Model Based Systems Engineering (MBSE) has encouraged the use of a single systems model in languages such as SysML that fully specify the system and which form the basis of all development effort. However, using SysML models for safety analysis has been restricted by the lack of defined modelling standards for analytical techniques like Fault Tree Analysis (FTA). In lieu of such standards, the ENCASE project has formulated a simple SysML profile that captures the information required to represent fault trees and which enables the linkage of failure modes to other parts of the SysML model. Unlike traditional fault trees that can be difficult to validate against a system design, associating failure modes with system functions and hardware components means that consistency checks between the two models are possible, and changes to the SysML design are easier to identify against the corresponding fault tree model. Common definitions of the system specification improves the quality of both safety analysis and assurance, and the alignment of the two models enables us to make the first steps towards the automatic translation of parts of the system design into fault trees.

Migrating systems and safety engineering (often with legacy processes and certified tools) towards a model based systems engineering (MBSE) environment is a socio-technical problem. Establishing a common conceptual framework requires agreement on modelling artefacts and the integration of existing tool chains to minimise disruption. We discuss our experience integrating a SysML Safety Profile to model fault trees but which has the prerequisite requirement to continue the analysis of those models by existing tools. We demonstrate a lightweight profile that minimally captures the fault logic for a Rolls-Royce gas turbine engine controller and provides specific in-house extensions for both fault tree and engine dispatch analysis by exporting model entities and relationships from the SysML fault trees. During integration we realised a more fundamental need to reconcile the systems engineers functional view with the safety engineers focus on failure modes and fault logic in order to maximimse the longer term benefits of MBSE development.

No abstract