New Methodology for Model-Based Safety Analysis

With the increase of military and civil aircraft system complexity, the shortage of traditional safety analysis technology goes distinctly, while the Model-based Safety Analysis technology attaches more and more importance. Therefore, this paper presents the background, basic concept and research and application situation of Model-based Safety Analysis technology, identifies the benefit of it. This paper also presents a framework of taking Model-based Safety Analysis into airplane safety assessment process, and a case study of performing MBSA in powerplant system is given to shown the effect of MBSA. Finally, this paper analyses the shortage and challenge of Model-based Safety Analysis considering its application in aircraft safety assessment process.

The complexity of safety-critical E/E-systems within the automotive domain are continuously increasing. At the same time, functional safety standards such as the ISO 26262 prescribe analysis methods like the Fault Tree Analysis (FTA) and Failure Mode and Effects Analysis (FMEA). Currently, these analysis methods are mainly performed manually and are often not consistent with an evolving system model. To tackle these challenges, we present our semi-automatic safety analysis and optimization (SASAO) process. The SASAO process extends model-based safety analysis (MBSA) approaches, which require a system model extended with component-internal error propagation information. By extracting necessary artifacts from such an extended system model, we show how safety experts can be supported when performing FTA and design FMEA that are consistent with the model. The resulting FTA and design FMEA represent mandatory arguments in the system's safety case. Furthermore, we propose a method to optimize the cost of the system with respect to the required safety level automatically.

Safety issues in hybrid systems increasingly result from a combination of multiple categories of hazard factors. However, current hazard analysis methods mainly focus on just one kind of system hazard. This paper presents a model-based safety analysis method for hybrid system that is based on multiple hazard factor categories. Using a Model-Based Safety Analysis framework, the functional model of a hybrid system is first established. Its logic component is modeled using a state diagram and its continuous component is modeled using a transfer function or a state equation. The safety model of the system is then constructed considering a variety of hazard factors. Improper control and logic inconsistency are established for the logic component. Component deviation and logic inconsistency are established for the continuous component. Finally, the safety of the system is then analyzed and the hazard paths are obtained. As an example, the Wheel Brake System for an aircraft is taken to analyze the safety of the aircraft landing phase. By taking into account multiple hazard factor categories, we are able to identify hazard paths that could not be found using a single hazard factor category.

To handle stricter safety regulations combined with increasing complexity and shorter development cycles, it is necessary to consider safety aspects starting from the early phases of design. This paper presents an approach to link methods of safety analysis and modeling (SysML). Even though SysML and MBSE are common in the early stages of system design, there is a lack of methods integrating model-based design activities and safety analyses. Existing approaches either focus on particular tasks or build models after conducting separate safety analyses. Our presented approach, tailored to early stages of system design, introduces a "Hazard Analysis" SysML profile accompanied by a procedure for its application within a model-based safety analysis. It provides a preliminary hazard analysis and facilitates the systematic identification of safety-critical functions and components.

SUMMARY & CONCLUSIONSMost, if not all, safety-critical systems developed are cyber-physical systems (CPS), defined by the presence of a physical component and connectedness to other systems, with a clear trend towards inclusion of over-the-air update capabilities. From a certification standpoint, every change to the system, even in software, should lead to an evaluation of its safety impact. Model-based system engineering offers the possibility of connecting domain-specific models used in the development of the CPS with relevant safety analysis models. The goal is to automate the evaluation of the impact of changes. Changes, however, can only be propagated if the dependencies of the specific model in which the change is introduced are accurately represented. These are difficult to model, as formal descriptions only exist for a subset of dependencies, and some have been completely neglected in model-based systems engineering. Our work provides an overview of the various shapes that dependencies take within model-based safety analysis. The importance of modeling these dependencies is shown in an illustrative example, in which an FMEA, SysML, and Lifecycle model are investigated.

The effective reuse of design assets in safety-critical Software Product Lines (SPL) would require the reuse of safety analyses of those assets in the variant contexts of certification of products derived from the SPL. This in turn requires the traceability of SPL variation across design, including variation in safety analysis and safety cases. In this paper, we propose a method and tool to support the automatic generation of modular SPL safety case architectures from the information provided by SPL feature modeling and model-based safety analysis. The Goal Structuring Notation (GSN) safety case modeling notation and its modular extensions supported by the D-Case Editor were used to implement the method in an automated tool support. The tool was used to generate a modular safety case for an automotive Hybrid Braking System SPL.

