysis and assurance cases. Compositional safety analysis, design optimization, and model-based assurance cases are examples of techniques that have been used to support the generation of safety artefacts required to achieve safety certification. This thesis aims to propose a model-based approach that integrates modelbased development, compositional safety analysis, and variant management techniques to support the systematic reuse and generation of safety artefacts in safety-critical software product line engineering. The approach contributes to reduce the effort and costs of performing safety analysis and assessment for a particular product variant, since such analysis is performed from the reused safety artefacts. Thus, variant-specific fault trees, Failure Modes and Effects Analysis (FMEA), and assurance case artefacts required to achieve safety certification can be automatically generated with the support the model-based safety analysis and assurance case construction techniques.

Brake is a safety critical system for railway vehicles and brake failures have caused many catastrophic accidents in the history. Detailed accident investigation reports are available and National Transportation Safety Board (NTSB) also makes safety recommendations to Federal Railroad Administration and the industry. However, there is limited research on how to improve the brake safety from the perspective of design, system integration and safety analysis. In this paper, a framework for braking safety design and analysis is introduced, which includes four parts: failure alarming system, safety design, safety analysis and preventative maintenance. For failure alarming, according to the severity level, the failures will be notified to the operator, to Operation Control Center (OCC) or saved for the maintainer. For safety design, redundant design for fail-safe feature, automatic braking, brake release, weight control, ergonomics design for easy operation and maintenance are discussed and several application examples are illustrated. In the safety analysis section, Preliminary Hazard Analysis (PHA) as a semi-quantitative analysis, Failure Modes, Effects, and Criticality Analysis (FMECA) as a bottom-up method and Fault Tree Analysis as a top-down method are used. The hazards details, system assurance actions and closure references are recorded in the Hazard Tracking Log (HTL) to ensure all the safety related items are well tracked and documented. Preventative Maintenance (PM) which is regularly performed on the brake components to lessen the likelihood of failing is also discussed in combination with the reliability prediction and safety analysis for a balance of safety and economy. The safety design framework and principles introduced in this paper can also be applied into other railway systems, such as Propulsion, Signaling, Doors, etc. and may provide insights to similar industries such as automotive, energy and so on.

Safety analysis is a key activity for the development of railway transportation systems. The analysis is used not only to determine whether new systems do not expose the general public to unduly high levels of risks, but also to inform the development process itself through identification and allocation of appropriate requirements. Whilst inadequate and inaccurate safety analysis may have potentially catastrophic consequences, it is rarely validated in practice. This paper presents a case for validation of safety analysis of the railway systems along with a technical approach to such validation. The approach is based on the concept of Failure Injection and the Lightweight Refinement relation. The paper further argues that the safety analysis validation should be embedded in a wider uncertainty management framework and shows how this can be made consistent with the spirit of the existing safety standards of the railway domain.

Software for safety-critical systems must deal with the hazards identified by safety analysis in order to make the system safe. Building a safety-critical software requires special procedures to be used in all phases of the software development process. In this work, we have dealt with safety analysis techniques such as failure modes and effects analysis (FMEA) and fault tree analysis (FTA)-based safety-critical approach towards to development of an integrated automotive safety critical system from a safety perspective. A proposal of software safety architecture and software safety lifecycle has developed here using some important safety techniques. A new software development lifecycle with an integration approach, i.e., Agile-V model is proposed. Driver assistance system like ACCS is a safety critical system which is helpful to prevent accidents by reducing the workload on the driver. The basic design and functionality of ACCS is done with the safety command of bypassing to braking system when needed. As a safety approach for some limitations we have introduced an integrated architecture using fuzzy logic which has less failure cases and improves efficiency. The basic design and functionality of braking system is done with ABS and without ABS so that stopping distance also decreases.

Software for safety-critical systems must deal with the hazards identified by safety analysis in order to make the system safe. Building a safety-critical software requires special procedures to be used in all phases of the software development process. In this work, we have dealt with safety analysis techniques such as failure modes and effects analysis (FMEA) and fault tree analysis (FTA)-based safety-critical approach towards to development of an integrated automotive safety critical system from a safety perspective. A proposal of software safety architecture and software safety lifecycle has developed here using some important safety techniques. A new software development lifecycle with an integration approach, i.e., Agile-V model is proposed. Driver assistance system like ACCS is a safety critical system which is helpful to prevent accidents by reducing the workload on the driver. The basic design and functionality of ACCS is done with the safety command of bypassing to braking system when needed. As a safety approach for some limitations we have introduced an integrated architecture using fuzzy logic which has less failure cases and improves efficiency. The basic design and functionality of braking system is done with ABS and without ABS so that stopping distance also decreases.

A systematic co-engineering of safety and security analysis in requirements engineering process

Automatic safety analysis of control systems

In the first part of the article is a methodology for implementing a model-driven safety analysis of dynamical technology systems. The safety analysis is performed in the development of control system, mainly aiming at critical processes of system operation. I divided my methodology into five steps. These steps of the methodology was carried out in a hierarchical sequence. The objective of the second part of the article is to demonstrate the principle of the SQMD method concept for performing safety analysis on the example of a dynamical system. By SQMD method will be developed a models of safety-critical processes by which they will be carried out on-line monitoring. The method combining qualitative and quantitative procedures of modelling and taking both methods advantages.

