CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims priority to PCT Application No. PCT/EP2019/085650, having a filing date of Dec. 17, 2019, which is based off of EP Application No. 18213525.1, having a filing date of Dec. 18, 2018, the entire contents both of which are hereby incorporated by reference.

FIELD OF TECHNOLOGY

The following pertains to a computer-implemented method for generating a mixed-layer fault tree of a multi-component system combining different layers of abstraction. The following further pertains to a device comprising a processor configured to perform such a method. The following particularly pertains to component fault trees.

BACKGROUND

The importance of safety-critical systems is continuously growing in many application domains of embedded systems, such as aerospace, railway, health care, automotive and industrial automation. Thus, along with growing system complexity, the need for safety assurance is increasing in order to guarantee high quality demands in these application domains.

The aim of safety assurance is to ensure that systems do not lead to hazardous situations, which may harm people or endanger the environment. In the application domains of safety-critical systems, safety assurance is defined by the means of standards, see, e.g., International Electrotechnical Commission (IEC) 61508, “Functional Safety of Electrical/Electronic/Programmable Electronic Safety-related Systems,” 1998.

Traditionally, the assessment of a system in terms of safety is based on a bottom-up safety analysis approach, such as Failure Mode and Effect Analysis (FMEA), see IEC 60812, “Analysis Techniques for System Reliability—Procedure for Failure Mode and Effects Analysis (FMEA),” 1991. Alternatively, the assessment of a system according to reference implementations is based on top-down approaches such as Fault Tree Analysis (FTA), see, e.g., Vesely et al., “Fault Tree Handbook,” US Nuclear Regulatory Commission, 1981. By such techniques, it is possible to identify system failure states, their causes and effects with impact on the system safety.

The decomposition of complex systems into manageable parts is an essential principle when dealing with complex technical systems. However, many safety and reliability modelling techniques do not support hierarchical decomposition in the desired way. FTA offers decomposition into modules, a breakdown with regard to the hierarchy of failure influences rather than to the system architecture. With component fault trees (CFT) a model- and component-based methodology for FTA is provided, which supports a modular and compositional safety analysis strategy, see, e.g., Kaiser et al., “A New Component Concept for Fault Trees,” Proceedings of the 8th Australian Workshop on Safety Critical Systems and Software, Volume 33, pp. 37-46, 2003, as well as Kaiser et al., “Advances in Component Fault Trees,” Safety and Reliability Safe Societies in a Changing World, Proceedings of ESREL 2018, pp. 815-823, Taylor & Francis (CRC Press), 2018.

In case of CFT, each technical component is represented by an extended fault tree. Besides internal basic failure events and gates (e.g., Boolean AND-gates, OR-gates and so on), each component can have input and output ports. By connecting these ports, components can be integrated into a higher-level system model. All components can be developed independently and stored in separate files or component libraries.

Mathematically, each CFT represents a logical function from its input ports and internal events to its output ports. Using such a methodology of components also within fault tree models offers benefits during the development in industrial practice, for example increased maintainability of the safety analysis model.

In industrial practice, fault trees are often built manually (based on the expert's knowledge) and typically comprise two parts: an upper part based on a functional decomposition of the system, and a lower part representing the technical failure behavior of the system, which may be realized as software and/or hardware.

However, there is no systematic approach to build such fault trees. Thus, in larger and more complex fault trees this mixture of different layers of abstraction may lead to confusion. Moreover, maintenance and evolution of such fault trees (e.g., due to modifications of the system specification) is cumbersome and error-prone.

Model-based approaches on the other hand, which automatically generate fault trees for complex systems, are based on system models, which, according to model-based system engineering approaches, solely represent either the logical/functional or the technical/physical system architecture.

SUMMARY

Against this background, an aspect relates to advanced techniques of analyzing safety-critical systems. In particular, a need exists for systematic approaches to generating fault trees, which can be easily extended, modified and/or reused during a system's life-cycle.

According to a first aspect of embodiments of the invention, a computer-implemented method for generating a mixed-layer fault tree of a multi-component system combining different layers of abstraction is provided. The multicomponent system comprises a logical-functional system layer and a physical system layer. The method comprises providing a logical-functional fault tree for the logical-functional system layer and a physical fault tree for the physical system layer. Each fault tree comprises at least one top failure event, wherein each top failure event in the logical-functional fault tree has a corresponding top failure event in the physical fault tree. Each fault tree further comprises elements associated with components of the multi-component system, wherein each element in the logical-functional fault tree has a corresponding element in the physical fault tree, wherein input failure ports and output failure ports existing in the elements of the logical-functional fault tree have corresponding input failure ports and output failure ports in the physical fault tree. Each fault tree further comprises external interconnections between the elements and the top failure events of each fault tree specifying failure propagation in the respective system layer. The method further comprises generating the mixed-layer fault tree by consecutively performing: adding the top failure events, the elements, including the respective input failure ports and the respective output failure ports, and the external interconnections of the logical-functional fault tree to the mixed-layer fault tree; interconnecting any input failure port within the elements of the mixed-layer fault tree with corresponding output failure ports within each respective element as defined in the logical-functional system layer; adding, for each element in the mixed-layer fault tree, any input failure port and output failure port additionally realized in the corresponding element of the physical fault tree; adding elements additionally realized in the physical fault tree to the mixed-layer fault tree, including respective input failure ports and respective output failure ports; adding external interconnections additionally realized in the physical fault tree to the mixed-layer fault tree; and adding any internal failure behavior from the elements in the physical fault tree not yet realized in the mixed-fault tree.

According to a second aspect of embodiments of the invention, a device is provided. The device comprises a processor configured to perform a method according to embodiments of the invention.