Topology-based Safety Analysis for Safety Critical CPS

Unmanned Aerial Systems (UAS, a.k.a., drones) are a compelling technology with numerous possibilities for highly productive new airspace operations. Safety of operators and bystanders is of paramount concern, and a common, accepted, safety methodology is a pressing need to enable widespread adoption of UAS. This paper provides a methodology for safety analyses that can be conducted for multiple applications using common models and a suggested standardized architecture for small UAS. To date, in the US, safety analyses have been done on an individualized, custom basis, mainly in support of waivers for specific, limited UAS operations. For example, safety analyses have been conducted in the Federal Aviation Administration's (FAA) Pathfinder Program for use of drones in three focus areas: beyond visual line of sight for infrastructure inspections, extended visual line of sight in rural areas, and flight over people. In addition, approximately 400 waivers have been granted for multiple individual applicants [1]. The waiver process is highly specific to an individual applicant's operation and a special safety analysis must be conducted for each waiver request. This is an inefficient use of resources for both the FAA and industry. It would be more efficient if a common model for UAS safety analysis could be employed that was adaptable to varied applications. An important subclass of UAS operations which currently requires waivers are operations termed Beyond Visual Line of Sight (BVLOS). BVLOS operations allow for UAS flight operations which are out of the visual line of sight of the UAS operator. BVLOS will allow multiple economically beneficial applications, for example, infrastructure inspection and agriculture. Our approach seeks to begin providing an adaptable framework for analyses, focusing on Beyond Visual Line of Sight operations, that allows rapid assurance of operational safety. The benefits of this approach are twofold: first, in the near term, the workload involved in applying for waivers, both for the FAA and for applicants, would be significantly reduced, and second, the approach can be used to inform industry standards on key system requirements. This would give industry an important start in the development of common standards for equipment requirements, as is typically done in standards bodies such as RTCA. To provide a UAS reference model, a common small UAS architecture is proposed to conduct analyses across UAS platforms and operations. The architecture enables the safety model's inputs to be adapted to target UAS platforms and operational scenarios. This approach allows for large scale simulations that can analyze the impact of various vehicle performance configurations in differing operational scenarios. This paper also provides a fault-tree analysis model that is customizable to specific operations, and shows some initial results that help provide insights into tradeoffs and potential requirements. The paper explores these tradeoffs in the context of previous analysis conducted by Patterson et al. [2] which identifies a top-level requirement for “Loss of Controlled Flight for any Reason.” The fault-tree analysis helps to identify the various root causes (basic events) of the model's system failure condition (top event) — loss of controlled flight of the UAS vehicle. The attractiveness of the model is that it is easily adaptable to different operations, safety guidelines, reliability requirements, equipment standards, etc. The paper demonstrates a sensitivity analysis to assess the varying impact of the basic events on system failure at different error levels. The fault-tree model and sensitivity analysis results, along with the accompanying common architecture, together provide a flexible approach to UAS safety analyses.

Model-based safety design and analysis uses high-fidelity models of processes and process equipment to provide accurate information for decision support in design and risk assessment of safety systems. This helps operating companies and EPCs to minimize capital expenditure while managing risk based on reliable and auditable quantification. It also provides the means to investigate many different failure scenarios within a relatively short timeframe. Until now much safety design and analysis has been done using steady-state or "pseudo-dynamic" trial-and-error modeling, looking at units in isolation, using off-the-shelf models that did not capture process complexity, or attempting to "bend" flowsheeting packages into doing something they were not designed for. It goes without saying that the models used for safety design and analysis need to be of the highest quality: It is essential that models have a high degree of predictive accuracy. This requires first-principles models with rigorous physical properties.

Verification of safety requirements is one important task during the development of safety critical systems. The increasing complexity of systems makes manual analysis almost impossible. This paper introduces a new methodology for formal verification of technical systems with smartIflow (State Machines for Automation of Reliability-related Tasks using Information FLOWs). smartIflow is a new modeling language that has been especially designed for the purpose of automating the safety analysis process in early product life cycle stages. It builds up on experience with existing approaches. As is common practice in current approaches, components are modeled as finite state machines. However, new concepts are introduced to describe component interactions. Events play a major role for internal interactions between components as well as for external (user) interactions. Our approach to the verification of formally specified safety requirements is a two-step method. First, an exhaustive simulation creates knowledge about a great variety of possible behaviors of the system, especially including reactions on suddenly occurring (possibly intermittent) faults. In the second step, safety requirements specified in CTL (Computation Tree Logic) are verified using model checking techniques, and counterexamples are generated if these are not satisfied. The practical applicability of this approach is demonstrated based on a Java implementation using a simple Two-Tank-Pump-Consumer system.

