Abstract. Efficient safety analyses of complex software intensive embedded systems are still a challenging task. This article illustrates how model-driven development principles can be used in safety engineering to reduce cost and effort. To this end, the article shows how well accepted safety engineering approaches can be shifted to the level of model-driven development by integrating safety models into functional development models. Namely, we illustrate how UML profiles, model transformations, and techniques for multi language development can be used to seamlessly integrate component fault trees into the UML.

Safety assurance is a major challenge in the design of today's complex embedded systems and future Cyber-physical systems. Especially changes in a system's architectural design invalidate former safety analyses and require an adaptation of related safety analysis models in order to restore consistency. In this work, we present an approach for automatically generating mappings between failure ports in compositional safety analysis models. This way, automatic and system-wide safety analyses are enabled that can be easily repeated after making modifications to the system's architecture. We demonstrate the feasibility of our approach using a case study from the automotive domain

No abstract

Identifying drawbacks or insufficiencies in terms of safety is important also in early development stages of safety critical systems. In industry, development artefacts such as components or units, are often reused from existing artefacts to save time and costs. When development artefacts are reused, their existing safety analysis models are an important input for an early safety assessment for the new system, since they already provide a valid model. Component fault trees support such reuse strategies by a compositional horizontal approach. But current development strategies do not only divide systems horizontally, e.g., by encapsulating different functionality into separate components and hierarchies of components, but also vertically, e.g. into software and hardware architecture layers. Current safety analysis methodologies, such as component fault trees, do not support such vertical layers. Therefore, we present here a methodology that is able to divide safety analysis models into different layers of a systems architecture. We use so called Architecture Layer Failure Dependencies to enable component fault trees on different layers of an architecture. These dependencies are then used to generate safety evidence for the entire system and over all different architecture layers. A case study applies the approach to hardware and software layers.

The growing complexity of safety-critical embedded systems is leading to an increased complexity of safety analysis models. Often used fault tolerance mechanisms have complex failure behavior and produce overhead compared to systems without such mechanisms. The question arises whether the overhead for fault tolerance is acceptable for the increased safety of a system. Manually modeling the timing behavior is cost intensive and error prone. Current approaches of safety analysis and execution time analysis are not able to reflect the timing behavior of complex mechanisms according to failures. In this paper, we describe an approach that combines safety analysis models with execution times to extract different execution times for different failure conditions. This provides a detailed view on the safety behavior in combination with the produced overhead and allows to find and certify appropriate fault tolerance mechanisms.