One idea of embodiments of the present invention is to offer a concept of generating (component) fault trees based on model-based failure propagation that employs component fault trees of both the logical/functional system architecture and the physical system architecture. The present approach eases the creation of fault trees being familiar to safety experts and assessors in a systematic way by creating comprehensive component fault trees, which can be easily extended or modified during the life-cycle of a system. Moreover, the creation of the fault trees can be (semi-)automated and parts of the fault trees can be reused.

To this end, embodiments of the present invention provide a mixed-layer fault tree of a multi-component system combining different layers of abstraction, namely a logical-functional system layer and a physical system layer. As a first step, a logical-functional fault tree is provided for the logical-functional system layer in the usual way known to the person of skill.

Next, a physical fault tree for the physical system layer is provided in a similar vein. Then, aspects of both trees are combined into the mixed-layer fault tree. Embodiments of the invention thus follows the common practice of model-based systems engineering, wherein the respective system is modeled on a logical/functional level and on a physical level of abstraction.

The logical/functional architecture of the system can be modeled by using any architecture description language (such as SysML, etc.). On basis of the functional architecture, a logical-functional (component) fault tree is specified to represent failure behavior of the systems' functions as well as the propagation of failures between the functions. The logical-functional fault tree comprises a fault tree element for each function within the logical architecture and one or several top failure events, representing the hazards of the system (as identified for example during a hazard and risk assessment).

External interconnections (possibly including the usual Boolean gates) between the elements and the top failure events specify failure propagation in the logical/functional system layer. Each such element may feature one or several output ports and/or input ports as it is known for CFT. Interconnections of the top failure events and the output ports of the fault tree elements using Boolean gates correspond to the decomposition of hazards to failures of individual functions.

Moreover, the interconnections of the input ports of the CFT elements with the output ports of other CFT elements specify the failure propagation within the functional/logical architecture of the system. Finally, each CFT element may comprise internal failure behavior connecting input/output failure ports within the elements in the usual way, i.e. Boolean gates, basic failure events and/or internal connections. The internal failure behavior thus models the internal decomposition of failures of the functions of the logical-functional layer of the system.

The physical architecture of the system can be modeled using an architecture description language as well (such as SysML, etc.). Moreover, it is specified which functions of the logical-functional layer are implemented by which of the elements of the physical architecture using dependencies between the respective model elements.

Based on these relationships between the functional and the physical architecture, the underlying system analysis model of the physical system architecture is derived from the CFT of the respective functional architecture. A CFT element is created for each element of the physical architecture, wherein:for each top failure event within the CFT of the functional architecture, a top failure event within the CFT of the physical architecture is created,for each output port as well as for each input port of the CFT elements of the functional architecture implemented by a specific element in the physical architecture, an output/input port is created within the respective CFT element of the physical fault tree, anddependencies are created between the ports/failure events in the functional fault tree and in the physical fault tree.

Next, the physical fault tree may be completed by adding further internal failure behavior particular to the physical layer (basic failure events, Boolean gates and internal interconnections). The resulting physical fault tree represents the failure behavior of the system from a technical/physical point of view.

Based on the functional as well as the physical system architecture and the CFTs defined on these levels of abstraction, a mixed-layer CFT is systematically generated which mixes these two layers into one comprehensive CFT. To this end, the functional aspects from the logical-functional fault tree are first introduced in the mixed-layer fault tree, i.e., top failure events, elements, external interconnections and internal interconnections.

Then, additional aspects from the physical fault tree are added to the mixed-layer fault tree including additional input/output ports, additional elements, additional external interconnections as well as aspects related to the internal failure behavior of the physical layer elements that are independent of the functional layer, i.e., Boolean gates, basic failure events and the corresponding internal interconnections within the elements of the physical layer.

The resulting mixed-layer fault tree combines aspects of both the logical-functional system layer and the physical system layer in a systematic way. This solution separates the logical-functional system layer and the physical system layer, thus offering certain advantages for subsequent amendments and/or updates to the multi-component systems.

According to a third aspect, embodiments of the invention provide a computer program product (non-transitory computer readable storage medium having instructions, which when executed by a processor, perform actions) comprising executable program instructions configured to, when executed, perform the method according to an embodiment of the first aspect.

According to a fourth aspect, embodiments of the invention provide a non-transient computer-readable data storage medium comprising executable program instructions configured to, when executed, perform the method according to an embodiment of the first aspect.

The non-transient computer-readable data storage medium may comprise, or consist of, any type of computer memory, in particular semiconductor memory such as a solid-state memory. The data storage medium may also comprise, or consist of, a CD, a DVD, a Blu-Ray-Disc, an USB memory stick, a memory card (e.g., an SD card) or the like.

According to a fifth aspect, embodiments of the invention provide a data stream representing, or configured to generate, executable program instructions configured to, when executed, perform the method according to an embodiment of the first aspect.

According to an embodiment of the invention, the added internal failure behavior from the elements in the physical fault tree may be interconnected with already realized internal connections in the mixed-fault tree via a Boolean-OR gate.

According to an embodiment of the invention, the physical system layer may correspond to a software and/or hardware realization of the logical-functional system layer.

According to an embodiment of the invention, the mixed-fault tree may be expressed within Boolean algebra by iteratively expanding the mixed-fault tree into Boolean expressions at the elements.

The mixed-fault tree may be expanded from the top failure events, in particular via external and internal interconnections and output/input ports towards the basic events or vice versa.

The accompanying drawings are included to provide a further understanding of embodiments of the present invention and are incorporated in and constitute a part of this specification. The drawings illustrate the embodiments of the present invention and together with the description serve to explain the principles of embodiments of the invention. Other embodiments of the present invention and many of the intended advantages of embodiments of the present invention will be readily appreciated as they become better understood by reference to the following detailed description.