Utilization of Constraint Satisfaction Problem Algorithms in Model-Based Safety Analysis [MBSA

Software Product Line Engineering (SPLE) has been proven to reduce development and maintenance costs, improving the time-to-market, and increasing the quality of product variants developed from a product family via systematic reuse of its core assets. SPLE has been successfully used in the development of safety-critical systems, especially in automotive and aerospace domains. Safety-critical systems have to be developed according to safety standards, which demands safety analysis, Fault Tree Analysis (FTA), and assurance cases safety engineering artefacts. However, performing safety analysis, FTA, and assurance case construction activities from scratch and manually for each product variant is time-consuming and error-prone, whereas variability in safety engineering artefacts can be automatically managed with the support of variant management techniques. As safety is context-dependent, context and design variation directly impact in the safety properties changing hazards, their causes, the risks posed by these hazards to system safety, risk mitigation measures, and FTA results. Therefore, managing variability in safety artefacts from different levels of abstraction increases the complexity of the variability model, even with the support of variant management techniques. To achieve an effective balance between benefits and complexity in adopting an SPLE approach for safety-critical systems it is necessary to distinguish between reusable safety artefacts, whose variability should be managed, and those that should be generated from the reused safety artefacts. On the other hand, both industry and safety standards have recognized the use of model-based techniques to support safety analysis and assurance cases. Compositional safety analysis, design optimization, and model-based assurance cases are examples of techniques that have been used to support the generation of safety artefacts required to achieve safety certification. This thesis aims to propose a model-based approach that integrates modelbased development, compositional safety analysis, and variant management techniques to support the systematic reuse and generation of safety artefacts in safety-critical software product line engineering. The approach contributes to reduce the effort and costs of performing safety analysis and assessment for a particular product variant, since such analysis is performed from the reused safety artefacts. Thus, variant-specific fault trees, Failure Modes and Effects Analysis (FMEA), and assurance case artefacts required to achieve safety certification can be automatically generated with the support the model-based safety analysis and assurance case construction techniques.

As the scale and complexity of the system tend to be increasing, model-based safety assessment (MBSA) has gradually become a research hotspot in system modeling and analysis. This paper independently designs and implements a model-based system safety analysis tool, and carries out a case study with landing gear system (LGS) as an example, including system hierarchy modeling, component interaction modeling and fault behavior modeling for LGS using AltaRica 3.0, as well as system simulation analysis and fault tree analysis for LGS on the platform. Finally, it is proved that the effectiveness of the tool and the accuracy of modeling and system safety analysis using AltaRica 3.0.KeywordsModel-based safety assessmentLanding gear systemAltaRica 3.0Safety analysis

Component Fault Trees (CFTs) were invented in 2003 as a compositional extension to fault trees to better reflect the technical architecture of a system in its safety analysis model. Since then, a lot of research has been contributed regarding semantic extensions, evaluation techniques, and tighter linking between system and safety models. This paper addresses three main objectives. First, we summarize the most important contributions and shape a vision of better integrated system modeling and safety analysis. Second, we push forward standardization and sketch a new evaluation scheme for quantitative analysis using mdd. Lastly, an outlook on future improvement ideas is given to make CFTs a viable technique for loosely coupled systems and Cyber-Physical Systems.

Failures in cyber-physical systems, such as trains and cars, are caused either by faults or attacks. The former are addressed by safety engineering, the latter by security analysis. Both disciplines use separate terminology, processes, and tools. However, both rely on a common system architecture and use models such as component fault trees and attack trees, respectively, for their analyses. We posit that the two disciplines should be aligned without entangling their processes or teams, mutually supporting their considerations. For that purpose, assuming a joint system model, we introduce tool support that heuristically suggests correspondences between analysis elements of the two disciplines and, upon user confirmation, derives additional suggestions for analysis. Our tool allows both disciplines to benefit from the analyses of the other, increasing consistency, exhaustiveness, and alignment of the disciplines. Our paper introduces the approach, describes our prototypical tool, and illustrates the concept with a realistic automotive use case.