Software and System Product Lines (SSPL) are the state-of-the-art for systematically reusing a common set of core assets in the development of similar products in a product family. A large number of SSPL success stories have been published in the last decade and commercial tool support is also available. SSPLs promise to reduce cost, to shorten time-to-market for new features, and to increase product quality by systematically reusing core assets in the development of three or more systems. However, an open challenge is SSPL engineering for safety-relevant systems such as automotive, avionic, or industrial automation systems. Safety-relevant systems have to be developed, analyzed, and certified according to safety standards such as IEC 61508. These standards demand the application of safety analyses such as Fault Tree Analysis and Failure Mode and Effect Analysis. Starting the safety analysis of each product variant of a SSPL from scratch is complex and very time-consuming. However, there are only few convincing cases, where SSPL approaches have been followed in safety engineering. To pave the way for a broader adoption of SSPL approaches, this paper reports practical experiences with industrial-strength methods and tools along an adaptive cruise control SSPL. The paper demonstrates how commercial tools can be used (i) to analyze safety-related aspects already in the architectural design, (ii) to model the results as component integrated component fault trees (C2FT), and (iii) to systematically reuse C2FT in the safety analysis of a concrete product. The results of the case study show that C2FT (i) can be easily integrated into a feature-oriented development process of SSPL, (ii) facilitate early consideration of safety in domain engineering, and (iii) reduce effort and complexity of safety analyses in application engineering.

This chapter on architecture design starts with a discussion on design in general. The designer must get a deep insight into all different aspects of the problem domain before she/he can design a proper structure for the application. In computer system design, the most important goal is controlling the complexity of the evolving artifact. A thorough analysis of the requirements and constraints limits the design space and avoids the investigation of unrealistic design alternatives. Any kind of structure restricts the design space and has a negative impact on the performance of a system, which must be carefully evaluated in real-time systems. The central step in the development of an architecture is concerned with the allocation of functions to nearly decomposable clusters of components. Components should have a high internal cohesion and simple external interfaces. In the following, different design styles such as model-based design and component-based design are discussed. The design of safety-critical systems starts with the safety analysis such as fault tree analysis and/or failure mode and effect analysis (FMEA) of the envisioned application, and the development of a convincing safety case. Different standards that must be observed in the design of safety-critical system are described, such as the IEC 61508 for electric and electronic equipment and the ARINC DO 178B standard for airborne equipment software. The elimination of all design errors, e.g., software errors or hardware errata of a large safety-critical system is a major challenge.KeywordsUnify Modeling LanguageEmbed SystemFault TreeWicked ProblemApplication Specific Integrate CircuitThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

The rapid increase in computer-related technologies puts greater demands on the software-controlled systems. These demands place the software in total control over safety-critical systems. A fault in such a Safety-Critical Computer Systems (SCCS) can result in catastrophic concerns such as loss of life, harm, or equipment damage. In order to detect and prevent such faults, some safety standards, safety analysis and fault-tolerant techniques have been developed. Still, it requires adequate methodologies and frameworks to complete verification of these SCCS. In this work, the software safety is considered into 3 parts: Safety Modeling, Safety Measurement and Safety Management, with assurance lying down to develop high quality software for SCCS. The proposed methodology is SM-Cube (Safety Modeling, Safety Measurement and Safety Management) which is the Safety-Critical Computer Systems concerned. SM-Cube provides a clarified differentiation for assessing and evaluating the safety embedded into the software. SM-Cube consists of required processes and operations for developing SCCS free of faults. This proposed SM-cube has been applied to safety-critical software based Railroad Crossing Control System (RCCS) which is a laboratory prototype. The outcomes of the prototype confirmed that all critical operations have been safe and risk free. The development of the software based on the proposed SM-cube for RCCS have shown a simplified and improved safety-critical operations of the overall system performance

As the complexity of the safety-critical system grows, the difficulty for safety engineers to validate and ensure system safety increases too. Formal languages have been introduced as an alternative to natural language (NL) requirement descriptions. Sometimes, the safety requirements are put forward in natural language such as requirements from stakeholders and nonexperts. The transformation and verification work of the requirements are completed manually. A tool called DODT can semi-automatically transforms NL requirements into semi-formal boilerplate requirements which reduce the manual work of transformation largely. Alloy is a formal modeling language which is amenable to automatic analyses. We use it as a tool to make safety analysis taking benefit from the model-based aspect of Alloy and its expressiveness for the specification of the properties to check. In this paper, we combine DDOT with Alloy. The attributes we use in boilerplates can be transformed into Alloy sentences easily. Hence, the formal requirements can be expressed in Alloy easily and checked by Alloy Analyzer, reducing manual work largely. Last, we illustrate our method with a fire detection system.

Communication channels in safety analysis: An industrial exploratory case study

A Comprehensive Safety Engineering Approach for Software-Intensive Systems Based on STPA

Various well-established techniques exist for functional safety analysis of safety-critical avionics systems. Most of these techniques are based on informal models and due to this, analysis is often subjective and success is dependent on the skill of the practitioner. Various standards like DO-178B, IEC 61508 etc. that provide guidelines to perform safety analysis also propose formal verification methods as one of the techniques for functional safety analysis. This technique is based on formal models of the system under development and can be applied on requirements, design and code to get assurance of the respective artifact satisfying a wide variety of functional requirements. In this paper, we present a case study of applying formal verification methods for doing safety analysis of requirements of a generic aircraft flight control system. Flight control system is broadly specified in two parts: mode transition logic part specifies which mode the system is in and represents the function performed by the flight control system. In each mode, certain control laws are executed to implement the various flight control functions. We used a particular technique in formal verification namely that of model checking for analysis. The mode transition logic of a generic auto pilot was modeled and verified using three different open source model checking tools-SPIN, NuSMV and SAL.