No abstract

The surface of Saturn's largest satellite--Titan--is largely obscured by an optically thick atmospheric haze, and so its nature has been the subject of considerable speculation and discussion. The Huygens probe entered Titan's atmosphere on 14 January 2005 and descended to the surface using a parachute system. Here we report measurements made just above and on the surface of Titan by the Huygens Surface Science Package. Acoustic sounding over the last 90 m above the surface reveals a relatively smooth, but not completely flat, surface surrounding the landing site. Penetrometry and accelerometry measurements during the probe impact event reveal that the surface was neither hard (like solid ice) nor very compressible (like a blanket of fluffy aerosol); rather, the Huygens probe landed on a relatively soft solid surface whose properties are analogous to wet clay, lightly packed snow and wet or dry sand. The probe settled gradually by a few millimetres after landing.

The scale and complexity of computer-based safety critical systems, like those used in the transport and manufacturing industries, pose significant challenges for failure analysis. Over the last decade, research has focused on automating this task. In one approach, predictive models of system failure are constructed from the topology of the system and local component failure models using a process of composition. An alternative approach employs model-checking of state automata to study the effects of failure and verify system safety properties.In this paper, we discuss these two approaches to failure analysis. We then focus on Hierarchically Performed Hazard Origin and Propagation Studies (HiP-HOPS) -one of the more advanced compositional approaches -and discuss its capabilities for automatic synthesis of fault trees, combinatorial Failure Modes and Effects Analyses, and reliability versus cost optimisation of systems via application of automatic model transformations.We summarise these contributions and demonstrate the application of HiP-HOPS on a simplified fuel oil system for a ship engine. In light of this example, we discuss strengths and limitations of the method in relation to other state-of-the-art techniques. In particular, because HiP-HOPS is deductive in nature, relating system failures back to their causes, it is less prone to combinatorial explosion and can more readily be iterated. For this reason, it enables exhaustive assessment of combinations of failures and design optimisation using computationally greedy meta-heuristics.

New processes for the design of dependable systems must address both cost and dependability concerns. They should also maximize the potential for automation to address the problem of increasing technological complexity and the potentially immense design spaces that need to be explored. In this paper we show a design process that integrates system modelling, automated dependability analysis and evolutionary optimization techniques to achieve the optimization of designs with respect to dependability and cost from the early stages. Computerized support is provided for difficult aspects of fault tolerant design, such as decision making on the type and location of fault detection and fault tolerant strategies. The process is supported by HiP‐HOPS, a scalable automated dependability analysis and optimization tool. The process was applied to a Pre‐collision system for vehicles at an early stage of its design. The study shows that HiP‐HOPS can overcome the limitations of earlier work based on Reliability Block Diagrams by enabling dependability analysis and optimization of architectures that may have a network topology and exhibit multiple failure modes. Copyright © 2011 John Wiley & Sons, Ltd.

Failure Modes and Effects Analysis (FMEA) is a classical system safety analysis technique which is currently widely used in the automotive, aerospace and other safety critical industries. In the process of an FMEA, analysts compile lists of component failure modes and try to infer the effects of those failure modes on the system. System models, typically simple engineering diagrams, assist analysts in understanding how the local effects of component failures propagate through complex architectures and ultimately cause hazardous effects at system level.Although there is software available that assists engineers in performing clerical tasks, such as forming tables and filling in data, the intelligent part of an FMEA process remains a manual and laborious process. Thus, one of the main criticisms of FMEA is that the time taken to perform the analysis can often exceed the period of the design and development phases and therefore the analysis de facto becomes a mere deliverable to the customer and not a useful tool capable of improving the design. Difficulties naturally become more acute as systems grow in scale and complexity.To address those difficulties, a body of work is looking into the automation and simplification of FMEA [1-3]. To mechanically infer the effects of component failures in a system, several approaches have been proposed which use domain specific qualitative or quantitative fault simulation. These approaches are restricted to particular application domains such as the design of electrical or electronic circuits. Limitations in scope but also difficulties with the efficiency and scalability of algorithms seem to have so far limited the industrial take-up of this automated FMEA technology which is still under development.In this paper we propose a new approach to the automatic synthesis of FMEAs which builds upon recent work towards automating fault tree analysis [4]. In this approach, FMEAs are built from engineering diagrams that have been augmented with information about component failures. The proposed approach is generic, i.e. not restricted to an application domain, and potentially applicable to a range of widely used engineering models. The models that provide the basis for the analysis identify the topology of the system, i.e. the system components and the material energy and data transactions among those components. Models can also be hierarchically structured and record in different layers the decomposition of subsystems into more basic components. We should note that this type of structural models include piping and instrumentation diagrams, data flow diagrams and other models commonly used in many areas of engineering design.The first step in the analysis of such models is the establishment of the local failure behaviour of components in the model as a set of failure expressions which show how output failures of each component can be caused by internal malfunctions and deviations of the component inputs. Once this local analysis has been completed for all components, the structure of the ...